dotcms 0.2.1 → 26.9.9-1

package/index.js

@@ -57,6 +57,24 @@ var SERVER_ENV = {
 };
 var SKILLS_SOURCE = "dotCMS/agent-toolkit";
 
+// libs/sdk/cli/src/shared/env.ts
+var ENV_KEYS = {
+  url: "DOTCMS_URL",
+  password: "DOTCMS_PASSWORD",
+  authToken: "DOTCMS_AUTH_TOKEN",
+  codexHome: "CODEX_HOME"
+};
+function readEnv(key) {
+  const value = process.env[key];
+  return value && value.trim() !== "" ? value : void 0;
+}
+function envWithoutSecrets(extra = {}) {
+  const clean = { ...process.env };
+  delete clean[ENV_KEYS.authToken];
+  delete clean[ENV_KEYS.password];
+  return { ...clean, ...extra };
+}
+
 // libs/sdk/cli/src/commands/agent/connect.ts
 var DEFAULT_TIMEOUT_MS = 6e4;
 function classify(stderr) {
@@ -71,11 +89,17 @@ async function confirmConnection(args) {
   const timeoutMs = args.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const child = childProcess.spawn("npx", ["-y", MCP_SERVER_PACKAGE], {
     stdio: ["pipe", "pipe", "pipe"],
-    env: {
-      ...process.env,
+    // `npx` is `npx.cmd` on Windows and Node refuses `.cmd` without a shell since the
+    // CVE-2024-27980 fix — so FR-024a failed on every Windows run, reporting a broken
+    // server for a configuration that was written correctly.
+    shell: process.platform === "win32",
+    // This child needs the URL and the token; it has no use for the developer's
+    // DOTCMS_PASSWORD, and it is an unpinned `@latest` package by design — so the smaller
+    // the environment it sees, the better.
+    env: envWithoutSecrets({
       [SERVER_ENV.url]: args.url,
       [SERVER_ENV.token]: args.token
-    }
+    })
   });
   let stderr = "";
   child.stderr?.on("data", (chunk) => {
@@ -89,7 +113,15 @@ async function confirmConnection(args) {
       settled = true;
       clearTimeout(timer);
       try {
-        child.kill();
+        child.stdin?.end();
+      } catch {
+      }
+      try {
+        if (process.platform === "win32" && child.pid) {
+          childProcess.spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"]);
+        } else {
+          child.kill();
+        }
       } catch {
       }
       resolve2(result);
@@ -112,6 +144,17 @@ async function confirmConnection(args) {
           continue;
         try {
           const message = JSON.parse(line);
+          if (message.id === 1) {
+            child.stdin?.write(
+              `${JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })}
+`
+            );
+            child.stdin?.write(
+              `${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" })}
+`
+            );
+            continue;
+          }
           const tools = message.result?.tools;
           if (Array.isArray(tools))
             finish({ ok: true, toolCount: tools.length });
@@ -144,108 +187,23 @@ async function confirmConnection(args) {
       })}
 `
     );
-    child.stdin?.write(`${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" })}
-`);
   });
 }
 
 // libs/sdk/cli/src/commands/agent/gitignore.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync } from "node:fs";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-function findRepositoryRoot(from) {
-  let dir = path.resolve(from);
-  for (; ; ) {
-    if (existsSync(path.join(dir, ".git")))
-      return dir;
-    const parent = path.dirname(dir);
-    if (parent === dir)
-      return null;
-    dir = parent;
-  }
-}
-async function protectFromVersionControl(args) {
-  const warnings = [];
-  const root = findRepositoryRoot(args.cwd);
-  const committed = new Set(args.committedByConvention ?? []);
-  for (const file of args.files) {
-    if (committed.has(file)) {
-      warnings.push(
-        `${path.basename(file)} is normally committed to version control \u2014 it now holds a token, so committing it would publish that token.`
-      );
-    }
-  }
-  if (!root) {
-    warnings.push(
-      "This directory is not under version control, so these files are unprotected \u2014 nothing here can exclude them for you."
-    );
-    return { files: args.files, inRepository: false, excluded: false, warnings };
-  }
-  const proceed = args.confirmExclude ? await args.confirmExclude(args.files) : false;
-  if (!proceed) {
-    return { files: args.files, inRepository: true, excluded: false, warnings };
-  }
-  const gitignorePath = path.join(root, ".gitignore");
-  let current = "";
-  try {
-    current = await fs.readFile(gitignorePath, "utf8");
-  } catch {
-  }
-  const already = new Set(current.split("\n").map((line) => line.trim()));
-  const toAdd = args.files.map((file) => path.relative(root, file).split(path.sep).join("/")).filter((entry) => !already.has(entry));
-  if (toAdd.length) {
-    const prefix = current === "" || current.endsWith("\n") ? "" : "\n";
-    const block = `${prefix}
-# dotCMS agent configuration \u2014 contains an access token
-${toAdd.join("\n")}
-`;
-    await fs.writeFile(gitignorePath, current + block, "utf8");
-  }
-  return { files: args.files, inRepository: true, excluded: true, warnings };
-}
-
-// libs/sdk/cli/src/commands/agent/skills.ts
-import * as childProcess2 from "node:child_process";
-function buildSkillsArgs(agentIds, global) {
-  return [
-    "-y",
-    "skills",
-    "add",
-    SKILLS_SOURCE,
-    ...agentIds.flatMap((id) => ["-a", id]),
-    ...global ? ["-g"] : [],
-    "-y"
-  ];
-}
-async function installSkills(args) {
-  const argv = buildSkillsArgs(args.agentIds, args.global);
-  const command = `npx ${argv.join(" ")}`;
-  try {
-    const result = childProcess2.spawnSync("npx", argv, { stdio: "inherit" });
-    if (result.status === 0)
-      return { ok: true, command };
-    return { ok: false, command, reason: `skills exited with code ${result.status}` };
-  } catch (error) {
-    return { ok: false, command, reason: error.message };
-  }
-}
-
-// libs/sdk/cli/src/commands/agent/targets/registry.ts
-import { existsSync as existsSync2 } from "node:fs";
-import * as os from "node:os";
+import * as fs2 from "node:fs/promises";
 import * as path2 from "node:path";
 
-// libs/sdk/cli/src/shared/env.ts
-var ENV_KEYS = {
-  url: "DOTCMS_URL",
-  password: "DOTCMS_PASSWORD",
-  authToken: "DOTCMS_AUTH_TOKEN",
-  codexHome: "CODEX_HOME"
-};
-function readEnv(key) {
-  const value = process.env[key];
-  return value && value.trim() !== "" ? value : void 0;
-}
+// libs/sdk/cli/src/shared/config-file.ts
+import {
+  findNodeAtLocation,
+  parse as parseJsonc,
+  parseTree
+} from "jsonc-parser";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
 
 // libs/sdk/cli/src/shared/errors.ts
 var CliError = class extends Error {
@@ -256,11 +214,31 @@ var CliError = class extends Error {
 };
 var UsageError = class extends CliError {
 };
+function withoutCredentials(value) {
+  try {
+    const u = new URL(value);
+    u.username = "";
+    u.password = "";
+    const path5 = u.pathname === "/" && !/\/$/.test(value) ? "" : u.pathname;
+    return `${u.protocol}//${u.host}${path5}${u.search}`;
+  } catch {
+    return value.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/]*@/i, "$1");
+  }
+}
 var InvalidUrlError = class extends CliError {
   constructor(value) {
-    const host = value.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/^\/+/, "");
+    const safe = withoutCredentials(value);
+    const host = safe.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/^\/+/, "");
+    super(
+      `"${safe}" is not a valid instance address. Pass it with an http:// or https:// scheme, e.g. https://${host || "demo.dotcms.com"}`
+    );
+  }
+};
+var CredentialInUrlError = class extends CliError {
+  constructor(url) {
+    const safe = withoutCredentials(url);
     super(
-      `"${value}" is not a valid instance address. Pass it with an http:// or https:// scheme, e.g. https://${host || "demo.dotcms.com"}`
+      `The instance address must not carry a username or password. Use ${safe} on its own \u2014 setup will ask you to sign in, or pass --authToken.`
     );
   }
 };
@@ -273,7 +251,15 @@ var InstanceUnreachableError = class extends CliError {
 };
 var NotADotCmsInstanceError = class extends CliError {
   constructor(url) {
-    super(`${url} is not a valid dotCMS instance. Check the address.`);
+    let hint = " Check the address.";
+    try {
+      const parsed = new URL(url);
+      if (parsed.pathname !== "/" && parsed.pathname !== "") {
+        hint = ` That address includes a path; the instance itself is probably ${parsed.origin}.`;
+      }
+    } catch {
+    }
+    super(`${url} is not a valid dotCMS instance.${hint}`);
   }
 };
 var CredentialsRejectedError = class extends CliError {
@@ -318,6 +304,13 @@ var NoConfigPathError = class extends CliError {
     );
   }
 };
+var UnreadableConfigError = class extends CliError {
+  constructor(file, reason) {
+    super(
+      `${file} could not be read \u2014 ${reason}. Nothing was changed. Check the file's permissions, or re-run with --skip-mcp.`
+    );
+  }
+};
 var MalformedConfigError = class extends CliError {
   /** The format is passed, not sniffed from the extension: both callers know exactly which
    *  parser just refused the file. */
@@ -328,17 +321,257 @@ var MalformedConfigError = class extends CliError {
   }
 };
 
+// libs/sdk/cli/src/shared/config-file.ts
+var CAN_RESTRICT = process.platform !== "win32";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+async function readFileIfPresent(file) {
+  try {
+    return await fs.readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new UnreadableConfigError(file, error.message);
+  }
+}
+async function writeFileAtomic(file, contents) {
+  const temp = `${file}.dotcms-${process.pid}.tmp`;
+  try {
+    await fs.writeFile(temp, contents, { encoding: "utf8", mode: FILE_MODE });
+  } catch {
+    await fs.writeFile(file, contents, { encoding: "utf8", mode: FILE_MODE });
+    return;
+  }
+  try {
+    await fs.rename(temp, file);
+  } catch (error) {
+    await fs.rm(temp, { force: true });
+    throw error;
+  }
+}
+var PARSE_OPTIONS = { allowTrailingComma: true, allowEmptyContent: true };
+function parseOrThrow(raw, file) {
+  if (raw.trim() === "")
+    return {};
+  const errors = [];
+  const doc = parseJsonc(raw, errors, PARSE_OPTIONS);
+  if (errors.length > 0 || doc === void 0)
+    throw new MalformedConfigError(file);
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
+    throw new MalformedConfigError(file);
+  }
+  return doc;
+}
+async function readJsonDocument(file) {
+  const raw = await readFileIfPresent(file);
+  return raw === null ? null : parseOrThrow(raw, file);
+}
+function detectIndent(raw) {
+  const match = raw.match(/\n([ \t]+)\S/);
+  if (!match)
+    return { insertSpaces: true, tabSize: 2 };
+  const indent = match[1];
+  return indent.startsWith("	") ? { insertSpaces: false, tabSize: 1 } : { insertSpaces: true, tabSize: indent.length };
+}
+async function hasEntry(args) {
+  const doc = await readJsonDocument(args.file).catch(() => null);
+  const container = doc?.[args.containerKey] ?? {};
+  return Object.prototype.hasOwnProperty.call(container, args.entryKey);
+}
+async function restrictFile(file, canRestrict = CAN_RESTRICT) {
+  if (!canRestrict)
+    return false;
+  await fs.chmod(file, FILE_MODE);
+  return true;
+}
+async function ensureDir(dir) {
+  const created = await fs.mkdir(dir, { recursive: true });
+  if (created && CAN_RESTRICT)
+    await fs.chmod(dir, DIR_MODE).catch(() => void 0);
+}
+function renderAt(value, unit, depth) {
+  const base = unit.repeat(depth);
+  return JSON.stringify(value, null, unit).split("\n").map((line, i) => i === 0 ? line : base + line).join("\n");
+}
+function setProperty(raw, object, key, value, unit, depth) {
+  const rendered = renderAt(value, unit, depth);
+  const properties = object.children ?? [];
+  const existing = properties.find((p) => p.children?.[0]?.value === key);
+  if (existing?.children?.[1]) {
+    const node = existing.children[1];
+    return raw.slice(0, node.offset) + rendered + raw.slice(node.offset + node.length);
+  }
+  const insertion = `"${key}": ${rendered}`;
+  const last = properties[properties.length - 1];
+  if (last) {
+    const end = last.offset + last.length;
+    return `${raw.slice(0, end)},
+${unit.repeat(depth)}${insertion}${raw.slice(end)}`;
+  }
+  const close = raw.lastIndexOf("}", object.offset + object.length);
+  return `${raw.slice(0, object.offset + 1)}
+${unit.repeat(depth)}${insertion}
+${unit.repeat(depth - 1)}${raw.slice(close)}`;
+}
+async function writeMerged(args) {
+  const raw = await readFileIfPresent(args.file);
+  const existing = raw === null ? {} : parseOrThrow(raw, args.file);
+  const container = existing[args.containerKey] ?? {};
+  const replacedExisting = Object.prototype.hasOwnProperty.call(container, args.entryKey);
+  let next;
+  const tree = raw === null ? void 0 : parseTree(raw, [], PARSE_OPTIONS);
+  if (raw === null || raw.trim() === "" || tree?.type !== "object") {
+    next = `${JSON.stringify({ [args.containerKey]: { [args.entryKey]: args.entry } }, null, 2)}
+`;
+  } else {
+    const { insertSpaces, tabSize } = detectIndent(raw);
+    const unit = insertSpaces ? " ".repeat(tabSize) : "	";
+    const containerNode = findNodeAtLocation(tree, [args.containerKey]);
+    next = containerNode?.type === "object" ? setProperty(raw, containerNode, args.entryKey, args.entry, unit, 2) : setProperty(
+      raw,
+      tree,
+      args.containerKey,
+      { [args.entryKey]: args.entry },
+      unit,
+      1
+    );
+  }
+  await ensureDir(path.dirname(args.file));
+  await writeFileAtomic(args.file, next);
+  const permissionsApplied = await restrictFile(args.file, args.canRestrict ?? CAN_RESTRICT);
+  return { path: args.file, permissionsApplied, replacedExisting };
+}
+
+// libs/sdk/cli/src/commands/agent/gitignore.ts
+function asPattern(relative2) {
+  const escaped = relative2.replace(/([\\*?[\]])/g, "\\$1").replace(/ $/, "\\ ");
+  return `/${escaped}`;
+}
+function confirmIgnored(root, files) {
+  const missed = [];
+  for (const file of files) {
+    const result = spawnSync2("git", ["check-ignore", "-q", file], { cwd: root });
+    if (result.error || result.status === null || result.status > 1)
+      return null;
+    if (result.status === 1)
+      missed.push(path2.basename(file));
+  }
+  return missed;
+}
+function findRepositoryRoot(from) {
+  let dir = path2.resolve(from);
+  for (; ; ) {
+    if (existsSync(path2.join(dir, ".git")))
+      return dir;
+    const parent = path2.dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+async function protectFromVersionControl(args) {
+  const warnings = [];
+  const root = findRepositoryRoot(args.cwd);
+  const committed = new Set(args.committedByConvention ?? []);
+  for (const file of args.files) {
+    if (committed.has(file)) {
+      warnings.push(
+        `${path2.basename(file)} is normally committed to version control \u2014 it now holds a token, so committing it would publish that token.`
+      );
+    }
+  }
+  if (!root) {
+    warnings.push(
+      "This directory is not under version control, so these files are unprotected \u2014 nothing here can exclude them for you."
+    );
+    return { files: args.files, inRepository: false, excluded: false, warnings };
+  }
+  const proceed = args.confirmExclude ? await args.confirmExclude(args.files) : false;
+  if (!proceed) {
+    return { files: args.files, inRepository: true, excluded: false, warnings };
+  }
+  const gitignorePath = path2.join(root, ".gitignore");
+  const current = await readFileIfPresent(gitignorePath) ?? "";
+  const already = new Set(current.split("\n").map((line) => line.trim()));
+  const relatives = args.files.map((file) => path2.relative(root, file).split(path2.sep).join("/"));
+  const toAdd = relatives.filter((rel) => !already.has(rel) && !already.has(asPattern(rel)));
+  if (toAdd.length) {
+    const prefix = current === "" || current.endsWith("\n") ? "" : "\n";
+    const block = `${prefix}
+# dotCMS agent configuration \u2014 contains an access token
+${toAdd.map(asPattern).join("\n")}
+`;
+    await fs2.writeFile(gitignorePath, current + block, "utf8");
+  }
+  const unverified = confirmIgnored(root, args.files);
+  if (unverified === null) {
+    warnings.push(
+      "Could not confirm with git that these files are excluded \u2014 check `git status` before committing."
+    );
+  } else if (unverified.length) {
+    warnings.push(
+      `.gitignore was written but git still tracks: ${unverified.join(", ")}. Exclude them by hand before committing.`
+    );
+  }
+  return {
+    files: args.files,
+    inRepository: true,
+    excluded: unverified !== null && unverified.length === 0,
+    warnings
+  };
+}
+
+// libs/sdk/cli/src/commands/agent/skills.ts
+import * as childProcess2 from "node:child_process";
+function buildSkillsArgs(agentIds, global) {
+  return [
+    "-y",
+    "skills",
+    "add",
+    SKILLS_SOURCE,
+    ...agentIds.flatMap((id) => ["-a", id]),
+    ...global ? ["-g"] : [],
+    "-y"
+  ];
+}
+async function installSkills(args) {
+  const argv = buildSkillsArgs(args.agentIds, args.global);
+  const command = `npx ${argv.join(" ")}`;
+  try {
+    const result = childProcess2.spawnSync("npx", argv, {
+      stdio: "inherit",
+      // The doc comment above says no secret is passed; `spawnSync` defaults to the whole
+      // environment, so it was not true until this line.
+      env: envWithoutSecrets(),
+      // On Windows `npx` is `npx.cmd`, and since the CVE-2024-27980 fix Node refuses to
+      // execute `.cmd`/`.bat` without a shell — so this spawn failed on every Windows run
+      // and FR-025 never installed anything there.
+      shell: process.platform === "win32"
+    });
+    if (result.error)
+      return { ok: false, command, reason: result.error.message };
+    if (result.status === 0)
+      return { ok: true, command };
+    return { ok: false, command, reason: `skills exited with code ${result.status}` };
+  } catch (error) {
+    return { ok: false, command, reason: error.message };
+  }
+}
+
 // libs/sdk/cli/src/commands/agent/targets/registry.ts
+import { existsSync as existsSync2 } from "node:fs";
+import * as os from "node:os";
+import * as path3 from "node:path";
 var home = () => os.homedir();
-var inHome = (...parts) => path2.join(home(), ...parts);
-var inFolder = (cwd, ...parts) => path2.join(cwd ?? process.cwd(), ...parts);
+var inHome = (...parts) => path3.join(home(), ...parts);
+var inFolder = (cwd, ...parts) => path3.join(cwd ?? process.cwd(), ...parts);
 var probe = (...parts) => async () => existsSync2(inHome(...parts));
 function vscodeUserDir() {
   if (process.platform === "darwin")
     return inHome("Library", "Application Support", "Code", "User");
   if (process.platform === "win32") {
     const appData = process.env["APPDATA"] ?? inHome("AppData", "Roaming");
-    return path2.join(appData, "Code", "User");
+    return path3.join(appData, "Code", "User");
   }
   return inHome(".config", "Code", "User");
 }
@@ -384,7 +617,7 @@ var TARGETS = [
     containerKey: "servers",
     entryShape: "stdio",
     detect: async () => existsSync2(vscodeUserDir()),
-    configPath: (scope, cwd) => scope === "global" ? path2.join(vscodeUserDir(), "mcp.json") : inFolder(cwd, ".vscode", "mcp.json")
+    configPath: (scope, cwd) => scope === "global" ? path3.join(vscodeUserDir(), "mcp.json") : inFolder(cwd, ".vscode", "mcp.json")
   },
   {
     id: "codex",
@@ -395,7 +628,7 @@ var TARGETS = [
     containerKey: "mcp_servers",
     entryShape: "stdio",
     detect: probe(".codex"),
-    configPath: (scope, cwd) => scope === "global" ? path2.join(codexHome(), "config.toml") : inFolder(cwd, ".codex", "config.toml")
+    configPath: (scope, cwd) => scope === "global" ? path3.join(codexHome(), "config.toml") : inFolder(cwd, ".codex", "config.toml")
   },
   {
     id: "antigravity",
@@ -458,117 +691,6 @@ function buildEntry(target, url, token) {
   return { type: "stdio", command: "npx", args: ["-y", MCP_SERVER_PACKAGE], env };
 }
 
-// libs/sdk/cli/src/shared/config-file.ts
-import {
-  findNodeAtLocation,
-  parse as parseJsonc,
-  parseTree
-} from "jsonc-parser";
-import * as fs2 from "node:fs/promises";
-import * as path3 from "node:path";
-var CAN_RESTRICT = process.platform !== "win32";
-var FILE_MODE = 384;
-var DIR_MODE = 448;
-var PARSE_OPTIONS = { allowTrailingComma: true, allowEmptyContent: true };
-function parseOrThrow(raw, file) {
-  if (raw.trim() === "")
-    return {};
-  const errors = [];
-  const doc = parseJsonc(raw, errors, PARSE_OPTIONS);
-  if (errors.length > 0 || doc === void 0)
-    throw new MalformedConfigError(file);
-  return doc;
-}
-async function readJsonDocument(file) {
-  let raw;
-  try {
-    raw = await fs2.readFile(file, "utf8");
-  } catch {
-    return null;
-  }
-  return parseOrThrow(raw, file);
-}
-function detectIndent(raw) {
-  const match = raw.match(/\n([ \t]+)\S/);
-  if (!match)
-    return { insertSpaces: true, tabSize: 2 };
-  const indent = match[1];
-  return indent.startsWith("	") ? { insertSpaces: false, tabSize: 1 } : { insertSpaces: true, tabSize: indent.length };
-}
-async function hasEntry(args) {
-  const doc = await readJsonDocument(args.file).catch(() => null);
-  const container = doc?.[args.containerKey] ?? {};
-  return Object.prototype.hasOwnProperty.call(container, args.entryKey);
-}
-async function restrictFile(file, canRestrict = CAN_RESTRICT) {
-  if (!canRestrict)
-    return false;
-  await fs2.chmod(file, FILE_MODE);
-  return true;
-}
-async function ensureDir(dir) {
-  const created = await fs2.mkdir(dir, { recursive: true });
-  if (created && CAN_RESTRICT)
-    await fs2.chmod(dir, DIR_MODE).catch(() => void 0);
-}
-function renderAt(value, unit, depth) {
-  const base = unit.repeat(depth);
-  return JSON.stringify(value, null, unit).split("\n").map((line, i) => i === 0 ? line : base + line).join("\n");
-}
-function setProperty(raw, object, key, value, unit, depth) {
-  const rendered = renderAt(value, unit, depth);
-  const properties = object.children ?? [];
-  const existing = properties.find((p) => p.children?.[0]?.value === key);
-  if (existing?.children?.[1]) {
-    const node = existing.children[1];
-    return raw.slice(0, node.offset) + rendered + raw.slice(node.offset + node.length);
-  }
-  const insertion = `"${key}": ${rendered}`;
-  const last = properties[properties.length - 1];
-  if (last) {
-    const end = last.offset + last.length;
-    return `${raw.slice(0, end)},
-${unit.repeat(depth)}${insertion}${raw.slice(end)}`;
-  }
-  const close = raw.lastIndexOf("}", object.offset + object.length);
-  return `${raw.slice(0, object.offset + 1)}
-${unit.repeat(depth)}${insertion}
-${unit.repeat(depth - 1)}${raw.slice(close)}`;
-}
-async function writeMerged(args) {
-  let raw;
-  try {
-    raw = await fs2.readFile(args.file, "utf8");
-  } catch {
-    raw = null;
-  }
-  const existing = raw === null ? {} : parseOrThrow(raw, args.file);
-  const container = existing[args.containerKey] ?? {};
-  const replacedExisting = Object.prototype.hasOwnProperty.call(container, args.entryKey);
-  let next;
-  const tree = raw === null ? void 0 : parseTree(raw, [], PARSE_OPTIONS);
-  if (raw === null || raw.trim() === "" || tree?.type !== "object") {
-    next = `${JSON.stringify({ [args.containerKey]: { [args.entryKey]: args.entry } }, null, 2)}
-`;
-  } else {
-    const { insertSpaces, tabSize } = detectIndent(raw);
-    const unit = insertSpaces ? " ".repeat(tabSize) : "	";
-    const containerNode = findNodeAtLocation(tree, [args.containerKey]);
-    next = containerNode?.type === "object" ? setProperty(raw, containerNode, args.entryKey, args.entry, unit, 2) : setProperty(
-      raw,
-      tree,
-      args.containerKey,
-      { [args.entryKey]: args.entry },
-      unit,
-      1
-    );
-  }
-  await ensureDir(path3.dirname(args.file));
-  await fs2.writeFile(args.file, next, "utf8");
-  const permissionsApplied = await restrictFile(args.file, args.canRestrict ?? CAN_RESTRICT);
-  return { path: args.file, permissionsApplied, replacedExisting };
-}
-
 // libs/sdk/cli/src/commands/agent/targets/json-target.ts
 function hasJsonEntry(file, target) {
   return hasEntry({ file, containerKey: target.containerKey, entryKey: ENTRY_KEY });
@@ -587,19 +709,16 @@ async function writeJsonTarget(args) {
 
 // libs/sdk/cli/src/commands/agent/targets/toml-target.ts
 import { parse, stringify } from "smol-toml";
-import * as fs3 from "node:fs/promises";
 import * as path4 from "node:path";
 async function hasTomlEntry(file, target) {
-  let raw;
-  try {
-    raw = await fs3.readFile(file, "utf8");
-  } catch {
-    return false;
-  }
-  return findEntrySpan(raw.split("\n"), target.containerKey) !== null;
+  const raw = await readFileIfPresent(file);
+  return raw === null ? false : findEntrySpan(raw.split("\n"), target.containerKey) !== null;
 }
 function findEntrySpan(lines, containerKey) {
-  const ours = new RegExp(`^\\s*\\[\\s*${containerKey}\\.${ENTRY_KEY}\\s*(\\.[^\\]]+)?\\]`);
+  const spelt = (key) => `(?:${key}|"${key}"|'${key}')`;
+  const ours = new RegExp(
+    `^\\s*\\[\\s*${spelt(containerKey)}\\s*\\.\\s*${spelt(ENTRY_KEY)}\\s*(\\.[^\\]]*)?\\]`
+  );
   const anyHeader = /^\s*\[/;
   const start = lines.findIndex((line) => ours.test(line));
   if (start === -1)
@@ -626,11 +745,7 @@ async function writeTomlTarget(args) {
   if (!file) {
     throw new NoConfigPathError(args.target.displayName, args.scope);
   }
-  let original = "";
-  try {
-    original = await fs3.readFile(file, "utf8");
-  } catch {
-  }
+  const original = await readFileIfPresent(file) ?? "";
   if (original.trim() !== "") {
     try {
       parse(original);
@@ -656,8 +771,8 @@ async function writeTomlTarget(args) {
     }
   }
   await ensureDir(path4.dirname(file));
-  await fs3.writeFile(file, next.endsWith("\n") ? next : `${next}
-`, "utf8");
+  await writeFileAtomic(file, next.endsWith("\n") ? next : `${next}
+`);
   return { path: file, permissionsApplied: await restrictFile(file), replacedExisting };
 }
 
@@ -718,8 +833,37 @@ function isHttpError(error) {
   return error instanceof HttpError;
 }
 var DEFAULT_TIMEOUT_MS2 = 1e4;
-async function readBody(response) {
-  const text = await response.text().catch(() => "");
+var MAX_BODY_BYTES = 10 * 1024 * 1024;
+async function readBody(response, url) {
+  const tooLarge = () => new HttpError(`Response from ${url} is too large (over ${MAX_BODY_BYTES} bytes)`, {
+    status: response.status,
+    code: "EBODYTOOLARGE"
+  });
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES)
+    throw tooLarge();
+  let text = "";
+  if (!response.body) {
+    text = await response.text().catch(() => "");
+  } else {
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0;
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (!value)
+        continue;
+      size += value.byteLength;
+      if (size > MAX_BODY_BYTES) {
+        await reader.cancel().catch(() => void 0);
+        throw tooLarge();
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+  }
   if (!text) {
     return void 0;
   }
@@ -738,25 +882,38 @@ async function request(url, init, { token, timeoutMs = DEFAULT_TIMEOUT_MS2, acce
   }
   let response;
   try {
-    response = await fetch(url, { ...init, headers, signal: controller.signal });
-  } catch (error) {
-    const aborted = error?.name === "AbortError";
-    const cause = error?.cause;
-    throw new HttpError(
-      aborted ? `Request to ${url} timed out after ${timeoutMs}ms` : `Request to ${url} failed: ${error?.message ?? String(error)}`,
-      { status: null, code: aborted ? "ETIMEDOUT" : cause?.code }
-    );
+    try {
+      response = await fetch(url, { ...init, headers, signal: controller.signal });
+    } catch (error) {
+      const aborted = error?.name === "AbortError";
+      const cause = error?.cause;
+      throw new HttpError(
+        aborted ? `Request to ${url} timed out after ${timeoutMs}ms` : `Request to ${url} failed: ${error?.message ?? String(error)}`,
+        { status: null, code: aborted ? "ETIMEDOUT" : cause?.code }
+      );
+    }
+    let data;
+    try {
+      data = await readBody(response, url);
+    } catch (error) {
+      if (isHttpError(error))
+        throw error;
+      const aborted = error?.name === "AbortError";
+      throw new HttpError(
+        aborted ? `Request to ${url} timed out after ${timeoutMs}ms while reading the response` : `Reading the response from ${url} failed: ${error?.message ?? String(error)}`,
+        { status: response.status, code: aborted ? "ETIMEDOUT" : void 0 }
+      );
+    }
+    if (!isSuccessStatus(response.status) && !acceptAnyStatus) {
+      throw new HttpError(`Request failed with status code ${response.status}`, {
+        status: response.status,
+        statusText: response.statusText
+      });
+    }
+    return { status: response.status, data };
   } finally {
     clearTimeout(timer);
   }
-  const data = await readBody(response);
-  if (!isSuccessStatus(response.status) && !acceptAnyStatus) {
-    throw new HttpError(`Request failed with status code ${response.status}`, {
-      status: response.status,
-      statusText: response.statusText
-    });
-  }
-  return { status: response.status, data };
 }
 function httpGet(url, options = {}) {
   return request(url, { method: "GET" }, options);
@@ -819,14 +976,29 @@ async function verifyToken(url, token) {
 function normalizeUrl(url) {
   return url.trim().replace(/\/+$/, "");
 }
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function insecureTransportWarning(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" || LOOPBACK.has(parsed.hostname))
+    return null;
+  return `${parsed.host} is plain http, so your password and the access token cross the network in the clear. Use https:// if the instance supports it.`;
+}
 function validateUrl(url) {
   if (!/^https?:\/\//i.test(url))
     throw new InvalidUrlError(url);
+  let parsed;
   try {
-    new URL(url);
+    parsed = new URL(url);
   } catch {
     throw new InvalidUrlError(url);
   }
+  if (parsed.username || parsed.password)
+    throw new CredentialInUrlError(url);
 }
 async function checkReachable(url) {
   let response;
@@ -934,7 +1106,7 @@ async function promptForAuth(port) {
 }
 
 // libs/sdk/cli/package.json
-var version = "0.2.0";
+var version = "26.09.09-01";
 
 // libs/sdk/cli/src/shared/version.ts
 var TOOL_VERSION = version;
@@ -985,6 +1157,11 @@ async function runSetup(opts) {
     warnings.push(warning);
     opts.onWarning?.(warning);
   }
+  const insecure = insecureTransportWarning(url);
+  if (insecure) {
+    warnings.push(insecure);
+    opts.onWarning?.(insecure);
+  }
   let inputs = await resolveRequiredInputs(
     { ...opts, url, authToken: auth.token, user: auth.user, password: auth.password },
     opts.promptPort
@@ -1044,6 +1221,12 @@ async function runSetup(opts) {
     seen.add(file);
     plan.push({ target, file });
   }
+  const configuredNothing = !plan.length && !opts.skipMcp;
+  if (configuredNothing) {
+    const noEditors = `No editor was configured. None of the supported editors was detected, and none was named. Re-run with --agent <id>, choosing from: ${TARGET_IDS.join(", ")}.`;
+    warnings.push(noEditors);
+    opts.onWarning?.(noEditors);
+  }
   const outcomes = [];
   if (opts.skipMcp) {
     for (const { target, file } of plan) {
@@ -1090,14 +1273,21 @@ async function runSetup(opts) {
   let versionControl;
   const written = outcomes.filter((o) => (o.result === "written" || o.result === "replaced") && o.path).map((o) => o.path);
   if (scope === "folder" && written.length) {
-    versionControl = await protectFromVersionControl({
-      files: written,
-      // Which of them a project would normally commit is the registry's to say, not a
-      // basename set inside the gitignore module.
-      committedByConvention: plan.filter(({ target }) => target.folderConfigIsCommitted).map(({ file }) => file),
-      cwd: opts.cwd ?? process.cwd(),
-      confirmExclude: opts.yes ? async () => true : opts.confirmExclude
-    });
+    try {
+      versionControl = await protectFromVersionControl({
+        files: written,
+        // Which of them a project would normally commit is the registry's to say, not a
+        // basename set inside the gitignore module.
+        committedByConvention: plan.filter(({ target }) => target.folderConfigIsCommitted).map(({ file }) => file),
+        cwd: opts.cwd ?? process.cwd(),
+        confirmExclude: opts.yes ? async () => true : opts.confirmExclude
+      });
+    } catch (error) {
+      const vcFailed = `Could not update .gitignore \u2014 ${error.message}. These files hold an access token and are NOT excluded from version control:
+      ${written.join("\n      ")}`;
+      warnings.push(vcFailed);
+      opts.onWarning?.(vcFailed);
+    }
   }
   if (!opts.skipSkills) {
     const eligible = opts.skipMcp ? plan.map((p) => p.target) : outcomes.filter((o) => o.result !== "failed").map((o) => byId.get(o.targetId)).filter((t) => Boolean(t));
@@ -1105,6 +1295,12 @@ async function runSetup(opts) {
     if (ids.length) {
       step("Installing the dotCMS skills");
       const skills = await installSkills({ agentIds: ids, global: scope === "global" });
+      if (!skills.ok) {
+        const failed = `Skills were not installed${skills.reason ? ` \u2014 ${skills.reason}` : ""}. Run this when the problem is fixed:
+      ${skills.command}`;
+        warnings.push(failed);
+        opts.onWarning?.(failed);
+      }
       for (const o of outcomes) {
         if (o.result === "failed")
           continue;
@@ -1131,7 +1327,8 @@ async function runSetup(opts) {
     warnings,
     connection,
     connectionReason,
-    exitCode: anyFailed ? 1 : 0
+    skillsSkipped: Boolean(opts.skipSkills),
+    exitCode: anyFailed || configuredNothing ? 1 : 0
   };
 }
 
@@ -1186,6 +1383,9 @@ function renderSummary(input) {
     for (const w of vc.warnings)
       lines.push(chalk.yellow(`  ! ${w}`));
   }
+  if (input.skillsSkipped) {
+    lines.push("  \xB7 skills installation skipped (--skip-skills)");
+  }
   lines.push("");
   if (input.connection === "ok") {
     lines.push(chalk.green("  \u2713 server responded"));
@@ -1195,10 +1395,16 @@ function renderSummary(input) {
     lines.push(chalk.red(`  \u2717 ${input.connectionReason ?? "the server did not start"}`));
     lines.push("    Configuration was written and left in place; the server did not come up.");
   }
-  const allGood = input.connection === "ok" && input.outcomes.every((o) => o.result !== "failed");
+  const done = (o) => o.result === "written" || o.result === "replaced";
+  const left = input.outcomes.filter((o) => !done(o) && o.result !== "failed");
+  const allGood = input.connection === "ok" && input.outcomes.length > 0 && input.outcomes.every(done);
+  lines.push("");
   if (allGood) {
-    lines.push("");
     lines.push(`  Ready \u2014 ${input.nextStep ?? "open your editor and start using dotCMS."}`);
+  } else if (left.length && input.connection === "ok") {
+    lines.push(
+      `  ${left.length} editor${left.length === 1 ? " was" : "s were"} left unchanged; what they already point at was not verified.`
+    );
   }
   return lines.join("\n");
 }
@@ -1321,7 +1527,8 @@ function registerAgentCommand(program2) {
           versionControl: result.versionControl,
           warnings: result.warnings,
           connection: result.connection,
-          connectionReason: result.connectionReason
+          connectionReason: result.connectionReason,
+          skillsSkipped: result.skillsSkipped
         })
       );
       process.exitCode = result.exitCode;

package/package.json

@@ -1,25 +1,25 @@
 {
-    "name": "dotcms",
-    "version": "0.2.1",
-    "type": "module",
-    "main": "./index.js",
-    "bin": {
-        "dotcms": "./index.js"
-    },
-    "files": [
-        "*.js",
-        "README.md"
-    ],
-    "publishConfig": {
-        "access": "public"
-    },
-    "dependencies": {
-        "cfonts": "^3.3.1",
-        "chalk": "^5.6.2",
-        "commander": "^14.0.2",
-        "inquirer": "^13.0.1",
-        "jsonc-parser": "^3.3.1",
-        "ora": "^9.0.0",
-        "smol-toml": "^1.8.0"
-    }
+  "name": "dotcms",
+  "version": "26.09.09-01",
+  "type": "module",
+  "main": "./index.js",
+  "bin": {
+    "dotcms": "./index.js"
+  },
+  "files": [
+    "*.js",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "cfonts": "^3.3.1",
+    "chalk": "^5.6.2",
+    "commander": "^14.0.2",
+    "inquirer": "^13.0.1",
+    "jsonc-parser": "^3.3.1",
+    "ora": "^9.0.0",
+    "smol-toml": "^1.8.0"
+  }
 }