@vm0/cli 9.19.0 → 9.20.0

package/index.js

@@ -236,9 +236,9 @@ var infoCommand = new Command6().name("info").description("Display environment i
 // src/commands/compose/index.ts
 import { Command as Command7, Option } from "commander";
 import chalk4 from "chalk";
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile4, rm as rm3 } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
-import { dirname as dirname2 } from "path";
+import { dirname as dirname2, join as join6 } from "path";
 import { parse as parseYaml2 } from "yaml";
 
 // ../../packages/core/src/variable-expander.ts
@@ -4447,11 +4447,6 @@ function validateAgentCompose(config) {
   return { valid: true };
 }
 
-// src/lib/storage/system-storage.ts
-import * as fs4 from "fs/promises";
-import * as path4 from "path";
-import * as os3 from "os";
-
 // src/lib/domain/github-skills.ts
 import * as fs from "fs/promises";
 import * as path from "path";
@@ -4494,6 +4489,49 @@ async function downloadGitHubSkill(parsed, destDir) {
     await fs.rm(tempDir, { recursive: true, force: true });
   }
 }
+async function downloadGitHubDirectory(url) {
+  const parsed = parseGitHubTreeUrl2(url);
+  const repoUrl = `https://github.com/${parsed.owner}/${parsed.repo}.git`;
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "vm0-github-"));
+  try {
+    try {
+      await execAsync("git --version");
+    } catch {
+      throw new Error(
+        "git command not found. Please install git to use GitHub URLs."
+      );
+    }
+    await execAsync(`git init`, { cwd: tempDir });
+    await execAsync(`git remote add origin "${repoUrl}"`, { cwd: tempDir });
+    await execAsync(`git config core.sparseCheckout true`, { cwd: tempDir });
+    const sparseFile = path.join(tempDir, ".git", "info", "sparse-checkout");
+    await fs.writeFile(sparseFile, parsed.path + "\n");
+    try {
+      await execAsync(`git fetch --depth 1 origin "${parsed.branch}"`, {
+        cwd: tempDir
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("Authentication failed") || message.includes("could not read Username")) {
+        throw new Error(`Cannot access repository. Is it private? URL: ${url}`);
+      }
+      if (message.includes("couldn't find remote ref")) {
+        throw new Error(
+          `Branch "${parsed.branch}" not found in repository: ${url}`
+        );
+      }
+      throw error;
+    }
+    await execAsync(`git checkout "${parsed.branch}"`, { cwd: tempDir });
+    return {
+      dir: path.join(tempDir, parsed.path),
+      tempRoot: tempDir
+    };
+  } catch (error) {
+    await fs.rm(tempDir, { recursive: true, force: true });
+    throw error;
+  }
+}
 async function validateSkillDirectory(skillDir) {
   const skillMdPath = path.join(skillDir, "SKILL.md");
   try {
@@ -4536,6 +4574,11 @@ async function readSkillFrontmatter(skillDir) {
   return parseSkillFrontmatter(content);
 }
 
+// src/lib/storage/system-storage.ts
+import * as fs4 from "fs/promises";
+import * as path4 from "path";
+import * as os3 from "os";
+
 // src/lib/storage/direct-upload.ts
 import { createHash } from "crypto";
 import * as fs3 from "fs";
@@ -5164,6 +5207,9 @@ async function silentUpgradeAfterCommand(currentVersion) {
 
 // src/commands/compose/index.ts
 var DEFAULT_CONFIG_FILE = "vm0.yaml";
+function isGitHubTreeUrl(input) {
+  return input.startsWith("https://github.com/") && input.includes("/tree/");
+}
 function getSecretsFromComposeContent(content) {
   const refs = extractVariableReferences(content);
   const grouped = groupVariablesBySource(refs);
@@ -5197,6 +5243,14 @@ async function loadAndValidateConfig(configFile) {
   const basePath = dirname2(configFile);
   return { config, agentName, agent, basePath };
 }
+function hasVolumes(config) {
+  if (typeof config !== "object" || config === null) {
+    return false;
+  }
+  const cfg = config;
+  const volumes = cfg.volumes;
+  return typeof volumes === "object" && volumes !== null && Object.keys(volumes).length > 0;
+}
 function checkLegacyImageFormat(config) {
   const cfg = config;
   const agentsConfig = cfg.agents;
@@ -5346,47 +5400,140 @@ function mergeSkillVariables(agent, variables) {
     agent.environment = environment;
   }
 }
+async function finalizeCompose(config, agent, variables, options) {
+  const confirmed = await displayAndConfirmVariables(variables, options);
+  if (!confirmed) {
+    process.exit(0);
+  }
+  mergeSkillVariables(agent, variables);
+  console.log("Uploading compose...");
+  const response = await createOrUpdateCompose({ content: config });
+  const scopeResponse = await getScope();
+  const shortVersionId = response.versionId.slice(0, 8);
+  const displayName = `${scopeResponse.slug}/${response.name}`;
+  if (response.action === "created") {
+    console.log(chalk4.green(`\u2713 Compose created: ${displayName}`));
+  } else {
+    console.log(chalk4.green(`\u2713 Compose version exists: ${displayName}`));
+  }
+  console.log(chalk4.dim(`  Version: ${shortVersionId}`));
+  console.log();
+  console.log("  Run your agent:");
+  console.log(
+    chalk4.cyan(
+      `    vm0 run ${displayName}:${shortVersionId} --artifact-name <artifact> "your prompt"`
+    )
+  );
+  if (options.autoUpdate !== false) {
+    await silentUpgradeAfterCommand("9.20.0");
+  }
+}
+async function handleGitHubCompose(url, options) {
+  console.log(`Downloading from GitHub: ${url}`);
+  const { dir: downloadedDir, tempRoot } = await downloadGitHubDirectory(url);
+  const configFile = join6(downloadedDir, "vm0.yaml");
+  try {
+    if (!existsSync4(configFile)) {
+      console.error(chalk4.red(`\u2717 vm0.yaml not found in the GitHub directory`));
+      console.error(chalk4.dim(`  URL: ${url}`));
+      process.exit(1);
+    }
+    const { config, agentName, agent, basePath } = await loadAndValidateConfig(configFile);
+    const existingCompose = await getComposeByName(agentName);
+    if (existingCompose) {
+      console.log();
+      console.log(
+        chalk4.yellow(`\u26A0 An agent named "${agentName}" already exists.`)
+      );
+      if (!isInteractive()) {
+        if (!options.yes) {
+          console.error(
+            chalk4.red(
+              `\u2717 Cannot overwrite existing agent in non-interactive mode`
+            )
+          );
+          console.error(
+            chalk4.dim(
+              `  Use --yes flag to confirm overwriting the existing agent.`
+            )
+          );
+          process.exit(1);
+        }
+      } else {
+        const confirmed = await promptConfirm(
+          "Do you want to overwrite it?",
+          false
+        );
+        if (!confirmed) {
+          console.log(chalk4.yellow("Compose cancelled."));
+          process.exit(0);
+        }
+      }
+    }
+    if (hasVolumes(config)) {
+      console.error(
+        chalk4.red(`\u2717 Volumes are not supported for GitHub URL compose`)
+      );
+      console.error(
+        chalk4.dim(
+          `  Clone the repository locally and run: vm0 compose ./path/to/vm0.yaml`
+        )
+      );
+      process.exit(1);
+    }
+    checkLegacyImageFormat(config);
+    const skillResults = await uploadAssets(agentName, agent, basePath);
+    const environment = agent.environment || {};
+    const variables = await collectSkillVariables(
+      skillResults,
+      environment,
+      agentName
+    );
+    await finalizeCompose(config, agent, variables, options);
+  } finally {
+    await rm3(tempRoot, { recursive: true, force: true });
+  }
+}
 var composeCommand = new Command7().name("compose").description("Create or update agent compose (e.g., vm0.yaml)").argument(
   "[agent-yaml]",
-  `Path to agent YAML file (default: ${DEFAULT_CONFIG_FILE})`
-).option("-y, --yes", "Skip confirmation prompts for skill requirements").addOption(new Option("--no-auto-update").hideHelp()).action(
+  `Path to agent YAML file or GitHub tree URL (default: ${DEFAULT_CONFIG_FILE})`
+).option("-y, --yes", "Skip confirmation prompts for skill requirements").option(
+  "--experimental-shared-compose",
+  "Enable GitHub URL compose (experimental)"
+).addOption(new Option("--no-auto-update").hideHelp()).action(
   async (configFile, options) => {
     const resolvedConfigFile = configFile ?? DEFAULT_CONFIG_FILE;
     try {
-      const { config, agentName, agent, basePath } = await loadAndValidateConfig(resolvedConfigFile);
-      checkLegacyImageFormat(config);
-      const skillResults = await uploadAssets(agentName, agent, basePath);
-      const environment = agent.environment || {};
-      const variables = await collectSkillVariables(
-        skillResults,
-        environment,
-        agentName
-      );
-      const confirmed = await displayAndConfirmVariables(variables, options);
-      if (!confirmed) {
-        process.exit(0);
-      }
-      mergeSkillVariables(agent, variables);
-      console.log("Uploading compose...");
-      const response = await createOrUpdateCompose({ content: config });
-      const scopeResponse = await getScope();
-      const shortVersionId = response.versionId.slice(0, 8);
-      const displayName = `${scopeResponse.slug}/${response.name}`;
-      if (response.action === "created") {
-        console.log(chalk4.green(`\u2713 Compose created: ${displayName}`));
+      if (isGitHubTreeUrl(resolvedConfigFile)) {
+        if (!options.experimentalSharedCompose) {
+          console.error(
+            chalk4.red(
+              "\u2717 Composing shared agents requires --experimental-shared-compose flag"
+            )
+          );
+          console.error();
+          console.error(
+            chalk4.dim(
+              "  Composing agents from other users carries security risks."
+            )
+          );
+          console.error(
+            chalk4.dim("  Only compose agents from users you trust.")
+          );
+          process.exit(1);
+        }
+        await handleGitHubCompose(resolvedConfigFile, options);
       } else {
-        console.log(chalk4.green(`\u2713 Compose version exists: ${displayName}`));
-      }
-      console.log(chalk4.dim(`  Version: ${shortVersionId}`));
-      console.log();
-      console.log("  Run your agent:");
-      console.log(
-        chalk4.cyan(
-          `    vm0 run ${displayName}:${shortVersionId} --artifact-name <artifact> "your prompt"`
-        )
-      );
-      if (options.autoUpdate !== false) {
-        await silentUpgradeAfterCommand("9.19.0");
+        const { config, agentName, agent, basePath } = await loadAndValidateConfig(resolvedConfigFile);
+        checkLegacyImageFormat(config);
+        const skillResults = await uploadAssets(agentName, agent, basePath);
+        const environment = agent.environment || {};
+        const variables = await collectSkillVariables(
+          skillResults,
+          environment,
+          agentName
+        );
+        await finalizeCompose(config, agent, variables, options);
       }
     } catch (error) {
       if (error instanceof Error) {
@@ -7544,10 +7691,39 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
 ).option(
   "--model-provider <type>",
   "Override model provider (e.g., anthropic-api-key)"
-).option("--verbose", "Show full tool inputs and outputs").addOption(new Option2("--debug-no-mock-claude").hideHelp()).addOption(new Option2("--no-auto-update").hideHelp()).action(
+).option("--verbose", "Show full tool inputs and outputs").option(
+  "--experimental-shared-agent",
+  "Allow running agents shared by other users (required when running scope/agent format)"
+).addOption(new Option2("--debug-no-mock-claude").hideHelp()).addOption(new Option2("--no-auto-update").hideHelp()).action(
   async (identifier, prompt, options) => {
     try {
       const { scope, name, version } = parseIdentifier(identifier);
+      if (scope && !options.experimentalSharedAgent) {
+        const userScope = await getScope();
+        const isOwnScope = userScope.slug === scope;
+        if (!isOwnScope) {
+          console.error(
+            chalk9.red(
+              `\u2717 Running shared agents requires --experimental-shared-agent flag`
+            )
+          );
+          console.error();
+          console.error(
+            chalk9.dim(
+              "  Running agent from other users carries security risks."
+            )
+          );
+          console.error(chalk9.dim("  Only run agents from users you trust."));
+          console.error();
+          console.error("Example:");
+          console.error(
+            chalk9.cyan(
+              `  vm0 run ${identifier} --experimental-shared-agent "your prompt"`
+            )
+          );
+          process.exit(1);
+        }
+      }
       let composeId;
       let composeContent;
       if (isUUID(name)) {
@@ -7617,7 +7793,7 @@ var mainRunCommand = new Command8().name("run").description("Run an agent").argu
       }
       showNextSteps(result);
       if (options.autoUpdate !== false) {
-        await silentUpgradeAfterCommand("9.19.0");
+        await silentUpgradeAfterCommand("9.20.0");
       }
     } catch (error) {
       handleRunError(error, identifier);
@@ -8725,11 +8901,11 @@ import { config as dotenvConfig2 } from "dotenv";
 
 // src/lib/domain/cook-state.ts
 import { homedir as homedir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { readFile as readFile6, writeFile as writeFile5, mkdir as mkdir5 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
-var CONFIG_DIR2 = join6(homedir2(), ".vm0");
-var COOK_STATE_FILE = join6(CONFIG_DIR2, "cook.json");
+var CONFIG_DIR2 = join7(homedir2(), ".vm0");
+var COOK_STATE_FILE = join7(CONFIG_DIR2, "cook.json");
 var STALE_THRESHOLD_MS = 48 * 60 * 60 * 1e3;
 async function loadCookStateFile() {
   if (!existsSync7(COOK_STATE_FILE)) {
@@ -9124,7 +9300,7 @@ var cookAction = new Command27().name("cook").description("Quick start: prepare,
 ).option("-y, --yes", "Skip confirmation prompts").option("-v, --verbose", "Show full tool inputs and outputs").addOption(new Option5("--debug-no-mock-claude").hideHelp()).addOption(new Option5("--no-auto-update").hideHelp()).action(
   async (prompt, options) => {
     if (options.autoUpdate !== false) {
-      const shouldExit = await checkAndUpgrade("9.19.0", prompt);
+      const shouldExit = await checkAndUpgrade("9.20.0", prompt);
       if (shouldExit) {
         process.exit(0);
       }
@@ -9705,8 +9881,8 @@ import { Command as Command43 } from "commander";
 import { Command as Command35 } from "commander";
 import chalk36 from "chalk";
 import { mkdtempSync as mkdtempSync5 } from "fs";
-import { mkdir as mkdir7, writeFile as writeFile6, readdir, copyFile, rm as rm3 } from "fs/promises";
-import { join as join7, dirname as dirname3 } from "path";
+import { mkdir as mkdir7, writeFile as writeFile6, readdir, copyFile, rm as rm4 } from "fs/promises";
+import { join as join8, dirname as dirname3 } from "path";
 import { tmpdir as tmpdir7 } from "os";
 import * as tar6 from "tar";
 import { stringify as yamlStringify } from "yaml";
@@ -9742,21 +9918,21 @@ async function downloadInstructions(agentName, instructionsPath, destination) {
     throw new Error(`Failed to download instructions: ${response.status}`);
   }
   const buffer = Buffer.from(await response.arrayBuffer());
-  const tmpDir = mkdtempSync5(join7(tmpdir7(), "vm0-clone-"));
-  const tarPath = join7(tmpDir, "archive.tar.gz");
+  const tmpDir = mkdtempSync5(join8(tmpdir7(), "vm0-clone-"));
+  const tarPath = join8(tmpDir, "archive.tar.gz");
   await writeFile6(tarPath, buffer);
   await tar6.extract({ file: tarPath, cwd: tmpDir, gzip: true });
   const files = await readdir(tmpDir);
   const mdFile = files.find((f) => f === "CLAUDE.md" || f === "AGENTS.md");
   if (!mdFile) {
     console.log(chalk36.yellow("\u26A0 No instructions file found in volume"));
-    await rm3(tmpDir, { recursive: true, force: true });
+    await rm4(tmpDir, { recursive: true, force: true });
     return false;
   }
-  const destPath = join7(destination, instructionsPath);
+  const destPath = join8(destination, instructionsPath);
   await mkdir7(dirname3(destPath), { recursive: true });
-  await copyFile(join7(tmpDir, mdFile), destPath);
-  await rm3(tmpDir, { recursive: true, force: true });
+  await copyFile(join8(tmpDir, mdFile), destPath);
+  await rm4(tmpDir, { recursive: true, force: true });
   return true;
 }
 var cloneCommand3 = new Command35().name("clone").description("Clone agent compose to local directory (latest version)").argument("<name>", "Agent compose name to clone").argument("[destination]", "Destination directory (default: agent name)").action(async (name, destination) => {
@@ -9781,7 +9957,7 @@ var cloneCommand3 = new Command35().name("clone").description("Clone agent compo
     const cleanedContent = cleanComposeContent(content);
     const yamlContent = yamlStringify(cleanedContent);
     await mkdir7(targetDir, { recursive: true });
-    const yamlPath = join7(targetDir, "vm0.yaml");
+    const yamlPath = join8(targetDir, "vm0.yaml");
     await writeFile6(yamlPath, yamlContent, "utf8");
     console.log(chalk36.green("\u2713 Created vm0.yaml"));
     const agentKey = Object.keys(content.agents)[0];
@@ -10122,7 +10298,7 @@ var statusCommand5 = new Command37().name("status").description("Show status of
 // src/commands/agent/public.ts
 import { Command as Command38 } from "commander";
 import chalk39 from "chalk";
-var publicCommand = new Command38().name("public").description("Make an agent public (accessible to all authenticated users)").argument("<name>", "Agent name").action(async (name) => {
+var publicCommand = new Command38().name("experimental-public").description("Make an agent public (accessible to all authenticated users)").argument("<name>", "Agent name").action(async (name) => {
   try {
     const compose = await getComposeByName(name);
     if (!compose) {
@@ -10146,7 +10322,11 @@ var publicCommand = new Command38().name("public").description("Make an agent pu
     console.log(chalk39.green(`\u2713 Agent "${name}" is now public`));
     console.log();
     console.log("Others can now run your agent with:");
-    console.log(chalk39.cyan(`  vm0 run ${fullName} "your prompt"`));
+    console.log(
+      chalk39.cyan(
+        `  vm0 run ${fullName} --experimental-shared-agent "your prompt"`
+      )
+    );
   } catch (error) {
     console.error(chalk39.red("\u2717 Failed to make agent public"));
     if (error instanceof Error) {
@@ -10159,7 +10339,7 @@ var publicCommand = new Command38().name("public").description("Make an agent pu
 // src/commands/agent/private.ts
 import { Command as Command39 } from "commander";
 import chalk40 from "chalk";
-var privateCommand = new Command39().name("private").description("Make an agent private (remove public access)").argument("<name>", "Agent name").action(async (name) => {
+var privateCommand = new Command39().name("experimental-private").description("Make an agent private (remove public access)").argument("<name>", "Agent name").action(async (name) => {
   try {
     const compose = await getComposeByName(name);
     if (!compose) {
@@ -10190,7 +10370,7 @@ var privateCommand = new Command39().name("private").description("Make an agent
 // src/commands/agent/share.ts
 import { Command as Command40 } from "commander";
 import chalk41 from "chalk";
-var shareCommand = new Command40().name("share").description("Share an agent with a user by email").argument("<name>", "Agent name").requiredOption("--email <email>", "Email address to share with").action(async (name, options) => {
+var shareCommand = new Command40().name("experimental-share").description("Share an agent with a user by email").argument("<name>", "Agent name").requiredOption("--email <email>", "Email address to share with").action(async (name, options) => {
   try {
     const compose = await getComposeByName(name);
     if (!compose) {
@@ -10220,7 +10400,11 @@ var shareCommand = new Command40().name("share").description("Share an agent wit
     );
     console.log();
     console.log("They can now run your agent with:");
-    console.log(chalk41.cyan(`  vm0 run ${fullName} "your prompt"`));
+    console.log(
+      chalk41.cyan(
+        `  vm0 run ${fullName} --experimental-shared-agent "your prompt"`
+      )
+    );
   } catch (error) {
     console.error(chalk41.red("\u2717 Failed to share agent"));
     if (error instanceof Error) {
@@ -10233,7 +10417,7 @@ var shareCommand = new Command40().name("share").description("Share an agent wit
 // src/commands/agent/unshare.ts
 import { Command as Command41 } from "commander";
 import chalk42 from "chalk";
-var unshareCommand = new Command41().name("unshare").description("Remove sharing from a user").argument("<name>", "Agent name").requiredOption("--email <email>", "Email address to unshare").action(async (name, options) => {
+var unshareCommand = new Command41().name("experimental-unshare").description("Remove sharing from a user").argument("<name>", "Agent name").requiredOption("--email <email>", "Email address to unshare").action(async (name, options) => {
   try {
     const compose = await getComposeByName(name);
     if (!compose) {
@@ -10268,7 +10452,7 @@ var unshareCommand = new Command41().name("unshare").description("Remove sharing
 // src/commands/agent/permission.ts
 import { Command as Command42 } from "commander";
 import chalk43 from "chalk";
-var permissionCommand = new Command42().name("permission").description("List all permissions for an agent").argument("<name>", "Agent name").action(async (name) => {
+var permissionCommand = new Command42().name("experimental-permission").description("List all permissions for an agent").argument("<name>", "Agent name").action(async (name) => {
   try {
     const compose = await getComposeByName(name);
     if (!compose) {
@@ -13231,7 +13415,7 @@ var setupClaudeCommand = new Command67().name("setup-claude").description("Insta
 
 // src/index.ts
 var program = new Command68();
-program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.19.0");
+program.name("vm0").description("VM0 CLI - Build and run agents with natural language").version("9.20.0");
 program.addCommand(authCommand);
 program.addCommand(infoCommand);
 program.addCommand(composeCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/cli",
-  "version": "9.19.0",
+  "version": "9.20.0",
   "description": "CLI application",
   "repository": {
     "type": "git",