@spacebar_ai/moldclaw-core 2026.3.14 → 2026.3.16

package/dist/onboard-remote-so38yXlX.js

@@ -0,0 +1,181 @@
+import { Bg as resolveSecretInputModeForEnvSelection, zg as promptSecretRefForSetup } from "./auth-profiles-9zZdaXJK.js";
+import { i as isSecureWebSocketUrl } from "./net-B_Iq_SVP.js";
+import { r as detectBinary } from "./onboard-helpers-ChMWfUnl.js";
+import { n as resolveWideAreaDiscoveryDomain } from "./widearea-dns-CEPmSOlu.js";
+import { t as discoverGatewayBeacons } from "./bonjour-discovery-BkskkfR_.js";
+//#region src/commands/onboard-remote.ts
+const DEFAULT_GATEWAY_URL = "ws://127.0.0.1:28789";
+function pickHost(beacon) {
+	return beacon.host || beacon.tailnetDns || beacon.lanHost;
+}
+function buildLabel(beacon) {
+	const host = pickHost(beacon);
+	const port = beacon.port ?? beacon.gatewayPort ?? 28789;
+	return `${beacon.displayName ?? beacon.instanceName} (${host ? `${host}:${port}` : "host unknown"})`;
+}
+function ensureWsUrl(value) {
+	const trimmed = value.trim();
+	if (!trimmed) return DEFAULT_GATEWAY_URL;
+	return trimmed;
+}
+function validateGatewayWebSocketUrl(value) {
+	const trimmed = value.trim();
+	if (!trimmed.startsWith("ws://") && !trimmed.startsWith("wss://")) return "URL must start with ws:// or wss://";
+	if (!isSecureWebSocketUrl(trimmed, { allowPrivateWs: process.env.MOLDCLAW_ALLOW_INSECURE_PRIVATE_WS === "1" })) return "Use wss:// for remote hosts, or ws://127.0.0.1/localhost via SSH tunnel. Break-glass: MOLDCLAW_ALLOW_INSECURE_PRIVATE_WS=1 for trusted private networks.";
+}
+async function promptRemoteGatewayConfig(cfg, prompter, options) {
+	let selectedBeacon = null;
+	let suggestedUrl = cfg.gateway?.remote?.url ?? DEFAULT_GATEWAY_URL;
+	const hasBonjourTool = await detectBinary("dns-sd") || await detectBinary("avahi-browse");
+	const wantsDiscover = hasBonjourTool ? await prompter.confirm({
+		message: "Discover gateway on LAN (Bonjour)?",
+		initialValue: true
+	}) : false;
+	if (!hasBonjourTool) await prompter.note(["Bonjour discovery requires dns-sd (macOS) or avahi-browse (Linux).", "Docs: https://docs.moldclaw.ai/gateway/discovery"].join("\n"), "Discovery");
+	if (wantsDiscover) {
+		const wideAreaDomain = resolveWideAreaDiscoveryDomain({ configDomain: cfg.discovery?.wideArea?.domain });
+		const spin = prompter.progress("Searching for gateways…");
+		const beacons = await discoverGatewayBeacons({
+			timeoutMs: 2e3,
+			wideAreaDomain
+		});
+		spin.stop(beacons.length > 0 ? `Found ${beacons.length} gateway(s)` : "No gateways found");
+		if (beacons.length > 0) {
+			const selection = await prompter.select({
+				message: "Select gateway",
+				options: [...beacons.map((beacon, index) => ({
+					value: String(index),
+					label: buildLabel(beacon)
+				})), {
+					value: "manual",
+					label: "Enter URL manually"
+				}]
+			});
+			if (selection !== "manual") {
+				const idx = Number.parseInt(String(selection), 10);
+				selectedBeacon = Number.isFinite(idx) ? beacons[idx] ?? null : null;
+			}
+		}
+	}
+	if (selectedBeacon) {
+		const host = pickHost(selectedBeacon);
+		const port = selectedBeacon.port ?? selectedBeacon.gatewayPort ?? 28789;
+		if (host) if (await prompter.select({
+			message: "Connection method",
+			options: [{
+				value: "direct",
+				label: `Direct gateway WS (${host}:${port})`
+			}, {
+				value: "ssh",
+				label: "SSH tunnel (loopback)"
+			}]
+		}) === "direct") {
+			suggestedUrl = `wss://${host}:${port}`;
+			await prompter.note([
+				"Direct remote access defaults to TLS.",
+				`Using: ${suggestedUrl}`,
+				"If your gateway is loopback-only, choose SSH tunnel and keep ws://127.0.0.1:28789."
+			].join("\n"), "Direct remote");
+		} else {
+			suggestedUrl = DEFAULT_GATEWAY_URL;
+			await prompter.note([
+				"Start a tunnel before using the CLI:",
+				`ssh -N -L 28789:127.0.0.1:28789 <user>@${host}${selectedBeacon.sshPort ? ` -p ${selectedBeacon.sshPort}` : ""}`,
+				"Docs: https://docs.moldclaw.ai/gateway/remote"
+			].join("\n"), "SSH tunnel");
+		}
+	}
+	const urlInput = await prompter.text({
+		message: "Gateway WebSocket URL",
+		initialValue: suggestedUrl,
+		validate: (value) => validateGatewayWebSocketUrl(String(value))
+	});
+	const url = ensureWsUrl(String(urlInput));
+	const authChoice = await prompter.select({
+		message: "Gateway auth",
+		options: [
+			{
+				value: "token",
+				label: "Token (recommended)"
+			},
+			{
+				value: "password",
+				label: "Password"
+			},
+			{
+				value: "off",
+				label: "No auth"
+			}
+		]
+	});
+	let token = cfg.gateway?.remote?.token;
+	let password = cfg.gateway?.remote?.password;
+	if (authChoice === "token") {
+		if (await resolveSecretInputModeForEnvSelection({
+			prompter,
+			explicitMode: options?.secretInputMode,
+			copy: {
+				modeMessage: "How do you want to provide this gateway token?",
+				plaintextLabel: "Enter token now",
+				plaintextHint: "Stores the token directly in moldClaw config"
+			}
+		}) === "ref") token = (await promptSecretRefForSetup({
+			provider: "gateway-remote-token",
+			config: cfg,
+			prompter,
+			preferredEnvVar: "MOLDCLAW_GATEWAY_TOKEN",
+			copy: {
+				sourceMessage: "Where is this gateway token stored?",
+				envVarPlaceholder: "MOLDCLAW_GATEWAY_TOKEN"
+			}
+		})).ref;
+		else token = String(await prompter.text({
+			message: "Gateway token",
+			initialValue: typeof token === "string" ? token : void 0,
+			validate: (value) => value?.trim() ? void 0 : "Required"
+		})).trim();
+		password = void 0;
+	} else if (authChoice === "password") {
+		if (await resolveSecretInputModeForEnvSelection({
+			prompter,
+			explicitMode: options?.secretInputMode,
+			copy: {
+				modeMessage: "How do you want to provide this gateway password?",
+				plaintextLabel: "Enter password now",
+				plaintextHint: "Stores the password directly in moldClaw config"
+			}
+		}) === "ref") password = (await promptSecretRefForSetup({
+			provider: "gateway-remote-password",
+			config: cfg,
+			prompter,
+			preferredEnvVar: "MOLDCLAW_GATEWAY_PASSWORD",
+			copy: {
+				sourceMessage: "Where is this gateway password stored?",
+				envVarPlaceholder: "MOLDCLAW_GATEWAY_PASSWORD"
+			}
+		})).ref;
+		else password = String(await prompter.text({
+			message: "Gateway password",
+			initialValue: typeof password === "string" ? password : void 0,
+			validate: (value) => value?.trim() ? void 0 : "Required"
+		})).trim();
+		token = void 0;
+	} else {
+		token = void 0;
+		password = void 0;
+	}
+	return {
+		...cfg,
+		gateway: {
+			...cfg.gateway,
+			mode: "remote",
+			remote: {
+				url,
+				...token !== void 0 ? { token } : {},
+				...password !== void 0 ? { password } : {}
+			}
+		}
+	};
+}
+//#endregion
+export { promptRemoteGatewayConfig as t };

package/dist/onboard-search-DS0tZS24.js

@@ -0,0 +1,297 @@
+import "./redact-fatrROh9.js";
+import "./errors-DOJWZqNo.js";
+import "./unhandled-rejections-CTvNvnT0.js";
+import "./logger-BFfIIIKH.js";
+import "./paths-D6AgsMTU.js";
+import "./tmp-moldclaw-dir-DWF-d8qD.js";
+import "./theme-BSXzMzAA.js";
+import "./globals-DESrFYmC.js";
+import "./subsystem-S4LNMNHd.js";
+import "./ansi-BPhP6LBZ.js";
+import "./boolean-D8Ha5nYV.js";
+import "./env-Dgex_t9p.js";
+import "./warning-filter-gJuwHM7C.js";
+import "./utils-rjVNXUns.js";
+import "./links-C5I443Xb.js";
+import "./setup-binary-Fw3cCSWL.js";
+import { xd as resolvePluginWebSearchProviders } from "./auth-profiles-9zZdaXJK.js";
+import "./model-selection-DfA4esOK.js";
+import "./agent-scope-DA7O8MVG.js";
+import "./boundary-file-read-Y1cMjPlu.js";
+import "./logger-wrbK9-ju.js";
+import "./exec-CoBTyh8B.js";
+import "./workspace-CxNKYS0V.js";
+import "./io-C6XifaT4.js";
+import "./host-env-security-xy11yVnm.js";
+import "./safe-text-BcUvBreN.js";
+import "./version-rW_3ob2o.js";
+import { a as hasConfiguredSecretInput, l as normalizeSecretInputString, t as DEFAULT_SECRET_PROVIDER_ALIAS } from "./types.secrets-Bojc4omL.js";
+import "./env-substitution-C9xZMTDL.js";
+import "./config-state-D1JkXt39.js";
+import "./network-mode-CE-ihBf6.js";
+import "./registry-DcDGl2X7.js";
+import "./manifest-registry-_0xclaVY.js";
+import "./ip-w605xvSx.js";
+import "./zod-schema.core-D5reNip6.js";
+import "./config-B2W1zTP1.js";
+import "./audit-fs-SjcfoPO7.js";
+import "./resolve-BbsCHGLY.js";
+import "./provider-web-search-BJhXD5dH.js";
+import "./text-runtime-CgEQ9Y9_.js";
+import "./workspace-dirs-d3Ms_ryk.js";
+import "./config-CMhKplgO.js";
+import "./tailnet-KyAU6tj_.js";
+import "./net-B_Iq_SVP.js";
+import "./credentials-yYt6VWCq.js";
+import "./routes-BZtqNrBf.js";
+import "./frontmatter-BTDAgsA3.js";
+import "./env-overrides-DYVIkuvN.js";
+import "./path-alias-guards-B3ZKrId1.js";
+import "./skills-4-r1mfJM.js";
+import "./ports-BVwQuCIR.js";
+import "./ports-lsof-DiY6GaAf.js";
+import "./ssh-tunnel-BaHTFPzH.js";
+import "./image-ops-Uw4rEShL.js";
+import "./fs-safe-Da4H0IOU.js";
+import "./mime-_IkgFMS2.js";
+import "./server-middleware-BPq4bu3A.js";
+import "./message-channel-CKeDAoOT.js";
+import "./resolve-route-IkBfMjBz.js";
+import "./internal-hooks-0x1JiQ5f.js";
+import "./lazy-runtime-DdzFA4b9.js";
+import "./config-schema-pPBCF4hz.js";
+import "./method-scopes-Du8ODGFW.js";
+import "./session-cost-usage-B-57mlS8.js";
+import "./paths-CDWV-9nX.js";
+import "./routing-3o2D0ix4.js";
+import "./send-BRRtHxyR.js";
+import "./node-resolve-CupmrA0Y.js";
+import "./provider-stream-gVymYPmd.js";
+import "./identity-file-DM4N5_7H.js";
+import "./provider-models-BA3hqqPq.js";
+import "./secret-file-Bjh19aoH.js";
+import "./logging-BdFqMomc.js";
+import "./runtime-env-CT-voxYE.js";
+import "./registry-Dgwc-7eS.js";
+import "./provider-onboard-CBC3kdk_.js";
+import "./model-definitions-DwehIMlw.js";
+import "./diagnostic-CkiYEGqt.js";
+import "./message-hook-mappers-DORrSLHM.js";
+import "./json-store-DlpyvQXN.js";
+import "./call-DYFR7oGy.js";
+import "./multimodal-BWF8MRkz.js";
+import "./memory-search-BBG2BKIh.js";
+import "./query-expansion-8R79qExs.js";
+import "./search-manager-DxkQvUrW.js";
+import "./core-EKuk2FxR.js";
+import "./issue-format-i6sEuV4a.js";
+import "./logging-BhqLWxTD.js";
+import "./note-z78_JyNp.js";
+import "./state-paths-C7dX__ql.js";
+import "./config-value-Dl3XEpA6.js";
+import "./command-secret-targets-CO_lZ_ZZ.js";
+import "./brave-CljenznH.js";
+import "./provider-usage-DzuzbNBv.js";
+import "./perplexity-Bw1u3CAF.js";
+import "./restart-stale-pids-CN9ElYwR.js";
+import "./delivery-queue-DLjFP-0C.js";
+import "./pairing-token-ANLRyJSu.js";
+import "./accounts-BCaV8MsT.js";
+import "./process-runtime-CicRKAFe.js";
+import "./audit-hdKa3D-u.js";
+import "./cli-runtime-DtIDS2w7.js";
+import "./cli-utils-FHeUZLsT.js";
+import "./help-format-1yV2Xzq7.js";
+import "./progress-BQSTKUhd.js";
+import "./gateway-runtime-D9FRZqKP.js";
+import { t as enablePluginInConfig } from "./enable-VYzv8b2z.js";
+//#region src/commands/onboard-search.ts
+const SEARCH_PROVIDER_IDS = [
+	"brave",
+	"firecrawl",
+	"gemini",
+	"grok",
+	"kimi",
+	"perplexity"
+];
+function isSearchProvider(value) {
+	return SEARCH_PROVIDER_IDS.includes(value);
+}
+function hasSearchProviderId(provider) {
+	return isSearchProvider(provider.id);
+}
+const SEARCH_PROVIDER_OPTIONS = resolvePluginWebSearchProviders({ bundledAllowlistCompat: true }).filter(hasSearchProviderId).map((provider) => ({
+	value: provider.id,
+	label: provider.label,
+	hint: provider.hint,
+	envKeys: provider.envVars,
+	placeholder: provider.placeholder,
+	signupUrl: provider.signupUrl
+}));
+function hasKeyInEnv(entry) {
+	return entry.envKeys.some((k) => Boolean(process.env[k]?.trim()));
+}
+function rawKeyValue(config, provider) {
+	const search = config.tools?.web?.search;
+	return resolvePluginWebSearchProviders({
+		config,
+		bundledAllowlistCompat: true
+	}).find((candidate) => candidate.id === provider)?.getCredentialValue(search);
+}
+/** Returns the plaintext key string, or undefined for SecretRefs/missing. */
+function resolveExistingKey(config, provider) {
+	return normalizeSecretInputString(rawKeyValue(config, provider));
+}
+/** Returns true if a key is configured (plaintext string or SecretRef). */
+function hasExistingKey(config, provider) {
+	return hasConfiguredSecretInput(rawKeyValue(config, provider));
+}
+/** Build an env-backed SecretRef for a search provider. */
+function buildSearchEnvRef(provider) {
+	const entry = SEARCH_PROVIDER_OPTIONS.find((e) => e.value === provider);
+	const envVar = entry?.envKeys.find((k) => Boolean(process.env[k]?.trim())) ?? entry?.envKeys[0];
+	if (!envVar) throw new Error(`No env var mapping for search provider "${provider}" in secret-input-mode=ref.`);
+	return {
+		source: "env",
+		provider: DEFAULT_SECRET_PROVIDER_ALIAS,
+		id: envVar
+	};
+}
+/** Resolve a plaintext key into the appropriate SecretInput based on mode. */
+function resolveSearchSecretInput(provider, key, secretInputMode) {
+	if (secretInputMode === "ref") return buildSearchEnvRef(provider);
+	return key;
+}
+function applySearchKey(config, provider, key) {
+	const search = {
+		...config.tools?.web?.search,
+		provider,
+		enabled: true
+	};
+	const entry = resolvePluginWebSearchProviders({
+		config,
+		bundledAllowlistCompat: true
+	}).find((candidate) => candidate.id === provider);
+	if (entry) entry.setCredentialValue(search, key);
+	const next = {
+		...config,
+		tools: {
+			...config.tools,
+			web: {
+				...config.tools?.web,
+				search
+			}
+		}
+	};
+	if (provider !== "firecrawl") return next;
+	return enablePluginInConfig(next, "firecrawl").config;
+}
+function applyProviderOnly(config, provider) {
+	const next = {
+		...config,
+		tools: {
+			...config.tools,
+			web: {
+				...config.tools?.web,
+				search: {
+					...config.tools?.web?.search,
+					provider,
+					enabled: true
+				}
+			}
+		}
+	};
+	if (provider !== "firecrawl") return next;
+	return enablePluginInConfig(next, "firecrawl").config;
+}
+function preserveDisabledState(original, result) {
+	if (original.tools?.web?.search?.enabled !== false) return result;
+	return {
+		...result,
+		tools: {
+			...result.tools,
+			web: {
+				...result.tools?.web,
+				search: {
+					...result.tools?.web?.search,
+					enabled: false
+				}
+			}
+		}
+	};
+}
+async function setupSearch(config, _runtime, prompter, opts) {
+	await prompter.note([
+		"Web search lets your agent look things up online.",
+		"Choose a provider and paste your API key.",
+		"Docs: https://docs.moldclaw.ai/tools/web"
+	].join("\n"), "Web search");
+	const existingProvider = config.tools?.web?.search?.provider;
+	const options = SEARCH_PROVIDER_OPTIONS.map((entry) => {
+		const hint = hasExistingKey(config, entry.value) || hasKeyInEnv(entry) ? `${entry.hint} · configured` : entry.hint;
+		return {
+			value: entry.value,
+			label: entry.label,
+			hint
+		};
+	});
+	const defaultProvider = (() => {
+		if (existingProvider && SEARCH_PROVIDER_OPTIONS.some((e) => e.value === existingProvider)) return existingProvider;
+		const detected = SEARCH_PROVIDER_OPTIONS.find((e) => hasExistingKey(config, e.value) || hasKeyInEnv(e));
+		if (detected) return detected.value;
+		return SEARCH_PROVIDER_OPTIONS[0].value;
+	})();
+	const choice = await prompter.select({
+		message: "Search provider",
+		options: [...options, {
+			value: "__skip__",
+			label: "Skip for now",
+			hint: "Configure later with moldclaw configure --section web"
+		}],
+		initialValue: defaultProvider
+	});
+	if (choice === "__skip__") return config;
+	const entry = SEARCH_PROVIDER_OPTIONS.find((e) => e.value === choice);
+	const existingKey = resolveExistingKey(config, choice);
+	const keyConfigured = hasExistingKey(config, choice);
+	const envAvailable = hasKeyInEnv(entry);
+	if (opts?.quickstartDefaults && (keyConfigured || envAvailable)) return preserveDisabledState(config, existingKey ? applySearchKey(config, choice, existingKey) : applyProviderOnly(config, choice));
+	if (opts?.secretInputMode === "ref") {
+		if (keyConfigured) return preserveDisabledState(config, applyProviderOnly(config, choice));
+		const ref = buildSearchEnvRef(choice);
+		await prompter.note([
+			"Secret references enabled — moldClaw will store a reference instead of the API key.",
+			`Env var: ${ref.id}${envAvailable ? " (detected)" : ""}.`,
+			...envAvailable ? [] : [`Set ${ref.id} in the Gateway environment.`],
+			"Docs: https://docs.moldclaw.ai/tools/web"
+		].join("\n"), "Web search");
+		return applySearchKey(config, choice, ref);
+	}
+	const key = (await prompter.text({
+		message: keyConfigured ? `${entry.label} API key (leave blank to keep current)` : envAvailable ? `${entry.label} API key (leave blank to use env var)` : `${entry.label} API key`,
+		placeholder: keyConfigured ? "Leave blank to keep current" : entry.placeholder
+	}))?.trim() ?? "";
+	if (key) return applySearchKey(config, choice, resolveSearchSecretInput(choice, key, opts?.secretInputMode));
+	if (existingKey) return preserveDisabledState(config, applySearchKey(config, choice, existingKey));
+	if (keyConfigured || envAvailable) return preserveDisabledState(config, applyProviderOnly(config, choice));
+	await prompter.note([
+		"No API key stored — web_search won't work until a key is available.",
+		`Get your key at: ${entry.signupUrl}`,
+		"Docs: https://docs.moldclaw.ai/tools/web"
+	].join("\n"), "Web search");
+	return {
+		...config,
+		tools: {
+			...config.tools,
+			web: {
+				...config.tools?.web,
+				search: {
+					...config.tools?.web?.search,
+					provider: choice
+				}
+			}
+		}
+	};
+}
+//#endregion
+export { SEARCH_PROVIDER_OPTIONS, applySearchKey, hasExistingKey, hasKeyInEnv, resolveExistingKey, setupSearch };

package/dist/onboard-skills-B9DxCCiU.js

@@ -0,0 +1,133 @@
+import { Q as normalizeSecretInput } from "./provider-web-search-BJhXD5dH.js";
+import { t as formatCliCommand } from "./command-format-DIDjlImI.js";
+import { _ as resolveNodeManagerOptions, r as detectBinary } from "./onboard-helpers-ChMWfUnl.js";
+import { t as buildWorkspaceSkillStatus } from "./skills-status-BZpoMXrR.js";
+import { t as installSkill } from "./skills-install-Del-Ogv8.js";
+//#region src/commands/onboard-skills.ts
+function summarizeInstallFailure(message) {
+	const cleaned = message.replace(/^Install failed(?:\s*\([^)]*\))?\s*:?\s*/i, "").trim();
+	if (!cleaned) return;
+	const maxLen = 140;
+	return cleaned.length > maxLen ? `${cleaned.slice(0, maxLen - 1)}…` : cleaned;
+}
+function formatSkillHint(skill) {
+	const desc = skill.description?.trim();
+	const installLabel = skill.install[0]?.label?.trim();
+	const combined = desc && installLabel ? `${desc} — ${installLabel}` : desc || installLabel;
+	if (!combined) return "install";
+	const maxLen = 90;
+	return combined.length > maxLen ? `${combined.slice(0, maxLen - 1)}…` : combined;
+}
+function upsertSkillEntry(cfg, skillKey, patch) {
+	const entries = { ...cfg.skills?.entries };
+	entries[skillKey] = {
+		...entries[skillKey] ?? {},
+		...patch
+	};
+	return {
+		...cfg,
+		skills: {
+			...cfg.skills,
+			entries
+		}
+	};
+}
+async function setupSkills(cfg, workspaceDir, runtime, prompter) {
+	const report = buildWorkspaceSkillStatus(workspaceDir, { config: cfg });
+	const eligible = report.skills.filter((s) => s.eligible);
+	const unsupportedOs = report.skills.filter((s) => !s.disabled && !s.blockedByAllowlist && s.missing.os.length > 0);
+	const missing = report.skills.filter((s) => !s.eligible && !s.disabled && !s.blockedByAllowlist && s.missing.os.length === 0);
+	const blocked = report.skills.filter((s) => s.blockedByAllowlist);
+	await prompter.note([
+		`Eligible: ${eligible.length}`,
+		`Missing requirements: ${missing.length}`,
+		`Unsupported on this OS: ${unsupportedOs.length}`,
+		`Blocked by allowlist: ${blocked.length}`
+	].join("\n"), "Skills status");
+	if (!await prompter.confirm({
+		message: "Configure skills now? (recommended)",
+		initialValue: true
+	})) return cfg;
+	const installable = missing.filter((skill) => skill.install.length > 0 && skill.missing.bins.length > 0);
+	let next = cfg;
+	if (installable.length > 0) {
+		const selected = (await prompter.multiselect({
+			message: "Install missing skill dependencies",
+			options: [{
+				value: "__skip__",
+				label: "Skip for now",
+				hint: "Continue without installing dependencies"
+			}, ...installable.map((skill) => ({
+				value: skill.name,
+				label: `${skill.emoji ?? "🧩"} ${skill.name}`,
+				hint: formatSkillHint(skill)
+			}))]
+		})).filter((name) => name !== "__skip__");
+		const selectedSkills = selected.map((name) => installable.find((s) => s.name === name)).filter((item) => Boolean(item));
+		if (process.platform !== "win32" && selectedSkills.some((skill) => skill.install.some((option) => option.kind === "brew")) && !await detectBinary("brew")) {
+			await prompter.note(["Many skill dependencies are shipped via Homebrew.", "Without brew, you'll need to build from source or download releases manually."].join("\n"), "Homebrew recommended");
+			if (await prompter.confirm({
+				message: "Show Homebrew install command?",
+				initialValue: true
+			})) await prompter.note(["Run:", "/bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\""].join("\n"), "Homebrew install");
+		}
+		if (selectedSkills.some((skill) => skill.install.some((option) => option.kind === "node"))) {
+			const nodeManager = await prompter.select({
+				message: "Preferred node manager for skill installs",
+				options: resolveNodeManagerOptions()
+			});
+			next = {
+				...next,
+				skills: {
+					...next.skills,
+					install: {
+						...next.skills?.install,
+						nodeManager
+					}
+				}
+			};
+		}
+		for (const name of selected) {
+			const target = installable.find((s) => s.name === name);
+			if (!target || target.install.length === 0) continue;
+			const installId = target.install[0]?.id;
+			if (!installId) continue;
+			const spin = prompter.progress(`Installing ${name}…`);
+			const result = await installSkill({
+				workspaceDir,
+				skillName: target.name,
+				installId,
+				config: next
+			});
+			const warnings = result.warnings ?? [];
+			if (result.ok) {
+				spin.stop(warnings.length > 0 ? `Installed ${name} (with warnings)` : `Installed ${name}`);
+				for (const warning of warnings) runtime.log(warning);
+				continue;
+			}
+			const code = result.code == null ? "" : ` (exit ${result.code})`;
+			const detail = summarizeInstallFailure(result.message);
+			spin.stop(`Install failed: ${name}${code}${detail ? ` — ${detail}` : ""}`);
+			for (const warning of warnings) runtime.log(warning);
+			if (result.stderr) runtime.log(result.stderr.trim());
+			else if (result.stdout) runtime.log(result.stdout.trim());
+			runtime.log(`Tip: run \`${formatCliCommand("moldclaw doctor")}\` to review skills + requirements.`);
+			runtime.log("Docs: https://docs.moldclaw.ai/skills");
+		}
+	}
+	for (const skill of missing) {
+		if (!skill.primaryEnv || skill.missing.env.length === 0) continue;
+		if (!await prompter.confirm({
+			message: `Set ${skill.primaryEnv} for ${skill.name}?`,
+			initialValue: false
+		})) continue;
+		const apiKey = String(await prompter.text({
+			message: `Enter ${skill.primaryEnv}`,
+			validate: (value) => value?.trim() ? void 0 : "Required"
+		}));
+		next = upsertSkillEntry(next, skill.skillKey, { apiKey: normalizeSecretInput(apiKey) });
+	}
+	return next;
+}
+//#endregion
+export { setupSkills as t };