npm - @vicoa/cli - Versions diffs - 1.6.2-win32-x64 → 1.6.2 - Mend

@vicoa/cli 1.6.2-win32-x64 → 1.6.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (318) hide show

package/bin/_internal/integrations/github/claude-code-action/docs/faq.md DELETED Viewed

@@ -1,205 +0,0 @@
-# Frequently Asked Questions (FAQ)
-This FAQ addresses common questions and gotchas when using the Claude Code GitHub Action.
-## Triggering and Authentication
-### Why doesn't tagging @claude from my automated workflow work?
-The `github-actions` user cannot trigger subsequent GitHub Actions workflows. This is a GitHub security feature to prevent infinite loops. To make this work, you need to use a Personal Access Token (PAT) instead, which will act as a regular user, or use a separate app token of your own. When posting a comment on an issue or PR from your workflow, use your PAT instead of the `GITHUB_TOKEN` generated in your workflow.
-### Why does Claude say I don't have permission to trigger it?
-Only users with **write permissions** to the repository can trigger Claude. This is a security feature to prevent unauthorized use. Make sure the user commenting has at least write access to the repository.
-### Why can't I assign @claude to an issue on my repository?
-If you're in a public repository, you should be able to assign to Claude without issue. If it's a private organization repository, you can only assign to users in your own organization, which Claude isn't. In this case, you'll need to make a custom user in that case.
-### Why am I getting OIDC authentication errors?
-If you're using the default GitHub App authentication, you must add the `id-token: write` permission to your workflow:
-```yaml
-permissions:
-  contents: read
-  id-token: write # Required for OIDC authentication
-```
-The OIDC token is required in order for the Claude GitHub app to function. If you wish to not use the GitHub app, you can instead provide a `github_token` input to the action for Claude to operate with. See the [Claude Code permissions documentation][perms] for more.
-## Claude's Capabilities and Limitations
-### Why won't Claude update workflow files when I ask it to?
-The GitHub App for Claude doesn't have workflow write access for security reasons. This prevents Claude from modifying CI/CD configurations that could potentially create unintended consequences. This is something we may reconsider in the future.
-### Why won't Claude rebase my branch?
-By default, Claude only uses commit tools for non-destructive changes to the branch. Claude is configured to:
-- Never push to branches other than where it was invoked (either its own branch or the PR branch)
-- Never force push or perform destructive operations
-You can grant additional tools via the `claude_args` input if needed:
-```yaml
-claude_args: |
-  --allowedTools "Bash(git rebase:*)"  # Use with caution
-```
-### Why won't Claude create a pull request?
-Claude doesn't create PRs by default. Instead, it pushes commits to a branch and provides a link to a pre-filled PR submission page. This approach ensures your repository's branch protection rules are still adhered to and gives you final control over PR creation.
-### Can Claude see my GitHub Actions CI results?
-Yes! Claude can access GitHub Actions workflow runs, job logs, and test results on the PR where it's tagged. To enable this:
-1. Add `actions: read` permission to your workflow:
-   ```yaml
-   permissions:
-     contents: write
-     pull-requests: write
-     issues: write
-     actions: read
-   ```
-2. Configure the action with additional permissions:
-   ```yaml
-   - uses: anthropics/claude-code-action@v1
-     with:
-       additional_permissions: |
-         actions: read
-   ```
-Claude will then be able to analyze CI failures and help debug workflow issues. For running tests locally before commits, you can still instruct Claude to do so in your request.
-### Why does Claude only update one comment instead of creating new ones?
-Claude is configured to update a single comment to avoid cluttering PR/issue discussions. All of Claude's responses, including progress updates and final results, will appear in the same comment with checkboxes showing task progress.
-## Branch and Commit Behavior
-### Why did Claude create a new branch when commenting on a closed PR?
-Claude's branch behavior depends on the context:
-- **Open PRs**: Pushes directly to the existing PR branch
-- **Closed/Merged PRs**: Creates a new branch (cannot push to closed PR branches)
-- **Issues**: Always creates a new branch with a timestamp
-### Why are my commits shallow/missing history?
-For performance, Claude uses shallow clones:
-- PRs: `--depth=20` (last 20 commits)
-- New branches: `--depth=1` (single commit)
-If you need full history, you can configure this in your workflow before calling Claude in the `actions/checkout` step.
-```
-- uses: actions/checkout@v4
-  depth: 0 # will fetch full repo history
-```
-## Configuration and Tools
-### How does automatic mode detection work?
-The action intelligently detects whether to run in interactive mode or automation mode:
-- **With `prompt` input**: Runs in automation mode - executes immediately without waiting for @claude mentions
-- **Without `prompt` input**: Runs in interactive mode - waits for @claude mentions in comments
-This automatic detection eliminates the need to manually configure modes.
-Example:
-```yaml
-# Automation mode - runs automatically
-prompt: "Review this PR for security vulnerabilities"
-# Interactive mode - waits for @claude mention
-# (no prompt provided)
-```
-### What happened to `direct_prompt` and `custom_instructions`?
-**These inputs are deprecated in v1.0:**
-- **`direct_prompt`** → Use `prompt` instead
-- **`custom_instructions`** → Use `claude_args` with `--system-prompt`
-Migration examples:
-```yaml
-# Old (v0.x)
-direct_prompt: "Review this PR"
-custom_instructions: "Focus on security"
-# New (v1.0)
-prompt: "Review this PR"
-claude_args: |
-  --system-prompt "Focus on security"
-```
-### Why doesn't Claude execute my bash commands?
-The Bash tool is **disabled by default** for security. To enable individual bash commands using `claude_args`:
-```yaml
-claude_args: |
-  --allowedTools "Bash(npm:*),Bash(git:*)"  # Allows only npm and git commands
-```
-### Can Claude work across multiple repositories?
-No, Claude's GitHub app token is sandboxed to the current repository only. It cannot push to any other repositories. It can, however, read public repositories, but to get access to this, you must configure it with tools to do so.
-### Why aren't comments posted as claude[bot]?
-Comments appear as claude[bot] when the action uses its built-in authentication. However, if you provide a `github_token` in your workflow, the action will use that token's authentication instead, causing comments to appear under a different username.
-**Solution**: Remove `github_token` from your workflow file unless you're using a custom GitHub App.
-**Note**: The `use_sticky_comment` feature only works with claude[bot] authentication. If you're using a custom `github_token`, sticky comments won't update properly since they expect the claude[bot] username.
-## MCP Servers and Extended Functionality
-### What MCP servers are available by default?
-Claude Code Action automatically configures two MCP servers:
-1. **GitHub MCP server**: For GitHub API operations
-2. **File operations server**: For advanced file manipulation
-However, tools from these servers still need to be explicitly allowed via `claude_args` with `--allowedTools`.
-## Troubleshooting
-### How can I debug what Claude is doing?
-Check the GitHub Action log for Claude's run for the full execution trace.
-### Why can't I trigger Claude with `@claude-mention` or `claude!`?
-The trigger uses word boundaries, so `@claude` must be a complete word. Variations like `@claude-bot`, `@claude!`, or `claude@mention` won't work unless you customize the `trigger_phrase`.
-## Best Practices
-1. **Always specify permissions explicitly** in your workflow file
-2. **Use GitHub Secrets** for API keys - never hardcode them
-3. **Be specific with tool permissions** - only enable what's necessary via `claude_args`
-4. **Test in a separate branch** before using on important PRs
-5. **Monitor Claude's token usage** to avoid hitting API limits
-6. **Review Claude's changes** carefully before merging
-## Getting Help
-If you encounter issues not covered here:
-1. Check the [GitHub Issues](https://github.com/anthropics/claude-code-action/issues)
-2. Review the [example workflows](https://github.com/anthropics/claude-code-action#examples)
-[perms]: https://docs.anthropic.com/en/docs/claude-code/settings#permissions

package/bin/_internal/integrations/github/claude-code-action/docs/migration-guide.md DELETED Viewed

@@ -1,261 +0,0 @@
-# Migration Guide: v0.x to v1.0
-This guide helps you migrate from Claude Code Action v0.x to v1.0. The new version introduces intelligent mode detection and simplified configuration while maintaining backward compatibility for most use cases.
-## Overview of Changes
-### 🎯 Key Improvements in v1.0
-1. **Automatic Mode Detection** - No more manual `mode` configuration
-2. **Simplified Configuration** - Unified `prompt` and `claude_args` inputs
-3. **Better SDK Alignment** - Closer integration with Claude Code CLI
-### ⚠️ Breaking Changes
-The following inputs have been deprecated and replaced:
-| Deprecated Input      | Replacement                      | Notes                                         |
-| --------------------- | -------------------------------- | --------------------------------------------- |
-| `mode`                | Auto-detected                    | Action automatically chooses based on context |
-| `direct_prompt`       | `prompt`                         | Direct drop-in replacement                    |
-| `override_prompt`     | `prompt`                         | Use GitHub context variables instead          |
-| `custom_instructions` | `claude_args: --system-prompt`   | Move to CLI arguments                         |
-| `max_turns`           | `claude_args: --max-turns`       | Use CLI format                                |
-| `model`               | `claude_args: --model`           | Specify via CLI                               |
-| `allowed_tools`       | `claude_args: --allowedTools`    | Use CLI format                                |
-| `disallowed_tools`    | `claude_args: --disallowedTools` | Use CLI format                                |
-| `claude_env`          | `settings` with env object       | Use settings JSON                             |
-| `mcp_config`          | `claude_args: --mcp-config`      | Pass MCP config via CLI arguments             |
-## Migration Examples
-### Basic Interactive Workflow (@claude mentions)
-**Before (v0.x):**
-```yaml
-- uses: anthropics/claude-code-action@beta
-  with:
-    mode: "tag"
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-    custom_instructions: "Follow our coding standards"
-    max_turns: "10"
-    allowed_tools: "Edit,Read,Write"
-```
-**After (v1.0):**
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-    claude_args: |
-      --max-turns 10
-      --system-prompt "Follow our coding standards"
-      --allowedTools Edit,Read,Write
-```
-### Automation Workflow
-**Before (v0.x):**
-```yaml
-- uses: anthropics/claude-code-action@beta
-  with:
-    mode: "agent"
-    direct_prompt: "Review this PR for security issues"
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-    model: "claude-3-5-sonnet-20241022"
-    allowed_tools: "Edit,Read,Write"
-```
-**After (v1.0):**
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    prompt: "Review this PR for security issues"
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-    claude_args: |
-      --model claude-4-0-sonnet-20250805
-      --allowedTools Edit,Read,Write
-```
-### Custom Template with Variables
-**Before (v0.x):**
-```yaml
-- uses: anthropics/claude-code-action@beta
-  with:
-    override_prompt: |
-      Analyze PR #$PR_NUMBER in $REPOSITORY
-      Changed files: $CHANGED_FILES
-      Focus on security vulnerabilities
-```
-**After (v1.0):**
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    prompt: |
-      Analyze PR #${{ github.event.pull_request.number }} in ${{ github.repository }}
-      Focus on security vulnerabilities in the changed files
-```
-### Environment Variables
-**Before (v0.x):**
-```yaml
-- uses: anthropics/claude-code-action@beta
-  with:
-    claude_env: |
-      NODE_ENV: test
-      CI: true
-```
-**After (v1.0):**
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    settings: |
-      {
-        "env": {
-          "NODE_ENV": "test",
-          "CI": "true"
-        }
-      }
-```
-## How Mode Detection Works
-The action now automatically detects the appropriate mode:
-1. **If `prompt` is provided** → Runs in **automation mode**
-   - Executes immediately without waiting for @claude mentions
-   - Perfect for scheduled tasks, PR automation, etc.
-2. **If no `prompt` but @claude is mentioned** → Runs in **interactive mode**
-   - Waits for and responds to @claude mentions
-   - Creates tracking comments with progress
-3. **If neither** → No action is taken
-## Advanced Configuration with claude_args
-The `claude_args` input provides direct access to Claude Code CLI arguments:
-```yaml
-claude_args: |
-  --max-turns 15
-  --model claude-4-0-sonnet-20250805
-  --allowedTools Edit,Read,Write,Bash
-  --disallowedTools WebSearch
-  --system-prompt "You are a senior engineer focused on code quality"
-  --mcp-config '{"mcpServers": {"custom": {"command": "npx", "args": ["-y", "@example/server"]}}}'
-```
-### Common claude_args Options
-| Option              | Description              | Example                                |
-| ------------------- | ------------------------ | -------------------------------------- |
-| `--max-turns`       | Limit conversation turns | `--max-turns 10`                       |
-| `--model`           | Specify Claude model     | `--model claude-4-0-sonnet-20250805`   |
-| `--allowedTools`    | Enable specific tools    | `--allowedTools Edit,Read,Write`       |
-| `--disallowedTools` | Disable specific tools   | `--disallowedTools WebSearch`          |
-| `--system-prompt`   | Add system instructions  | `--system-prompt "Focus on security"`  |
-| `--mcp-config`      | Add MCP server config    | `--mcp-config '{"mcpServers": {...}}'` |
-## Provider-Specific Updates
-### AWS Bedrock
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    use_bedrock: "true"
-    claude_args: |
-      --model anthropic.claude-4-0-sonnet-20250805-v1:0
-```
-### Google Vertex AI
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    use_vertex: "true"
-    claude_args: |
-      --model claude-4-0-sonnet@20250805
-```
-## MCP Configuration Migration
-### Adding Custom MCP Servers
-**Before (v0.x):**
-```yaml
-- uses: anthropics/claude-code-action@beta
-  with:
-    mcp_config: |
-      {
-        "mcpServers": {
-          "custom-server": {
-            "command": "npx",
-            "args": ["-y", "@example/server"]
-          }
-        }
-      }
-```
-**After (v1.0):**
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    claude_args: |
-      --mcp-config '{"mcpServers": {"custom-server": {"command": "npx", "args": ["-y", "@example/server"]}}}'
-```
-You can also pass MCP configuration from a file:
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    claude_args: |
-      --mcp-config /path/to/mcp-config.json
-```
-## Step-by-Step Migration Checklist
-- [ ] Update action version from `@beta` to `@v1`
-- [ ] Remove `mode` input (auto-detected now)
-- [ ] Replace `direct_prompt` with `prompt`
-- [ ] Replace `override_prompt` with `prompt` using GitHub context
-- [ ] Move `custom_instructions` to `claude_args` with `--system-prompt`
-- [ ] Convert `max_turns` to `claude_args` with `--max-turns`
-- [ ] Convert `model` to `claude_args` with `--model`
-- [ ] Convert `allowed_tools` to `claude_args` with `--allowedTools`
-- [ ] Convert `disallowed_tools` to `claude_args` with `--disallowedTools`
-- [ ] Move `claude_env` to `settings` JSON format
-- [ ] Move `mcp_config` to `claude_args` with `--mcp-config`
-- [ ] Test workflow in a non-production environment
-## Getting Help
-If you encounter issues during migration:
-1. Check the [FAQ](./faq.md) for common questions
-2. Review [example workflows](../examples/) for reference
-3. Open an [issue](https://github.com/anthropics/claude-code-action/issues) for support
-## Version Compatibility
-- **v0.x workflows** will continue to work but with deprecation warnings
-- **v1.0** is the recommended version for all new workflows
-- Future versions may remove deprecated inputs entirely

package/bin/_internal/integrations/github/claude-code-action/docs/security.md DELETED Viewed

@@ -1,38 +0,0 @@
-# Security
-## Access Control
-- **Repository Access**: The action can only be triggered by users with write access to the repository
-- **Bot User Control**: By default, GitHub Apps and bots cannot trigger this action for security reasons. Use the `allowed_bots` parameter to enable specific bots or all bots
-- **Token Permissions**: The GitHub app receives only a short-lived token scoped specifically to the repository it's operating in
-- **No Cross-Repository Access**: Each action invocation is limited to the repository where it was triggered
-- **Limited Scope**: The token cannot access other repositories or perform actions beyond the configured permissions
-## GitHub App Permissions
-The [Claude Code GitHub app](https://github.com/apps/claude) requires these permissions:
-- **Pull Requests**: Read and write to create PRs and push changes
-- **Issues**: Read and write to respond to issues
-- **Contents**: Read and write to modify repository files
-## Commit Signing
-All commits made by Claude through this action are automatically signed with commit signatures. This ensures the authenticity and integrity of commits, providing a verifiable trail of changes made by the action.
-## ⚠️ Authentication Protection
-**CRITICAL: Never hardcode your Anthropic API key or OAuth token in workflow files!**
-Your authentication credentials must always be stored in GitHub secrets to prevent unauthorized access:
-```yaml
-# CORRECT ✅
-anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-# OR
-claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-# NEVER DO THIS ❌
-anthropic_api_key: "sk-ant-api03-..." # Exposed and vulnerable!
-claude_code_oauth_token: "oauth_token_..." # Exposed and vulnerable!
-```

package/bin/_internal/integrations/github/claude-code-action/docs/setup.md DELETED Viewed

@@ -1,146 +0,0 @@
-# Setup Guide
-## Manual Setup (Direct API)
-**Requirements**: You must be a repository admin to complete these steps.
-1. Install the Claude GitHub app to your repository: https://github.com/apps/claude
-2. Add authentication to your repository secrets ([Learn how to use secrets in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions)):
-   - Either `ANTHROPIC_API_KEY` for API key authentication
-   - Or `CLAUDE_CODE_OAUTH_TOKEN` for OAuth token authentication (Pro and Max users can generate this by running `claude setup-token` locally)
-3. Copy the workflow file from [`examples/claude.yml`](../examples/claude.yml) into your repository's `.github/workflows/`
-## Using a Custom GitHub App
-If you prefer not to install the official Claude app, you can create your own GitHub App to use with this action. This gives you complete control over permissions and access.
-**When you may want to use a custom GitHub App:**
-- You need more restrictive permissions than the official app
-- Organization policies prevent installing third-party apps
-- You're using AWS Bedrock or Google Vertex AI
-**Steps to create and use a custom GitHub App:**
-1. **Create a new GitHub App:**
-   - Go to https://github.com/settings/apps (for personal apps) or your organization's settings
-   - Click "New GitHub App"
-   - Configure the app with these minimum permissions:
-     - **Repository permissions:**
-       - Contents: Read & Write
-       - Issues: Read & Write
-       - Pull requests: Read & Write
-     - **Account permissions:** None required
-   - Set "Where can this GitHub App be installed?" to your preference
-   - Create the app
-2. **Generate and download a private key:**
-   - After creating the app, scroll down to "Private keys"
-   - Click "Generate a private key"
-   - Download the `.pem` file (keep this secure!)
-3. **Install the app on your repository:**
-   - Go to the app's settings page
-   - Click "Install App"
-   - Select the repositories where you want to use Claude
-4. **Add the app credentials to your repository secrets:**
-   - Go to your repository's Settings → Secrets and variables → Actions
-   - Add these secrets:
-     - `APP_ID`: Your GitHub App's ID (found in the app settings)
-     - `APP_PRIVATE_KEY`: The contents of the downloaded `.pem` file
-5. **Update your workflow to use the custom app:**
-   ```yaml
-   name: Claude with Custom App
-   on:
-     issue_comment:
-       types: [created]
-     # ... other triggers
-   jobs:
-     claude-response:
-       runs-on: ubuntu-latest
-       steps:
-         # Generate a token from your custom app
-         - name: Generate GitHub App token
-           id: app-token
-           uses: actions/create-github-app-token@v1
-           with:
-             app-id: ${{ secrets.APP_ID }}
-             private-key: ${{ secrets.APP_PRIVATE_KEY }}
-         # Use Claude with your custom app's token
-         - uses: anthropics/claude-code-action@beta
-           with:
-             anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-             github_token: ${{ steps.app-token.outputs.token }}
-             # ... other configuration
-   ```
-**Important notes:**
-- The custom app must have read/write permissions for Issues, Pull Requests, and Contents
-- Your app's token will have the exact permissions you configured, nothing more
-For more information on creating GitHub Apps, see the [GitHub documentation](https://docs.github.com/en/apps/creating-github-apps).
-## Security Best Practices
-**⚠️ IMPORTANT: Never commit API keys directly to your repository! Always use GitHub Actions secrets.**
-To securely use your Anthropic API key:
-1. Add your API key as a repository secret:
-   - Go to your repository's Settings
-   - Navigate to "Secrets and variables" → "Actions"
-   - Click "New repository secret"
-   - Name it `ANTHROPIC_API_KEY`
-   - Paste your API key as the value
-2. Reference the secret in your workflow:
-   ```yaml
-   anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-   ```
-**Never do this:**
-```yaml
-# ❌ WRONG - Exposes your API key
-anthropic_api_key: "sk-ant-..."
-```
-**Always do this:**
-```yaml
-# ✅ CORRECT - Uses GitHub secrets
-anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-```
-This applies to all sensitive values including API keys, access tokens, and credentials.
-We also recommend that you always use short-lived tokens when possible
-## Setting Up GitHub Secrets
-1. Go to your repository's Settings
-2. Click on "Secrets and variables" → "Actions"
-3. Click "New repository secret"
-4. For authentication, choose one:
-   - API Key: Name: `ANTHROPIC_API_KEY`, Value: Your Anthropic API key (starting with `sk-ant-`)
-   - OAuth Token: Name: `CLAUDE_CODE_OAUTH_TOKEN`, Value: Your Claude Code OAuth token (Pro and Max users can generate this by running `claude setup-token` locally)
-5. Click "Add secret"
-### Best Practices for Authentication
-1. ✅ Always use `${{ secrets.ANTHROPIC_API_KEY }}` or `${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}` in workflows
-2. ✅ Never commit API keys or tokens to version control
-3. ✅ Regularly rotate your API keys and tokens
-4. ✅ Use environment secrets for organization-wide access
-5. ❌ Never share API keys or tokens in pull requests or issues
-6. ❌ Avoid logging workflow variables that might contain keys