@theholocron/cli 2.0.0-alpha.67 → 2.0.0-alpha.69

package/README.md

@@ -64,6 +64,31 @@ in at load time:
 A minimal config — for repos with a `package.json` and a GitHub remote
 — only needs `providers`:
 
+### repo options
+
+Additional `repo` fields recognised by `holocron setup`:
+
+| Field              | Type                                      | Description |
+| ------------------ | ----------------------------------------- | ----------- |
+| `repo.teams`       | `Array<string \| { slug, permission }>`   | GitHub teams granted repo access. String shorthand defaults to `push` (Write). `holocron setup` also writes `.github/CODEOWNERS` for teams with `push`/`maintain`/`admin`. |
+| `repo.topics`      | `string[]`                                | GitHub topics set on the repository. |
+| `repo.protection`  | `"balanced" \| "strict" \| "none"`        | Branch-protection preset applied by `holocron setup`. |
+| `repo.properties`  | `RepoProperties`                          | Org-level custom property values synced to the GitHub dashboard. |
+
+### Skills installer
+
+`holocron setup` can install shared skills from `@theholocron/skills` into the local repo:
+
+```ts
+export default defineConfig({
+  agent: "claude",                          // "claude" | "codex" | "gemini"
+  skills: ["git-safety", "pr-workflow"],    // skill names from @theholocron/skills
+  providers: { source: "github" },
+});
+```
+
+Skills are copied to `.agents/skills/<name>/` and symlinked at the agent's expected path (e.g. `.claude/skills/<name>`). All installed paths are added to a managed block in `.gitignore` automatically.
+
 <!-- prettier-ignore -->
 ```jsonc
 { "providers": { "source": "github" } }

package/dist/capabilities/index.d.mts

@@ -71,6 +71,12 @@ interface LabelDef {
   readonly color: string;
   readonly description: string;
 }
+type TeamPermission = "pull" | "triage" | "push" | "maintain" | "admin";
+/** Shorthand `"slug"` defaults to `push` permission. */
+type TeamEntry = string | {
+  slug: string;
+  permission: TeamPermission;
+};
 interface Source extends ProviderIdentity {
   readonly key: "source";
   /** Auth sanity-check. Throws ProviderApiError on auth failure. */
@@ -137,6 +143,11 @@ interface Source extends ProviderIdentity {
    * Optional — providers that don't support topics omit this.
    */
   syncTopics?(topics: string[]): Promise<string>;
+  /**
+   * Sync GitHub team repository access. String shorthand defaults to `push`.
+   * Optional — providers without a team concept omit this.
+   */
+  syncTeams?(teams: TeamEntry[]): Promise<string>;
   /**
    * Set the repository description.
    * Optional — providers that don't support setting descriptions omit this.
@@ -554,4 +565,4 @@ type CardinalityFor<K extends CapabilityKey> = (typeof CARDINALITY)[K];
 type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends "many" ? CapabilityImpls[K][] : CapabilityImpls[K];
 declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends "many" ? true : false;
 //#endregion
-export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti };
+export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti };

package/dist/cli.mjs

@@ -1,18 +1,19 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import path, { basename, dirname, join } from "node:path";
+import path, { basename, dirname, join, relative } from "node:path";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { createInterface } from "node:readline";
 import { stdin, stdout } from "node:process";
-import { ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
+import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import ora from "ora";
 import chalk from "chalk";
 import { createHash } from "node:crypto";
 import { createGitHubClient } from "@theholocron/github-client";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
-import { access, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 //#region src/capabilities/index.ts
@@ -149,7 +150,9 @@ function resolveConfig(raw) {
 		workflows: raw.workflows,
 		providers,
 		apps: raw.apps ?? [],
-		doctor: raw.doctor ?? {}
+		doctor: raw.doctor ?? {},
+		agent: raw.agent,
+		skills: raw.skills
 	};
 }
 //#endregion
@@ -3298,6 +3301,36 @@ async function runSetup(input) {
 			steps.push(await runStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
 			print(formatStep(steps[steps.length - 1]));
 		}
+		const teams = repo?.teams ?? [];
+		if (teams.length > 0) if (source.syncTeams) {
+			steps.push(await runStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
+			print(formatStep(steps[steps.length - 1]));
+			const repoCoord = input.context.repo ?? repo?.name ?? "";
+			const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
+			const writeableTeams = teams.map((t) => typeof t === "string" ? {
+				slug: t,
+				permission: "push"
+			} : t).filter((t) => [
+				"push",
+				"maintain",
+				"admin"
+			].includes(t.permission));
+			if (org && writeableTeams.length > 0) {
+				steps.push(await runStep("source", "write .github/CODEOWNERS", dryRun, async () => {
+					const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
+					await source.writeRepoFile(".github/CODEOWNERS", content);
+				}));
+				print(formatStep(steps[steps.length - 1]));
+			}
+		} else {
+			steps.push({
+				capability: "source",
+				step: "sync teams",
+				status: "skip",
+				message: "provider does not implement syncTeams"
+			});
+			print(formatStep(steps[steps.length - 1]));
+		}
 	}
 	if (loader.has("environments")) {
 		const envs = loader.get("environments");
@@ -3382,6 +3415,23 @@ async function runSetup(input) {
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
+	if (config.skills && config.skills.length > 0 && config.agent) {
+		print(style.step("skills"));
+		if (!(config.agent in AGENT_SYMLINK_PATHS)) steps.push({
+			capability: "skills",
+			step: "install skills",
+			status: "skip",
+			message: `agent "${config.agent}" has no known skill install path`
+		});
+		else steps.push(await runStep("skills", "install skills", dryRun, async () => {
+			return await installSkills({
+				agent: config.agent,
+				skills: config.skills,
+				repoRoot: input.context.repoRoot
+			});
+		}));
+		print(formatStep(steps[steps.length - 1]));
+	}
 	const summary = steps.reduce((acc, s) => {
 		if (s.status === "ok") acc.ok += 1;
 		else if (s.status === "fail") acc.fail += 1;
@@ -3419,6 +3469,94 @@ async function runSetup(input) {
 		summary
 	};
 }
+const AGENTS_SKILLS_ROOT = ".agents/skills";
+/** Relative path of the agent-specific symlink. undefined = unsupported agent. */
+const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
+const GITIGNORE_BLOCK_START = "# managed by holocron setup — skills";
+const GITIGNORE_BLOCK_END = "# end managed by holocron setup — skills";
+async function installSkills({ agent, skills, repoRoot }) {
+	const symlinkFn = AGENT_SYMLINK_PATHS[agent];
+	if (!symlinkFn) return `agent "${agent}" has no known skill install path — skipping`;
+	const require = createRequire(pathToFileURL(join(repoRoot, "package.json")));
+	let skillsRoot;
+	try {
+		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
+	} catch {
+		throw new Error("@theholocron/skills not found — run: pnpm add -D @theholocron/skills");
+	}
+	const gitignorePath = join(repoRoot, ".gitignore");
+	const existingContent = await readFile(gitignorePath, "utf8").catch(() => "");
+	const previouslyInstalled = parsePreviousSkills(existingContent, symlinkFn);
+	const currentSet = new Set(skills);
+	const stale = previouslyInstalled.filter((n) => !currentSet.has(n));
+	for (const name of stale) {
+		await rm(join(repoRoot, symlinkFn(name)), { force: true }).catch(() => void 0);
+		await rm(join(repoRoot, AGENTS_SKILLS_ROOT, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	const installed = [];
+	const missing = [];
+	for (const name of skills) {
+		const srcDir = join(skillsRoot, "skills", name);
+		try {
+			await stat(srcDir);
+		} catch {
+			missing.push(name);
+			continue;
+		}
+		const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+		await copyDirRecursive(srcDir, agentsDir);
+		const symlinkPath = join(repoRoot, symlinkFn(name));
+		await mkdir(dirname(symlinkPath), { recursive: true });
+		try {
+			await unlink(symlinkPath);
+		} catch {}
+		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+		installed.push(name);
+	}
+	if (installed.length > 0 || stale.length > 0 || missing.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [...installed, ...missing], symlinkFn);
+	const parts = [`installed ${installed.length}`];
+	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
+	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
+	return parts.join("; ");
+}
+/** Extract skill names from the previous gitignore block so stale dirs can be pruned. */
+function parsePreviousSkills(gitignoreContent, symlinkFn) {
+	if (!gitignoreContent.includes(GITIGNORE_BLOCK_START)) return [];
+	const startIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_START);
+	const endIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_END, startIdx);
+	const block = endIdx !== -1 ? gitignoreContent.slice(startIdx, endIdx) : gitignoreContent.slice(startIdx);
+	const placeholder = "__placeholder__";
+	const symlinkPrefix = `/${symlinkFn(placeholder)}`.replace(placeholder, "");
+	return block.split("\n").filter((line) => line.startsWith(symlinkPrefix)).map((line) => line.slice(symlinkPrefix.length));
+}
+async function copyDirRecursive(src, dest) {
+	await mkdir(dest, { recursive: true });
+	const entries = await readdir(src, { withFileTypes: true });
+	for (const entry of entries) {
+		const srcPath = join(src, entry.name);
+		const destPath = join(dest, entry.name);
+		if (entry.isDirectory()) await copyDirRecursive(srcPath, destPath);
+		else await copyFile(srcPath, destPath);
+	}
+}
+async function updateSkillsGitignore(gitignorePath, existingContent, skills, symlinkFn) {
+	const block = [
+		GITIGNORE_BLOCK_START,
+		...[`/${AGENTS_SKILLS_ROOT}/`, ...skills.map((n) => `/${symlinkFn(n)}`)],
+		GITIGNORE_BLOCK_END
+	].join("\n");
+	let content;
+	if (existingContent.includes(GITIGNORE_BLOCK_START)) {
+		const start = existingContent.indexOf(GITIGNORE_BLOCK_START);
+		const end = existingContent.indexOf(GITIGNORE_BLOCK_END, start);
+		const afterBlock = end !== -1 ? existingContent.slice(end + 40) : "\n";
+		content = existingContent.slice(0, start) + block + afterBlock;
+	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
+	await writeFile(gitignorePath, content, "utf8");
+}
 async function runStep(capability, step, dryRun, body) {
 	if (dryRun) return {
 		capability,
@@ -3469,22 +3607,54 @@ function formatStep(step) {
 	return `    ${style.dim(`· ${label}`)}`;
 }
 //#endregion
+//#region src/commands/skills.ts
+async function runSkillsInstall(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const config = input.loaded.resolved;
+	if (!config.agent || !config.skills?.length) {
+		print("Nothing to install — set `agent` and `skills` in holocron.config.ts");
+		return;
+	}
+	if (input.context.dryRun) {
+		print(`Would install ${config.skills.length} skill(s) for agent: ${config.agent}`);
+		for (const name of config.skills) print(`  → would install: ${name}`);
+		return;
+	}
+	print(`Installing ${config.skills.length} skill(s) for agent: ${config.agent}`);
+	try {
+		print(`  → ${await installSkills({
+			agent: config.agent,
+			skills: config.skills,
+			repoRoot: input.context.repoRoot
+		})}`);
+	} catch (err) {
+		print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+//#endregion
 //#region src/commands/sync.ts
 const SYNC_STEPS = [
 	"labels",
 	"properties",
+	"teams",
 	"topics",
 	"keywords",
 	"description"
 ];
+const LOCAL_STEPS = /* @__PURE__ */ new Set(["keywords", "description"]);
 async function runSync(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	await loader.load();
 	const config = input.loaded.resolved;
 	const dryRun = input.context.dryRun ?? false;
 	const requestedSteps = input.steps;
 	const steps = [];
+	if (!requestedSteps || requestedSteps.some((s) => !LOCAL_STEPS.has(s))) await loader.load();
+	else try {
+		await loader.load();
+	} catch (err) {
+		if (!(err instanceof AuthError)) throw err;
+	}
 	print(`Holocron sync — ${config.name}${dryRun ? " (dry-run)" : ""}`);
 	print(`  config: ${input.loaded.filepath}`);
 	print("");
@@ -3493,6 +3663,7 @@ async function runSync(input) {
 		print("  → source");
 		for (const stepName of SYNC_STEPS) {
 			if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+			if (LOCAL_STEPS.has(stepName)) continue;
 			if (stepName === "labels") if (source.syncLabels) {
 				steps.push(await runSyncStep("source", "sync labels", dryRun, () => source.syncLabels(CANONICAL_LABELS, STALE_LABELS)));
 				print(formatSyncStep(steps[steps.length - 1]));
@@ -3528,68 +3699,67 @@ async function runSync(input) {
 				});
 				print(formatSyncStep(steps[steps.length - 1]));
 			}
-			if (stepName === "topics") {
-				const topics = config.repo?.topics ?? [];
-				if (topics.length === 0) {
+			if (stepName === "teams") {
+				const teams = config.repo?.teams ?? [];
+				if (teams.length === 0) {
 					steps.push({
 						capability: "source",
-						step: "sync topics",
+						step: "sync teams",
 						status: "skip",
-						message: "no topics configured"
+						message: "no teams configured"
 					});
 					print(formatSyncStep(steps[steps.length - 1]));
-				} else if (source.syncTopics) {
-					steps.push(await runSyncStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
+				} else if (source.syncTeams) {
+					steps.push(await runSyncStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
 					print(formatSyncStep(steps[steps.length - 1]));
+					const repoCoord = input.context.repo ?? config.repo?.name ?? "";
+					const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
+					const writeableTeams = teams.map((t) => typeof t === "string" ? {
+						slug: t,
+						permission: "push"
+					} : t).filter((t) => [
+						"push",
+						"maintain",
+						"admin"
+					].includes(t.permission));
+					if (org && writeableTeams.length > 0) {
+						steps.push(await runSyncStep("source", "write .github/CODEOWNERS", dryRun, async () => {
+							const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
+							await source.writeRepoFile(".github/CODEOWNERS", content);
+						}));
+						print(formatSyncStep(steps[steps.length - 1]));
+					}
 				} else {
 					steps.push({
 						capability: "source",
-						step: "sync topics",
+						step: "sync teams",
 						status: "skip",
-						message: "provider does not implement syncTopics"
+						message: "provider does not implement syncTeams"
 					});
 					print(formatSyncStep(steps[steps.length - 1]));
 				}
 			}
-			if (stepName === "keywords") {
+			if (stepName === "topics") {
 				const topics = config.repo?.topics ?? [];
 				if (topics.length === 0) {
 					steps.push({
 						capability: "source",
-						step: "sync keywords",
+						step: "sync topics",
 						status: "skip",
 						message: "no topics configured"
 					});
 					print(formatSyncStep(steps[steps.length - 1]));
-				} else {
-					steps.push(await runSyncStep("source", "sync keywords", dryRun, async () => {
-						return await writePackageJsonField(input.context.repoRoot, "keywords", topics) ? `${topics.length} keywords written` : `${topics.length} topics (no package.json)`;
-					}));
+				} else if (source.syncTopics) {
+					steps.push(await runSyncStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
 					print(formatSyncStep(steps[steps.length - 1]));
-				}
-			}
-			if (stepName === "description") {
-				const description = config.description;
-				if (!description) {
+				} else {
 					steps.push({
 						capability: "source",
-						step: "sync description",
+						step: "sync topics",
 						status: "skip",
-						message: "no description configured"
+						message: "provider does not implement syncTopics"
 					});
 					print(formatSyncStep(steps[steps.length - 1]));
-				} else {
-					steps.push(await runSyncStep("source", "sync description", dryRun, async () => {
-						const pkgWrote = await writePackageJsonField(input.context.repoRoot, "description", description);
-						const readmeWrote = await updateReadmeDescription(input.context.repoRoot, description);
-						if (source.syncDescription) await source.syncDescription(description);
-						const parts = [];
-						if (pkgWrote) parts.push("package.json");
-						if (readmeWrote) parts.push("README.md");
-						if (source.syncDescription) parts.push("GitHub");
-						return parts.length > 0 ? parts.join(", ") + " updated" : "description synced";
-					}));
-					print(formatSyncStep(steps[steps.length - 1]));
 				}
 			}
 		}
@@ -3605,6 +3775,51 @@ async function runSync(input) {
 			}
 		}
 	}
+	for (const stepName of ["keywords", "description"]) {
+		if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+		if (stepName === "keywords") {
+			const topics = config.repo?.topics ?? [];
+			if (topics.length === 0) {
+				steps.push({
+					capability: "local",
+					step: "sync keywords",
+					status: "skip",
+					message: "no topics configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push(await runSyncStep("local", "sync keywords", dryRun, async () => {
+					return await writePackageJsonField(input.context.repoRoot, "keywords", topics) ? `${topics.length} keywords written` : `${topics.length} topics (no package.json)`;
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+		if (stepName === "description") {
+			const description = config.description;
+			if (!description) {
+				steps.push({
+					capability: "local",
+					step: "sync description",
+					status: "skip",
+					message: "no description configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				const source = loader.has("source") ? loader.get("source") : null;
+				steps.push(await runSyncStep("local", "sync description", dryRun, async () => {
+					const pkgWrote = await writePackageJsonField(input.context.repoRoot, "description", description);
+					const readmeWrote = await updateReadmeDescription(input.context.repoRoot, description);
+					if (source?.syncDescription) await source.syncDescription(description);
+					const parts = [];
+					if (pkgWrote) parts.push("package.json");
+					if (readmeWrote) parts.push("README.md");
+					if (source?.syncDescription) parts.push("GitHub");
+					return parts.length > 0 ? parts.join(", ") + " updated" : "description synced";
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+	}
 	const summary = steps.reduce((acc, s) => {
 		if (s.status === "ok") acc.ok += 1;
 		else if (s.status === "fail") acc.fail += 1;
@@ -3851,6 +4066,18 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 			...argv.token ? { cliToken: argv.token } : {}
 		}
 	})).summary.fail > 0) process.exitCode = 1;
+}).command("skills <action>", "Manage agent skills from the @theholocron/skills registry", (y) => y.positional("action", {
+	type: "string",
+	choices: ["install"],
+	describe: "install — copy skills from @theholocron/skills into .agents/ with agent symlinks"
+}), async (argv) => {
+	if (argv.action === "install") await runSkillsInstall({
+		loaded: await loadConfig(argv.cwd),
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun
+		}
+	});
 }).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
 	type: "string",
 	demandOption: true,
@@ -3956,10 +4183,10 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		dryRun: argv.dryRun,
 		...argv.otp ? { otp: argv.otp } : {}
 	})).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync source-level state (labels, properties, topics) from config to the provider", (y) => y.positional("steps", {
+}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description)", (y) => y.positional("steps", {
 	type: "string",
 	array: true,
-	describe: "Steps to run: labels, properties, topics (default: all)"
+	describe: "Steps to run: labels, properties, topics, keywords, description (default: all)"
 }).option("repo", {
 	type: "string",
 	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti } from "./capabilities/index.mjs";
+import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti } from "./capabilities/index.mjs";
 import { AuthError, RequestOptions, ResolveTokenConfig as ResolveTokenConfig$1, ResolveTokenInput, RestClient, RestClientConfig, createRestClient } from "@theholocron/http-client";
 
 //#region src/auth-resolver.d.ts
@@ -47,6 +47,12 @@ interface RepoConfig {
   protection?: RepoProtection;
   /** CI check context names required on the default branch (only used when `protection` is "strict"). */
   requiredChecks?: string[];
+  /**
+   * GitHub teams granted repository access. Synced by `holocron setup`, which
+   * also writes `.github/CODEOWNERS` for teams with write-or-higher permission.
+   * String shorthand defaults to `push` (Write).
+   */
+  teams?: TeamEntry[];
   /** GitHub topics set on the repository. */
   topics?: string[];
   /** GitHub custom properties synced to the org dashboard. */
@@ -93,6 +99,22 @@ interface HolocronConfig {
   providers: RawProvidersConfig;
   apps?: AppConfig[];
   doctor?: DoctorConfig;
+  /**
+   * Agent runtime that determines where skills are installed by `holocron setup`.
+   * Skills are installed to `.agents/skills/<name>/` (canonical) with a
+   * relative symlink at the agent-specific path:
+   * - `"claude"` → `.claude/skills/<name>` → `../../.agents/skills/<name>`
+   * - `"codex"` | `"gemini"` → logged as unsupported; skipped gracefully.
+   */
+  agent?: "claude" | "codex" | "gemini";
+  /**
+   * Skill names from `@theholocron/skills` to install during `holocron setup`.
+   * Installed paths are gitignored and managed by setup — do not commit them.
+   *
+   * @example
+   * ["git-safety", "pr-workflow", "commit-standards"]
+   */
+  skills?: string[];
 }
 interface ResolvedTuple {
   provider: string;
@@ -119,6 +141,8 @@ interface ResolvedHolocronConfig {
   providers: ResolvedProvidersConfig;
   apps: AppConfig[];
   doctor: DoctorConfig;
+  agent?: "claude" | "codex" | "gemini";
+  skills?: string[];
 }
 declare class ConfigError extends Error {
   name: string;
@@ -195,4 +219,4 @@ interface LoadedConfig {
  */
 declare function loadConfig(cwd: string): Promise<LoadedConfig>;
 //#endregion
-export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, EnsureResult, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, EnsureResult, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/index.mjs

@@ -196,7 +196,9 @@ function resolveConfig(raw) {
 		workflows: raw.workflows,
 		providers,
 		apps: raw.apps ?? [],
-		doctor: raw.doctor ?? {}
+		doctor: raw.doctor ?? {},
+		agent: raw.agent,
+		skills: raw.skills
 	};
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.0-alpha.67",
+  "version": "2.0.0-alpha.69",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -34,8 +34,8 @@
   ],
   "dependencies": {
     "@napi-rs/keyring": "^1.3.0",
-    "@theholocron/github-client": "^0.11.3",
-    "@theholocron/http-client": "^0.11.3",
+    "@theholocron/github-client": "^1.1.0",
+    "@theholocron/http-client": "^1.1.0",
     "chalk": "^5.4.1",
     "ora": "^8.2.0",
     "tsx": "^4.22.4",