autohand-cli 0.7.14 → 0.8.2

package/dist/chunk-OHUZKDGX.js

@@ -0,0 +1,348 @@
+import {
+  showConfirm
+} from "./chunk-YZXUDM5X.js";
+import {
+  AUTOHAND_PATHS,
+  PROJECT_DIR_NAME
+} from "./chunk-EGFT4PGW.js";
+import {
+  t
+} from "./chunk-APIXPPMT.js";
+
+// src/skills/communityInstaller.ts
+import crypto from "crypto";
+import path from "path";
+import chalk from "chalk";
+
+// src/skills/LearnClient.ts
+import { createHash } from "crypto";
+var DEFAULT_LIMIT = 5;
+var LearnClient = class {
+  search(registry, query, limit = DEFAULT_LIMIT) {
+    if (!query.trim()) return [];
+    const lowerQuery = query.toLowerCase();
+    const matched = registry.skills.filter((skill) => {
+      const searchText = [
+        skill.name,
+        skill.description,
+        skill.category,
+        ...skill.tags || [],
+        ...skill.languages || [],
+        ...skill.frameworks || []
+      ].join(" ").toLowerCase();
+      return searchText.includes(lowerQuery);
+    });
+    matched.sort((a, b) => (b.downloadCount ?? 0) - (a.downloadCount ?? 0));
+    return matched.slice(0, limit);
+  }
+  trending(registry, limit = 10) {
+    const sorted = [...registry.skills].sort((a, b) => {
+      const featuredDiff = Number(Boolean(b.isFeatured)) - Number(Boolean(a.isFeatured));
+      if (featuredDiff !== 0) return featuredDiff;
+      return (b.downloadCount ?? 0) - (a.downloadCount ?? 0);
+    });
+    return sorted.slice(0, limit);
+  }
+  findBySlug(registry, slug) {
+    let searchName = slug;
+    let searchAuthor;
+    if (slug.startsWith("@")) {
+      const parts = slug.slice(1).split("/");
+      if (parts.length === 2) {
+        searchAuthor = parts[0].toLowerCase();
+        searchName = parts[1].toLowerCase();
+      }
+    }
+    const lower = searchName.toLowerCase();
+    return registry.skills.find((s) => {
+      const nameMatch = s.id.toLowerCase() === lower || s.name.toLowerCase() === lower;
+      if (!nameMatch) return false;
+      if (searchAuthor && s.author?.toLowerCase() !== searchAuthor) return false;
+      return true;
+    }) || null;
+  }
+  filterLearnedSkills(skills) {
+    return skills.filter(
+      (s) => s.metadata && s.metadata["agentskill-slug"]
+    );
+  }
+  checkUpdates(installedSkills, registry, getShaForSkill) {
+    const updates = [];
+    for (const skill of installedSkills) {
+      const slug = skill.metadata?.["agentskill-slug"];
+      const localSha = skill.metadata?.["agentskill-sha"];
+      if (!slug || !localSha) continue;
+      const registrySkill = registry.skills.find(
+        (s) => s.id === slug || s.name === slug
+      );
+      if (!registrySkill) continue;
+      const remoteSha = getShaForSkill(registrySkill.id);
+      if (remoteSha && remoteSha !== localSha) {
+        updates.push({
+          name: skill.name,
+          slug,
+          localSha,
+          remoteSha
+        });
+      }
+    }
+    return updates;
+  }
+  static computeContentSha(content) {
+    return createHash("sha256").update(content).digest("hex").slice(0, 7);
+  }
+};
+
+// src/skills/SkillSecurityScanner.ts
+var THREAT_RULES = [
+  // Command injection
+  { category: "command-injection", pattern: /rm\s+-rf\b/i, severity: 15 },
+  { category: "command-injection", pattern: /curl\s+.*\|\s*bash/i, severity: 20 },
+  { category: "command-injection", pattern: /wget\s+.*\|\s*bash/i, severity: 20 },
+  { category: "command-injection", pattern: /\beval\s*\(/i, severity: 15 },
+  { category: "command-injection", pattern: /\bexec\s*\(/i, severity: 12 },
+  { category: "command-injection", pattern: /\bsudo\b/i, severity: 15 },
+  { category: "command-injection", pattern: /chmod\s+777\b/i, severity: 12 },
+  // Data exfiltration
+  { category: "data-exfiltration", pattern: /process\.env\b/i, severity: 10 },
+  { category: "data-exfiltration", pattern: /\bcredentials?\b/i, severity: 8 },
+  { category: "data-exfiltration", pattern: /\bapi[_-]?key\b/i, severity: 8 },
+  { category: "data-exfiltration", pattern: /\bsecret[_-]?key\b/i, severity: 10 },
+  { category: "data-exfiltration", pattern: /\.ssh\/id_rsa\b/i, severity: 15 },
+  // Encoded payloads
+  { category: "encoded-payload", pattern: /\batob\s*\(/i, severity: 12 },
+  { category: "encoded-payload", pattern: /Buffer\.from\s*\(/i, severity: 8 },
+  // Network calls
+  { category: "network-calls", pattern: /\bfetch\s*\(\s*["'`]https?:\/\//i, severity: 10 },
+  { category: "network-calls", pattern: /\bwget\s+https?:\/\//i, severity: 12 },
+  { category: "network-calls", pattern: /\bcurl\s+https?:\/\//i, severity: 8 },
+  { category: "network-calls", pattern: /http\.request\s*\(/i, severity: 10 },
+  { category: "network-calls", pattern: /XMLHttpRequest/i, severity: 10 }
+];
+var SAFE_THRESHOLD = 50;
+var BLOCKED_THRESHOLD = 30;
+var SkillSecurityScanner = class {
+  /**
+   * Scan skill content for security threats.
+   * Returns a score (0-100) and list of matched threats.
+   */
+  scan(content) {
+    if (!content.trim()) {
+      return { score: 100, threats: [], safe: true, blocked: false };
+    }
+    const lines = content.split("\n");
+    const threats = [];
+    let deductions = 0;
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+      const lineContent = lines[lineIndex];
+      for (const rule of THREAT_RULES) {
+        if (rule.pattern.test(lineContent)) {
+          threats.push({
+            category: rule.category,
+            pattern: rule.pattern.source,
+            line: lineIndex + 1,
+            context: lineContent.trim()
+          });
+          deductions += rule.severity;
+        }
+      }
+    }
+    const score = Math.max(0, 100 - deductions);
+    return {
+      score,
+      threats,
+      safe: score >= SAFE_THRESHOLD,
+      blocked: score < BLOCKED_THRESHOLD
+    };
+  }
+};
+
+// src/skills/communityInstaller.ts
+async function fetchRegistryWithFallback(cache, fetcher) {
+  const cached = await cache.getRegistry();
+  if (cached) return cached;
+  try {
+    const registry = await fetcher.fetchRegistry();
+    await cache.setRegistry(registry);
+    return registry;
+  } catch {
+    return cache.getRegistryIgnoreTTL();
+  }
+}
+async function installSkillWithSecurity(ctx, skill, cache, fetcher, scope = "user") {
+  const targetDir = scope === "project" ? path.join(ctx.workspaceRoot, PROJECT_DIR_NAME, "skills") : AUTOHAND_PATHS.skills;
+  const installed = await ctx.skillsRegistry.isSkillInstalled(skill.id, targetDir);
+  if (installed) {
+    return t("commands.learn.alreadyInstalled", { name: skill.name });
+  }
+  let files = await cache.getSkillDirectory(skill.id);
+  if (!files) {
+    try {
+      files = await fetcher.fetchSkillDirectory(skill);
+      await cache.setSkillDirectory(skill.id, files);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Unknown error";
+      return chalk.red(`Failed to fetch skill files: ${msg}`);
+    }
+  }
+  const scanner = new SkillSecurityScanner();
+  const allContent = Array.from(files.values()).join("\n");
+  const scanResult = scanner.scan(allContent);
+  if (scanResult.blocked) {
+    const lines = [];
+    lines.push(chalk.red(t("commands.learn.securityBlocked", { score: String(scanResult.score) })));
+    lines.push("");
+    for (const threat of scanResult.threats) {
+      lines.push(chalk.red(`  [${threat.category}] Line ${threat.line}: ${threat.context}`));
+    }
+    if (ctx.isNonInteractive) {
+      return lines.join("\n");
+    }
+    lines.push("");
+    const override = await showConfirm({
+      title: t("commands.learn.securityOverride"),
+      defaultValue: false
+    });
+    if (!override) {
+      return lines.join("\n");
+    }
+  } else if (!scanResult.safe) {
+    console.log(chalk.yellow(t("commands.learn.securityWarning", { score: String(scanResult.score) })));
+    for (const threat of scanResult.threats) {
+      console.log(chalk.yellow(`  [${threat.category}] Line ${threat.line}: ${threat.context}`));
+    }
+  }
+  if (ctx.hookManager) {
+    const hookResults = await ctx.hookManager.executeHooks("pre-learn", {
+      tool: "learn",
+      args: { slug: skill.id, name: skill.name, scope }
+    });
+    const blocked = hookResults.some((r) => r.blockingError);
+    if (blocked) {
+      return chalk.yellow(t("commands.learn.hookBlocked"));
+    }
+  }
+  const skillMd = files.get("SKILL.md");
+  if (skillMd) {
+    const enriched = injectLearnMetadata(skillMd, skill);
+    files.set("SKILL.md", enriched);
+  }
+  const importResult = await ctx.skillsRegistry.importCommunitySkillDirectory(
+    skill.id,
+    files,
+    targetDir
+  );
+  if (!importResult.success) {
+    return chalk.red(importResult.error ?? "Failed to install skill");
+  }
+  if (ctx.hookManager) {
+    await ctx.hookManager.executeHooks("post-learn", {
+      tool: "learn",
+      args: { slug: skill.id, name: skill.name, scope },
+      path: importResult.path,
+      success: true
+    });
+  }
+  ctx.skillsRegistry.trackSkillEvent({
+    skillName: skill.name,
+    source: "community",
+    activationType: "explicit",
+    action: "install"
+  });
+  return chalk.green(t("commands.learn.installed", { name: skill.name }));
+}
+function injectLearnMetadata(skillMd, skill) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const sha = LearnClient.computeContentSha(skillMd);
+  const metadataEntries = [
+    `agentskill-slug: ${skill.id}`,
+    `agentskill-owner: ${skill.author ?? "community"}`,
+    `agentskill-sha: ${sha}`,
+    `agentskill-installed: ${now}`,
+    `agentskill-source: github-registry`
+  ];
+  if (skillMd.startsWith("---")) {
+    const endIndex = skillMd.indexOf("---", 3);
+    if (endIndex !== -1) {
+      const frontmatter = skillMd.slice(0, endIndex);
+      const rest = skillMd.slice(endIndex);
+      if (frontmatter.includes("metadata:")) {
+        const injected = metadataEntries.map((e) => `  ${e}`).join("\n");
+        return frontmatter + injected + "\n" + rest;
+      }
+      const metadataBlock2 = "metadata:\n" + metadataEntries.map((e) => `  ${e}`).join("\n") + "\n";
+      return frontmatter + metadataBlock2 + rest;
+    }
+  }
+  const metadataBlock = "---\nmetadata:\n" + metadataEntries.map((e) => `  ${e}`).join("\n") + "\n---\n";
+  return metadataBlock + skillMd;
+}
+function computeProjectHash(analysis) {
+  const serialized = JSON.stringify({
+    languages: analysis.languages.slice().sort(),
+    frameworks: analysis.frameworks.slice().sort(),
+    patterns: analysis.patterns.slice().sort(),
+    packageManager: analysis.packageManager
+  });
+  return crypto.createHash("sha256").update(serialized).digest("hex").slice(0, 7);
+}
+function injectGeneratedMetadata(content, skillName, projectHash) {
+  const metadataLines = [
+    `  agentskill-slug: ${skillName}`,
+    `  agentskill-source: llm-generated`,
+    `  agentskill-generated-at: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `  agentskill-project-hash: ${projectHash}`
+  ].join("\n");
+  if (content.startsWith("---")) {
+    if (content.includes("metadata:")) {
+      return content.replace(/metadata:/, `metadata:
+${metadataLines}`);
+    }
+    const endIndex = content.indexOf("---", 3);
+    if (endIndex !== -1) {
+      return content.slice(0, endIndex) + `metadata:
+${metadataLines}
+` + content.slice(endIndex);
+    }
+  }
+  return `---
+name: ${skillName}
+metadata:
+${metadataLines}
+---
+
+${content}`;
+}
+
+export {
+  LearnClient,
+  fetchRegistryWithFallback,
+  installSkillWithSecurity,
+  injectLearnMetadata,
+  computeProjectHash,
+  injectGeneratedMetadata
+};
+/**
+ * @license
+ * Copyright 2025 Autohand AI LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * LearnClient - Search, version-check, and filtering logic for /learn command.
+ * Wraps GitHubRegistryFetcher with learn-specific behavior.
+ */
+/**
+ * @license
+ * Copyright 2025 Autohand AI LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * SkillSecurityScanner - Client-side threat pattern scanning for community skills.
+ * Provides the second layer of security (after server-side scoring in the registry).
+ */
+/**
+ * @license
+ * Copyright 2025 Autohand AI LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Shared community skill install utilities.
+ * Used by both /skills (registry install) and /learn (LLM-generated install).
+ */

package/dist/{chunk-BRXIEKJ3.cjs → chunk-OLSBBZW6.cjs}

@@ -3,7 +3,7 @@
 
 
 
-var _chunkXBUMKEFNcjs = require('./chunk-XBUMKEFN.cjs');
+var _chunkZYQMLKOKcjs = require('./chunk-ZYQMLKOK.cjs');
 
 // src/utils/prompt.ts
 async function safePrompt(questions) {
@@ -17,7 +17,7 @@ async function safePrompt(questions) {
         label: choice.message,
         value: choice.name
       }));
-      const result = await _chunkXBUMKEFNcjs.showModal.call(void 0, {
+      const result = await _chunkZYQMLKOKcjs.showModal.call(void 0, {
         title: selectConfig.message,
         options,
         initialIndex: selectConfig.initial
@@ -25,19 +25,19 @@ async function safePrompt(questions) {
       value = _optionalChain([result, 'optionalAccess', _ => _.value]);
     } else if (question.type === "confirm") {
       const confirmConfig = question;
-      value = await _chunkXBUMKEFNcjs.showConfirm.call(void 0, {
+      value = await _chunkZYQMLKOKcjs.showConfirm.call(void 0, {
         title: confirmConfig.message,
         defaultValue: confirmConfig.initial
       });
     } else if (question.type === "password") {
       const inputConfig = question;
-      value = await _chunkXBUMKEFNcjs.showPassword.call(void 0, {
+      value = await _chunkZYQMLKOKcjs.showPassword.call(void 0, {
         title: inputConfig.message,
         validate: inputConfig.validate
       });
     } else if (question.type === "input") {
       const inputConfig = question;
-      value = await _chunkXBUMKEFNcjs.showInput.call(void 0, {
+      value = await _chunkZYQMLKOKcjs.showInput.call(void 0, {
         title: inputConfig.message,
         defaultValue: inputConfig.initial,
         validate: inputConfig.validate

package/dist/{chunk-MILZEEUV.js → chunk-OOKY3HPZ.js}

@@ -1,13 +1,19 @@
 import {
   t
-} from "./chunk-NMWEDN4Z.js";
+} from "./chunk-APIXPPMT.js";
 
 // src/commands/automode.ts
 import chalk from "chalk";
 var metadata = {
   command: "/automode",
   description: t("commands.automode.description"),
-  implemented: true
+  implemented: true,
+  subcommands: [
+    { name: "status", description: "Show current loop state" },
+    { name: "pause", description: "Pause the active loop" },
+    { name: "resume", description: "Resume paused loop" },
+    { name: "cancel", description: "Cancel the active loop" }
+  ]
 };
 function parseArgs(args) {
   const result = {};
@@ -137,7 +143,7 @@ function showHelp() {
 ${chalk.cyan("Auto-Mode: Autonomous Development Loops")}
 
 Auto-mode lets autohand work autonomously on tasks through
-iterative improvement cycles\u2014inspired by the Ralph technique.
+iterative improvement cycles-inspired by the Ralph technique.
 
 ${chalk.yellow("Usage:")}
   /automode <prompt>              Start auto-mode with a task