auriga-cli 1.7.0 → 1.9.2

package/dist/plugins.js

@@ -2,6 +2,49 @@ import fs from "node:fs";
 import path from "node:path";
 import { checkbox, select } from "@inquirer/prompts";
 import { exec, log, withEsc } from "./utils.js";
+// Plugin names, marketplace names/sources, and plugin-package names all
+// end up in `claude plugins ...` shell commands via string interpolation.
+// .claude/plugins.json is fetched from raw GitHub at runtime, so every
+// value must pass a conservative whitelist before composing the command.
+// Without this a compromised plugins.json would execute arbitrary
+// commands via shell metachar injection.
+const PLUGIN_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const PLUGIN_SOURCE_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
+const MARKETPLACE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const PLUGIN_PACKAGE_RE = /^[A-Za-z0-9][A-Za-z0-9._@/-]{0,255}$/;
+export function validatePluginsConfig(raw) {
+    if (!raw || typeof raw !== "object") {
+        throw new Error("plugins.json: root must be an object");
+    }
+    const cfg = raw;
+    if (!Array.isArray(cfg.plugins)) {
+        throw new Error("plugins.json: .plugins must be an array");
+    }
+    cfg.plugins.forEach((p, i) => {
+        if (!p || typeof p !== "object") {
+            throw new Error(`plugins.json: plugins[${i}] must be an object`);
+        }
+        const plugin = p;
+        if (typeof plugin.name !== "string" || !PLUGIN_NAME_RE.test(plugin.name)) {
+            throw new Error(`plugins.json: plugins[${i}].name ${JSON.stringify(plugin.name)} does not match ${PLUGIN_NAME_RE}`);
+        }
+        if (typeof plugin.package !== "string" || !PLUGIN_PACKAGE_RE.test(plugin.package)) {
+            throw new Error(`plugins.json: plugins[${i}].package ${JSON.stringify(plugin.package)} does not match ${PLUGIN_PACKAGE_RE}`);
+        }
+        if (plugin.marketplace !== undefined) {
+            if (!plugin.marketplace || typeof plugin.marketplace !== "object") {
+                throw new Error(`plugins.json: plugins[${i}].marketplace must be an object`);
+            }
+            const mp = plugin.marketplace;
+            if (typeof mp.name !== "string" || !MARKETPLACE_NAME_RE.test(mp.name)) {
+                throw new Error(`plugins.json: plugins[${i}].marketplace.name ${JSON.stringify(mp.name)} does not match ${MARKETPLACE_NAME_RE}`);
+            }
+            if (typeof mp.source !== "string" || !PLUGIN_SOURCE_RE.test(mp.source)) {
+                throw new Error(`plugins.json: plugins[${i}].marketplace.source ${JSON.stringify(mp.source)} does not match ${PLUGIN_SOURCE_RE}`);
+            }
+        }
+    });
+}
 function getInstalledPlugins() {
     try {
         const output = exec("claude plugins list --json");
@@ -22,6 +65,17 @@ function getInstalledPlugins() {
         return new Map();
     }
 }
+/**
+ * Non-interactive selection resolver for plugins. Mirrors the skills
+ * resolveSelected: `undefined` / `["*"]` = full set; explicit names =
+ * filter. CLI parser validates names up-front.
+ */
+function resolvePluginSelection(all, selected) {
+    if (!selected || (selected.length === 1 && selected[0] === "*"))
+        return all;
+    const wanted = new Set(selected);
+    return all.filter((p) => wanted.has(p.name));
+}
 function getInstalledMarketplaces() {
     try {
         const output = exec("claude plugins marketplace list");
@@ -35,45 +89,58 @@ function getInstalledMarketplaces() {
         return new Set();
     }
 }
-export async function installPlugins(packageRoot) {
-    // Check claude CLI availability
-    try {
-        exec("which claude");
-    }
-    catch {
-        log.error("'claude' CLI not found. Please install Claude Code first.");
-        return;
+export async function installPlugins(packageRoot, opts) {
+    // Non-interactive path already ran `precheckExternal(["plugins"])` in
+    // cli.ts's runAll / runSingle before dispatching here, so rechecking
+    // `which claude` would be a redundant subprocess on every install.
+    // The interactive TTY menu doesn't have that precheck, so still
+    // validate there — and fail soft (log-and-return) to match the menu's
+    // continue-on-failure ergonomics.
+    if (opts.interactive) {
+        try {
+            exec("which claude");
+        }
+        catch {
+            log.error("'claude' CLI not found. Please install Claude Code first.");
+            return;
+        }
     }
     const configPath = path.join(packageRoot, ".claude", "plugins.json");
     if (!fs.existsSync(configPath)) {
         log.warn("No .claude/plugins.json found");
         return;
     }
-    const config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    validatePluginsConfig(raw);
+    const config = raw;
     if (config.plugins.length === 0) {
         log.warn("No plugins defined in plugins.json");
         return;
     }
-    const scope = await withEsc(select({
-        message: "Plugins installation scope:",
-        choices: [
-            { name: "User (user-level)", value: "user" },
-            { name: "Project (current project)", value: "project" },
-        ],
-    }));
+    const scope = opts.interactive
+        ? await withEsc(select({
+            message: "Plugins installation scope:",
+            choices: [
+                { name: "User (user-level)", value: "user" },
+                { name: "Project (current project)", value: "project" },
+            ],
+        }))
+        : opts.scope ?? "project";
     const installed = getInstalledPlugins();
-    const selected = await withEsc(checkbox({
-        message: "Select plugins to install:",
-        choices: config.plugins.map((p) => {
-            const scopes = installed.get(p.package);
-            const suffix = scopes ? ` (installed: ${scopes.join(", ")})` : "";
-            return {
-                name: `${p.name} — ${p.description}${suffix}`,
-                value: p,
-                checked: !scopes || !(scopes.includes("user") && scopes.includes("project")),
-            };
-        }),
-    }));
+    const selected = opts.interactive
+        ? await withEsc(checkbox({
+            message: "Select plugins to install:",
+            choices: config.plugins.map((p) => {
+                const scopes = installed.get(p.package);
+                const suffix = scopes ? ` (installed: ${scopes.join(", ")})` : "";
+                return {
+                    name: `${p.name} — ${p.description}${suffix}`,
+                    value: p,
+                    checked: !scopes || !(scopes.includes("user") && scopes.includes("project")),
+                };
+            }),
+        }))
+        : resolvePluginSelection(config.plugins, opts.selected);
     if (selected.length === 0) {
         log.skip("No plugins selected");
         return;
@@ -86,6 +153,7 @@ export async function installPlugins(packageRoot) {
             marketplacesToAdd.set(plugin.marketplace.name, plugin.marketplace.source);
         }
     }
+    const failures = [];
     for (const [name, source] of marketplacesToAdd) {
         console.log(`\nAdding marketplace: ${name}...`);
         try {
@@ -94,6 +162,7 @@ export async function installPlugins(packageRoot) {
         }
         catch {
             log.error(`Failed to add marketplace: ${name}`);
+            failures.push(`marketplace ${name}`);
         }
     }
     // Install plugins
@@ -107,6 +176,10 @@ export async function installPlugins(packageRoot) {
         }
         catch {
             log.error(`Failed to install: ${plugin.name}`);
+            failures.push(plugin.name);
         }
     }
+    if (failures.length > 0 && !opts.interactive) {
+        throw new Error(`${failures.length} plugin operation(s) failed: ${failures.join(", ")}`);
+    }
 }

package/dist/skills.d.ts

@@ -1,2 +1,10 @@
-export declare function installSkills(packageRoot: string): Promise<void>;
-export declare function installRecommendedSkills(packageRoot: string): Promise<void>;
+import type { InstallOpts, SkillsLock } from "./utils.js";
+export declare const WORKFLOW_SKILLS: string[];
+export declare function validateSkillsLock(raw: unknown): asserts raw is SkillsLock;
+export declare function planSkillInstallCommands(selected: string[], lock: SkillsLock["skills"], globalFlag: string): {
+    source: string;
+    skills: string[];
+    command: string;
+}[];
+export declare function installSkills(packageRoot: string, opts: InstallOpts): Promise<void>;
+export declare function installRecommendedSkills(packageRoot: string, opts: InstallOpts): Promise<void>;

package/dist/skills.js

@@ -5,8 +5,7 @@ import { exec, log, withEsc } from "./utils.js";
 // Curated default-on set: skills that the workflow in the root CLAUDE.md
 // directly references. Anything else in skills-lock.json is surfaced via
 // installRecommendedSkills as an opt-in utility.
-const WORKFLOW_SKILLS = [
-    "auriga-go",
+export const WORKFLOW_SKILLS = [
     "brainstorming",
     "deep-review",
     "parallel-implementation",
@@ -18,58 +17,128 @@ const WORKFLOW_SKILLS = [
     "ui-ux-pro-max",
     "verification-before-completion",
 ];
-const RECOMMENDED_DESCRIPTIONS = {
-    "claude-code-agent": "Delegate tasks to another Claude Code CLI instance",
-    "codex-agent": "Delegate tasks to Codex CLI",
-};
+// Skill names and npm-style sources are interpolated into the shell
+// command we hand to `exec()`. The lock file is fetched from raw GitHub
+// at runtime, so every value must pass a conservative whitelist before
+// we compose the command. Without this a compromised skills-lock.json
+// would execute arbitrary commands via shell metachar injection.
+const SKILL_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const SKILL_SOURCE_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
+export function validateSkillsLock(raw) {
+    if (!raw || typeof raw !== "object") {
+        throw new Error("skills-lock.json: root must be an object");
+    }
+    const lock = raw;
+    if (!lock.skills || typeof lock.skills !== "object") {
+        throw new Error("skills-lock.json: .skills must be an object");
+    }
+    for (const [name, entry] of Object.entries(lock.skills)) {
+        if (!SKILL_NAME_RE.test(name)) {
+            throw new Error(`skills-lock.json: skill name ${JSON.stringify(name)} does not match ${SKILL_NAME_RE}`);
+        }
+        if (!entry || typeof entry !== "object") {
+            throw new Error(`skills-lock.json: .skills[${name}] must be an object`);
+        }
+        const src = entry.source;
+        if (typeof src !== "string" || !SKILL_SOURCE_RE.test(src)) {
+            throw new Error(`skills-lock.json: .skills[${name}].source ${JSON.stringify(src)} does not match ${SKILL_SOURCE_RE}`);
+        }
+    }
+}
 function loadLock(packageRoot) {
-    return JSON.parse(fs.readFileSync(path.join(packageRoot, "skills-lock.json"), "utf-8"));
+    const raw = JSON.parse(fs.readFileSync(path.join(packageRoot, "skills-lock.json"), "utf-8"));
+    validateSkillsLock(raw);
+    return raw;
 }
-async function installSelected(entries, defaultChecked, descriptionMap) {
+// Deterministic: selection order is preserved; the first occurrence of
+// each source fixes its position in the returned array.
+export function planSkillInstallCommands(selected, lock, globalFlag) {
+    const bySource = new Map();
+    for (const name of selected) {
+        const entry = lock[name];
+        if (!entry)
+            continue;
+        const bucket = bySource.get(entry.source);
+        if (bucket)
+            bucket.push(name);
+        else
+            bySource.set(entry.source, [name]);
+    }
+    return [...bySource].map(([source, skills]) => ({
+        source,
+        skills,
+        command: `npx -y skills add ${source}${globalFlag} --skill ${skills.join(" ")} --agent claude-code codex --yes`,
+    }));
+}
+async function installSelected(entries, defaultChecked, opts) {
     if (entries.length === 0) {
         log.warn("No skills found");
         return;
     }
-    const scope = await withEsc(select({
-        message: "Skills installation scope:",
-        choices: [
-            { name: "Project (current directory)", value: "project" },
-            { name: "Global (user-level)", value: "global" },
-        ],
-    }));
-    const selected = await withEsc(checkbox({
-        message: "Select skills to install:",
-        choices: entries.map(([name, entry]) => {
-            const desc = descriptionMap?.[name];
-            const label = desc ? `${name} — ${desc}` : `${name} (${entry.source})`;
-            return { name: label, value: name, checked: defaultChecked };
-        }),
-    }));
+    const scope = opts.interactive
+        ? await withEsc(select({
+            message: "Skills installation scope:",
+            choices: [
+                { name: "Project (current directory)", value: "project" },
+                { name: "Global (user-level)", value: "global" },
+            ],
+        }))
+        : opts.scope === "user" ? "global" : "project";
+    const availableNames = entries.map(([name]) => name);
+    const selected = opts.interactive
+        ? await withEsc(checkbox({
+            message: "Select skills to install:",
+            choices: entries.map(([name, entry]) => ({
+                name: `${name} (${entry.source})`,
+                value: name,
+                checked: defaultChecked,
+            })),
+        }))
+        : resolveSelected(opts.selected, availableNames);
     if (selected.length === 0) {
         log.skip("No skills selected");
         return;
     }
     const globalFlag = scope === "global" ? " -g" : "";
     const lock = Object.fromEntries(entries);
-    for (const name of selected) {
-        const entry = lock[name];
-        console.log(`\nInstalling ${name}...`);
+    const batches = planSkillInstallCommands(selected, lock, globalFlag);
+    const failures = [];
+    for (const batch of batches) {
+        console.log(`\nInstalling ${batch.skills.join(", ")} from ${batch.source}...`);
         try {
-            exec(`npx skills add ${entry.source}${globalFlag} --skill ${name} --agent claude-code codex --yes`, { inherit: true });
-            log.ok(`${name}: installed`);
+            exec(batch.command, { inherit: true });
+            for (const name of batch.skills)
+                log.ok(`${name}: installed`);
         }
         catch {
-            log.error(`${name}: failed to install`);
+            log.error(`${batch.source}: failed to install (${batch.skills.join(", ")})`);
+            failures.push(batch.source);
         }
     }
+    if (failures.length > 0 && !opts.interactive) {
+        throw new Error(`${failures.length} skill batch(es) failed: ${failures.join(", ")}`);
+    }
+}
+/**
+ * Resolves the non-interactive `opts.selected` filter against the set
+ * of names available in the current category. Semantics match spec
+ * §3.2: `undefined` = all; `["*"]` = all; any other list = that list.
+ * The CLI parser is responsible for rejecting unknown names up-front
+ * (so installers can trust the list).
+ */
+function resolveSelected(selected, available) {
+    if (!selected || (selected.length === 1 && selected[0] === "*")) {
+        return available;
+    }
+    return selected;
 }
-export async function installSkills(packageRoot) {
+export async function installSkills(packageRoot, opts) {
     const lock = loadLock(packageRoot);
     const entries = Object.entries(lock.skills).filter(([name]) => WORKFLOW_SKILLS.includes(name));
-    await installSelected(entries, true);
+    await installSelected(entries, true, opts);
 }
-export async function installRecommendedSkills(packageRoot) {
+export async function installRecommendedSkills(packageRoot, opts) {
     const lock = loadLock(packageRoot);
     const entries = Object.entries(lock.skills).filter(([name]) => !WORKFLOW_SKILLS.includes(name));
-    await installSelected(entries, false, RECOMMENDED_DESCRIPTIONS);
+    await installSelected(entries, false, opts);
 }

package/dist/types.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Shared leaf types. Put things here when multiple modules need the
+ * same nominal type and a natural "owner" doesn't exist — avoids
+ * forcing leaf renderers (help.ts, guide.ts) to depend on the CLI
+ * entrypoint just to pull one union.
+ */
+export type CategoryName = "workflow" | "skills" | "recommended" | "plugins" | "hooks";
+export declare const CATEGORY_NAMES: readonly CategoryName[];

package/dist/types.js

@@ -0,0 +1,13 @@
+/**
+ * Shared leaf types. Put things here when multiple modules need the
+ * same nominal type and a natural "owner" doesn't exist — avoids
+ * forcing leaf renderers (help.ts, guide.ts) to depend on the CLI
+ * entrypoint just to pull one union.
+ */
+export const CATEGORY_NAMES = [
+    "workflow",
+    "skills",
+    "recommended",
+    "plugins",
+    "hooks",
+];

package/dist/utils.d.ts

@@ -19,6 +19,39 @@ export interface PluginDef {
 export interface PluginsConfig {
     plugins: PluginDef[];
 }
+/**
+ * Shared install function argument shape. Each installer consumes the
+ * subset of fields meaningful to its category; irrelevant fields are
+ * ignored (e.g. `lang` / `cwd` only apply to workflow).
+ *
+ * `interactive` is required (no default) to force callers to be
+ * explicit — silently falling back to prompts in a piped Agent session
+ * was the original bug this spec closes.
+ */
+export interface InstallOpts {
+    /** workflow only — language code from `LANGUAGES`. */
+    lang?: string;
+    /** workflow only — install target directory (absolute or cwd-relative). */
+    cwd?: string;
+    /** skills / recommended / plugins / hooks — `"user"` means install globally. */
+    scope?: "project" | "user";
+    /**
+     * sub-item filter. `undefined` = full set of this category.
+     * Names are validated against the catalog by the CLI layer; installers
+     * take the list as authoritative.
+     */
+    selected?: string[];
+    /** `true` = drive via inquirer prompts (existing interactive UX);
+     *  `false` = non-interactive, use only the fields above. */
+    interactive: boolean;
+}
+/**
+ * Whether the current process should be treated as non-interactive.
+ * Used by the top-level CLI dispatcher to pick the interactive vs
+ * non-interactive code path when only the verb was supplied with no
+ * positional types / flags.
+ */
+export declare function isNonInteractive(): boolean;
 export declare function getPackageRoot(): string;
 export declare function exec(cmd: string, opts?: {
     cwd?: string;
@@ -30,6 +63,13 @@ export interface LangOption {
     file: string;
 }
 export declare const LANGUAGES: LangOption[];
+/**
+ * Reads `version` from the packaged manifest. Throws when the package
+ * root / manifest is unreadable — callers that need a fallback should
+ * wrap in try/catch and pick their own default (see
+ * `resolveContentRef` for an example).
+ */
+export declare function readPackageVersion(): string;
 export declare function fetchContentRoot(): Promise<string>;
 export declare function fetchExtraContent(tmpDir: string, file: string): Promise<void>;
 export declare function fetchExtraContentBinary(tmpDir: string, file: string): Promise<void>;

package/dist/utils.js

@@ -3,11 +3,36 @@ import { fileURLToPath } from "node:url";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+/**
+ * Whether the current process should be treated as non-interactive.
+ * Used by the top-level CLI dispatcher to pick the interactive vs
+ * non-interactive code path when only the verb was supplied with no
+ * positional types / flags.
+ */
+export function isNonInteractive() {
+    return !process.stdin.isTTY;
+}
 // --- Package root ---
+// Walks up from the current module file until it finds the auriga-cli
+// package.json. Handles both `dist/utils.js` (production) and
+// `dist-test/src/utils.js` (test compile output) uniformly — a plain
+// `path.resolve(..., "..")` works for the first but not the second.
 export function getPackageRoot() {
     const __filename = fileURLToPath(import.meta.url);
-    // dist/utils.js -> package root
-    return path.resolve(path.dirname(__filename), "..");
+    let dir = path.dirname(__filename);
+    while (dir !== path.dirname(dir)) {
+        const pkgPath = path.join(dir, "package.json");
+        if (fs.existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+                if (pkg.name === "auriga-cli")
+                    return dir;
+            }
+            catch { /* malformed parent package.json — keep walking */ }
+        }
+        dir = path.dirname(dir);
+    }
+    return process.cwd();
 }
 // --- Exec ---
 export function exec(cmd, opts) {
@@ -23,7 +48,45 @@ export const LANGUAGES = [
 ];
 // --- Remote content ---
 const REPO = "Ben2pc/auriga-cli";
-const BRANCH = "main";
+/**
+ * Reads `version` from the packaged manifest. Throws when the package
+ * root / manifest is unreadable — callers that need a fallback should
+ * wrap in try/catch and pick their own default (see
+ * `resolveContentRef` for an example).
+ */
+export function readPackageVersion() {
+    const pkg = JSON.parse(fs.readFileSync(path.join(getPackageRoot(), "package.json"), "utf-8"));
+    return pkg.version;
+}
+/**
+ * Git ref to fetch content from. Defaults to the tag matching the
+ * published CLI version (`v<package.version>`) so a pinned npm install
+ * never drifts against `main`. Overridable via `AURIGA_CONTENT_REF`
+ * (CI / debugging) and auto-falls-back to `main` for the legacy
+ * behavior when `AURIGA_CONTENT_REF=main` or when the package version
+ * can't be read.
+ *
+ * Release discipline: cut the git tag `v<version>` BEFORE `npm
+ * publish`. Publishing without tagging would leave `fetchContentRoot`
+ * hitting a 404 for the first minutes until the tag exists.
+ */
+function resolveContentRef() {
+    const override = process.env.AURIGA_CONTENT_REF;
+    if (override && override.length > 0)
+        return override;
+    try {
+        const version = readPackageVersion();
+        if (typeof version === "string" && /^\d+\.\d+\.\d+/.test(version)) {
+            return `v${version}`;
+        }
+    }
+    catch {
+        // Fall through to main; getPackageRoot can legitimately fail in
+        // bizarre installs (broken tarball), and a live-main fetch is
+        // strictly better than a hard crash on `--help`.
+    }
+    return "main";
+}
 const CONTENT_FILES = [
     "CLAUDE.md",
     "skills-lock.json",
@@ -31,14 +94,16 @@ const CONTENT_FILES = [
     ".claude/hooks/hooks.json",
 ];
 async function fetchFile(file) {
-    const url = `https://raw.githubusercontent.com/${REPO}/${BRANCH}/${file}`;
+    const ref = resolveContentRef();
+    const url = `https://raw.githubusercontent.com/${REPO}/${ref}/${file}`;
     const res = await fetch(url);
     if (!res.ok)
         throw new Error(`Failed to fetch ${url}: ${res.status}`);
     return res.text();
 }
 async function fetchFileBinary(file) {
-    const url = `https://raw.githubusercontent.com/${REPO}/${BRANCH}/${file}`;
+    const ref = resolveContentRef();
+    const url = `https://raw.githubusercontent.com/${REPO}/${ref}/${file}`;
     const res = await fetch(url);
     if (!res.ok)
         throw new Error(`Failed to fetch ${url}: ${res.status}`);
@@ -238,7 +303,11 @@ export function printBanner(version) {
 // --- Log ---
 export const log = {
     ok: (msg) => console.log(`${green}\u2713${reset} ${msg}`),
-    warn: (msg) => console.log(`${yellow}\u26a0${reset} ${msg}`),
-    error: (msg) => console.log(`${red}\u2717${reset} ${msg}`),
+    // warn / error go to stderr so shell redirection (and non-interactive
+    // agents) can separate diagnostics from normal CLI output. Earlier
+    // both wrote to stdout via console.log, which collapsed the two
+    // streams and forced callers to re-parse mixed output.
+    warn: (msg) => console.error(`${yellow}\u26a0${reset} ${msg}`),
+    error: (msg) => console.error(`${red}\u2717${reset} ${msg}`),
     skip: (msg) => console.log(`${dim}  skip: ${msg}${reset}`),
 };

package/dist/workflow.d.ts

@@ -1 +1,2 @@
-export declare function installWorkflow(packageRoot: string): Promise<void>;
+import { type InstallOpts } from "./utils.js";
+export declare function installWorkflow(packageRoot: string, opts: InstallOpts): Promise<void>;

package/dist/workflow.js

@@ -1,21 +1,29 @@
 import fs from "node:fs";
 import path from "node:path";
 import { input, select } from "@inquirer/prompts";
-import { LANGUAGES, fetchExtraContent, log, withEsc } from "./utils.js";
-export async function installWorkflow(packageRoot) {
-    const lang = await withEsc(select({
-        message: "CLAUDE.md language:",
-        choices: LANGUAGES.map((l) => ({ name: l.label, value: l.value })),
-        default: "en",
-    }));
-    const targetDir = await withEsc(input({
-        message: "Workflow install target directory:",
-        default: process.cwd(),
-    }));
+import { LANGUAGES, fetchExtraContent, log, withEsc, } from "./utils.js";
+export async function installWorkflow(packageRoot, opts) {
+    const lang = opts.interactive
+        ? await withEsc(select({
+            message: "CLAUDE.md language:",
+            choices: LANGUAGES.map((l) => ({ name: l.label, value: l.value })),
+            default: "en",
+        }))
+        : (opts.lang ?? "en");
+    const targetDir = opts.interactive
+        ? await withEsc(input({
+            message: "Workflow install target directory:",
+            default: process.cwd(),
+        }))
+        : (opts.cwd ?? process.cwd());
     const resolved = path.resolve(targetDir);
     if (!fs.existsSync(resolved) || !fs.statSync(resolved).isDirectory()) {
-        log.error(`Not a valid directory: ${resolved}`);
-        return;
+        const msg = `Not a valid directory: ${resolved}`;
+        if (opts.interactive) {
+            log.error(msg);
+            return;
+        }
+        throw new Error(msg);
     }
     const langOpt = LANGUAGES.find((l) => l.value === lang);
     // Lazy fetch: only download non-default language file when needed

package/package.json

@@ -1,26 +1,41 @@
 {
   "name": "auriga-cli",
-  "version": "1.7.0",
+  "version": "1.9.2",
   "description": "Interactive CLI to install Claude Code harness modules (Workflow, Skills, Recommended Skills, Plugins, Hooks)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ben2pc/auriga-cli.git"
+  },
+  "homepage": "https://github.com/Ben2pc/auriga-cli#readme",
+  "bugs": {
+    "url": "https://github.com/Ben2pc/auriga-cli/issues"
+  },
   "type": "module",
   "bin": {
     "auriga-cli": "dist/cli.js"
   },
   "files": [
-    "dist"
+    "dist/*.js",
+    "dist/*.d.ts",
+    "dist/catalog.json"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node dist/build/generate-catalog.js",
     "dev": "tsc --watch",
     "start": "node dist/cli.js",
-    "test": "tsc -p tsconfig.test.json && DEV=1 node --test dist-test/tests/hooks.test.js",
-    "test:watch": "tsc -p tsconfig.test.json --watch & node --test --watch dist-test/tests/hooks.test.js"
+    "pretest": "npm run build",
+    "test": "tsc -p tsconfig.test.json && DEV=1 node --test --experimental-test-module-mocks dist-test/tests/hooks.test.js dist-test/tests/skills.test.js dist-test/tests/catalog.test.js dist-test/tests/cli-parse.test.js dist-test/tests/install-nontty.test.js dist-test/tests/guide.test.js dist-test/tests/validators.test.js dist-test/tests/entrypoint.test.js",
+    "test:watch": "tsc -p tsconfig.test.json --watch & node --test --watch --experimental-test-module-mocks dist-test/tests/hooks.test.js dist-test/tests/skills.test.js dist-test/tests/catalog.test.js dist-test/tests/cli-parse.test.js dist-test/tests/install-nontty.test.js dist-test/tests/guide.test.js dist-test/tests/validators.test.js dist-test/tests/entrypoint.test.js",
+    "pretest:e2e": "npm run build",
+    "test:e2e": "tsc -p tsconfig.test.json && node --test dist-test/tests/e2e-install.test.js"
   },
   "engines": {
     "node": ">=18"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.0.0"
+    "@inquirer/prompts": "^8.0.0",
+    "gray-matter": "^4.0.3"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",