@sushanglewis/lincoln 1.8.0 → 1.8.3

package/dist/postinstall.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/commands/install.ts
-import fs5 from "fs";
-import path6 from "path";
+import fs6 from "fs";
+import path7 from "path";
 import { spawn as spawn2 } from "child_process";
 
 // src/lib/paths.ts
@@ -106,7 +106,12 @@ var COPY_SUBDIRS = [
   "stages",
   "schemas",
   "templates",
-  "harnesses"
+  "harnesses",
+  // Policies are data files consumed by hooks at runtime (e.g.
+  // .claude/policies/less-is-more.md read by on-session-start.sh,
+  // security.yaml read by pre-tool-use.sh). Without syncing them into the
+  // project, vendored installs silently skip those guardrails (#126).
+  "policies"
 ];
 function sha256(filePath) {
   const data = fs3.readFileSync(filePath);
@@ -327,9 +332,265 @@ async function syncHarness(harnessId, opts, syncClaude) {
   return report;
 }
 
-// src/lib/harnessDetect.ts
+// src/lib/syncSkills.ts
 import fs4 from "fs";
 import path5 from "path";
+import { execFile } from "child_process";
+import yaml from "js-yaml";
+
+// src/lib/semver.ts
+var SEMVER_CORE = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+var NUMERIC_IDENTIFIER = /^\d+$/;
+function compareVersions(a, b) {
+  const pa = parseVersion(a);
+  const pb = parseVersion(b);
+  if (!pa || !pb) {
+    return void 0;
+  }
+  if (pa.major !== pb.major) return pa.major - pb.major;
+  if (pa.minor !== pb.minor) return pa.minor - pb.minor;
+  if (pa.patch !== pb.patch) return pa.patch - pb.patch;
+  return comparePrerelease(pa.prerelease, pb.prerelease);
+}
+function parseVersion(version) {
+  const match = SEMVER_CORE.exec(version.trim());
+  if (!match) {
+    return void 0;
+  }
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] ? match[4].split(".") : []
+  };
+}
+function comparePrerelease(a, b) {
+  if (a.length === 0 && b.length === 0) return 0;
+  if (a.length === 0) return 1;
+  if (b.length === 0) return -1;
+  const shared = Math.min(a.length, b.length);
+  for (let i = 0; i < shared; i++) {
+    const x = a[i];
+    const y = b[i];
+    if (x === y) continue;
+    const xNumeric = NUMERIC_IDENTIFIER.test(x);
+    const yNumeric = NUMERIC_IDENTIFIER.test(y);
+    if (xNumeric && yNumeric) return Number(x) - Number(y);
+    if (xNumeric) return -1;
+    if (yNumeric) return 1;
+    return x < y ? -1 : 1;
+  }
+  return a.length - b.length;
+}
+
+// src/lib/syncSkills.ts
+var GIT_SOURCE = /^(https?:\/\/|git@)/;
+var FULL_SHA = /^[0-9a-f]{40}$/i;
+var PINNED_SEMVER = /^v?(\d+\.\d+\.\d+)$/;
+var NPM_GLOBAL_INSTALL = /^npm install -g (\S+)$/;
+var MAX_BUFFER = 16 * 1024 * 1024;
+var defaultRunner = (cmd, args) => new Promise((resolvePromise, rejectPromise) => {
+  execFile(cmd, args, { maxBuffer: MAX_BUFFER }, (err, stdout, stderr) => {
+    if (err && !("code" in err && typeof err.code === "number")) {
+      rejectPromise(err);
+      return;
+    }
+    const code = err && typeof err.code === "number" ? err.code : 0;
+    resolvePromise({ code, stdout: String(stdout), stderr: String(stderr) });
+  });
+});
+async function syncExternalSkills(options) {
+  const report = { entries: [], warnings: [] };
+  const manifestPath = path5.join(options.payloadRoot, ".claude", "skills", "dependencies.yaml");
+  if (!fs4.existsSync(manifestPath)) {
+    report.warnings.push(`skill dependency manifest not found at ${manifestPath}; skipping external skill sync`);
+    return report;
+  }
+  let manifest;
+  try {
+    manifest = yaml.load(fs4.readFileSync(manifestPath, "utf8")) ?? {};
+  } catch (err) {
+    report.warnings.push(
+      `failed to parse ${manifestPath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return report;
+  }
+  const runCommand3 = options.runCommand ?? defaultRunner;
+  const platform = options.platform ?? (process.platform === "darwin" ? "macos" : process.platform === "linux" ? "linux" : process.platform);
+  for (const [name, cfg] of Object.entries(manifest.skills ?? {})) {
+    if (!cfg.source || cfg.source === "inline" || !GIT_SOURCE.test(cfg.source)) {
+      continue;
+    }
+    const enabled = cfg.default_install ?? cfg.required ?? true;
+    if (!enabled) {
+      report.entries.push({ name, status: "skipped-optional", detail: "default_install is false" });
+      continue;
+    }
+    if (cfg.type === "cli") {
+      await syncCli(name, cfg, options, platform, runCommand3, report);
+    } else {
+      await syncGitSkill(name, cfg, options, runCommand3, report);
+    }
+  }
+  return report;
+}
+async function syncGitSkill(name, cfg, options, runCommand3, report) {
+  const source = cfg.source;
+  const ref = cfg.ref ?? "";
+  const target = path5.join(options.skillsDir, name);
+  if (options.dryRun) {
+    const planned = fs4.existsSync(target) ? "verify pinned ref and update if behind" : `clone and pin to ${ref}`;
+    report.entries.push({ name, status: "dry-run", detail: `would ${planned}` });
+    return;
+  }
+  if (!fs4.existsSync(target)) {
+    const clone = await runCommand3("git", ["clone", source, target]);
+    if (clone.code !== 0) {
+      fail(report, name, `git clone failed: ${clone.stderr.trim() || `exit code ${clone.code}`}`);
+      return;
+    }
+    const checkout = await runCommand3("git", ["-C", target, "checkout", ref]);
+    if (checkout.code !== 0) {
+      fail(report, name, `git checkout ${ref} failed: ${checkout.stderr.trim() || `exit code ${checkout.code}`}`);
+      return;
+    }
+    report.entries.push({ name, status: "installed", detail: ref });
+    return;
+  }
+  const status = await runCommand3("git", ["-C", target, "status", "--porcelain"]);
+  if (status.code !== 0) {
+    fail(report, name, `git status failed (not a git repository?): ${status.stderr.trim() || `exit code ${status.code}`}`);
+    return;
+  }
+  if (status.stdout.trim() !== "") {
+    const detail = "working tree is dirty; skipping update (commit or stash local changes first)";
+    report.entries.push({ name, status: "skipped-dirty", detail });
+    report.warnings.push(`${name}: ${detail}`);
+    return;
+  }
+  const head = await runCommand3("git", ["-C", target, "rev-parse", "HEAD"]);
+  if (head.code !== 0) {
+    fail(report, name, `git rev-parse failed: ${head.stderr.trim() || `exit code ${head.code}`}`);
+    return;
+  }
+  if (head.stdout.trim() === ref) {
+    report.entries.push({ name, status: "current", detail: ref });
+    return;
+  }
+  const advertised = await isPinAdvertised(source, ref, runCommand3);
+  if (advertised) {
+    const fetch2 = await runCommand3("git", ["-C", target, "fetch", "origin", ref]);
+    if (fetch2.code === 0 && await checkoutFetchHead(name, target, runCommand3, report)) {
+      return;
+    }
+    if (fetch2.code !== 0) {
+      fail(report, name, `git fetch origin ${ref} failed: ${fetch2.stderr.trim() || `exit code ${fetch2.code}`}`);
+      return;
+    }
+    return;
+  }
+  const fetch = await runCommand3("git", ["-C", target, "fetch", "origin", ref]);
+  if (fetch.code === 0) {
+    await checkoutFetchHead(name, target, runCommand3, report);
+    return;
+  }
+  if (FULL_SHA.test(ref)) {
+    const fetchAll = await runCommand3("git", ["-C", target, "fetch", "origin"]);
+    if (fetchAll.code !== 0) {
+      fail(report, name, `git fetch origin failed: ${fetchAll.stderr.trim() || `exit code ${fetchAll.code}`}`);
+      return;
+    }
+    const checkout = await runCommand3("git", ["-C", target, "checkout", ref]);
+    if (checkout.code !== 0) {
+      fail(report, name, `git checkout ${ref} failed: ${checkout.stderr.trim() || `exit code ${checkout.code}`}`);
+      return;
+    }
+    report.entries.push({ name, status: "updated", detail: ref });
+    return;
+  }
+  fail(report, name, `git fetch origin ${ref} failed: ${fetch.stderr.trim() || `exit code ${fetch.code}`}`);
+}
+async function isPinAdvertised(source, ref, runCommand3) {
+  const remote = await runCommand3("git", ["ls-remote", source]);
+  if (remote.code !== 0) {
+    return false;
+  }
+  return remote.stdout.split("\n").some((line) => line.split("	")[0]?.trim() === ref);
+}
+async function checkoutFetchHead(name, target, runCommand3, report) {
+  const checkout = await runCommand3("git", ["-C", target, "checkout", "FETCH_HEAD"]);
+  if (checkout.code !== 0) {
+    fail(report, name, `git checkout FETCH_HEAD failed: ${checkout.stderr.trim() || `exit code ${checkout.code}`}`);
+    return false;
+  }
+  report.entries.push({ name, status: "updated", detail: "checked out FETCH_HEAD" });
+  return true;
+}
+async function syncCli(name, cfg, options, platform, runCommand3, report) {
+  const binary = cfg.binary ?? name;
+  const installCommand = cfg.platforms?.[platform] ?? cfg.platforms?.linux;
+  const npmPackage = installCommand ? parseNpmGlobalInstall(installCommand) : void 0;
+  const pinned = cfg.ref ? pinnedSemver(cfg.ref) : void 0;
+  if (options.dryRun) {
+    const managed = npmPackage && pinned ? `install ${npmPackage}@${pinned} if missing or older` : "verify presence";
+    report.entries.push({ name, status: "dry-run", detail: `would ${managed}` });
+    return;
+  }
+  const whichCmd = process.platform === "win32" ? "where" : "which";
+  const found = await runCommand3(whichCmd, [binary]);
+  if (found.code !== 0) {
+    if (npmPackage && pinned) {
+      await npmInstall(name, npmPackage, pinned, runCommand3, report, "installed");
+      return;
+    }
+    fail(report, name, `CLI '${binary}' not found. Install manually (${platform}): ${installCommand ?? "see dependency manifest"}`);
+    return;
+  }
+  if (!npmPackage || !pinned) {
+    report.entries.push({ name, status: "current", detail: `${binary} present` });
+    return;
+  }
+  const version = await runCommand3(binary, ["--version"]);
+  const installed = version.code === 0 ? version.stdout.split("\n")[0]?.trim() ?? "" : "";
+  const comparison = installed ? compareVersions(installed, pinned) : void 0;
+  if (comparison === void 0) {
+    report.entries.push({
+      name,
+      status: "current",
+      detail: `could not parse installed version '${installed}'; leaving ${binary} as-is`
+    });
+    return;
+  }
+  if (comparison >= 0) {
+    report.entries.push({ name, status: "current", detail: `${binary} ${installed}` });
+    return;
+  }
+  await npmInstall(name, npmPackage, pinned, runCommand3, report, "updated");
+}
+async function npmInstall(name, npmPackage, version, runCommand3, report, status) {
+  const result = await runCommand3("npm", ["install", "-g", `${npmPackage}@${version}`]);
+  if (result.code !== 0) {
+    fail(report, name, `npm install -g ${npmPackage}@${version} failed: ${result.stderr.trim() || `exit code ${result.code}`}`);
+    return;
+  }
+  report.entries.push({ name, status, detail: `${npmPackage}@${version}` });
+}
+function parseNpmGlobalInstall(command) {
+  const match = NPM_GLOBAL_INSTALL.exec(command.trim());
+  return match?.[1];
+}
+function pinnedSemver(ref) {
+  const match = PINNED_SEMVER.exec(ref.trim());
+  return match?.[0].replace(/^v/, "");
+}
+function fail(report, name, detail) {
+  report.entries.push({ name, status: "failed", detail });
+  report.warnings.push(`${name}: ${detail}`);
+}
+
+// src/lib/harnessDetect.ts
+import fs5 from "fs";
+import path6 from "path";
 import os2 from "os";
 var HARNESS_SPECS = [
   {
@@ -343,9 +604,9 @@ var HARNESS_SPECS = [
 function detectGlobalHarnesses(overrideHomeDir) {
   const homeDir = overrideHomeDir ?? os2.homedir();
   return HARNESS_SPECS.map((spec) => {
-    const configDir = path5.join(homeDir, spec.configDirName);
-    const installed = fs4.existsSync(configDir);
-    const pluginManaged = spec.pluginMarker ? fs4.existsSync(path5.join(configDir, spec.pluginMarker)) : false;
+    const configDir = path6.join(homeDir, spec.configDirName);
+    const installed = fs5.existsSync(configDir);
+    const pluginManaged = spec.pluginMarker ? fs5.existsSync(path6.join(configDir, spec.pluginMarker)) : false;
     return {
       id: spec.id,
       installed,
@@ -537,6 +798,7 @@ function createDefaultDeps() {
     paths: resolveLincolnPaths(),
     payloadRoot: resolvePayloadRoot() || "",
     syncHarnesses,
+    syncExternalSkills,
     createPrompt,
     resolvePythonForVenv,
     isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY)
@@ -549,7 +811,7 @@ async function install(options, deps = createDefaultDeps()) {
     return 1;
   }
   const payloadRoot = deps.payloadRoot;
-  if (!payloadRoot || !fs5.existsSync(payloadRoot)) {
+  if (!payloadRoot || !fs6.existsSync(payloadRoot)) {
     console.error('Lincoln payload not found. Run "npm install -g @sushanglewis/lincoln" first.');
     return 1;
   }
@@ -568,15 +830,15 @@ async function install(options, deps = createDefaultDeps()) {
     return 1;
   }
   if (!options.dryRun) {
-    const versionDir = path6.join(deps.paths.versionsDir, version);
-    fs5.mkdirSync(versionDir, { recursive: true });
-    fs5.cpSync(payloadRoot, versionDir, { recursive: true, force: true });
+    const versionDir = path7.join(deps.paths.versionsDir, version);
+    fs6.mkdirSync(versionDir, { recursive: true });
+    fs6.cpSync(payloadRoot, versionDir, { recursive: true, force: true });
     try {
-      fs5.rmSync(deps.paths.currentDir, { recursive: true, force: true });
-      fs5.symlinkSync(versionDir, deps.paths.currentDir);
+      fs6.rmSync(deps.paths.currentDir, { recursive: true, force: true });
+      fs6.symlinkSync(versionDir, deps.paths.currentDir);
     } catch {
-      fs5.rmSync(deps.paths.currentDir, { recursive: true, force: true });
-      fs5.cpSync(versionDir, deps.paths.currentDir, { recursive: true, force: true });
+      fs6.rmSync(deps.paths.currentDir, { recursive: true, force: true });
+      fs6.cpSync(versionDir, deps.paths.currentDir, { recursive: true, force: true });
     }
   }
   const reports = await deps.syncHarnesses({
@@ -596,9 +858,30 @@ async function install(options, deps = createDefaultDeps()) {
       managedFiles: collectManagedFiles(reports)
     });
   }
-  printSummary(options, version, harnesses, reports);
+  const skillReport = await syncSkillLibraries(options, deps, harnesses);
+  printSummary(options, version, harnesses, reports, skillReport);
   return 0;
 }
+async function syncSkillLibraries(options, deps, harnesses) {
+  if (!harnesses.includes("claude-code") || !deps.syncExternalSkills) {
+    return void 0;
+  }
+  const payloadRoot = deps.paths.currentDir;
+  const manifestPath = path7.join(payloadRoot, ".claude", "skills", "dependencies.yaml");
+  if (!fs6.existsSync(manifestPath)) {
+    return void 0;
+  }
+  try {
+    return await deps.syncExternalSkills({
+      payloadRoot,
+      skillsDir: path7.join(deps.paths.claudeDir, "skills"),
+      dryRun: options.dryRun
+    });
+  } catch (err) {
+    console.warn(`  warning: external skill sync failed: ${err instanceof Error ? err.message : String(err)}`);
+    return void 0;
+  }
+}
 async function resolvePythonIfNeeded(options, deps, harnesses) {
   const needsPython = !options.dryRun && !options.noVenv && harnesses.some((id) => id === "codex" || id === "opencode");
   if (!needsPython) {
@@ -659,7 +942,7 @@ function collectManagedFiles(reports) {
   }
   return files;
 }
-function printSummary(options, version, harnesses, reports) {
+function printSummary(options, version, harnesses, reports, skillReport) {
   const warnings = collectWarnings(reports);
   if (options.dryRun) {
     console.log(`Dry run: would install Lincoln ${version} for harnesses: ${harnesses.join(", ")}`);
@@ -670,6 +953,13 @@ function printSummary(options, version, harnesses, reports) {
     const count = report.written.length + report.skipped.length + report.preserved.length;
     console.log(`  ${harnessId}: ${count} file(s)`);
   }
+  if (skillReport) {
+    for (const entry of skillReport.entries) {
+      const detail = entry.detail ? ` (${entry.detail})` : "";
+      console.log(`  skill ${entry.name}: ${entry.status}${detail}`);
+    }
+    warnings.push(...skillReport.warnings);
+  }
   for (const warning of warnings) {
     console.warn(`  warning: ${warning}`);
   }
@@ -730,7 +1020,7 @@ async function resolvePythonForVenv(envOverride = process.env.LINCOLN_PYTHON, ca
   return void 0;
 }
 function venvPythonPath(paths) {
-  return path6.join(
+  return path7.join(
     paths.venvDir,
     process.platform === "win32" ? "Scripts" : "bin",
     process.platform === "win32" ? "python.exe" : "python"
@@ -738,17 +1028,17 @@ function venvPythonPath(paths) {
 }
 async function setupVenv(paths, payloadRoot, pythonCommand) {
   const pythonExe = venvPythonPath(paths);
-  if (!fs5.existsSync(pythonExe)) {
+  if (!fs6.existsSync(pythonExe)) {
     console.log("Creating Lincoln virtual environment...");
     const venvCode = await runCommand2(pythonCommand, ["-m", "venv", paths.venvDir]);
     if (venvCode !== 0) {
       throw new Error(`Failed to create virtual environment (exit code ${venvCode})`);
     }
   }
-  const requirementsPath = path6.join(payloadRoot, "requirements.txt");
-  if (fs5.existsSync(requirementsPath)) {
+  const requirementsPath = path7.join(payloadRoot, "requirements.txt");
+  if (fs6.existsSync(requirementsPath)) {
     console.log("Installing Python dependencies...");
-    const pipExe = path6.join(
+    const pipExe = path7.join(
       paths.venvDir,
       process.platform === "win32" ? "Scripts" : "bin",
       process.platform === "win32" ? "pip.exe" : "pip"