contentrain 0.16.0 → 0.17.0

package/README.md

@@ -332,11 +332,18 @@ Import a WordPress site into a `.contentrain` content store:
 ```bash
 contentrain import export.xml            # WXR export file (highest offline fidelity)
 contentrain import https://site.example  # public REST
-contentrain import https://site.example --auth user:app-password  # authenticated REST
+contentrain import https://site.example --auth editor  # authenticated REST: prompts for the Application Password
+CONTENTRAIN_WP_APP_PASSWORD=… contentrain import https://site.example --auth editor
+CONTENTRAIN_WP_AUTH=editor:… contentrain import https://site.example
+contentrain import export.xml --include-emails  # also write author/commenter e-mails
 ```
 
 Writes the canonical store plus `import-report.json`, `entry-source-map.json` (WP id → entry address), and — when the source has comments — `comments-export.json` (`contentrain-comments@1`, ready for a comments-service intake). An existing `.contentrain` is only overwritten with `--force`. Powered by `@contentrain/wp-import`.
 
+**Personal data.** The store holds author names and logins, and commenters' names, website URLs and comment text. A WXR export also carries author and commenter e-mail addresses; they are left out of the store and of `comments-export.json` unless you pass `--include-emails`. Commenter IPs, user agents and avatar URLs (including Akismet's comment meta) are never written. The e-mails stay out by default because the store usually ends up in git (sometimes a public repo). The REST path never sees them.
+
+**Credentials.** The Application Password is read from `CONTENTRAIN_WP_APP_PASSWORD` (with `--auth <user>`), from `CONTENTRAIN_WP_AUTH=user:password`, or from a hidden prompt. `--auth user:password` still works but is deprecated and warns: argv lands in shell history and process listings.
+
 ### `contentrain delta`
 
 Plan what a later WordPress change means for a store that was already delivered:

package/dist/{ide-D1J4iAhK.mjs → ide-zPN-87R5.mjs}

@@ -1,25 +1,24 @@
 import { appendFile, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { ensureDir, pathExists } from "@contentrain/mcp/util/fs";
 import { createGit } from "@contentrain/mcp/git/identity";
 //#region src/utils/ide.ts
-const AGENT_SKILL_NAMES = [
-	"contentrain",
-	"contentrain-normalize",
-	"contentrain-quality",
-	"contentrain-sdk",
-	"contentrain-content",
-	"contentrain-model",
-	"contentrain-init",
-	"contentrain-bulk",
-	"contentrain-validate-fix",
-	"contentrain-review",
-	"contentrain-translate",
-	"contentrain-generate",
-	"contentrain-serve",
-	"contentrain-diff",
-	"contentrain-doctor"
-];
+/**
+* Every skill the installed `@contentrain/skills` ships: the directories under
+* its `skills/` that hold a `SKILL.md`, sorted. Read from disk rather than kept
+* as a second hand-written list, which is how `contentrain skills` came to
+* install 15 of 16 (`contentrain-migrate-wordpress` was never added).
+*
+* The package exports `./skills/*` only, so the directory is found through one
+* known file: the core `contentrain` skill.
+*/
+async function listAgentSkillNames(resolveSkillFile) {
+	const { readdir } = await import("node:fs/promises");
+	const skillsRoot = dirname(dirname(resolveSkillFile("skills/contentrain/SKILL.md")));
+	const dirs = (await readdir(skillsRoot, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name);
+	const hasSkill = await Promise.all(dirs.map((d) => pathExists(join(skillsRoot, d, "SKILL.md"))));
+	return dirs.filter((_, i) => hasSkill[i]).toSorted();
+}
 const OLD_RULE_FILES = [
 	"contentrain-content-quality.md",
 	"contentrain-seo-rules.md",
@@ -223,7 +222,11 @@ async function installIdeRulesAndSkills(projectRoot, ide, resolveRuleFile, resol
 	if (resolveSkillFile) {
 		const skillsDir = join(projectRoot, ide.skillsDir);
 		await ensureDir(skillsDir);
-		for (const skillName of AGENT_SKILL_NAMES) {
+		let skillNames = [];
+		try {
+			skillNames = await listAgentSkillNames(resolveSkillFile);
+		} catch {}
+		for (const skillName of skillNames) {
 			const skillDir = join(skillsDir, skillName);
 			const skillMd = join(skillDir, "SKILL.md");
 			try {
@@ -294,4 +297,4 @@ async function addClaudeMdReference(projectRoot) {
 	}
 }
 //#endregion
-export { createPackageResolver as a, writeMcpConfig as c, addClaudeMdReference as i, IDE_CONFIGS as n, detectIdes as o, MCP_CONFIGS as r, installIdeRulesAndSkills as s, AGENT_SKILL_NAMES as t };
+export { detectIdes as a, writeMcpConfig as c, createPackageResolver as i, MCP_CONFIGS as n, installIdeRulesAndSkills as o, addClaudeMdReference as r, listAgentSkillNames as s, IDE_CONFIGS as t };

package/dist/{import-D9TtmPgM.mjs → import-DXA71z9x.mjs}

@@ -1,10 +1,64 @@
 import { i as pc } from "./ui-B8l_LC36.mjs";
 import { defineCommand } from "citty";
-import { intro, log, outro, spinner } from "@clack/prompts";
+import { intro, isCancel, log, outro, password, spinner } from "@clack/prompts";
 import { createReadStream, existsSync } from "node:fs";
 import { access, mkdir, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 //#region src/commands/import.ts
+/** `user:password` for REST, read from the environment so it stays out of argv and shell history. */
+const WP_AUTH_ENV = "CONTENTRAIN_WP_AUTH";
+/** The Application Password alone, for `--auth <user>`. */
+const WP_APP_PASSWORD_ENV = "CONTENTRAIN_WP_APP_PASSWORD";
+/** `user:password` → parts; the password may itself contain colons. */
+const splitUserPassword = (value) => {
+	const i = value.indexOf(":");
+	if (i <= 0 || i === value.length - 1) return void 0;
+	return {
+		user: value.slice(0, i),
+		appPassword: value.slice(i + 1)
+	};
+};
+/**
+* Where the REST credential comes from, in order:
+* 1. `--auth user:password` — still works, but argv lands in shell history and
+*    process listings, so the caller prints a deprecation warning.
+* 2. `--auth user` — the password from `CONTENTRAIN_WP_APP_PASSWORD`, else an
+*    interactive hidden prompt (only when `interactive`).
+* 3. `CONTENTRAIN_WP_AUTH=user:password` in the environment.
+* Nothing given → anonymous REST.
+*/
+async function resolveRestAuth(input) {
+	const flag = input.auth?.trim();
+	if (flag) {
+		if (flag.includes(":")) {
+			const auth = splitUserPassword(flag);
+			return auth ? {
+				auth,
+				deprecatedArgv: true
+			} : { error: "--auth expects a user name (the password comes from the environment or a prompt)" };
+		}
+		const fromEnv = input.env[WP_APP_PASSWORD_ENV];
+		if (fromEnv) return { auth: {
+			user: flag,
+			appPassword: fromEnv
+		} };
+		if (input.interactive && input.prompt) {
+			const pw = await input.prompt(flag);
+			if (pw) return { auth: {
+				user: flag,
+				appPassword: pw
+			} };
+			return { error: "No Application Password entered" };
+		}
+		return { error: `--auth ${flag} needs the Application Password in ${WP_APP_PASSWORD_ENV} (or run in a terminal to be prompted)` };
+	}
+	const envAuth = input.env[WP_AUTH_ENV];
+	if (envAuth) {
+		const auth = splitUserPassword(envAuth);
+		return auth ? { auth } : { error: `${WP_AUTH_ENV} must be user:password` };
+	}
+	return {};
+}
 var import_default = defineCommand({
 	meta: {
 		name: "import",
@@ -23,7 +77,12 @@ var import_default = defineCommand({
 		},
 		auth: {
 			type: "string",
-			description: "REST Application Password as user:password (lifts access to rest_auth)",
+			description: `REST user for an Application Password (lifts access to rest_auth). The password comes from ${WP_APP_PASSWORD_ENV} or a prompt; ${WP_AUTH_ENV}=user:password also works. user:password here is deprecated`,
+			required: false
+		},
+		"include-emails": {
+			type: "boolean",
+			description: "Write author and commenter e-mail addresses from a WXR export into the store (default: left out — they are personal data and the store usually lands in git)",
 			required: false
 		},
 		force: {
@@ -58,11 +117,29 @@ var import_default = defineCommand({
 		let raw;
 		const warnings = [];
 		if (isUrl) {
-			const [user, ...pw] = (args.auth ?? "").split(":");
-			const auth = args.auth && user && pw.length ? {
-				user,
-				appPassword: pw.join(":")
-			} : void 0;
+			const resolved = await resolveRestAuth({
+				auth: args.auth,
+				env: process.env,
+				interactive: !args.json && Boolean(process.stdin.isTTY),
+				prompt: async (user) => {
+					s?.stop("Credential needed");
+					const value = await password({ message: `Application Password for ${user}` });
+					s?.start(`Fetching ${args.source} over REST`);
+					return isCancel(value) ? void 0 : value;
+				}
+			});
+			if (resolved.error) {
+				s?.stop("Credential missing");
+				log.error(resolved.error);
+				process.exitCode = 1;
+				return;
+			}
+			if (resolved.deprecatedArgv) {
+				const msg = `--auth user:password is deprecated: the password lands in shell history and process listings. Use --auth <user> with ${WP_APP_PASSWORD_ENV} (or the prompt), or ${WP_AUTH_ENV}=user:password`;
+				if (args.json) process.stderr.write(`warning: ${msg}\n`);
+				else log.warning(msg);
+			}
+			const auth = resolved.auth;
 			const result = await fetchRestRawIR({
 				origin: args.source,
 				auth,
@@ -73,9 +150,10 @@ var import_default = defineCommand({
 		} else raw = (await parseWxr(createReadStream(args.source), { tool: "contentrain-cli" })).raw;
 		s?.stop(`Source read: ${raw.posts.length} posts, ${raw.attachments.length} media, ${raw.comments?.length ?? 0} comments (${raw.provenance.kind})`);
 		s?.start("Converting to .contentrain");
-		const { files, entry_source_map, report } = rawToContentrain(raw);
+		const includeEmails = Boolean(args["include-emails"]);
+		const { files, entry_source_map, report } = rawToContentrain(raw, { includeEmails });
 		if (raw.comments?.length) {
-			const exp = buildCommentsExport(raw, entry_source_map);
+			const exp = buildCommentsExport(raw, entry_source_map, { includeEmails });
 			files["comments-export.json"] = `${JSON.stringify(exp, null, 2)}\n`;
 			const summary = summarizeComments(exp);
 			if (summary.unresolved?.length) warnings.push(`${summary.unresolved.length} comments reference posts outside the import`);
@@ -99,6 +177,7 @@ var import_default = defineCommand({
 		if (report.password_protected_drafts) log.warning(`${report.password_protected_drafts} password-protected posts brought in as drafts — their body is the protected text; publish one only after deciding what it should show`);
 		if (report.dropped_relations) log.warning(`${report.dropped_relations} relations pointed outside the import and were dropped (details in import-report.json)`);
 		for (const w of warnings) log.warning(w);
+		if (includeEmails && raw.provenance.kind === "wxr") log.warning("Author and commenter e-mail addresses were written into the store (--include-emails). They are personal data: keep this repository private");
 		if (raw.comments?.length) log.info(`comments-export.json written (contentrain-comments@1) — ready for a comments-service intake`);
 		outro(`Done. Next: ${pc.bold("contentrain validate")} to check the imported store.`);
 	}

package/dist/index.mjs

@@ -2,7 +2,7 @@
 import { i as pc } from "./ui-B8l_LC36.mjs";
 import { defineCommand, runMain } from "citty";
 //#region package.json
-var version = "0.16.0";
+var version = "0.17.0";
 //#endregion
 //#region src/utils/debug.ts
 /**
@@ -43,8 +43,8 @@ runMain(defineCommand({
 		description: "Contentrain CLI — AI content governance infrastructure"
 	},
 	subCommands: {
-		init: () => import("./init-Bp5aMELm.mjs").then((m) => m.default),
-		import: () => import("./import-D9TtmPgM.mjs").then((m) => m.default),
+		init: () => import("./init-CqQgYoJq.mjs").then((m) => m.default),
+		import: () => import("./import-DXA71z9x.mjs").then((m) => m.default),
 		delta: () => import("./delta-D6Cp9BdP.mjs").then((m) => m.default),
 		status: () => import("./status-DSzoldCi.mjs").then((m) => m.default),
 		doctor: () => import("./doctor-B9MJgRO5.mjs").then((m) => m.default),
@@ -58,8 +58,8 @@ runMain(defineCommand({
 		describe: () => import("./describe-C6-AWlKx.mjs").then((m) => m.default),
 		"describe-format": () => import("./describe-format-CR0-NMR8.mjs").then((m) => m.default),
 		scaffold: () => import("./scaffold-DX6eJ0n1.mjs").then((m) => m.default),
-		setup: () => import("./setup-BRVyTOxY.mjs").then((m) => m.default),
-		skills: () => import("./skills-DZT0pbmO.mjs").then((m) => m.default),
+		setup: () => import("./setup-aaeHJ90i.mjs").then((m) => m.default),
+		skills: () => import("./skills-ix03X2Rj.mjs").then((m) => m.default),
 		studio: () => import("./studio-CU0fTK5f.mjs").then((m) => m.default)
 	}
 }));

package/dist/{init-Bp5aMELm.mjs → init-CqQgYoJq.mjs}

@@ -1,6 +1,6 @@
 import { i as pc } from "./ui-B8l_LC36.mjs";
 import { r as resolveProjectRoot, t as loadProjectContext } from "./context-SIGQmozp.mjs";
-import { a as createPackageResolver, c as writeMcpConfig, i as addClaudeMdReference, n as IDE_CONFIGS, o as detectIdes, s as installIdeRulesAndSkills } from "./ide-D1J4iAhK.mjs";
+import { a as detectIdes, c as writeMcpConfig, i as createPackageResolver, o as installIdeRulesAndSkills, r as addClaudeMdReference, t as IDE_CONFIGS } from "./ide-zPN-87R5.mjs";
 import { defineCommand } from "citty";
 import { confirm, intro, isCancel, log, multiselect, outro, select, spinner } from "@clack/prompts";
 import { appendFile, readFile, writeFile } from "node:fs/promises";

package/dist/{setup-BRVyTOxY.mjs → setup-aaeHJ90i.mjs}

@@ -1,6 +1,6 @@
 import { i as pc } from "./ui-B8l_LC36.mjs";
 import { r as resolveProjectRoot, t as loadProjectContext } from "./context-SIGQmozp.mjs";
-import { a as createPackageResolver, c as writeMcpConfig, n as IDE_CONFIGS, o as detectIdes, r as MCP_CONFIGS, s as installIdeRulesAndSkills } from "./ide-D1J4iAhK.mjs";
+import { a as detectIdes, c as writeMcpConfig, i as createPackageResolver, n as MCP_CONFIGS, o as installIdeRulesAndSkills, t as IDE_CONFIGS } from "./ide-zPN-87R5.mjs";
 import { defineCommand } from "citty";
 import { intro, log, outro, spinner } from "@clack/prompts";
 //#region src/commands/setup.ts

package/dist/{skills-DZT0pbmO.mjs → skills-ix03X2Rj.mjs}

@@ -1,6 +1,6 @@
 import { i as pc } from "./ui-B8l_LC36.mjs";
 import { r as resolveProjectRoot } from "./context-SIGQmozp.mjs";
-import { a as createPackageResolver, n as IDE_CONFIGS, o as detectIdes, s as installIdeRulesAndSkills, t as AGENT_SKILL_NAMES } from "./ide-D1J4iAhK.mjs";
+import { a as detectIdes, i as createPackageResolver, o as installIdeRulesAndSkills, s as listAgentSkillNames, t as IDE_CONFIGS } from "./ide-zPN-87R5.mjs";
 import { defineCommand } from "citty";
 import { intro, log, outro, spinner } from "@clack/prompts";
 import { join } from "node:path";
@@ -72,12 +72,18 @@ var skills_default = defineCommand({
 });
 async function listInstalledSkills(projectRoot) {
 	let found = false;
+	const resolveSkillFile = await createPackageResolver("@contentrain/skills", projectRoot);
+	let skillNames = [];
+	if (resolveSkillFile) try {
+		skillNames = await listAgentSkillNames(resolveSkillFile);
+	} catch {}
+	if (skillNames.length === 0) log.warning("@contentrain/skills package not found — cannot tell which skills are missing");
 	for (const [, ide] of Object.entries(IDE_CONFIGS)) {
 		const skillsDir = join(projectRoot, ide.skillsDir);
 		if (!await pathExists(skillsDir)) continue;
 		found = true;
 		log.info(`${pc.bold(ide.name)} (${ide.skillsDir}/):`);
-		for (const skillName of AGENT_SKILL_NAMES) if (await pathExists(join(skillsDir, skillName, "SKILL.md"))) log.message(`  ${pc.green("✓")} ${skillName}`);
+		for (const skillName of skillNames) if (await pathExists(join(skillsDir, skillName, "SKILL.md"))) log.message(`  ${pc.green("✓")} ${skillName}`);
 		else log.message(`  ${pc.red("✗")} ${skillName} ${pc.dim("(missing)")}`);
 		if (await pathExists(join(projectRoot, ide.rulesDir, ide.guardrailsFileName))) log.message(`  ${pc.green("✓")} essential rules`);
 		else log.message(`  ${pc.red("✗")} essential rules ${pc.dim("(missing)")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "contentrain",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "license": "MIT",
   "description": "CLI for Contentrain — AI content governance infrastructure",
   "type": "module",
@@ -47,12 +47,12 @@
     "simple-git": "^3.27.0",
     "ws": "^8.18.0",
     "zod": "^3.24.0",
-    "@contentrain/mcp": "3.10.0",
-    "@contentrain/query": "7.6.41",
+    "@contentrain/mcp": "3.10.1",
     "@contentrain/rules": "0.7.3",
-    "@contentrain/skills": "0.9.5",
-    "@contentrain/types": "1.61.0",
-    "@contentrain/wp-import": "0.12.1"
+    "@contentrain/query": "7.6.42",
+    "@contentrain/skills": "0.9.6",
+    "@contentrain/types": "1.62.0",
+    "@contentrain/wp-import": "0.13.0"
   },
   "devDependencies": {
     "@types/ws": "^8.5.0",