@vibe-agent-toolkit/utils 0.1.39-rc.6 → 0.1.39-rc.7

package/dist/git-url.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Parsed representation of a git URL accepted by `vat audit`.
+ *
+ * - `cloneUrl` is the URL passed to `git clone` (after stripping ref/subpath
+ *   fragments and after expanding GitHub shorthand to a full HTTPS URL).
+ * - `ref` is an optional branch or tag name (deep commit SHAs are not
+ *   guaranteed to work with shallow clone — see design spec for details).
+ * - `subpath` is an optional subdirectory within the cloned repo to audit.
+ */
+export interface ParsedGitUrl {
+    cloneUrl: string;
+    ref?: string;
+    subpath?: string;
+}
+/**
+ * Parse a string into a {@link ParsedGitUrl}.
+ *
+ * Accepted forms:
+ *  - `https://host/owner/repo.git`
+ *  - `https://host/owner/repo.git#ref`
+ *  - `https://host/owner/repo.git#ref:subpath`
+ *  - `https://github.com/owner/repo/tree/<ref>/<subpath>` (GitHub web URL)
+ *  - `owner/repo` (GitHub shorthand → expanded to HTTPS)
+ *  - `git@host:owner/repo.git`
+ *  - `ssh://git@host/owner/repo.git`
+ *
+ * Throws on malformed input.
+ */
+export declare function parseGitUrl(input: string): ParsedGitUrl;
+/**
+ * Detect whether a string should be treated as a git URL (for the polymorphic
+ * `[git-url-or-path]` audit argument). True for:
+ *  - http(s):// URLs
+ *  - ssh:// URLs
+ *  - file:// URLs (used by integration tests against local bare repos)
+ *  - git@host:path scp-style URLs
+ *  - GitHub shorthand `owner/repo` (strict — no extensions, no extra slashes)
+ *
+ * Everything else (including relative paths like `./foo/bar`, absolute paths,
+ * and multi-segment paths like `foo/bar/baz`) is treated as a filesystem path.
+ */
+export declare function isGitUrl(input: string): boolean;
+//# sourceMappingURL=git-url.d.ts.map

package/dist/git-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-url.d.ts","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAyBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAgEvD;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAmB/C"}

package/dist/git-url.js

@@ -0,0 +1,135 @@
+/**
+ * Split a URL with an optional `#ref[:subpath]` fragment into the base URL
+ * and fragment components. Keeps the fragment-handling logic local so the
+ * per-form regexes can stay simple and anchored.
+ */
+function splitFragment(input) {
+    const hashIndex = input.indexOf('#');
+    if (hashIndex === -1) {
+        return { base: input };
+    }
+    const base = input.slice(0, hashIndex);
+    const fragment = input.slice(hashIndex + 1);
+    const colonIndex = fragment.indexOf(':');
+    if (colonIndex === -1) {
+        return { base, ref: fragment };
+    }
+    return {
+        base,
+        ref: fragment.slice(0, colonIndex),
+        subpath: fragment.slice(colonIndex + 1),
+    };
+}
+/**
+ * Parse a string into a {@link ParsedGitUrl}.
+ *
+ * Accepted forms:
+ *  - `https://host/owner/repo.git`
+ *  - `https://host/owner/repo.git#ref`
+ *  - `https://host/owner/repo.git#ref:subpath`
+ *  - `https://github.com/owner/repo/tree/<ref>/<subpath>` (GitHub web URL)
+ *  - `owner/repo` (GitHub shorthand → expanded to HTTPS)
+ *  - `git@host:owner/repo.git`
+ *  - `ssh://git@host/owner/repo.git`
+ *
+ * Throws on malformed input.
+ */
+export function parseGitUrl(input) {
+    const trimmed = input.trim();
+    if (trimmed === '') {
+        throw new Error(`Invalid git URL or path: <empty>.`);
+    }
+    // file:// form: file:///path/to/repo[#ref[:subpath]] — used primarily by
+    // integration tests that clone a local bare repo. `git clone` accepts
+    // file:// natively.
+    if (trimmed.startsWith('file://')) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        return buildParsed(base, ref, subpath);
+    }
+    // HTTPS .git form: https://host/path.git[#ref[:subpath]]
+    if (/^https?:\/\//.test(trimmed)) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        if (base.endsWith('.git')) {
+            return buildParsed(base, ref, subpath);
+        }
+        // GitHub web URL: https://github.com/owner/repo/tree/<ref>[/<subpath>]
+        const ghWeb = 
+        // eslint-disable-next-line security/detect-unsafe-regex -- Anchored ^...$ with bounded character classes; the only variable-length group is the trailing subpath. Safe from ReDoS.
+        /^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/tree\/([^/]+)(?:\/(.+))?$/.exec(trimmed);
+        if (ghWeb) {
+            const owner = ghWeb[1] ?? '';
+            const repo = ghWeb[2] ?? '';
+            const webRef = ghWeb[3];
+            const webSubpath = ghWeb[4];
+            return buildParsed(`https://github.com/${owner}/${repo}.git`, webRef, webSubpath);
+        }
+    }
+    // SSH ssh:// form: ssh://git@host/path[#ref[:subpath]]
+    if (trimmed.startsWith('ssh://')) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        return buildParsed(base, ref, subpath);
+    }
+    // SSH scp-like form: git@host:owner/repo.git[#ref[:subpath]]
+    // Anchored, no alternation with nested quantifiers — safe from ReDoS.
+    if (/^[^@\s]+@[^:\s]+:[^#\s]+/.test(trimmed)) {
+        const { base, ref, subpath } = splitFragment(trimmed);
+        return buildParsed(base, ref, subpath);
+    }
+    // GitHub shorthand: owner/repo[#ref[:subpath]] (single slash in base)
+    const { base, ref, subpath } = splitFragment(trimmed);
+    const shorthand = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(base);
+    if (shorthand) {
+        const owner = shorthand[1] ?? '';
+        const repo = shorthand[2] ?? '';
+        return buildParsed(`https://github.com/${owner}/${repo}.git`, ref, subpath);
+    }
+    throw new Error(`Invalid git URL or path: ${input}. Accepted forms: ` +
+        `https://<host>/<owner>/<repo>.git, ` +
+        `git@<host>:<owner>/<repo>.git, ` +
+        `<owner>/<repo>, or a local filesystem path.`);
+}
+function buildParsed(cloneUrl, ref, subpath) {
+    const result = { cloneUrl };
+    if (ref !== undefined && ref !== '')
+        result.ref = ref;
+    if (subpath !== undefined && subpath !== '')
+        result.subpath = subpath;
+    return result;
+}
+/**
+ * Detect whether a string should be treated as a git URL (for the polymorphic
+ * `[git-url-or-path]` audit argument). True for:
+ *  - http(s):// URLs
+ *  - ssh:// URLs
+ *  - file:// URLs (used by integration tests against local bare repos)
+ *  - git@host:path scp-style URLs
+ *  - GitHub shorthand `owner/repo` (strict — no extensions, no extra slashes)
+ *
+ * Everything else (including relative paths like `./foo/bar`, absolute paths,
+ * and multi-segment paths like `foo/bar/baz`) is treated as a filesystem path.
+ */
+export function isGitUrl(input) {
+    const trimmed = input.trim();
+    if (trimmed === '')
+        return false;
+    if (/^https?:\/\//.test(trimmed))
+        return true;
+    if (trimmed.startsWith('ssh://'))
+        return true;
+    if (trimmed.startsWith('file://'))
+        return true;
+    // Match the same scp-style pattern parseGitUrl uses, including the
+    // requirement of a non-empty path segment after the colon. Without the
+    // trailing `[^#\s]+`, `isGitUrl` would accept inputs like `foo@host:`
+    // that parseGitUrl then rejects with a less-helpful error.
+    if (/^[^@\s]+@[^:\s]+:[^#\s]+/.test(trimmed))
+        return true;
+    // Strict GitHub shorthand: exactly two segments, no extension on second,
+    // no path separators beyond the single /. Strip any `#ref[:subpath]`
+    // fragment first so `owner/repo#main` and `owner/repo#main:sub` are
+    // recognized — `parseGitUrl` handles fragments uniformly across forms.
+    const hashIndex = trimmed.indexOf('#');
+    const base = hashIndex === -1 ? trimmed : trimmed.slice(0, hashIndex);
+    return /^[A-Za-z0-9_-]+\/[A-Za-z0-9_-]+$/.test(base);
+}
+//# sourceMappingURL=git-url.js.map

package/dist/git-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-url.js","sourceRoot":"","sources":["../src/git-url.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC;QAClC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,yDAAyD;IACzD,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,uEAAuE;QACvE,MAAM,KAAK;QACT,mLAAmL;QACnL,yFAAyF,CAAC,IAAI,CAC5F,OAAO,CACR,CAAC;QACJ,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,6DAA6D;IAC7D,sEAAsE;IACtE,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,sEAAsE;IACtE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,sBAAsB,KAAK,IAAI,IAAI,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,KAAK,oBAAoB;QACnD,qCAAqC;QACrC,iCAAiC;QACjC,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,GAAY,EAAE,OAAgB;IACnE,MAAM,MAAM,GAAiB,EAAE,QAAQ,EAAE,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACtE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,mEAAmE;IACnE,uEAAuE;IACvE,sEAAsE;IACtE,2DAA2D;IAC3D,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,yEAAyE;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtE,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export * from './asset-reference.js';
 export * from './fs-utils.js';
 export * from './file-crawler.js';
 export * from './gitignore-checker.js';
+export * from './git-url.js';
 export * from './git-utils.js';
 export * from './project-utils.js';
 export * from './git-tracker.js';
@@ -22,4 +23,5 @@ export type { ProviderMatch } from './link-auth/select-provider.js';
 export type { RewriteRule } from './link-auth/rewrite.js';
 export type { TokenSource } from './link-auth/resolve-token.js';
 export { expandMacro, UnknownMacroError } from './link-auth/expand-macro.js';
+export * from './skill-test/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAG/B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,gBAAgB,CAAC;AAI/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,eAAe,CAAC;AAG9B,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAG/B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,eAAe,CAAC;AAG9B,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAI/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,eAAe,CAAC;AAG9B,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAG7E,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -16,6 +16,8 @@ export * from './fs-utils.js';
 export * from './file-crawler.js';
 // Git ignore checking
 export * from './gitignore-checker.js';
+// Git URL parsing (parse/detect git URLs, GitHub shorthand, SSH forms)
+export * from './git-url.js';
 // Git utilities (using git commands directly)
 export * from './git-utils.js';
 // Project root discovery (canonical: config → git → null).
@@ -35,4 +37,6 @@ export * from './skill-targets.js';
 // Internal helpers (rewrite, build-headers, etc.) stay module-private.
 export { resolveAuthenticatedUrl, } from './link-auth/resolve.js';
 export { expandMacro, UnknownMacroError } from './link-auth/expand-macro.js';
+// Skill testing utilities (environment management for headless agent runs)
+export * from './skill-test/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,uBAAuB;AACvB,cAAc,eAAe,CAAC;AAE9B,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,uDAAuD;AACvD,uEAAuE;AACvE,OAAO,EAKL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,uBAAuB;AACvB,cAAc,eAAe,CAAC;AAE9B,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,uEAAuE;AACvE,cAAc,cAAc,CAAC;AAE7B,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,uDAAuD;AACvD,uEAAuE;AACvE,OAAO,EAKL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,2EAA2E;AAC3E,cAAc,uBAAuB,CAAC"}

package/dist/skill-test/auth-resolver.d.ts

@@ -0,0 +1,34 @@
+export type AuthMode = 'inherit' | 'subscription' | 'api-key' | 'auto';
+export type AuthMechanism = 'subscription' | 'api-key';
+export interface AuthStatusResult {
+    loggedIn: boolean;
+    authMethod?: string;
+    apiKeySource?: string;
+}
+export type AuthStatusProbe = (env: NodeJS.ProcessEnv) => AuthStatusResult | null;
+export interface ResolveAuthOptions {
+    mode: AuthMode;
+    requireAuth?: AuthMechanism;
+    sourceEnv: NodeJS.ProcessEnv;
+    /** Injected in tests; defaults to the real CLI probe in production. */
+    probe?: AuthStatusProbe;
+    modelVars?: string[];
+}
+export interface ResolvedAuth {
+    forwardedEnv: NodeJS.ProcessEnv;
+    effectiveMechanism: AuthMechanism;
+    authMethod?: string;
+    apiKeySource?: string;
+}
+/** A preflight auth failure — maps to exit code 2. */
+export declare class AuthPreflightError extends Error {
+    readonly exitCode: 2;
+    constructor(message: string);
+}
+/**
+ * Token-free auth probe (spec §8/§10). Runs `claude auth status --json` in the
+ * given env: returns in ~150ms, exit 0, spends NO tokens. NOT a `-p` call.
+ */
+export declare function probeAuthStatus(env: NodeJS.ProcessEnv): AuthStatusResult | null;
+export declare function resolveAuth(opts: ResolveAuthOptions): ResolvedAuth;
+//# sourceMappingURL=auth-resolver.d.ts.map

package/dist/skill-test/auth-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-resolver.d.ts","sourceRoot":"","sources":["../../src/skill-test/auth-resolver.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;AACvE,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,KAAK,gBAAgB,GAAG,IAAI,CAAC;AAElF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;IAC7B,uEAAuE;IACvE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,kBAAkB,EAAE,aAAa,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,sDAAsD;AACtD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAG,CAAC,CAAU;gBACnB,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAa/E;AAgBD,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,YAAY,CA+BlE"}

package/dist/skill-test/auth-resolver.js

@@ -0,0 +1,68 @@
+import { safeExecResult } from '../safe-exec.js';
+import { buildForwardedEnv } from './env-scrub.js';
+/** A preflight auth failure — maps to exit code 2. */
+export class AuthPreflightError extends Error {
+    exitCode = 2;
+    constructor(message) {
+        super(message);
+        this.name = 'AuthPreflightError';
+    }
+}
+/**
+ * Token-free auth probe (spec §8/§10). Runs `claude auth status --json` in the
+ * given env: returns in ~150ms, exit 0, spends NO tokens. NOT a `-p` call.
+ */
+export function probeAuthStatus(env) {
+    const res = safeExecResult('claude', ['auth', 'status', '--json'], { env, encoding: 'utf8', stdio: 'pipe' });
+    if (!res.success)
+        return null;
+    try {
+        const parsed = JSON.parse(res.stdout.toString());
+        return {
+            loggedIn: parsed['loggedIn'] === true,
+            ...(typeof parsed['authMethod'] === 'string' ? { authMethod: parsed['authMethod'] } : {}),
+            ...(typeof parsed['apiKeySource'] === 'string' ? { apiKeySource: parsed['apiKeySource'] } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function hasInferenceKey(env) {
+    return Boolean(env['ANTHROPIC_API_KEY'] ?? env['ANTHROPIC_AUTH_TOKEN']);
+}
+/** Decide whether to scrub the inference key, given mode + a subscription-present probe. */
+function decideScrub(mode, sourceEnv, probe) {
+    if (mode === 'subscription')
+        return true;
+    if (mode === 'api-key' || mode === 'auto')
+        return false;
+    // inherit: scrub the key only if a subscription is actually logged in.
+    const scrubbed = buildForwardedEnv(sourceEnv, { scrubInferenceKey: true });
+    const status = probe(scrubbed);
+    return status?.loggedIn === true;
+}
+export function resolveAuth(opts) {
+    const probe = opts.probe ?? probeAuthStatus;
+    const baseOpts = opts.modelVars ? { modelVars: opts.modelVars } : {};
+    if (opts.mode === 'api-key' && !hasInferenceKey(opts.sourceEnv)) {
+        throw new AuthPreflightError('--auth api-key requires ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN to be set.');
+    }
+    const scrubInferenceKey = decideScrub(opts.mode, opts.sourceEnv, probe);
+    const forwardedEnv = buildForwardedEnv(opts.sourceEnv, { scrubInferenceKey, ...baseOpts });
+    const status = probe(forwardedEnv);
+    if (opts.mode === 'subscription' && status?.loggedIn !== true) {
+        throw new AuthPreflightError('--auth subscription requires a logged-in subscription (claude auth status reports not logged in).');
+    }
+    const effectiveMechanism = !scrubInferenceKey && hasInferenceKey(forwardedEnv) ? 'api-key' : 'subscription';
+    if (opts.requireAuth && opts.requireAuth !== effectiveMechanism) {
+        throw new AuthPreflightError(`--require-auth ${opts.requireAuth} but the effective mechanism is ${effectiveMechanism}. Refusing to spend tokens.`);
+    }
+    return {
+        forwardedEnv,
+        effectiveMechanism,
+        ...(status?.authMethod ? { authMethod: status.authMethod } : {}),
+        ...(status?.apiKeySource ? { apiKeySource: status.apiKeySource } : {}),
+    };
+}
+//# sourceMappingURL=auth-resolver.js.map

package/dist/skill-test/auth-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-resolver.js","sourceRoot":"","sources":["../../src/skill-test/auth-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AA6BnD,sDAAsD;AACtD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,QAAQ,GAAG,CAAU,CAAC;IAC/B,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAsB;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7G,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,CAA4B,CAAC;QAC5E,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI;YACrC,GAAG,CAAC,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,4FAA4F;AAC5F,SAAS,WAAW,CAAC,IAAc,EAAE,SAA4B,EAAE,KAAsB;IACvF,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,uEAAuE;IACvE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,MAAM,EAAE,QAAQ,KAAK,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAErE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,8EAA8E,CAAC,CAAC;IAC/G,CAAC;IAED,MAAM,iBAAiB,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,iBAAiB,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAE3F,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAAC,mGAAmG,CAAC,CAAC;IACpI,CAAC;IAED,MAAM,kBAAkB,GACtB,CAAC,iBAAiB,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;IAEnF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,kBAAkB,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,IAAI,CAAC,WAAW,mCAAmC,kBAAkB,6BAA6B,CACrH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY;QACZ,kBAAkB;QAClB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC"}

package/dist/skill-test/env-scrub.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Build the forwarded environment for the headless `claude` child using a
+ * STRICT exact-name allowlist (spec §14). We never forward ANTHROPIC_* by
+ * prefix — that would silently leak ANTHROPIC_ADMIN_API_KEY, proxy overrides,
+ * etc. into untrusted skill code. Anything not enumerated is dropped.
+ */
+export interface ForwardEnvOptions {
+    /** True under --auth subscription (and inherit-with-subscription): drop the inference key so the child uses OAuth. */
+    scrubInferenceKey: boolean;
+    /** Additional exact model var names the run needs (e.g. ANTHROPIC_MODEL). */
+    modelVars?: string[];
+}
+export declare function buildForwardedEnv(source: NodeJS.ProcessEnv, opts: ForwardEnvOptions): NodeJS.ProcessEnv;
+//# sourceMappingURL=env-scrub.d.ts.map

package/dist/skill-test/env-scrub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-scrub.d.ts","sourceRoot":"","sources":["../../src/skill-test/env-scrub.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,sHAAsH;IACtH,iBAAiB,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAWD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,UAAU,EACzB,IAAI,EAAE,iBAAiB,GACtB,MAAM,CAAC,UAAU,CAuBnB"}

package/dist/skill-test/env-scrub.js

@@ -0,0 +1,35 @@
+/**
+ * Build the forwarded environment for the headless `claude` child using a
+ * STRICT exact-name allowlist (spec §14). We never forward ANTHROPIC_* by
+ * prefix — that would silently leak ANTHROPIC_ADMIN_API_KEY, proxy overrides,
+ * etc. into untrusted skill code. Anything not enumerated is dropped.
+ */
+/** Process-essential vars that must survive for the child to even start. */
+const PROCESS_ESSENTIALS = ['PATH', 'Path', 'HOME', 'USERPROFILE', 'SystemRoot', 'TEMP', 'TMP', 'TMPDIR', 'LANG', 'LC_ALL'];
+/** The only auth/config vars ever forwarded. */
+const AUTH_CONFIG_ALLOWLIST = ['CLAUDE_CONFIG_DIR'];
+/** The active inference credential candidates (forwarded unless scrubbed). */
+const INFERENCE_CREDENTIALS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN'];
+export function buildForwardedEnv(source, opts) {
+    const out = {};
+    const allow = new Set([
+        ...PROCESS_ESSENTIALS,
+        ...AUTH_CONFIG_ALLOWLIST,
+        ...(opts.modelVars ?? []),
+    ]);
+    if (!opts.scrubInferenceKey) {
+        for (const name of INFERENCE_CREDENTIALS)
+            allow.add(name);
+    }
+    for (const name of allow) {
+        const value = source[name];
+        if (value !== undefined)
+            out[name] = value;
+    }
+    // ANTHROPIC_ADMIN_API_KEY and CLAUDECODE/CLAUDE_CODE_* are never in `allow`,
+    // so they are dropped by construction. No explicit delete needed — but assert
+    // the invariant defensively so a future allowlist edit can't reintroduce it.
+    delete out['ANTHROPIC_ADMIN_API_KEY'];
+    return out;
+}
+//# sourceMappingURL=env-scrub.js.map

package/dist/skill-test/env-scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-scrub.js","sourceRoot":"","sources":["../../src/skill-test/env-scrub.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;AAErI,gDAAgD;AAChD,MAAM,qBAAqB,GAAG,CAAC,mBAAmB,CAAU,CAAC;AAE7D,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,CAAC,mBAAmB,EAAE,sBAAsB,CAAU,CAAC;AAErF,MAAM,UAAU,iBAAiB,CAC/B,MAAyB,EACzB,IAAuB;IAEvB,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS;QAC5B,GAAG,kBAAkB;QACrB,GAAG,qBAAqB;QACxB,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,qBAAqB;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,OAAO,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAEtC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/skill-test/index.d.ts

@@ -0,0 +1,4 @@
+export { buildForwardedEnv, type ForwardEnvOptions } from './env-scrub.js';
+export { AuthPreflightError, probeAuthStatus, resolveAuth, type AuthMechanism, type AuthMode, type AuthStatusProbe, type AuthStatusResult, type ResolveAuthOptions, type ResolvedAuth, } from './auth-resolver.js';
+export { assembleClaudeArgs, spawnHeadlessClaude, type ClaudeSpawnArgs, type SpawnHeadlessOptions, type SpawnResult, } from './spawn-claude.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/skill-test/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skill-test/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC"}

package/dist/skill-test/index.js

@@ -0,0 +1,4 @@
+export { buildForwardedEnv } from './env-scrub.js';
+export { AuthPreflightError, probeAuthStatus, resolveAuth, } from './auth-resolver.js';
+export { assembleClaudeArgs, spawnHeadlessClaude, } from './spawn-claude.js';
+//# sourceMappingURL=index.js.map

package/dist/skill-test/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skill-test/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAA0B,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,WAAW,GAOZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GAIpB,MAAM,mBAAmB,CAAC"}

package/dist/skill-test/spawn-claude.d.ts

@@ -0,0 +1,37 @@
+export interface ClaudeSpawnArgs {
+    promptFile: string;
+    pluginDirs: string[];
+    sandboxDir: string;
+    model?: string;
+    maxTurns?: number;
+    maxBudgetUsd?: number;
+}
+/**
+ * Pure assembly of the headless `claude -p` argv (spec §9). The prompt is read
+ * from a file via the prompt-file flag — never inlined as an argv string
+ * (Windows cmd-quoting safety). `--setting-sources ""` suppresses user/project
+ * settings; built-in skills remain (§5).
+ */
+export declare function assembleClaudeArgs(opts: ClaudeSpawnArgs): string[];
+export interface SpawnResult {
+    status: number;
+    timedOut: boolean;
+    stalled: boolean;
+}
+export interface SpawnHeadlessOptions extends ClaudeSpawnArgs {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    timeoutMs: number;
+    /** If set, SIGKILL the child if no stdout/stderr output is received for this many ms. */
+    stallMs?: number;
+    onStdout?: (chunk: string) => void;
+    onStderr?: (chunk: string) => void;
+}
+/**
+ * Spawn the headless `claude`. stdin is redirected from the OS null device so
+ * the session cannot block on input (§16). Wall-clock kill on timeout.
+ * If `stallMs` is set, a resettable stall watchdog kills the child when no
+ * output is received for that duration (stalled: true in result).
+ */
+export declare function spawnHeadlessClaude(opts: SpawnHeadlessOptions): Promise<SpawnResult>;
+//# sourceMappingURL=spawn-claude.d.ts.map

package/dist/skill-test/spawn-claude.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-claude.d.ts","sourceRoot":"","sources":["../../src/skill-test/spawn-claude.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,EAAE,CAgBlE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,CA4C1F"}

package/dist/skill-test/spawn-claude.js

@@ -0,0 +1,77 @@
+import { spawn } from 'node:child_process';
+import { createReadStream } from 'node:fs';
+import which from 'which';
+/**
+ * Pure assembly of the headless `claude -p` argv (spec §9). The prompt is read
+ * from a file via the prompt-file flag — never inlined as an argv string
+ * (Windows cmd-quoting safety). `--setting-sources ""` suppresses user/project
+ * settings; built-in skills remain (§5).
+ */
+export function assembleClaudeArgs(opts) {
+    const args = [
+        '-p',
+        '--output-format', 'stream-json',
+        '--setting-sources', '',
+        '--permission-mode', 'bypassPermissions',
+        '--add-dir', opts.sandboxDir,
+        '--prompt-file', opts.promptFile,
+    ];
+    for (const dir of opts.pluginDirs) {
+        args.push('--plugin-dir', dir);
+    }
+    if (opts.model !== undefined)
+        args.push('--model', opts.model);
+    if (opts.maxTurns !== undefined)
+        args.push('--max-turns', String(opts.maxTurns));
+    if (opts.maxBudgetUsd !== undefined)
+        args.push('--max-budget-usd', String(opts.maxBudgetUsd));
+    return args;
+}
+/**
+ * Spawn the headless `claude`. stdin is redirected from the OS null device so
+ * the session cannot block on input (§16). Wall-clock kill on timeout.
+ * If `stallMs` is set, a resettable stall watchdog kills the child when no
+ * output is received for that duration (stalled: true in result).
+ */
+export async function spawnHeadlessClaude(opts) {
+    const bin = which.sync('claude');
+    const args = assembleClaudeArgs(opts);
+    const nullDevice = process.platform === 'win32' ? 'NUL' : '/dev/null';
+    return await new Promise((resolve, reject) => {
+        const child = spawn(bin, args, { cwd: opts.cwd, env: opts.env, stdio: ['pipe', 'pipe', 'pipe'] });
+        let timedOut = false;
+        let stalled = false;
+        const wallTimer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGKILL');
+        }, opts.timeoutMs);
+        // Stall watchdog: reset on every stdout/stderr chunk; fire if silent for stallMs.
+        let stallTimer;
+        if (opts.stallMs !== undefined) {
+            const stallMs = opts.stallMs;
+            const resetStallTimer = () => {
+                if (stallTimer !== undefined)
+                    clearTimeout(stallTimer);
+                stallTimer = setTimeout(() => {
+                    stalled = true;
+                    child.kill('SIGKILL');
+                }, stallMs);
+            };
+            resetStallTimer();
+            child.stdout.on('data', () => { resetStallTimer(); });
+            child.stderr.on('data', () => { resetStallTimer(); });
+        }
+        const clearAllTimers = () => {
+            clearTimeout(wallTimer);
+            if (stallTimer !== undefined)
+                clearTimeout(stallTimer);
+        };
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
+        createReadStream(nullDevice).pipe(child.stdin);
+        child.stdout.on('data', (d) => { opts.onStdout?.(d.toString()); });
+        child.stderr.on('data', (d) => { opts.onStderr?.(d.toString()); });
+        child.on('error', err => { clearAllTimers(); reject(err); });
+        child.on('close', code => { clearAllTimers(); resolve({ status: code ?? -1, timedOut, stalled }); });
+    });
+}
+//# sourceMappingURL=spawn-claude.js.map

package/dist/skill-test/spawn-claude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-claude.js","sourceRoot":"","sources":["../../src/skill-test/spawn-claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,KAAK,MAAM,OAAO,CAAC;AAW1B;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,MAAM,IAAI,GAAa;QACrB,IAAI;QACJ,iBAAiB,EAAE,aAAa;QAChC,mBAAmB,EAAE,EAAE;QACvB,mBAAmB,EAAE,mBAAmB;QACxC,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,eAAe,EAAE,IAAI,CAAC,UAAU;KACjC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC;AACd,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAA0B;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;IAEtE,OAAO,MAAM,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,kFAAkF;QAClF,IAAI,UAAqD,CAAC;QAC1D,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAC7B,MAAM,eAAe,GAAG,GAAS,EAAE;gBACjC,IAAI,UAAU,KAAK,SAAS;oBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;gBACvD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC3B,OAAO,GAAG,IAAI,CAAC;oBACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC,EAAE,OAAO,CAAC,CAAC;YACd,CAAC,CAAC;YACF,eAAe,EAAE,CAAC;YAElB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,cAAc,GAAG,GAAS,EAAE;YAChC,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,UAAU,KAAK,SAAS;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,mEAAmE;QACnE,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/utils",
-  "version": "0.1.39-rc.6",
+  "version": "0.1.39-rc.7",
   "type": "module",
   "description": "Core utility functions with no external dependencies",
   "keywords": [