@skillsmith/cli 0.6.3 → 0.6.5

package/dist/src/commands/audit-sources.action.js

@@ -0,0 +1,321 @@
+/**
+ * @fileoverview Action implementation for `sklx audit sources`.
+ * @module @skillsmith/cli/commands/audit-sources.action
+ * @see SMI-5407
+ *
+ * Wires SourceRecoveryService (with real findCandidatesByName over the CLI DB)
+ * and backfillManifest. Applies an already_tracked overlay after recovery (the
+ * core service cannot know the current manifest state).
+ *
+ * Safety:
+ *   - Dry-run unless --apply.
+ *   - --apply requires typed phrase `BACKFILL SOURCES` (waived by --yes).
+ *   - --write-frontmatter requires --force-write-frontmatter and prints a bold
+ *     stderr WARNING before proceeding.
+ *
+ * Output:
+ *   Human: === Skillsmith — Source Recovery === + table + footer summary.
+ *   --json: { skills, summary } to stdout, no prompts, no file mutation.
+ */
+import { input } from '@inquirer/prompts';
+import chalk from 'chalk';
+import { hashContent } from '@skillsmith/core/services/skill-installation-helpers';
+import { SourceRecoveryService, defaultSkillsRoot, backfillManifest, parseRepoUrl, skillNameVariants, METHOD_LABELS, } from '@skillsmith/core';
+import { withTelemetry } from '@skillsmith/core/telemetry';
+import { openCliDatabase } from '../utils/open-database.js';
+import { loadManifest } from '../utils/manifest.js';
+import { sanitizeError } from '../utils/sanitize.js';
+import { DEFAULT_DB_PATH } from '../config.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const BACKFILL_PHRASE = 'BACKFILL SOURCES';
+const CONFIDENCE_BADGES = {
+    exact: '[EXACT]',
+    high: '[HIGH]',
+    medium: '[MEDIUM]',
+    low: '[LOW]',
+    'user-specified': '[SET]',
+    unknown: '[-]',
+};
+// ============================================================================
+// Helpers
+// ============================================================================
+/** Parse `--set` pairs like `"dirName=owner/repo"` → Record. */
+function parseSetPairs(pairs) {
+    if (!pairs || pairs.length === 0)
+        return {};
+    const out = {};
+    for (const pair of pairs) {
+        const eq = pair.indexOf('=');
+        if (eq < 1) {
+            console.error(chalk.yellow(`[audit sources] ignoring malformed --set pair: ${pair}`));
+            continue;
+        }
+        out[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    return out;
+}
+/** Parse `minConfidence` CLI value; fall back to `'high'` on unknown input. */
+function parseMinConfidence(value) {
+    const valid = ['exact', 'high', 'medium', 'low', 'user-specified'];
+    const v = (value ?? 'high');
+    return valid.includes(v) ? v : 'high';
+}
+/**
+ * Apply the already_tracked overlay: a skill whose manifest entry already has a
+ * non-empty source should be marked `already_tracked` (the core service cannot
+ * know the current manifest state).
+ *
+ * Mutates `report.skills` in place and recomputes `report.summary`.
+ */
+async function overlayAlreadyTracked(report) {
+    const manifest = await loadManifest();
+    const installed = manifest.installedSkills ?? {};
+    for (const skill of report.skills) {
+        const entry = installed[skill.skillName];
+        if (entry && typeof entry.source === 'string' && entry.source.trim().length > 0) {
+            skill.status = 'already_tracked';
+        }
+    }
+    // Recompute summary totals from mutated statuses.
+    report.summary.recovered = 0;
+    report.summary.already_tracked = 0;
+    report.summary.unknown = 0;
+    report.summary.skipped_backup = 0;
+    for (const skill of report.skills) {
+        report.summary[skill.status] += 1;
+    }
+}
+// ============================================================================
+// Output — human-readable
+// ============================================================================
+const COL_SKILL = 24;
+const COL_SOURCE = 46;
+const COL_CONF = 12;
+function pad(s, n) {
+    return s.length >= n ? s.slice(0, n - 1) + ' ' : s.padEnd(n);
+}
+function sourceCell(skill) {
+    if (skill.status === 'already_tracked')
+        return '(already tracked)';
+    if (skill.status === 'skipped_backup')
+        return '(backup — skipped)';
+    if (skill.candidates.length > 1)
+        return '(ambiguous)';
+    if (!skill.recoveredSource)
+        return '(unresolved)';
+    return skill.recoveredSource.url;
+}
+function confCell(skill) {
+    if (skill.status === 'already_tracked' || skill.status === 'skipped_backup')
+        return '-';
+    return CONFIDENCE_BADGES[skill.confidence] ?? '?';
+}
+function methodCell(skill) {
+    if (skill.status === 'already_tracked' || skill.status === 'skipped_backup')
+        return '-';
+    if (!skill.method)
+        return '-';
+    return METHOD_LABELS[skill.method] ?? skill.method;
+}
+function printHumanReport(report, applying) {
+    console.log(chalk.bold.blue('\n=== Skillsmith — Source Recovery ===\n'));
+    const hdr = pad('skill', COL_SKILL) +
+        '| ' +
+        pad('source', COL_SOURCE) +
+        '| ' +
+        pad('confidence', COL_CONF) +
+        '| method';
+    const sep = '-'.repeat(hdr.length);
+    console.log(hdr);
+    console.log(sep);
+    for (const skill of report.skills) {
+        const row = pad(skill.skillName, COL_SKILL) +
+            '| ' +
+            pad(sourceCell(skill), COL_SOURCE) +
+            '| ' +
+            pad(confCell(skill), COL_CONF) +
+            '| ' +
+            methodCell(skill);
+        console.log(row);
+        // Multi-candidate indented row for ambiguous name matches.
+        if (skill.candidates.length > 1) {
+            const parts = skill.candidates
+                .map((c, i) => `(${i + 1}) ${c.owner}/${c.repo}`)
+                .join(' ');
+            console.log(chalk.dim(`  -> ${parts} [ambiguous — --set or --embedding]`));
+        }
+    }
+    console.log();
+    const s = report.summary;
+    const exactCount = report.skills.filter((sk) => sk.status === 'recovered' && sk.confidence === 'exact').length;
+    const highCount = report.skills.filter((sk) => sk.status === 'recovered' && (sk.confidence === 'high' || sk.confidence === 'user-specified')).length;
+    console.log(chalk.bold(`Summary: ${s.total} scanned, ${s.recovered} recovered ` +
+        `(${exactCount} exact, ${highCount} high), ` +
+        `${s.already_tracked} already-tracked, ` +
+        `${s.unknown} unresolved, ` +
+        `${s.skipped_backup} backups skipped.`));
+    if (!applying) {
+        console.log(chalk.dim('Dry run — --apply to backfill.'));
+    }
+    console.log();
+}
+// ============================================================================
+// Typed-confirmation gate
+// ============================================================================
+async function requireBackfillPhrase() {
+    const answer = await input({
+        message: `Type ${chalk.bold(BACKFILL_PHRASE)} to confirm writing recovered sources to the manifest`,
+    });
+    if (answer !== BACKFILL_PHRASE) {
+        throw new Error(`Confirmation phrase mismatch — operation aborted. ` + `Must be exactly: ${BACKFILL_PHRASE}`);
+    }
+}
+// ============================================================================
+// Main entry
+// ============================================================================
+export async function runAuditSources(options) {
+    const skillsRoot = options.skillsRoot ?? defaultSkillsRoot();
+    const setOverrides = parseSetPairs(options.set);
+    const minConfidence = parseMinConfidence(options.minConfidence);
+    // --write-frontmatter requires --force-write-frontmatter.
+    if (options.writeFrontmatter && !options.forceWriteFrontmatter) {
+        console.error(chalk.red('--write-frontmatter requires --force-write-frontmatter. ' +
+            'Re-run with both flags to modify SKILL.md files inside installed skill directories.'));
+        process.exit(1);
+        return;
+    }
+    // Bold warning when frontmatter mutation is armed.
+    if (options.writeFrontmatter && options.forceWriteFrontmatter) {
+        console.error(chalk.bold.yellow('WARNING: --write-frontmatter will modify SKILL.md files inside ' +
+            'git-tracked skill repos. This operation is irreversible without a git reset.'));
+    }
+    // Open local DB (required for findCandidatesByName).
+    const db = await openCliDatabase(options.db);
+    let report;
+    try {
+        const findCandidatesByName = async (name) => {
+            const variants = skillNameVariants(name);
+            const placeholders = variants.map(() => '?').join(', ');
+            const rows = db
+                .prepare(`SELECT id, name, repo_url, quality_score FROM skills WHERE name IN (${placeholders})`)
+                .all(...variants);
+            const candidates = [];
+            for (const row of rows) {
+                if (!row.repo_url)
+                    continue;
+                try {
+                    const parsed = parseRepoUrl(row.repo_url);
+                    candidates.push({
+                        id: row.id,
+                        name: row.name,
+                        owner: parsed.owner,
+                        repo: parsed.repo,
+                        url: `https://github.com/${parsed.owner}/${parsed.repo}`,
+                        qualityScore: row.quality_score ?? 0,
+                    });
+                }
+                catch {
+                    // Non-GitHub repo_url — skip candidate.
+                }
+            }
+            // Prefer an exact-name match so the affix-broadened query never downgrades
+            // a clean exact hit to ambiguous; fall back to affix variants. SMI-5413.
+            const exact = candidates.filter((c) => c.name.toLowerCase() === name.toLowerCase());
+            return exact.length > 0 ? exact : candidates;
+        };
+        // SMI-5411: enrich a git/plugin-recovered source's manifest id with the
+        // registry UUID when the repo is catalog-known. The recovered URL is the
+        // canonical `https://github.com/<owner>/<repo>` form, and the catalog stores
+        // repo_url in that same canonical form, so an exact match is correct (and
+        // safer than normalizing, which would false-positive across monorepo
+        // siblings sharing one repo root). Returns null when no row matches.
+        const findRegistryIdByRepoUrl = async (repoUrl) => {
+            const row = db
+                .prepare('SELECT id FROM skills WHERE repo_url = ?')
+                .get(repoUrl);
+            return row?.id ?? null;
+        };
+        const service = new SourceRecoveryService({
+            hashContent,
+            findCandidatesByName,
+            findRegistryIdByRepoUrl,
+        });
+        report = await service.recoverSources({
+            skillsRoot,
+            enableEmbedding: options.embedding,
+            enableCatalogHint: options.catalogHint,
+        });
+    }
+    finally {
+        db.close();
+    }
+    // Overlay already_tracked status from the current manifest.
+    await overlayAlreadyTracked(report);
+    // --json: emit raw data, no prompts, no writes.
+    if (options.json) {
+        process.stdout.write(JSON.stringify({ skills: report.skills, summary: report.summary }, null, 2));
+        process.stdout.write('\n');
+        return;
+    }
+    printHumanReport(report, options.apply);
+    if (!options.apply)
+        return;
+    // --apply: confirm and write.
+    if (!options.yes) {
+        await requireBackfillPhrase();
+    }
+    const outcome = await backfillManifest(report, {
+        minConfidence,
+        apply: true,
+        setOverrides,
+        writeFrontmatter: options.writeFrontmatter,
+    });
+    if (outcome.written.length > 0) {
+        console.log(chalk.green(`Backfilled ${outcome.written.length} skill(s): ${outcome.written.join(', ')}`));
+    }
+    else {
+        console.log(chalk.dim('Nothing new to backfill.'));
+    }
+    if (outcome.skipped.length > 0) {
+        console.log(chalk.dim(`Skipped: ${outcome.skipped.join(', ')}`));
+    }
+}
+// ============================================================================
+// withTelemetry-wrapped export (SMI-5127+)
+// ============================================================================
+async function auditSourcesActionImpl(skillsRoot, opts) {
+    try {
+        await runAuditSources({
+            skillsRoot,
+            apply: opts['apply'] ?? false,
+            yes: opts['yes'] ?? false,
+            set: opts['set'],
+            minConfidence: opts['minConfidence'] ?? 'high',
+            json: opts['json'] ?? false,
+            embedding: opts['embedding'] ?? false,
+            catalogHint: opts['catalogHint'] ?? false,
+            writeFrontmatter: opts['writeFrontmatter'] ?? false,
+            forceWriteFrontmatter: opts['forceWriteFrontmatter'] ?? false,
+            db: opts['db'] ?? DEFAULT_DB_PATH,
+        });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : sanitizeError(error);
+        if (msg.startsWith('Confirmation phrase mismatch')) {
+            console.error(chalk.yellow(msg));
+        }
+        else {
+            console.error(chalk.red('Error:'), msg);
+        }
+        process.exit(1);
+    }
+}
+export const auditSourcesAction = withTelemetry(auditSourcesActionImpl, {
+    source: 'cli',
+    extractSkillId: () => 'audit-sources',
+    extractFramework: () => 'cli',
+});
+export { BACKFILL_PHRASE };
+//# sourceMappingURL=audit-sources.action.js.map

package/dist/src/commands/audit-sources.action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.action.js","sourceRoot":"","sources":["../../../src/commands/audit-sources.action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,WAAW,EAAE,MAAM,sDAAsD,CAAA;AAClF,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GAKd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,eAAe,GAAG,kBAAkB,CAAA;AAE1C,MAAM,iBAAiB,GAAuC;IAC5D,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,OAAO;IACZ,gBAAgB,EAAE,OAAO;IACzB,OAAO,EAAE,KAAK;CACf,CAAA;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAA2B;IAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAC3C,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,kDAAkD,IAAI,EAAE,CAAC,CAAC,CAAA;YACrF,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,KAAyB;IACnD,MAAM,KAAK,GAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IACxF,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,MAAM,CAAuB,CAAA;IACjD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAAC,MAAsB;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACxC,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChF,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAA;QAClC,CAAC;IACH,CAAC;IACD,kDAAkD;IAClD,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAA;IAC5B,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,CAAA;IAClC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;IAC1B,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AAEnB,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS;IAC/B,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,KAA0B;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB;QAAE,OAAO,mBAAmB,CAAA;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,oBAAoB,CAAA;IAClE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,cAAc,CAAA;IACjD,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAA;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,KAA0B;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,GAAG,CAAA;IACvF,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,KAA0B;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,GAAG,CAAA;IACvF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB,EAAE,QAAiB;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAA;IAExE,MAAM,GAAG,GACP,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QACvB,IAAI;QACJ,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACzB,IAAI;QACJ,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC3B,UAAU,CAAA;IACZ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,GAAG,GACP,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC;YAC/B,IAAI;YACJ,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;YAClC,IAAI;YACJ,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;YAC9B,IAAI;YACJ,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEhB,2DAA2D;QAC3D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU;iBAC3B,GAAG,CAAC,CAAC,CAAoB,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;YACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,qCAAqC,CAAC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAA;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CACrC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,EAAE,CAAC,UAAU,KAAK,OAAO,CAC/D,CAAC,MAAM,CAAA;IACR,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,EAAE,EAAE,EAAE,CACL,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,EAAE,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAChG,CAAC,MAAM,CAAA;IAER,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,SAAS,aAAa;QACtD,IAAI,UAAU,WAAW,SAAS,UAAU;QAC5C,GAAG,CAAC,CAAC,eAAe,oBAAoB;QACxC,GAAG,CAAC,CAAC,OAAO,eAAe;QAC3B,GAAG,CAAC,CAAC,cAAc,mBAAmB,CACzC,CACF,CAAA;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,KAAK,UAAU,qBAAqB;IAClC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,uDAAuD;KACpG,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,oBAAoB,eAAe,EAAE,CAC7F,CAAA;IACH,CAAC;AACH,CAAC;AAoBD,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAA;IAC5D,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAE/D,0DAA0D;IAC1D,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC/D,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,0DAA0D;YACxD,qFAAqF,CACxF,CACF,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACf,OAAM;IACR,CAAC;IAED,mDAAmD;IACnD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC9D,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,IAAI,CAAC,MAAM,CACf,iEAAiE;YAC/D,8EAA8E,CACjF,CACF,CAAA;IACH,CAAC;IAED,qDAAqD;IACrD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5C,IAAI,MAAsB,CAAA;IAE1B,IAAI,CAAC;QACH,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAY,EAAgC,EAAE;YAOhF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;YACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACvD,MAAM,IAAI,GAAG,EAAE;iBACZ,OAAO,CACN,uEAAuE,YAAY,GAAG,CACvF;iBACA,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAA;YAEnB,MAAM,UAAU,GAAwB,EAAE,CAAA;YAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,QAAQ;oBAAE,SAAQ;gBAC3B,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;oBACzC,UAAU,CAAC,IAAI,CAAC;wBACd,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,GAAG,EAAE,sBAAsB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;wBACxD,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;qBACrC,CAAC,CAAA;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;YACH,CAAC;YACD,2EAA2E;YAC3E,yEAAyE;YACzE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YACnF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAA;QAC9C,CAAC,CAAA;QAED,wEAAwE;QACxE,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,uBAAuB,GAAG,KAAK,EAAE,OAAe,EAA0B,EAAE;YAChF,MAAM,GAAG,GAAG,EAAE;iBACX,OAAO,CAAiB,0CAA0C,CAAC;iBACnE,GAAG,CAAC,OAAO,CAAC,CAAA;YACf,OAAO,GAAG,EAAE,EAAE,IAAI,IAAI,CAAA;QACxB,CAAC,CAAA;QAED,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC;YACxC,WAAW;YACX,oBAAoB;YACpB,uBAAuB;SACxB,CAAC,CAAA;QAEF,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YACpC,UAAU;YACV,eAAe,EAAE,OAAO,CAAC,SAAS;YAClC,iBAAiB,EAAE,OAAO,CAAC,WAAW;SACvC,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAA;IACZ,CAAC;IAED,4DAA4D;IAC5D,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAEnC,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC5E,CAAA;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,OAAM;IACR,CAAC;IAED,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAEvC,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAM;IAE1B,8BAA8B;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,qBAAqB,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE;QAC7C,aAAa;QACb,KAAK,EAAE,IAAI;QACX,YAAY;QACZ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,cAAc,OAAO,CAAC,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAC5F,CAAA;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E,KAAK,UAAU,sBAAsB,CACnC,UAA8B,EAC9B,IAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,eAAe,CAAC;YACpB,UAAU;YACV,KAAK,EAAG,IAAI,CAAC,OAAO,CAAa,IAAI,KAAK;YAC1C,GAAG,EAAG,IAAI,CAAC,KAAK,CAAa,IAAI,KAAK;YACtC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAyB;YACxC,aAAa,EAAG,IAAI,CAAC,eAAe,CAAwB,IAAI,MAAM;YACtE,IAAI,EAAG,IAAI,CAAC,MAAM,CAAa,IAAI,KAAK;YACxC,SAAS,EAAG,IAAI,CAAC,WAAW,CAAa,IAAI,KAAK;YAClD,WAAW,EAAG,IAAI,CAAC,aAAa,CAAa,IAAI,KAAK;YACtD,gBAAgB,EAAG,IAAI,CAAC,kBAAkB,CAAa,IAAI,KAAK;YAChE,qBAAqB,EAAG,IAAI,CAAC,uBAAuB,CAAa,IAAI,KAAK;YAC1E,EAAE,EAAG,IAAI,CAAC,IAAI,CAAwB,IAAI,eAAe;SAC1D,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACzE,IAAI,GAAG,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,sBAAsB,EAAE;IACtE,MAAM,EAAE,KAAK;IACb,cAAc,EAAE,GAAG,EAAE,CAAC,eAAe;IACrC,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK;CAC9B,CAAC,CAAA;AAEF,OAAO,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/commands/audit-sources.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @fileoverview `sklx audit sources` — skill source provenance recovery subcommand factory.
+ * @module @skillsmith/cli/commands/audit-sources
+ * @see SMI-5407
+ *
+ * Sibling of `sklx audit advisories` and `sklx audit collisions`.
+ * Implementation lives in `audit-sources.action.ts` (SMI-5127+ split).
+ *
+ * Flags:
+ *   [skillsRoot]            Optional positional: override the scan root
+ *                           (default: ~/.claude/skills).
+ *   --apply                 Write recovered sources to the manifest.
+ *                           Dry-run when omitted.
+ *   --yes                   Skip typed-confirmation gate (requires --apply).
+ *   --set <pair...>         Override: dirName=owner/repo. Repeatable.
+ *   --min-confidence <c>    Minimum confidence to backfill.
+ *                           One of: exact|high|medium|low. Default: high.
+ *   --json                  Emit JSON to stdout; no prompts; no file mutation.
+ *   --embedding             Enable embedding tiebreak tier (off by default).
+ *   --catalog-hint          Enable catalog / author hint tier (off by default).
+ *   --write-frontmatter     Write repository: into non-git SKILL.md frontmatter.
+ *                           Requires --force-write-frontmatter.
+ *   --force-write-frontmatter  Confirm SKILL.md mutation (required with
+ *                              --write-frontmatter). Prints a bold warning.
+ *   -d, --db <path>         SQLite database path (default: ~/.skillsmith/skills.db).
+ *
+ * Community tier (no requireTier call). Read-only by default; --apply enables
+ * the manifest write path.
+ */
+import { Command } from 'commander';
+/**
+ * Build the `audit sources` subcommand. Registered in `createAuditCommand()`
+ * beside `advisories` and `collisions`.
+ */
+export declare function createAuditSourcesSubcommand(): Command;
+export default createAuditSourcesSubcommand;
+//# sourceMappingURL=audit-sources.d.ts.map

package/dist/src/commands/audit-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.d.ts","sourceRoot":"","sources":["../../../src/commands/audit-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAInC;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CA0BtD;AAED,eAAe,4BAA4B,CAAA"}

package/dist/src/commands/audit-sources.js

@@ -0,0 +1,55 @@
+/**
+ * @fileoverview `sklx audit sources` — skill source provenance recovery subcommand factory.
+ * @module @skillsmith/cli/commands/audit-sources
+ * @see SMI-5407
+ *
+ * Sibling of `sklx audit advisories` and `sklx audit collisions`.
+ * Implementation lives in `audit-sources.action.ts` (SMI-5127+ split).
+ *
+ * Flags:
+ *   [skillsRoot]            Optional positional: override the scan root
+ *                           (default: ~/.claude/skills).
+ *   --apply                 Write recovered sources to the manifest.
+ *                           Dry-run when omitted.
+ *   --yes                   Skip typed-confirmation gate (requires --apply).
+ *   --set <pair...>         Override: dirName=owner/repo. Repeatable.
+ *   --min-confidence <c>    Minimum confidence to backfill.
+ *                           One of: exact|high|medium|low. Default: high.
+ *   --json                  Emit JSON to stdout; no prompts; no file mutation.
+ *   --embedding             Enable embedding tiebreak tier (off by default).
+ *   --catalog-hint          Enable catalog / author hint tier (off by default).
+ *   --write-frontmatter     Write repository: into non-git SKILL.md frontmatter.
+ *                           Requires --force-write-frontmatter.
+ *   --force-write-frontmatter  Confirm SKILL.md mutation (required with
+ *                              --write-frontmatter). Prints a bold warning.
+ *   -d, --db <path>         SQLite database path (default: ~/.skillsmith/skills.db).
+ *
+ * Community tier (no requireTier call). Read-only by default; --apply enables
+ * the manifest write path.
+ */
+import { Command } from 'commander';
+import { DEFAULT_DB_PATH } from '../config.js';
+import { auditSourcesAction } from './audit-sources.action.js';
+/**
+ * Build the `audit sources` subcommand. Registered in `createAuditCommand()`
+ * beside `advisories` and `collisions`.
+ */
+export function createAuditSourcesSubcommand() {
+    return new Command('sources')
+        .description('Recover the canonical GitHub source of locally-installed skills ' +
+        'and optionally backfill ~/.skillsmith/manifest.json')
+        .argument('[skillsRoot]', 'Root directory to scan (default: ~/.claude/skills)')
+        .option('--apply', 'Write recovered sources to the manifest (dry-run by default)', false)
+        .option('--yes', 'Skip typed-confirmation phrase (requires --apply)', false)
+        .option('--set <pair...>', 'Override source for a skill: dirName=owner/repo (repeatable)')
+        .option('--min-confidence <c>', 'Minimum confidence to backfill: exact|high|medium|low', 'high')
+        .option('--json', 'Emit JSON to stdout; no prompts; no file mutation', false)
+        .option('--embedding', 'Enable embedding tiebreak tier (off by default)', false)
+        .option('--catalog-hint', 'Enable catalog / author hint tier (off by default)', false)
+        .option('--write-frontmatter', 'Write repository: into non-git SKILL.md frontmatter (requires --force-write-frontmatter)', false)
+        .option('--force-write-frontmatter', 'Confirm SKILL.md mutation — required with --write-frontmatter (prints a bold warning)', false)
+        .option('-d, --db <path>', 'Database file path', DEFAULT_DB_PATH)
+        .action(auditSourcesAction);
+}
+export default createAuditSourcesSubcommand;
+//# sourceMappingURL=audit-sources.js.map

package/dist/src/commands/audit-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.js","sourceRoot":"","sources":["../../../src/commands/audit-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAE9D;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CACV,kEAAkE;QAChE,qDAAqD,CACxD;SACA,QAAQ,CAAC,cAAc,EAAE,oDAAoD,CAAC;SAC9E,MAAM,CAAC,SAAS,EAAE,8DAA8D,EAAE,KAAK,CAAC;SACxF,MAAM,CAAC,OAAO,EAAE,mDAAmD,EAAE,KAAK,CAAC;SAC3E,MAAM,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;SACzF,MAAM,CAAC,sBAAsB,EAAE,uDAAuD,EAAE,MAAM,CAAC;SAC/F,MAAM,CAAC,QAAQ,EAAE,mDAAmD,EAAE,KAAK,CAAC;SAC5E,MAAM,CAAC,aAAa,EAAE,iDAAiD,EAAE,KAAK,CAAC;SAC/E,MAAM,CAAC,gBAAgB,EAAE,oDAAoD,EAAE,KAAK,CAAC;SACrF,MAAM,CACL,qBAAqB,EACrB,0FAA0F,EAC1F,KAAK,CACN;SACA,MAAM,CACL,2BAA2B,EAC3B,uFAAuF,EACvF,KAAK,CACN;SACA,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,CAAC;SAChE,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAC/B,CAAC;AAED,eAAe,4BAA4B,CAAA"}

package/dist/src/commands/audit-sources.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Unit tests for `sklx audit sources` CLI command.
+ * @see SMI-5407: Skill Source Provenance Recovery
+ *
+ * Tests the action layer (`runAuditSources`) with injected mocks so the test
+ * suite runs fully offline without a real DB or skills directory.
+ */
+export {};
+//# sourceMappingURL=audit-sources.test.d.ts.map

package/dist/src/commands/audit-sources.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.test.d.ts","sourceRoot":"","sources":["../../../src/commands/audit-sources.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}