bazilion 0.7.0 → 0.8.0

package/dist/cli.js

@@ -6,7 +6,7 @@ import { defineCommand as defineCommand23, runCommand, showUsage } from "citty";
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.7.0",
+  version: "0.8.0",
   description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/groups/skills, and run the local daemon.",
   license: "MIT",
   repository: {
@@ -736,15 +736,38 @@ var skillAddCmd = defineCommand({
   meta: { name: "add", description: "Attach a skill to an agent" },
   args: {
     agent: { type: "positional", required: true },
-    skill: { type: "positional", required: true }
+    skill: { type: "positional", required: true },
+    "allow-warnings": {
+      type: "boolean",
+      description: "Attach even when the static skill scan reports findings"
+    }
   },
   async run({ args }) {
     const client = createClient2();
-    const body = { skill: args.skill };
-    await client.post(`/api/agents/${args.agent}/skills`, body);
+    const body = { skill: args.skill, allowFindings: args["allow-warnings"] };
+    try {
+      await client.post(`/api/agents/${args.agent}/skills`, body);
+    } catch (err) {
+      if (err instanceof ApiClientError && err.body.code === "skill_scan_blocked") {
+        console.error(`error: ${err.body.error}`);
+        printSkillFindings(err.body.findings ?? []);
+        console.error("  hint: inspect the skill, then rerun with --allow-warnings to confirm");
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
+    }
     console.log(`attached skill ${args.skill} to ${args.agent}`);
   }
 });
+function printSkillFindings(findings) {
+  if (findings.length === 0) return;
+  console.error("scan findings:");
+  for (const f of findings) {
+    const line = f.line ? ` line ${f.line}` : "";
+    console.error(`  ${f.severity}: ${f.code}${line} - ${f.message}`);
+  }
+}
 var skillRmCmd = defineCommand({
   meta: { name: "rm", description: "Detach a skill from an agent" },
   args: {
@@ -2830,6 +2853,12 @@ var serveCommand = defineCommand17({
 import { existsSync as existsSync6, readFileSync as readFileSync7, statSync } from "fs";
 import { basename as basename2, resolve as resolve2 } from "path";
 import { defineCommand as defineCommand18 } from "citty";
+function printFindings(findings, prefix = "  ") {
+  for (const f of findings) {
+    const line = f.line ? ` line ${f.line}` : "";
+    console.log(`${prefix}${f.severity}: ${f.code}${line} - ${f.message}`);
+  }
+}
 var listCmd10 = defineCommand18({
   meta: { name: "list", description: "List installed skills (or those attached to an agent)" },
   args: {
@@ -2860,6 +2889,15 @@ var listCmd10 = defineCommand18({
       s.parseError ? `(parse error: ${s.parseError})` : s.description
     ]);
     for (const line of columnize(rows)) console.log(line);
+    const flagged = skills.filter((s) => s.scanFindings && s.scanFindings.length > 0);
+    if (flagged.length > 0) {
+      console.log("");
+      console.log("scan findings:");
+      for (const s of flagged) {
+        console.log(`${s.name}:`);
+        printFindings(s.scanFindings ?? []);
+      }
+    }
   }
 });
 var importCmd = defineCommand18({
@@ -2880,19 +2918,36 @@ var importCmd = defineCommand18({
     const absFrom = resolve2(args.from);
     const isLocalZip = args.from.toLowerCase().endsWith(".zip") && existsSync6(absFrom) && statSync(absFrom).isFile();
     let result;
-    if (isLocalZip) {
-      const bytes = readFileSync7(absFrom);
-      const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
-      const fd = new FormData();
-      fd.set("file", file);
-      if (args.force) fd.set("force", "true");
-      result = await client.postMultipart("/api/skills/import", fd);
-    } else {
-      const body = {
-        source: args.from,
-        force: args.force
-      };
-      result = await client.post("/api/skills/import", body);
+    try {
+      if (isLocalZip) {
+        const bytes = readFileSync7(absFrom);
+        const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
+        const fd = new FormData();
+        fd.set("file", file);
+        if (args.force) fd.set("force", "true");
+        result = await client.postMultipart("/api/skills/import", fd);
+      } else {
+        const body = {
+          source: args.from,
+          force: args.force
+        };
+        result = await client.post("/api/skills/import", body);
+      }
+    } catch (err) {
+      if (err instanceof ApiClientError && err.body.code === "skill_scan_blocked") {
+        console.error(`error: ${err.body.error}`);
+        if (err.body.findings && err.body.findings.length > 0) {
+          console.error("scan findings:");
+          for (const f of err.body.findings) {
+            const line = f.line ? ` line ${f.line}` : "";
+            console.error(`  ${f.severity}: ${f.code}${line} - ${f.message}`);
+          }
+        }
+        console.error("  hint: inspect the skill, then rerun with --force to confirm");
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
     }
     if (result.imported.length === 0 && result.skipped.length === 0) {
       console.log("(nothing to import)");
@@ -2904,6 +2959,14 @@ var importCmd = defineCommand18({
     for (const s of result.skipped) {
       console.log(`skipped ${s.name}: ${s.reason}`);
     }
+    if (result.findings && Object.keys(result.findings).length > 0) {
+      console.log("");
+      console.log("confirmed scan findings:");
+      for (const [name, findings] of Object.entries(result.findings)) {
+        console.log(`${name}:`);
+        printFindings(findings);
+      }
+    }
   }
 });
 var rmCmd5 = defineCommand18({