@vosjs/cli 0.75.1 → 0.77.0

package/dist/{chunk-X6NQNBDF.js → chunk-SB622PZM.js}

@@ -9,7 +9,7 @@ import {
   reencodeStill,
   renderStill,
   videoFormat
-} from "./chunk-YZAM4W7B.js";
+} from "./chunk-KDIRW72G.js";
 import {
   PREV_DOC_NAME,
   RECORDING_NAME,
@@ -28,6 +28,7 @@ import {
   readJson,
   readMediaHead,
   recordHostedMedia,
+  safePathName,
   sourceSidecarRefs,
   takeMediaFile,
   takePaths,
@@ -36,7 +37,7 @@ import {
   uploadDocRefs,
   uploadManifest,
   writeJson
-} from "./chunk-M3QIN457.js";
+} from "./chunk-UY2N42P2.js";
 import {
   CREDENTIALS_PATH,
   MEDIA_HEAD_BYTES,
@@ -68,8 +69,9 @@ import {
   sniffMediaType,
   strFlag,
   writeCredential,
+  writeFileSafe,
   writeSyncState
-} from "./chunk-FL3E27WE.js";
+} from "./chunk-B4U4URE3.js";
 import {
   deadLine,
   deadWarns
@@ -366,10 +368,13 @@ var EPS = 1e-3;
 var isNum = (v) => typeof v === "number" && Number.isFinite(v);
 var isObj = (v) => typeof v === "object" && v !== null;
 function htmlFontUrlProblem(url) {
-  if (/^https?:\/\//.test(url)) return null;
+  if (/^https:\/\/assets\.vos\.so\//.test(url)) return null;
   if (/^\/api\/assets\/[^/]+\/file$/.test(url)) return null;
+  if (/^https?:\/\//i.test(url)) {
+    return `names ${url}: a face is fetched from https://assets.vos.so (the host a layer's images are held to), a hosted file (/api/assets/<id>/file) or a .woff2 beside the document, never another host`;
+  }
   if (/^(data:|blob:)/.test(url) || url.startsWith("/")) {
-    return `must be an https URL, a hosted file (/api/assets/<id>/file) or a .woff2 beside the document (got ${url})`;
+    return `must be an https://assets.vos.so URL, a hosted file (/api/assets/<id>/file) or a .woff2 beside the document (got ${url})`;
   }
   if (url.split(/[\\/]/).includes("..")) {
     return `names ${url}, outside the document's directory: copy the font beside doc.json`;
@@ -6205,7 +6210,7 @@ async function writeScriptBeside(dir, doc) {
 }
 
 // src/plugin/folder.ts
-import { mkdir as mkdir5, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir5 } from "fs/promises";
 import { join as join12 } from "path";
 import { recipeHints } from "@vosjs/shared/frontmatter";
 import { migrateHostedDoc } from "@vosjs/studio-core";
@@ -6394,7 +6399,6 @@ function recipeLine(filename, body) {
   ].filter(Boolean);
   return `${filename}${facts.length ? `  (${facts.join(" \xB7 ")})` : ""}`;
 }
-var safeName = (v) => v.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "file";
 async function cmdPull(argv) {
   const { positionals, flags } = parseArgs(argv, BOOLEAN_FLAGS);
   const ref = positionals[0];
@@ -6413,26 +6417,27 @@ async function cmdPull(argv) {
   if (res.status !== 200)
     throw new Error(apiError(`pull folder ${folder.slug}`, res));
   const payload = res.body;
-  const out = strFlag(flags, "out") ?? folder.slug;
+  const safeName = (v, id) => safePathName((v ?? "").toLowerCase(), id);
+  const out = strFlag(flags, "out") ?? safeName(folder.slug, folder.id);
   await mkdir5(join12(out, "recipes"), { recursive: true });
   const lines = [];
   const recipes = [];
   for (const rec of payload.recipes) {
-    const path = join12(out, "recipes", safeName(rec.filename));
-    await writeFile8(path, rec.body ?? "");
+    const path = join12(out, "recipes", safeName(rec.filename, rec.id));
+    await writeFileSafe(path, rec.body ?? "");
     recipes.push({ path, line: recipeLine(rec.filename, rec.body ?? "") });
   }
   for (const rec of payload.inheritedRecipes) {
-    const from = safeName(rec.folderSlug ?? "inherited");
+    const from = safeName(rec.folderSlug ?? "inherited", "inherited");
     await mkdir5(join12(out, "recipes", "_inherited", from), { recursive: true });
     const path = join12(
       out,
       "recipes",
       "_inherited",
       from,
-      safeName(rec.filename)
+      safeName(rec.filename, rec.id)
     );
-    await writeFile8(path, rec.body ?? "");
+    await writeFileSafe(path, rec.body ?? "");
     recipes.push({
       path,
       line: `${recipeLine(rec.filename, rec.body ?? "")}  [inherited from ${rec.folderName ?? from}]`
@@ -6440,14 +6445,14 @@ async function cmdPull(argv) {
   }
   const members = [];
   for (const v of payload.voses) {
-    const dir = join12(out, "members", safeName(v.slug || v.title || v.id));
+    const dir = join12(out, "members", safeName(v.slug || v.title, v.id));
     await mkdir5(dir, { recursive: true });
     const cfg = await apiJson(origin, `/api/vos/${v.id}/config`, { key });
     if (cfg.status !== 200) {
       lines.push(`skipped ${v.title}: ${apiError("fetch config", cfg)}`);
       continue;
     }
-    await writeFile8(
+    await writeFileSafe(
       join12(dir, "config.json"),
       JSON.stringify(cfg.body.config, null, 2)
     );
@@ -6459,7 +6464,7 @@ async function cmdPull(argv) {
         { key }
       );
       if (doc.status === 200) {
-        await writeFile8(
+        await writeFileSafe(
           join12(dir, "doc.json"),
           JSON.stringify(doc.body, null, 2)
         );
@@ -6991,7 +6996,7 @@ async function pushTakeClaimable(dir, flags, r) {
 
 // src/plugin/program.ts
 import { existsSync as existsSync13 } from "fs";
-import { mkdir as mkdir6, readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir6, readFile as readFile11 } from "fs/promises";
 import { createInterface as createInterface2 } from "readline/promises";
 import { basename as basename3, dirname as dirname2, join as join14 } from "path";
 import {
@@ -7209,9 +7214,9 @@ async function cmdFetch(argv) {
   if (cfg.status !== 200)
     throw new Error(apiError(`fetch config for ${vosId}`, cfg));
   const slug = typeof vosMeta.slug === "string" && vosMeta.slug ? vosMeta.slug : vosId;
-  const out = strFlag(flags, "out") ?? slug;
+  const out = strFlag(flags, "out") ?? safePathName(slug, vosId);
   await mkdir6(out, { recursive: true });
-  await writeFile9(
+  await writeFileSafe(
     join14(out, "config.json"),
     JSON.stringify(cfg.body.config, null, 2)
   );
@@ -7237,12 +7242,18 @@ async function cmdFetch(argv) {
       const hosted = migrateHostedDoc3(doc.body);
       const { config: own } = await writeProgramDoc(out, hosted);
       if (own) {
-        await writeFile9(join14(out, "config.json"), JSON.stringify(own, null, 2));
+        await writeFileSafe(
+          join14(out, "config.json"),
+          JSON.stringify(own, null, 2)
+        );
       }
     } else if (doc.status === 200) {
       take = true;
       const hosted = migrateHostedDoc3(doc.body);
-      await writeFile9(join14(out, "doc.json"), JSON.stringify(hosted, null, 2));
+      await writeFileSafe(
+        join14(out, "doc.json"),
+        JSON.stringify(hosted, null, 2)
+      );
       if (flags.media === true) {
         const media = await pullMedia({ origin, key }, out, hosted, r.log);
         await recordHostedMedia(out, vosId, media);
@@ -7263,7 +7274,7 @@ async function cmdFetch(argv) {
     if (hostedCount && flags.media === true) {
       const pulled = await pullManifest({ origin, key }, out, written, r.log);
       if (pulled) {
-        await writeFile9(
+        await writeFileSafe(
           configPath,
           JSON.stringify({ ...written, assets: pulled.assets }, null, 2)
         );
@@ -7737,7 +7748,10 @@ async function cmdPullProgram(argv) {
   const configPath = join14(dir, "config.json");
   let backedUp = false;
   if (existsSync13(configPath)) {
-    await writeFile9(join14(dir, "config.backup.json"), await readFile11(configPath));
+    await writeFileSafe(
+      join14(dir, "config.backup.json"),
+      await readFile11(configPath)
+    );
     backedUp = true;
   }
   let headConfig = cfg.body.config;
@@ -7756,7 +7770,7 @@ async function cmdPullProgram(argv) {
       if (own) headConfig = own;
     }
   }
-  await writeFile9(configPath, JSON.stringify(headConfig, null, 2));
+  await writeFileSafe(configPath, JSON.stringify(headConfig, null, 2));
   writeSyncState(dir, {
     vosId,
     versionId: typeof head.id === "string" ? head.id : since
@@ -7898,13 +7912,16 @@ async function setProgramStill(dir, t) {
       );
     doc = parsed;
   }
-  await writeFile9(docPath, JSON.stringify({ ...doc, still: t }, null, 2) + "\n");
+  await writeFileSafe(
+    docPath,
+    JSON.stringify({ ...doc, still: t }, null, 2) + "\n"
+  );
 }
 async function writeProgramDoc(dir, hosted) {
   const program = hosted.program && typeof hosted.program === "object" ? hosted.program : {};
   const { config, ...rest } = program;
   const onDisk = { ...hosted, program: rest };
-  await writeFile9(join14(dir, "doc.json"), JSON.stringify(onDisk, null, 2));
+  await writeFileSafe(join14(dir, "doc.json"), JSON.stringify(onDisk, null, 2));
   return {
     config: config && typeof config === "object" ? config : null
   };
@@ -8013,6 +8030,130 @@ function nameFromUrl(url) {
   }
 }
 
+// src/plugin/netAddress.ts
+function privateHostReason(hostname2) {
+  const host = hostname2.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost"))
+    return "is this machine";
+  const v4 = parseIPv4(host);
+  if (v4) return privateIPv4Reason(v4);
+  const v6 = expandIPv6(host);
+  if (!v6) return null;
+  const carried = carriedIPv4(v6);
+  if (carried) return privateIPv4Reason(carried);
+  if (v6.every((w) => w === 0)) return "is an unspecified address";
+  if (v6.slice(0, 7).every((w) => w === 0) && v6[7] === 1)
+    return "is this machine";
+  if ((v6[0] & 65024) === 64512) return "is a private network address";
+  if ((v6[0] & 65472) === 65152) return "is a link-local address";
+  return null;
+}
+function privateIPv4Reason([a, b]) {
+  if (a === 0) return "is an unspecified address";
+  if (a === 127) return "is this machine";
+  if (a === 10) return "is a private network address";
+  if (a === 172 && b >= 16 && b <= 31) return "is a private network address";
+  if (a === 192 && b === 168) return "is a private network address";
+  if (a === 100 && b >= 64 && b <= 127) return "is a private network address";
+  if (a === 169 && b === 254) return "is a link-local address";
+  return null;
+}
+function parseIPv4(host) {
+  if (!/^[0-9a-fx.]+$/i.test(host)) return null;
+  const parts = host.split(".");
+  if (parts.length > 4 || parts.some((p) => p === "")) return null;
+  const nums = [];
+  for (const p of parts) {
+    let n;
+    if (/^0x[0-9a-f]+$/i.test(p)) n = parseInt(p.slice(2), 16);
+    else if (/^0[0-7]+$/.test(p)) n = parseInt(p, 8);
+    else if (/^[0-9]+$/.test(p)) n = parseInt(p, 10);
+    else return null;
+    nums.push(n);
+  }
+  const last = nums[nums.length - 1];
+  const lead = nums.slice(0, -1);
+  if (lead.some((n) => n > 255)) return null;
+  const fill = 4 - lead.length;
+  if (last >= 256 ** fill) return null;
+  const tail = [];
+  let rest = last;
+  for (let i = 0; i < fill; i++) {
+    tail.unshift(rest % 256);
+    rest = Math.floor(rest / 256);
+  }
+  return [...lead, ...tail];
+}
+function expandIPv6(host) {
+  if (!host.includes(":")) return null;
+  const zone = host.indexOf("%");
+  const addr = zone >= 0 ? host.slice(0, zone) : host;
+  if (!/^[0-9a-f:.]+$/i.test(addr)) return null;
+  const halves = addr.split("::");
+  if (halves.length > 2) return null;
+  const words2 = (part) => {
+    if (part === "") return [];
+    const out = [];
+    const groups = part.split(":");
+    for (let i = 0; i < groups.length; i++) {
+      const g = groups[i];
+      if (g.includes(".")) {
+        if (i !== groups.length - 1) return null;
+        const v4 = parseIPv4(g);
+        if (!v4) return null;
+        out.push(v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]);
+        continue;
+      }
+      if (!/^[0-9a-f]{1,4}$/i.test(g)) return null;
+      out.push(parseInt(g, 16));
+    }
+    return out;
+  };
+  const head = words2(halves[0]);
+  const tail = halves.length === 2 ? words2(halves[1]) : [];
+  if (!head || !tail) return null;
+  if (halves.length === 1) return head.length === 8 ? head : null;
+  const gap = 8 - head.length - tail.length;
+  if (gap < 1) return null;
+  return [...head, ...new Array(gap).fill(0), ...tail];
+}
+function carriedIPv4(v6) {
+  const zeroLead = v6.slice(0, 5).every((w) => w === 0);
+  const mapped = zeroLead && v6[5] === 65535;
+  const compatible = zeroLead && v6[5] === 0 && (v6[6] !== 0 || v6[7] > 1);
+  const nat64 = v6[0] === 100 && v6[1] === 65435;
+  if (!mapped && !compatible && !nat64) return null;
+  return [v6[6] >> 8, v6[6] & 255, v6[7] >> 8, v6[7] & 255];
+}
+function fetchRefusal(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return `${url} is not a URL`;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:")
+    return `${url} is not an http(s) address, and the CLI fetches nothing else`;
+  const reason = privateHostReason(u.hostname);
+  if (reason)
+    return `${u.hostname} ${reason}, and the CLI fetches only from the public internet`;
+  return null;
+}
+var MAX_HOPS = 5;
+async function fetchPublic(url, init = {}, fetchImpl = fetch) {
+  let at2 = url;
+  for (let hop = 0; ; hop++) {
+    const refused = fetchRefusal(at2);
+    if (refused) throw new Error(refused);
+    const res = await fetchImpl(at2, { ...init, redirect: "manual" });
+    const location = res.headers.get("location");
+    if (res.status < 300 || res.status > 399 || !location) return res;
+    if (hop >= MAX_HOPS)
+      throw new Error(`${url} redirected more than ${MAX_HOPS} times`);
+    at2 = new URL(location, at2).href;
+  }
+}
+
 // src/plugin/asset.ts
 var BOOLEAN_FLAGS3 = /* @__PURE__ */ new Set(["json", "help"]);
 async function cmdRename(argv) {
@@ -8133,8 +8274,10 @@ async function cmdImport(argv) {
   const key = requireCredential(strFlag(flags, "key"));
   const folderRef = strFlag(flags, "folder");
   const folder = folderRef ? resolveFolder(await listFolders(origin, key), folderRef) : null;
+  const refused = fetchRefusal(url);
+  if (refused) throw new UsageError(`import: ${refused}`);
   r.log(`fetching ${url}`);
-  const res = await fetch(url, { redirect: "follow" });
+  const res = await fetchPublic(url);
   if (!res.ok)
     throw new Error(`import ${url}: the address answered ${res.status}`);
   const declared = Number(res.headers.get("content-length") ?? 0);
@@ -10608,7 +10751,7 @@ async function cmdRecipe(argv) {
 }
 
 // src/plugin/brand.ts
-import { writeFile as writeFile10 } from "fs/promises";
+import { writeFile as writeFile8 } from "fs/promises";
 import { resolve as resolve11 } from "path";
 import { parseFrontmatter as parseFrontmatter2 } from "@vosjs/shared/frontmatter";
 import { lookKindForGround } from "@vosjs/studio-core";
@@ -10907,7 +11050,7 @@ function renderBrandMd(c, claim) {
 }
 async function fetchText(url) {
   try {
-    const res = await fetch(url, { redirect: "follow" });
+    const res = await fetchPublic(url);
     if (!res.ok) return null;
     const type = res.headers.get("content-type") ?? "";
     if (/text\/html/i.test(type)) return null;
@@ -10927,6 +11070,8 @@ async function cmdBrand(argv) {
   } catch {
     throw new UsageError(`not a URL: ${raw}`);
   }
+  const refused = fetchRefusal(url);
+  if (refused) throw new UsageError(refused);
   const r = createReporter(flags.json === true);
   const out = resolve11(strFlag(flags, "out") ?? "BRAND.md");
   r.log(`reading ${origin}/design.md and /llms.txt\u2026`);
@@ -10962,7 +11107,7 @@ async function cmdBrand(argv) {
     composition,
     llms?.claim ?? design?.description ?? null
   );
-  await writeFile10(out, md);
+  await writeFile8(out, md);
   const k = composition.kit;
   r.done(
     {
@@ -10993,6 +11138,20 @@ function hostedEnv(actions, shell) {
   }
   return { env, missing };
 }
+function envNamesNotice(actions) {
+  const names = setupEnvNames2(actions.setup);
+  if (names.length === 0) return null;
+  return {
+    names,
+    line: `the setup reads ${names.length === 1 ? "this environment variable" : "these environment variables"} from this shell: ${names.join(", ")} (names only; a value is never printed or stored)`
+  };
+}
+function announceEnvNames(actions, r) {
+  const notice = envNamesNotice(actions);
+  if (!notice) return;
+  r.log(notice.line);
+  r.event({ event: "env", names: notice.names });
+}
 function isWallError(error) {
   return !!error && /^(\[\w+\] )?The page is behind a sign-in/.test(error);
 }
@@ -11076,8 +11235,11 @@ async function recordHosted(input) {
   };
 }
 
+// src/plugin/run.ts
+import { urlSchemeProblem } from "@vosjs/render-core/record";
+
 // src/plugin/agentBrowser.ts
-import { writeFile as writeFile11 } from "fs/promises";
+import { writeFile as writeFile9 } from "fs/promises";
 import { resolve as resolve12 } from "path";
 function parseAgentBrowserLog(text) {
   const records = [];
@@ -11575,7 +11737,7 @@ async function cmdActions(argv) {
     );
     return EXIT_ERROR;
   }
-  await writeFile11(out, `${JSON.stringify(result.actions, null, 2)}
+  await writeFile9(out, `${JSON.stringify(result.actions, null, 2)}
 `);
   r.done(
     { ok: true, out, url: result.actions.url ?? null, ...summary2(result) },
@@ -11610,7 +11772,43 @@ async function cmdActionsScript(input, flags) {
 import { existsSync as existsSync20 } from "fs";
 import { copyFile, mkdir as mkdir7, readFile as readFile12, stat as stat2 } from "fs/promises";
 import { basename as basename9, join as join22, resolve as resolve13 } from "path";
+
+// src/plugin/traceInflate.ts
 import { inflateRawSync } from "zlib";
+var TRACE_ENTRY_MAX_BYTES = 64 * 1024 * 1024;
+var TRACE_TOTAL_MAX_BYTES = 256 * 1024 * 1024;
+function traceBudget(caps = {}) {
+  return {
+    entry: caps.entry ?? TRACE_ENTRY_MAX_BYTES,
+    total: caps.total ?? TRACE_TOTAL_MAX_BYTES,
+    used: 0
+  };
+}
+var mib = (n) => `${(n / (1024 * 1024)).toFixed(n < 10 * 1024 * 1024 ? 1 : 0)} MiB`;
+function inflateEntry(raw, entry, budget) {
+  const room = Math.min(budget.entry, budget.total - budget.used);
+  const over = (bytes) => new Error(
+    `${entry.name} inflates to ${bytes}, past the ${mib(budget.entry)} an entry may take (${mib(budget.total)} for the whole trace); this is not a trace the recorder reads`
+  );
+  if (entry.size > room) throw over(mib(entry.size));
+  let out;
+  if (entry.method === 8) {
+    try {
+      out = new Uint8Array(inflateRawSync(raw, { maxOutputLength: room + 1 }));
+    } catch (e) {
+      if (e.code === "ERR_BUFFER_TOO_LARGE")
+        throw over(`more than ${mib(room)}`);
+      throw e;
+    }
+  } else {
+    out = raw;
+  }
+  if (out.length > room) throw over(mib(out.length));
+  budget.used += out.length;
+  return out;
+}
+
+// src/plugin/ingest.ts
 import {
   cursorFromPlaywrightTrace,
   cursorFromTrace,
@@ -11706,7 +11904,7 @@ async function readTraceFile(path, offsetMs) {
     }
     const raw = zipEntryBytes(bytes, entry);
     const text2 = new TextDecoder().decode(
-      entry.method === 8 ? new Uint8Array(inflateRawSync(raw)) : raw
+      inflateEntry(raw, entry, traceBudget())
     );
     return cursorFromPlaywrightTrace(text2, { offsetMs });
   }
@@ -12053,6 +12251,14 @@ function doctorReport(facts) {
     next_step = "Record: npx vos record --actions actions.json --out take --strict (the product-video skill writes actions.json)";
   return { ok: nodeOk && browserOk, lines, next_step, facts };
 }
+function bundledSkillsVersion(dir) {
+  try {
+    const v = readFileSync10(join23(dir, "VERSION"), "utf8").trim();
+    return /^\d+\.\d+\.\d+$/.test(v) ? v : null;
+  } catch {
+    return null;
+  }
+}
 function bundledSkillsDir(from) {
   let dir = dirname8(from);
   for (let i = 0; i < 6; i++) {
@@ -12080,10 +12286,15 @@ var BOOLEAN_FLAGS11 = /* @__PURE__ */ new Set([
   "help",
   "global",
   "no-skills",
+  "skills-from-catalog",
   "no-rules",
   "no-browser"
 ]);
 var SKILLS_SOURCE = "vosjs/skills";
+var SKILLS_CLI_VERSION = "1.7.2";
+function skillsCatalogAt(version) {
+  return `https://github.com/${SKILLS_SOURCE}/tree/v${version}`;
+}
 function reporterFor(flags) {
   return createReporter(flags.json === true || process.stdout.isTTY !== true);
 }
@@ -12159,6 +12370,7 @@ async function cmdSetup(argv) {
   const global = flags.global === true;
   const url = strFlag(flags, "url");
   const noSkills = flags["no-skills"] === true;
+  const fromCatalog = flags["skills-from-catalog"] === true;
   const noRules = flags["no-rules"] === true;
   const noBrowser = flags["no-browser"] === true;
   const wanted = strFlag(flags, "agent");
@@ -12178,48 +12390,61 @@ async function cmdSetup(argv) {
   let skillsVia = "skipped";
   let skillNames = [];
   if (!noSkills) {
-    const args = [
-      "skills",
-      "add",
-      SKILLS_SOURCE,
-      "-y",
-      ...global ? ["-g"] : []
-    ];
-    r.log(`installing the vos skills: npx ${args.join(" ")}`);
-    const res = spawnSync4(npx(), args, {
-      cwd: root,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-      shell: process.platform === "win32",
-      timeout: 12e4
-    });
-    if (res.status === 0) {
-      skillsVia = "skills.sh";
-    } else {
-      const bundled = bundledSkillsDir(import.meta.url.replace("file://", ""));
-      if (!bundled)
-        throw new Error(
-          `could not install the skills: npx skills add ${SKILLS_SOURCE} failed (${(res.stderr ?? "").trim().split("\n").at(-1) ?? res.error?.message ?? "no output"}) and this build carries no bundled copy`
-        );
-      const targets = homes.length ? homes : [fallbackSkillsHome(root)];
+    const bundled = bundledSkillsDir(import.meta.url.replace("file://", ""));
+    const version = bundled ? bundledSkillsVersion(bundled) : null;
+    const targets = homes.length ? homes : [fallbackSkillsHome(root)];
+    const copyBundled = (dir) => {
       for (const home of targets) {
         const dest = skillsDirFor(home);
         mkdirSync6(dest, { recursive: true });
-        for (const name of installedSkills(bundled)) {
-          cpSync(join24(bundled, name), join24(dest, name), { recursive: true });
+        for (const name of installedSkills(dir)) {
+          cpSync(join24(dir, name), join24(dest, name), { recursive: true });
         }
       }
+    };
+    if (fromCatalog) {
+      const source = version ? skillsCatalogAt(version) : SKILLS_SOURCE;
+      const args = [
+        `skills@${SKILLS_CLI_VERSION}`,
+        "add",
+        source,
+        "-y",
+        ...global ? ["-g"] : []
+      ];
+      r.log(`installing the vos skills: npx ${args.join(" ")}`);
+      const res = spawnSync4(npx(), args, {
+        cwd: root,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: process.platform === "win32",
+        timeout: 12e4
+      });
+      if (res.status === 0) {
+        skillsVia = "skills.sh";
+      } else {
+        if (!bundled)
+          throw new Error(
+            `could not install the skills: npx ${args.join(" ")} failed (${(res.stderr ?? "").trim().split("\n").at(-1) ?? res.error?.message ?? "no output"}) and this build carries no bundled copy`
+          );
+        copyBundled(bundled);
+        skillsVia = "bundled";
+        r.log(
+          `skills.sh did not answer; copied the bundled skills into ${targets.map((t) => skillsDirFor(t)).join(", ")}`
+        );
+      }
+    } else {
+      if (!bundled)
+        throw new Error(
+          "this build carries no bundled skills; run with --skills-from-catalog"
+        );
+      copyBundled(bundled);
       skillsVia = "bundled";
       r.log(
-        `skills.sh did not answer; copied the bundled skills into ${targets.map((t) => skillsDirFor(t)).join(", ")}`
+        `installed the bundled vos skills${version ? ` (catalog ${version})` : ""} into ${targets.map((t) => skillsDirFor(t)).join(", ")}`
       );
     }
     skillNames = [
-      ...new Set(
-        (homes.length ? homes : [fallbackSkillsHome(root)]).flatMap(
-          (h) => installedSkills(skillsDirFor(h))
-        )
-      )
+      ...new Set(targets.flatMap((h) => installedSkills(skillsDirFor(h))))
     ].sort();
   }
   r.event({ event: "skills", via: skillsVia, names: skillNames });
@@ -12432,11 +12657,12 @@ Take pipeline
             the flow as numbered beats in words, for a person recording it by hand
 
 This machine (no account)
-  vos setup [--agent claude,cursor,codex,copilot|all] [--global] [--no-skills] [--no-rules] [--no-browser] [--url <dev server>] [--json]
+  vos setup [--agent claude,cursor,codex,copilot|all] [--global] [--no-skills] [--skills-from-catalog] [--no-rules] [--no-browser] [--url <dev server>] [--json]
             ready this computer for the loop: the vos skills into your
-            agent's directories (npx skills add vosjs/skills, else the copy
-            bundled in this package), a browser found or installed, one
-            idempotent block in AGENTS.md (or CLAUDE.md), then doctor.
+            agent's directories (the copy bundled in this package, or with
+            --skills-from-catalog the same tag through skills.sh), a
+            browser found or installed, one idempotent block in AGENTS.md
+            (or CLAUDE.md), then doctor.
             NDJSON whenever stdout is not a TTY; done carries next_step
   vos doctor [--url <dev server>] [--json]
             what is ready, in words: node, browser, ffmpeg, the skills per
@@ -12839,6 +13065,9 @@ async function cmdRecord(argv) {
   const url = strFlag(flags, "url") ?? actions.url;
   if (!url)
     throw new UsageError('no URL \u2014 set "url" in the actions file or pass --url');
+  const scheme = urlSchemeProblem(url);
+  if (scheme) throw new UsageError(scheme);
+  announceEnvNames(actions, r);
   const outDir = resolve14(strFlag(flags, "out") ?? "take");
   const storageState = takeStorageState(flags);
   const sessionName = takeSessionName(flags, storageState);
@@ -13084,6 +13313,9 @@ async function cmdCreate2(argv) {
   const url = strFlag(flags, "url") ?? actions.url;
   if (!url)
     throw new UsageError('no URL \u2014 set "url" in the actions file or pass --url');
+  const scheme = urlSchemeProblem(url);
+  if (scheme) throw new UsageError(scheme);
+  announceEnvNames(actions, r);
   const outDir = resolve14(strFlag(flags, "out") ?? "take");
   const format = videoFormat(strFlag(flags, "format"), positionals[0]);
   const out = positionals[0] ?? join25(outDir, `out.${format}`);
@@ -14447,4 +14679,4 @@ export {
   verbHelp,
   run
 };
-//# sourceMappingURL=chunk-X6NQNBDF.js.map
+//# sourceMappingURL=chunk-SB622PZM.js.map