@vibe-agent-toolkit/cli 0.1.39-rc.1 → 0.1.39-rc.11

package/dist/commands/skill/test/run.js

@@ -0,0 +1,381 @@
+/**
+ * `vat skill test run <skill...>` — execute a packaged skill's eval suite in isolation.
+ *
+ * Thin orchestration layer: parse flags, resolve precedence (flag > config > default),
+ * print the §12 security warning, call runSkillTestHarness, map result/error to exit code.
+ * All domain logic lives in run-harness.ts (agent-skills package).
+ */
+import { basename } from 'node:path';
+import { BootstrapNeededError, mapErrorToExitCode, runSkillTestHarness } from '@vibe-agent-toolkit/agent-skills';
+import { findProjectRoot, toForwardSlash } from '@vibe-agent-toolkit/utils';
+import { Command } from 'commander';
+import { loadConfig } from '../../../utils/config-loader.js';
+/** Extract the trailing path segment (cross-platform) from a path-like string. */
+function lastPathSegment(p) {
+    return basename(toForwardSlash(p));
+}
+// ---------------------------------------------------------------------------
+// Security warning (§12)
+// ---------------------------------------------------------------------------
+const SECURITY_WARNING = `
+WARNING: vat skill test run executes arbitrary skill code inside a headless
+Claude session. The experimenter prompt and all staged skill files run with
+bypassPermissions. Pass --i-understand-this-runs-skill-code to acknowledge
+this and proceed.
+`.trim();
+function printSecurityWarning() {
+    process.stderr.write(SECURITY_WARNING + '\n\n');
+}
+// ---------------------------------------------------------------------------
+// Knob coercion helpers
+// ---------------------------------------------------------------------------
+function coercePositiveInt(value, flagName) {
+    if (value === undefined)
+        return undefined;
+    const n = Number.parseInt(value, 10);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new Error(`${flagName} must be a positive integer. Got: ${value}`);
+    }
+    return n;
+}
+function coercePositiveFloat(value, flagName) {
+    if (value === undefined)
+        return undefined;
+    const n = Number.parseFloat(value);
+    if (!Number.isFinite(n) || n <= 0) {
+        throw new Error(`${flagName} must be a positive number. Got: ${value}`);
+    }
+    return n;
+}
+function coerceKnobs(options) {
+    const result = {};
+    const maxTurns = coercePositiveInt(options.maxTurns, '--max-turns');
+    if (maxTurns !== undefined)
+        result.maxTurns = maxTurns;
+    const maxBudgetUsd = coercePositiveFloat(options.maxBudgetUsd, '--max-budget-usd');
+    if (maxBudgetUsd !== undefined)
+        result.maxBudgetUsd = maxBudgetUsd;
+    const timeout = coercePositiveInt(options.timeout, '--timeout');
+    if (timeout !== undefined)
+        result.timeout = timeout;
+    const stall = coercePositiveInt(options.stall, '--stall');
+    if (stall !== undefined)
+        result.stall = stall;
+    return result;
+}
+/**
+ * Parse a single `name=src` pair into a [name, SkillSourceSpec] tuple. The
+ * source half uses a `kind:value` prefix:
+ *   workspace:foo · npm:@scope/s@1.2.3 · url:https://… · path:../baz · vendored
+ * A bare value without `name=` is rejected — every injected dep needs a name so
+ * the domain can key it (and so the skill resolves under that name in staging).
+ */
+function parseWithPair(pair) {
+    const eq = pair.indexOf('=');
+    if (eq <= 0) {
+        throw new Error(`--with entries must be "name=<src>" (e.g. mydep=workspace:foo, bar=npm:@scope/s@1.2.3, baz=path:../baz). Got: ${pair}`);
+    }
+    const name = pair.slice(0, eq);
+    const src = pair.slice(eq + 1);
+    return [name, parseSourceSpec(src, pair)];
+}
+/** Parse the `kind:value` source half of a --with pair into a SkillSourceSpec. */
+function parseSourceSpec(src, original) {
+    if (src === 'vendored')
+        return { vendored: true };
+    const colon = src.indexOf(':');
+    const kind = colon === -1 ? src : src.slice(0, colon);
+    const value = colon === -1 ? '' : src.slice(colon + 1);
+    switch (kind) {
+        case 'workspace': return requireValue(value, original, () => ({ workspace: value }));
+        case 'npm': return requireValue(value, original, () => ({ npm: value }));
+        case 'path': return requireValue(value, original, () => ({ path: value }));
+        case 'url': return requireValue(value, original, () => ({ url: value }));
+        default:
+            throw new Error(`--with source must start with workspace:|npm:|url:|path:|vendored. Got: ${original}`);
+    }
+}
+function requireValue(value, original, build) {
+    if (!value) {
+        throw new Error(`--with source is missing a value: ${original}`);
+    }
+    return build();
+}
+/** Parse an array of `name=src` flag values into a name→spec record. */
+function parseWithFlags(pairs) {
+    if (pairs === undefined || pairs.length === 0)
+        return undefined;
+    const record = {};
+    for (const pair of pairs) {
+        const [name, spec] = parseWithPair(pair);
+        record[name] = spec;
+    }
+    return record;
+}
+/** Derive a stable name for a config-supplied (nameless) skill source descriptor. */
+function descriptorName(d) {
+    if ('workspace' in d)
+        return d.workspace;
+    if ('npm' in d)
+        return d.npm.replace(/@[^@/]+$/, '');
+    if ('path' in d)
+        return lastPathSegment(d.path) || d.path;
+    if ('url' in d)
+        return 'url-dep';
+    return 'skill-creator';
+}
+/** Map a config descriptor array (with/optional) into a name→spec record. */
+function descriptorsToRecord(list) {
+    if (list === undefined || list.length === 0)
+        return undefined;
+    const record = {};
+    for (const d of list)
+        record[descriptorName(d)] = d;
+    return record;
+}
+// ---------------------------------------------------------------------------
+// Precedence resolution: flag > config > default
+// ---------------------------------------------------------------------------
+/**
+ * Load the persisted `skills.config.<skill>.test` block for the subject skill.
+ * The subject is the first positional skill name (a path or skill key). We key
+ * the config by its basename so `./dist/skills/my-skill/` matches `my-skill`.
+ * Missing config / missing file → undefined (defaults apply).
+ */
+function loadTestConfig(skills) {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (projectRoot === null)
+        return undefined;
+    let config;
+    try {
+        config = loadConfig(projectRoot);
+    }
+    catch {
+        return undefined; // tolerate a broken/absent config → defaults
+    }
+    const perSkill = config?.skills?.config;
+    if (perSkill === undefined)
+        return undefined;
+    const subject = skills[0] ?? '';
+    const base = lastPathSegment(subject) || subject;
+    return perSkill[subject]?.test ?? perSkill[base]?.test;
+}
+/** Resolve the project root used as the harness repoRoot anchor. */
+function resolveRepoRoot() {
+    return findProjectRoot(process.cwd()) ?? process.cwd();
+}
+/** Copy flag-only passthrough options (no config counterpart) onto opts. */
+function applyFlagOnlyOptions(opts, options) {
+    if (options.refresh !== undefined)
+        opts.refresh = options.refresh;
+    if (options.workdir !== undefined)
+        opts.workdir = options.workdir;
+    if (options.out !== undefined)
+        opts.out = options.out;
+    if (options.keep !== undefined)
+        opts.keep = options.keep;
+    if (options.dryRun !== undefined)
+        opts.dryRun = options.dryRun;
+    if (options.allowUnverifiedSkillSource !== undefined)
+        opts.allowUnverifiedSkillSource = options.allowUnverifiedSkillSource;
+    if (options.iUnderstandThisRunsSkillCode !== undefined)
+        opts.acknowledgedRunsSkillCode = options.iUnderstandThisRunsSkillCode;
+}
+/** Apply flag>config merges for scalar knobs (auth, model, baseline, eval/prompt). */
+function applyScalarMerges(opts, options, config) {
+    const authMode = options.auth ?? config?.auth;
+    if (authMode !== undefined)
+        opts.auth = authMode;
+    const authRequirement = options.requireAuth ?? config?.requireAuth;
+    if (authRequirement !== undefined)
+        opts.requireAuth = authRequirement;
+    const baseline = options.baseline ?? config?.baseline;
+    if (baseline !== undefined)
+        opts.baseline = baseline;
+    const model = options.model ?? config?.model;
+    if (model !== undefined)
+        opts.model = model;
+    if (config?.evals !== undefined)
+        opts.evalsSubpath = config.evals;
+    if (config?.experimenterPrompt !== undefined)
+        opts.promptOverride = config.experimenterPrompt;
+    if (config?.build !== undefined)
+        opts.build = config.build;
+}
+/** Apply flag>config merges for numeric knobs (turns/budget/timeout/stall). */
+function applyKnobMerges(opts, knobs, config) {
+    const maxTurns = knobs.maxTurns ?? config?.maxTurns;
+    if (maxTurns !== undefined)
+        opts.maxTurns = maxTurns;
+    const maxBudgetUsd = knobs.maxBudgetUsd ?? config?.maxBudgetUsd;
+    if (maxBudgetUsd !== undefined)
+        opts.maxBudgetUsd = maxBudgetUsd;
+    const timeout = knobs.timeout ?? config?.timeout;
+    if (timeout !== undefined)
+        opts.timeout = timeout;
+    const stall = knobs.stall ?? config?.stall;
+    if (stall !== undefined)
+        opts.stall = stall;
+}
+/**
+ * Parse a single `KEY=VALUE` pair (split on the FIRST `=`, so values may contain
+ * `=`). The key must be non-empty; the value may be empty.
+ */
+function parseEnvPair(pair) {
+    const eq = pair.indexOf('=');
+    if (eq <= 0) {
+        throw new Error(`--env entries must be "KEY=VALUE" (e.g. CUSTOMER_SNAPSHOT_PATH=\${fixturesDir}/snapshot.json). Got: ${pair}`);
+    }
+    return [pair.slice(0, eq), pair.slice(eq + 1)];
+}
+/** Parse repeated `--env KEY=VALUE` flags into a record (undefined when none). */
+function parseEnvFlags(pairs) {
+    if (pairs === undefined || pairs.length === 0)
+        return undefined;
+    const record = {};
+    for (const pair of pairs) {
+        const [key, value] = parseEnvPair(pair);
+        record[key] = value;
+    }
+    return record;
+}
+/** Merge config + CLI `env` maps; CLI wins per-key. undefined when both absent. */
+function mergeEnv(configEnv, cliEnv) {
+    if (configEnv === undefined && cliEnv === undefined)
+        return undefined;
+    return { ...configEnv, ...cliEnv };
+}
+/** Union config + CLI `passEnv` lists (config first), de-duplicated. */
+function mergePassEnv(configPass, cliPass) {
+    if (configPass === undefined && cliPass === undefined)
+        return undefined;
+    return [...new Set([...(configPass ?? []), ...(cliPass ?? [])])];
+}
+/** Apply flag>config merges for the declared test env (Features A + B). */
+function applyEnvMerges(opts, options, config) {
+    const env = mergeEnv(config?.env, parseEnvFlags(options.env));
+    if (env !== undefined)
+        opts.env = env;
+    const passEnv = mergePassEnv(config?.passEnv, options.passEnv);
+    if (passEnv !== undefined)
+        opts.passEnv = passEnv;
+}
+/** Apply flag>config merges for injected-dependency records. */
+function applyDepMerges(opts, options, config) {
+    const withSources = parseWithFlags(options.with) ?? descriptorsToRecord(config?.with);
+    if (withSources !== undefined)
+        opts.withSources = withSources;
+    const withOptional = parseWithFlags(options.withOptional) ?? descriptorsToRecord(config?.optional);
+    if (withOptional !== undefined)
+        opts.withOptional = withOptional;
+}
+/**
+ * Resolve CLI flags → RunHarnessOptions, applying flag > config > default
+ * precedence. CLI flags win; config (`skills.config.<skill>.test`) fills gaps;
+ * built-in defaults (inside the domain) are the final fallback.
+ */
+function buildHarnessOpts(skills, options, knobs, config) {
+    const repoRoot = resolveRepoRoot();
+    const opts = { skills, repoRoot };
+    // cwd for the pre-stage build hook. repoRoot comes from findProjectRoot, whose
+    // discovery ladder is config-anchored (vibe-agent-toolkit.config.yaml first, then
+    // .git), so the project root IS the directory holding the config — configRoot and
+    // repoRoot are the same dir by construction, not coincidence.
+    opts.configRoot = repoRoot;
+    applyFlagOnlyOptions(opts, options);
+    applyScalarMerges(opts, options, config);
+    applyKnobMerges(opts, knobs, config);
+    applyDepMerges(opts, options, config);
+    applyEnvMerges(opts, options, config);
+    return opts;
+}
+// ---------------------------------------------------------------------------
+// Testable action
+// ---------------------------------------------------------------------------
+/**
+ * The unit-testable action for `vat skill test run`. Exported so tests can
+ * call it directly without parsing CLI args. Calls process.exit on completion.
+ *
+ * Note: the security ack enforcement lives inside runSkillTestHarness (domain),
+ * NOT here — this ensures the mock in tests can bypass it cleanly.
+ */
+export async function runSkillTestRun(skills, options) {
+    printSecurityWarning();
+    const knobs = coerceKnobs(options);
+    const config = loadTestConfig(skills);
+    const harnessOpts = buildHarnessOpts(skills, options, knobs, config);
+    try {
+        const result = await runSkillTestHarness(harnessOpts);
+        process.stderr.write(`Harness: ${result.harnessPath}\n`);
+        process.stdout.write(`Summary: ${result.summary}\n`);
+        process.exit(result.exitCode);
+        return;
+    }
+    catch (err) {
+        const exitCode = mapErrorToExitCode(err);
+        // BootstrapNeededError (exit 3) is the happy "wrote a template, fill it in
+        // and re-run" path — surface its message plainly, not as a hard `Error:`.
+        if (err instanceof BootstrapNeededError) {
+            process.stderr.write(`${err.message}\n`);
+        }
+        else {
+            process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+        process.exit(exitCode);
+        return;
+    }
+}
+// ---------------------------------------------------------------------------
+// Commander command builder
+// ---------------------------------------------------------------------------
+export function createSkillTestRunCommand() {
+    const command = new Command('run');
+    command
+        .description('Execute the eval suite for a packaged skill in a headless Claude sandbox')
+        .argument('<skill...>', 'Skill name(s) to test (primary subject set)')
+        .option('--with <pair...>', 'Inject a declared-dependency skill as name=<src>, where <src> is workspace:<pkg> | npm:<spec> | url:<u> | path:<dir> | vendored (e.g. mydep=npm:@scope/s@1.2.3)')
+        .option('--with-optional <pair...>', 'Inject an optional skill as name=<src> (same syntax as --with)')
+        .option('--env <pair...>', 'Inject an env var into the experimenter spawn as KEY=VALUE (repeatable). Values support ${fixturesDir}, ${stagedSkillDir}, ${harnessRoot}, ${resultsDir}. CLI overrides config for the same key.')
+        .option('--pass-env <key...>', 'Forward a host env var by NAME to the experimenter spawn if present (repeatable). Protected names (PATH, auth, model) are ignored.')
+        .option('--refresh', 'Force a full re-stage (ignore existing staged content)')
+        .option('--workdir <dir>', 'Override the harness working directory')
+        .option('--out <dir>', 'Override the harness output directory')
+        .option('--keep', 'Keep the harness directory after the run')
+        .option('--dry-run', 'Assemble the command without spawning Claude')
+        .option('--auth <mode>', 'Auth mechanism: inherit | subscription | api-key | auto')
+        .option('--require-auth <mech>', 'Require a specific auth mechanism: subscription | api-key')
+        .option('--baseline', 'Enable A/B baseline run (with/without skill)')
+        .option('--allow-unverified-skill-source', 'Skip the vendored manifest integrity check')
+        .option('--i-understand-this-runs-skill-code', 'Acknowledge this command executes skill code (required)')
+        .option('--model <id>', 'Pinned model ID override')
+        .option('--max-turns <n>', 'Cap on experimenter turns (positive integer)')
+        .option('--max-budget-usd <n>', 'Hard USD budget cap (positive number)')
+        .option('--timeout <s>', 'Wall-clock timeout in seconds (positive integer)')
+        .option('--stall <s>', 'Stall-watchdog in seconds (positive integer)')
+        .option('--debug', 'Enable debug logging')
+        .action(runSkillTestRun)
+        .addHelpText('after', `
+Description:
+  Stages the named skill(s) into an isolated tmp directory, runs preflight
+  checks (claude binary, auth, eval inputs, budget), then spawns a headless
+  Claude session with a non-interactive experimenter prompt. The experimenter
+  grades each eval against the skill's expectations and writes grading.json.
+
+  IMPORTANT: This command executes arbitrary skill code. You MUST pass
+  --i-understand-this-runs-skill-code to acknowledge this and proceed.
+
+Exit Codes:
+  0 - Harness ran to completion and produced a valid grading.json (check summary/grading.json for pass/fail counts)
+  1 - Internal error (grading.json absent/invalid, experimenter crash, stall/timeout)
+  2 - Preflight failed (missing binary, auth error, eval inputs absent, unsafe workdir, ack missing)
+  3 - Bootstrap needed: evals.json was absent, so VAT wrote a starter template next to the skill source. Fill it in and re-run.
+
+  Note: eval pass/fail is NOT reflected in the exit code. Read the printed summary
+  ("PASS N/N" or "FAIL N/N") or grading.json to determine whether expectations passed.
+
+Example:
+  $ vat skill test run my-skill --i-understand-this-runs-skill-code
+`);
+    return command;
+}
+//# sourceMappingURL=run.js.map

package/dist/commands/skill/test/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../../src/commands/skill/test/run.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAEjH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,kFAAkF;AAClF,SAAS,eAAe,CAAC,CAAS;IAChC,OAAO,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG;;;;;CAKxB,CAAC,IAAI,EAAE,CAAC;AAET,SAAS,oBAAoB;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,CAAC;AAClD,CAAC;AA6BD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,KAAyB,EAAE,QAAgB;IACpE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,qCAAqC,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAyB,EAAE,QAAgB;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oCAAoC,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,WAAW,CAAC,OAA4B;IAM/C,MAAM,MAAM,GAKR,EAAE,CAAC;IAEP,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAEvD,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACnF,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAEnE,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAEpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAE9C,OAAO,MAAM,CAAC;AAChB,CAAC;AASD;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,iHAAiH,IAAI,EAAE,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,GAAW,EAAE,QAAgB;IACpD,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACvD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW,CAAC,CAAC,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,KAAK,KAAK,CAAC,CAAC,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,CAAC,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,KAAK,KAAK,CAAC,CAAC,OAAO,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE;YACE,MAAM,IAAI,KAAK,CACb,2EAA2E,QAAQ,EAAE,CACtF,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,KAA4B;IACjF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,SAAS,cAAc,CAAC,KAA2B;IACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,SAAS,cAAc,CAAC,CAAwB;IAC9C,IAAI,WAAW,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,SAAS,CAAC;IACzC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAC1B,IAAyC;IAEzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAoB,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAAgB;IACtC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,6CAA6C;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IACjD,OAAO,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;AACzD,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe;IACtB,OAAO,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAAC,IAAiB,EAAE,OAA4B;IAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAClE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACtD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/D,IAAI,OAAO,CAAC,0BAA0B,KAAK,SAAS;QAAE,IAAI,CAAC,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAC3H,IAAI,OAAO,CAAC,4BAA4B,KAAK,SAAS;QAAE,IAAI,CAAC,yBAAyB,GAAG,OAAO,CAAC,4BAA4B,CAAC;AAChI,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,IAAiB,EAAE,OAA4B,EAAE,MAA8B;IACxG,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,QAA2D,CAAC;IACpG,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,EAAE,WAAW,CAAC;IACnE,IAAI,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,eAA6C,CAAC;IACpG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,CAAC;IAC7C,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC5C,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;IAClE,IAAI,MAAM,EAAE,kBAAkB,KAAK,SAAS;QAAE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,kBAAkB,CAAC;IAC9F,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CACtB,IAAiB,EACjB,KAAqC,EACrC,MAA8B;IAE9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,QAAQ,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACrD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY,CAAC;IAChE,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uGAAuG,IAAI,EAAE,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAA2B;IAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CACf,SAA6C,EAC7C,MAA0C;IAE1C,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CACnB,UAAgC,EAChC,OAA6B;IAE7B,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,IAAiB,EAAE,OAA4B,EAAE,MAA8B;IACrG,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,IAAI,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;AACpD,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,IAAiB,EAAE,OAA4B,EAAE,MAA8B;IACrG,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtF,IAAI,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAC9D,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnG,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,MAAgB,EAChB,OAA4B,EAC5B,KAAqC,EACrC,MAA8B;IAE9B,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,kFAAkF;IAClF,kFAAkF;IAClF,8DAA8D;IAC9D,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC;IAC3B,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAgB,EAChB,OAA4B;IAE5B,oBAAoB,EAAE,CAAC;IAEvB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAErE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACzC,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAEnC,OAAO;SACJ,WAAW,CAAC,0EAA0E,CAAC;SACvF,QAAQ,CAAC,YAAY,EAAE,6CAA6C,CAAC;SACrE,MAAM,CACL,kBAAkB,EAClB,iKAAiK,CAClK;SACA,MAAM,CACL,2BAA2B,EAC3B,gEAAgE,CACjE;SACA,MAAM,CACL,iBAAiB,EACjB,kMAAkM,CACnM;SACA,MAAM,CACL,qBAAqB,EACrB,oIAAoI,CACrI;SACA,MAAM,CAAC,WAAW,EAAE,wDAAwD,CAAC;SAC7E,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC;SACnE,MAAM,CAAC,aAAa,EAAE,uCAAuC,CAAC;SAC9D,MAAM,CAAC,QAAQ,EAAE,0CAA0C,CAAC;SAC5D,MAAM,CAAC,WAAW,EAAE,8CAA8C,CAAC;SACnE,MAAM,CAAC,eAAe,EAAE,yDAAyD,CAAC;SAClF,MAAM,CAAC,uBAAuB,EAAE,2DAA2D,CAAC;SAC5F,MAAM,CAAC,YAAY,EAAE,8CAA8C,CAAC;SACpE,MAAM,CAAC,iCAAiC,EAAE,4CAA4C,CAAC;SACvF,MAAM,CAAC,qCAAqC,EAAE,yDAAyD,CAAC;SACxG,MAAM,CAAC,cAAc,EAAE,0BAA0B,CAAC;SAClD,MAAM,CAAC,iBAAiB,EAAE,8CAA8C,CAAC;SACzE,MAAM,CAAC,sBAAsB,EAAE,uCAAuC,CAAC;SACvE,MAAM,CAAC,eAAe,EAAE,kDAAkD,CAAC;SAC3E,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC;SACzC,MAAM,CAAC,eAAe,CAAC;SACvB,WAAW,CACV,OAAO,EACP;;;;;;;;;;;;;;;;;;;;;CAqBL,CACI,CAAC;IAEJ,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/cli",
-  "version": "0.1.39-rc.1",
+  "version": "0.1.39-rc.11",
   "description": "Command-line interface for vibe-agent-toolkit",
   "type": "module",
   "bin": {
@@ -41,16 +41,16 @@
   "//dependencies-note": "DO NOT add example agent packages or adopter packages here. Adopter packages (like vat-development-agents) depend on the CLI binary at build time — declaring them as deps creates a circular build dependency. They are built in a second turbo pass via package#task overrides in turbo.json.",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.71.2",
-    "@vibe-agent-toolkit/agent-config": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/agent-schema": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/agent-skills": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/claude-marketplace": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/discovery": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/gateway-mcp": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/rag": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/rag-lancedb": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/resources": "0.1.39-rc.1",
-    "@vibe-agent-toolkit/utils": "0.1.39-rc.1",
+    "@vibe-agent-toolkit/agent-config": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/agent-schema": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/agent-skills": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/claude-marketplace": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/discovery": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/gateway-mcp": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/rag": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/rag-lancedb": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/resources": "0.1.39-rc.11",
+    "@vibe-agent-toolkit/utils": "0.1.39-rc.11",
     "adm-zip": "^0.5.16",
     "commander": "^12.1.0",
     "picomatch": "^4.0.3",

package/dist/utils/git-url.d.ts

@@ -1,43 +0,0 @@
-/**
- * Parsed representation of a git URL accepted by `vat audit`.
- *
- * - `cloneUrl` is the URL passed to `git clone` (after stripping ref/subpath
- *   fragments and after expanding GitHub shorthand to a full HTTPS URL).
- * - `ref` is an optional branch or tag name (deep commit SHAs are not
- *   guaranteed to work with shallow clone — see design spec for details).
- * - `subpath` is an optional subdirectory within the cloned repo to audit.
- */
-export interface ParsedGitUrl {
-    cloneUrl: string;
-    ref?: string;
-    subpath?: string;
-}
-/**
- * Parse a string into a {@link ParsedGitUrl}.
- *
- * Accepted forms:
- *  - `https://host/owner/repo.git`
- *  - `https://host/owner/repo.git#ref`
- *  - `https://host/owner/repo.git#ref:subpath`
- *  - `https://github.com/owner/repo/tree/<ref>/<subpath>` (GitHub web URL)
- *  - `owner/repo` (GitHub shorthand → expanded to HTTPS)
- *  - `git@host:owner/repo.git`
- *  - `ssh://git@host/owner/repo.git`
- *
- * Throws on malformed input.
- */
-export declare function parseGitUrl(input: string): ParsedGitUrl;
-/**
- * Detect whether a string should be treated as a git URL (for the polymorphic
- * `[git-url-or-path]` audit argument). True for:
- *  - http(s):// URLs
- *  - ssh:// URLs
- *  - file:// URLs (used by integration tests against local bare repos)
- *  - git@host:path scp-style URLs
- *  - GitHub shorthand `owner/repo` (strict — no extensions, no extra slashes)
- *
- * Everything else (including relative paths like `./foo/bar`, absolute paths,
- * and multi-segment paths like `foo/bar/baz`) is treated as a filesystem path.
- */
-export declare function isGitUrl(input: string): boolean;
-//# sourceMappingURL=git-url.d.ts.map

package/dist/utils/git-url.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-url.d.ts","sourceRoot":"","sources":["../../src/utils/git-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAgEvD;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAmB/C"}

package/dist/utils/git-url.js

@@ -1,135 +0,0 @@
-/**
- * Split a URL with an optional `#ref[:subpath]` fragment into the base URL
- * and fragment components. Keeps the fragment-handling logic local so the
- * per-form regexes can stay simple and anchored.
- */
-function splitFragment(input) {
-    const hashIndex = input.indexOf('#');
-    if (hashIndex === -1) {
-        return { base: input };
-    }
-    const base = input.slice(0, hashIndex);
-    const fragment = input.slice(hashIndex + 1);
-    const colonIndex = fragment.indexOf(':');
-    if (colonIndex === -1) {
-        return { base, ref: fragment };
-    }
-    return {
-        base,
-        ref: fragment.slice(0, colonIndex),
-        subpath: fragment.slice(colonIndex + 1),
-    };
-}
-/**
- * Parse a string into a {@link ParsedGitUrl}.
- *
- * Accepted forms:
- *  - `https://host/owner/repo.git`
- *  - `https://host/owner/repo.git#ref`
- *  - `https://host/owner/repo.git#ref:subpath`
- *  - `https://github.com/owner/repo/tree/<ref>/<subpath>` (GitHub web URL)
- *  - `owner/repo` (GitHub shorthand → expanded to HTTPS)
- *  - `git@host:owner/repo.git`
- *  - `ssh://git@host/owner/repo.git`
- *
- * Throws on malformed input.
- */
-export function parseGitUrl(input) {
-    const trimmed = input.trim();
-    if (trimmed === '') {
-        throw new Error(`Invalid git URL or path: <empty>.`);
-    }
-    // file:// form: file:///path/to/repo[#ref[:subpath]] — used primarily by
-    // integration tests that clone a local bare repo. `git clone` accepts
-    // file:// natively.
-    if (trimmed.startsWith('file://')) {
-        const { base, ref, subpath } = splitFragment(trimmed);
-        return buildParsed(base, ref, subpath);
-    }
-    // HTTPS .git form: https://host/path.git[#ref[:subpath]]
-    if (/^https?:\/\//.test(trimmed)) {
-        const { base, ref, subpath } = splitFragment(trimmed);
-        if (base.endsWith('.git')) {
-            return buildParsed(base, ref, subpath);
-        }
-        // GitHub web URL: https://github.com/owner/repo/tree/<ref>[/<subpath>]
-        const ghWeb = 
-        // eslint-disable-next-line security/detect-unsafe-regex -- Anchored ^...$ with bounded character classes; the only variable-length group is the trailing subpath. Safe from ReDoS.
-        /^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/tree\/([^/]+)(?:\/(.+))?$/.exec(trimmed);
-        if (ghWeb) {
-            const owner = ghWeb[1] ?? '';
-            const repo = ghWeb[2] ?? '';
-            const webRef = ghWeb[3];
-            const webSubpath = ghWeb[4];
-            return buildParsed(`https://github.com/${owner}/${repo}.git`, webRef, webSubpath);
-        }
-    }
-    // SSH ssh:// form: ssh://git@host/path[#ref[:subpath]]
-    if (trimmed.startsWith('ssh://')) {
-        const { base, ref, subpath } = splitFragment(trimmed);
-        return buildParsed(base, ref, subpath);
-    }
-    // SSH scp-like form: git@host:owner/repo.git[#ref[:subpath]]
-    // Anchored, no alternation with nested quantifiers — safe from ReDoS.
-    if (/^[^@\s]+@[^:\s]+:[^#\s]+/.test(trimmed)) {
-        const { base, ref, subpath } = splitFragment(trimmed);
-        return buildParsed(base, ref, subpath);
-    }
-    // GitHub shorthand: owner/repo[#ref[:subpath]] (single slash in base)
-    const { base, ref, subpath } = splitFragment(trimmed);
-    const shorthand = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(base);
-    if (shorthand) {
-        const owner = shorthand[1] ?? '';
-        const repo = shorthand[2] ?? '';
-        return buildParsed(`https://github.com/${owner}/${repo}.git`, ref, subpath);
-    }
-    throw new Error(`Invalid git URL or path: ${input}. Accepted forms: ` +
-        `https://<host>/<owner>/<repo>.git, ` +
-        `git@<host>:<owner>/<repo>.git, ` +
-        `<owner>/<repo>, or a local filesystem path.`);
-}
-function buildParsed(cloneUrl, ref, subpath) {
-    const result = { cloneUrl };
-    if (ref !== undefined && ref !== '')
-        result.ref = ref;
-    if (subpath !== undefined && subpath !== '')
-        result.subpath = subpath;
-    return result;
-}
-/**
- * Detect whether a string should be treated as a git URL (for the polymorphic
- * `[git-url-or-path]` audit argument). True for:
- *  - http(s):// URLs
- *  - ssh:// URLs
- *  - file:// URLs (used by integration tests against local bare repos)
- *  - git@host:path scp-style URLs
- *  - GitHub shorthand `owner/repo` (strict — no extensions, no extra slashes)
- *
- * Everything else (including relative paths like `./foo/bar`, absolute paths,
- * and multi-segment paths like `foo/bar/baz`) is treated as a filesystem path.
- */
-export function isGitUrl(input) {
-    const trimmed = input.trim();
-    if (trimmed === '')
-        return false;
-    if (/^https?:\/\//.test(trimmed))
-        return true;
-    if (trimmed.startsWith('ssh://'))
-        return true;
-    if (trimmed.startsWith('file://'))
-        return true;
-    // Match the same scp-style pattern parseGitUrl uses, including the
-    // requirement of a non-empty path segment after the colon. Without the
-    // trailing `[^#\s]+`, `isGitUrl` would accept inputs like `foo@host:`
-    // that parseGitUrl then rejects with a less-helpful error.
-    if (/^[^@\s]+@[^:\s]+:[^#\s]+/.test(trimmed))
-        return true;
-    // Strict GitHub shorthand: exactly two segments, no extension on second,
-    // no path separators beyond the single /. Strip any `#ref[:subpath]`
-    // fragment first so `owner/repo#main` and `owner/repo#main:sub` are
-    // recognized — `parseGitUrl` handles fragments uniformly across forms.
-    const hashIndex = trimmed.indexOf('#');
-    const base = hashIndex === -1 ? trimmed : trimmed.slice(0, hashIndex);
-    return /^[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+$/.test(base);
-}
-//# sourceMappingURL=git-url.js.map

package/dist/utils/git-url.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"git-url.js","sourceRoot":"","sources":["../../src/utils/git-url.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,yDAAyD;IACzD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,uEAAuE;QACvE,MAAM,KAAK;QACT,mLAAmL;QACnL,yFAAyF,CAAC,IAAI,CAC5F,OAAO,CACR,CAAC;QACJ,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,6DAA6D;IAC7D,sEAAsE;IACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,sEAAsE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,KAAK,oBAAoB;QACnD,qCAAqC;QACrC,iCAAiC;QACjC,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,GAAY,EAAE,OAAgB;IACnE,MAAM,MAAM,GAAiB,EAAE,QAAQ,EAAE,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC"}