githits 0.4.11 → 0.4.13

package/dist/shared/chunk-q9yem3rk.js

@@ -0,0 +1 @@
+import{clearAutoLoginAuthSessionMetadata,createAuthCommandDependencies,createAuthStatusDependencies,createContainer,loadAutoLoginAuthSessionMetadata}from"./chunk-ancbjszp.js";import"./chunk-33j95qx6.js";export{loadAutoLoginAuthSessionMetadata,createContainer,createAuthStatusDependencies,createAuthCommandDependencies,clearAutoLoginAuthSessionMetadata};

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "Code examples from global open source for developers and AI assistants.",
   "mcpServers": {
     "githits": {

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "githits",
   "description": "CLI companion for GitHits - code examples from global open source for developers and AI assistants",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "type": "module",
+  "workspaces": [
+    "packages/*"
+  ],
   "files": [
     "dist",
     "LICENSE",
@@ -30,7 +33,7 @@
     "githits": "dist/cli.js"
   },
   "scripts": {
-    "build": "bunup --dts --target node --packages=external --exports && chmod +x dist/cli.js",
+    "build": "bunup && chmod +x dist/cli.js",
     "dev": "bun run ./src/cli.ts",
     "inspector": "npx @modelcontextprotocol/inspector bun run dev mcp",
     "smoke:cli": "bun run scripts/cli-smoke.ts",
@@ -75,7 +78,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.4.3",
+    "@inquirer/core": "11.1.10",
+    "@inquirer/prompts": "8.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^14.0.2",

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.4.11",
+  "version": "0.4.13",
   "description": "Code examples from global open source for developers and AI assistants",
   "author": {
     "name": "GitHits"

package/plugins/claude/skills/onboarding/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: onboarding
+description: >-
+  Set up GitHits from Claude Code: detect supported tools, install GitHits MCP,
+  start sign-in/signup, verify auth, and recover from setup issues.
+metadata:
+  internal: true
+---
+
+Use this skill when the user asks to install, connect, set up, sign up for, or start using GitHits. This is a new-user onboarding skill: assume the user wants to create or connect a GitHits account and configure GitHits unless they explicitly say otherwise.
+
+## Current Boundary
+
+- GitHits sign-in/signup currently uses browser OAuth. You can start and monitor login, but the user may need to approve GitHits in a browser tab.
+- Never ask the user to paste passwords, OAuth codes, cookies, access tokens, refresh tokens, or API keys into chat.
+
+## Execution Mode
+
+- Use `npx -y githits@latest ...` for every normal onboarding command. This guarantees the latest published GitHits CLI behavior for new users.
+- Do not use a globally installed `githits` binary for onboarding unless the user explicitly asks to test a local, dev, or pinned CLI build.
+- If the user explicitly asks for local/dev/pinned testing, preserve the command and environment they provide.
+- Run onboarding commands inline in the current agent session.
+- Do not use subagents, background agents, background terminals, or long-running background tasks for onboarding.
+- Do not delegate `githits`, `npx`, `npm`, `codex`, `claude`, detection, login, or setup commands to subagents or background agents.
+- Do not start `npx -y githits@latest init --detect-agents --json` as a background task. Wait for the result before continuing.
+- Do not run `pkill`, `ps`, process inspection, or package-source inspection as part of normal onboarding.
+- If `npx -y githits@latest ...` fails because of network, DNS, or package-fetch errors, stop and report that GitHits CLI is unavailable.
+- If official detection fails or appears stuck, do not inspect package internals, manually probe tools to infer install IDs, or ask the user to type inferred IDs. Report the detection failure and offer to retry, switch setup scope, or stop.
+
+## Flow
+
+1. Choose setup scope with a structured choice. Do not ask the user to type a freeform response.
+
+Ask: `Where should GitHits be configured?`
+
+Options:
+
+- `My user account (Recommended)` — configures detected tools globally/user-level on this machine so GitHits is available wherever the user works with those agents.
+- `This project only` — writes project-local MCP files into this repo; files may be committed.
+
+2. Detect supported tools and current MCP state for the selected scope.
+
+Project-level detection:
+
+```bash
+npx -y githits@latest init --project --detect-agents --json
+```
+
+User-level detection:
+
+```bash
+npx -y githits@latest init --detect-agents --json
+```
+
+Run detection inline, not in a background terminal. Wait for JSON before continuing.
+
+Do not offer tools with `unsupported_project_config` for project-level setup.
+
+3. If `installableIds` is non-empty, use structured choices for tool selection. Do not ask the user to type comma-separated tool IDs unless no structured choice UI is available.
+
+Present `Configure all detected tools (Recommended)` as the first option, then list individual tools for selective setup. Do not present "configure none" as a normal onboarding choice.
+
+Ask before writing configuration: `I recommend configuring all detected tools so GitHits works wherever you use an agent. Proceed with all, or choose specific tools?`
+
+Do not run `init -y` or `init --yes` unless the user explicitly asks to configure every detected tool.
+
+4. Install only approved IDs using the selected scope.
+
+Project-level install:
+
+```bash
+npx -y githits@latest init --project --install-agents <comma-separated-approved-ids> --json
+```
+
+User-level install:
+
+```bash
+npx -y githits@latest init --install-agents <comma-separated-approved-ids> --json
+```
+
+5. Start GitHits sign-in/signup as part of onboarding. Do not ask whether the user wants to log in; login creates or connects the GitHits account.
+
+Check whether login can be skipped because auth is already active:
+
+```bash
+npx -y githits@latest auth status
+```
+
+If not authenticated or expired, ask before launching browser login, then run:
+
+```bash
+npx -y githits@latest login
+```
+
+Use this only when browser launch fails or the environment is headless:
+
+```bash
+npx -y githits@latest login --no-browser
+```
+
+With `--no-browser`, ask the user to open the printed URL. Do not ask them to paste secrets or OAuth codes back into chat.
+
+6. Verify with the selected scope.
+
+Project-level verification:
+
+```bash
+npx -y githits@latest auth status
+npx -y githits@latest init --project --detect-agents --json
+```
+
+User-level verification:
+
+```bash
+npx -y githits@latest auth status
+npx -y githits@latest init --detect-agents --json
+```
+
+Report configured tools, auth state, failures, and whether the user should open a new Claude Code session so MCP config changes load.

package/skills/githits-onboarding/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: githits-onboarding
+description: >-
+  Set up GitHits from an agent session: detect supported coding tools, install
+  GitHits MCP configuration, start account sign-in/signup, verify auth, and
+  recover from setup issues. Use when the user asks to install, connect, set up,
+  sign up for, or start using GitHits.
+compatibility: Requires shell access, internet access, and npx. Use a local githits binary only for explicit local/dev/pinned testing.
+---
+
+Use this skill when the user wants to start using GitHits from their agent.
+This is a new-user onboarding skill: assume the user wants to create or connect
+a GitHits account and configure GitHits unless they explicitly say otherwise.
+
+## Current Boundary
+
+- GitHits account sign-in/signup currently uses browser OAuth. You can start and monitor the flow, but the user may need to approve GitHits in a browser tab.
+- Do not promise browserless account creation or that everything happens inside chat.
+- Never ask the user to paste passwords, OAuth codes, cookies, access tokens, refresh tokens, or API keys into chat.
+
+## Command Style
+
+- Use `npx -y githits@latest ...` for every normal onboarding command. This guarantees the latest published GitHits CLI behavior for new users.
+- Do not use a globally installed `githits` binary for onboarding unless the user explicitly asks to test a local, dev, or pinned CLI build.
+- If the user explicitly asks for local/dev/pinned testing, preserve the command and environment they provide.
+- Prefer `--json` for staged `init` commands because agents need stable fields.
+- Do not start `npx -y githits@latest` as a background task. If `npx` fails because of network, DNS, or package-fetch errors, stop and report that GitHits CLI is unavailable.
+
+## Execution Mode
+
+- Run onboarding commands inline in the current agent session.
+- For Codex and other agents with background/subagent capabilities, do not use subagents, background agents, background terminals, or long-running background tasks for onboarding.
+- Do not delegate `githits`, `npx`, `npm`, `codex`, `claude`, detection, login, or setup commands to subagents or background agents.
+- Do not start `npx -y githits@latest init --detect-agents --json` as a background task. Run it directly, wait for the result, and only continue after it returns.
+- Do not run `pkill`, `ps`, process inspection, or package-source inspection as part of normal onboarding. If a command appears stuck, stop and report that official detection did not return.
+- These are short setup probes and must stay visible and sequential so the user can approve side effects and failures are easy to diagnose.
+- If official detection fails or appears stuck, do not inspect package internals, manually probe tools to infer install IDs, or ask the user to type inferred IDs. Report that official GitHits detection failed and offer to retry, switch setup scope, or stop.
+
+## Onboarding Flow
+
+1. Choose setup scope with a structured choice.
+
+Use the agent's structured choice UI when available. Do not ask the user to type a freeform response for setup scope.
+
+Ask: `Where should GitHits be configured?`
+
+Options:
+
+- `My user account (Recommended)` — configures detected tools globally/user-level on this machine. Best for onboarding because GitHits will be available wherever the user works with those agents.
+- `This project only` — writes project-local MCP files into the current repo. Good for repo-specific or team setup. These files may be committed.
+
+2. Detect supported coding tools and GitHits MCP configuration state for the selected scope:
+
+Project-level detection:
+
+```bash
+npx -y githits@latest init --project --detect-agents --json
+```
+
+User-level detection:
+
+```bash
+npx -y githits@latest init --detect-agents --json
+```
+
+Run detection inline, not in a background terminal. Wait for JSON before continuing.
+
+Use the JSON fields to summarize detected tools. `agents[].status` can be `needs_setup`, `already_configured`, `unsupported_project_config`, or `not_detected`. `installableIds` lists detected tools that need setup for the selected scope.
+
+For project-level setup, do not offer tools with `unsupported_project_config`. Explain only if needed: those detected tools do not have verified project-level MCP support.
+
+3. Recommend the simplest tool setup choice with structured options.
+
+If `installableIds` is non-empty, use structured choices when available. Do not ask the user to type comma-separated tool IDs unless the current agent interface has no structured choice mechanism.
+
+Ask: `Which tools should I configure?`
+
+Options:
+
+- `Configure all detected tools (Recommended)` — the recommended default option; use all `installableIds`.
+- One selective setup option per installable detected tool, using the tool display name and ID.
+
+Do not present "configure none" as a normal onboarding choice; if the user does not want any tool configured, pause and clarify whether they want to stop onboarding.
+
+Ask before writing configuration. A good prompt is: `I recommend configuring all detected tools so GitHits works wherever you use an agent. Proceed with all, or choose specific tools?`
+
+Only install user-approved IDs. Do not run `init -y` or `init --yes` unless the user explicitly asks to configure every detected tool.
+
+4. Install GitHits MCP for approved tools using the selected scope.
+
+Project-level install:
+
+```bash
+npx -y githits@latest init --project --install-agents <comma-separated-approved-ids> --json
+```
+
+User-level install:
+
+```bash
+npx -y githits@latest init --install-agents <comma-separated-approved-ids> --json
+```
+
+Treat `success` and `already_configured` outcomes as usable. Report any `failed` outcome with the tool name and message. For project-level setup, remind the user that project-local MCP files may be committed.
+
+5. Start GitHits sign-in/signup during onboarding.
+
+Do not ask whether the user wants to log in. Login creates or connects the GitHits account, so it is part of onboarding. Ask before launching browser OAuth, then run login unless `auth status` already shows an active session.
+
+Check auth state:
+
+```bash
+npx -y githits@latest auth status
+```
+
+Treat `Authenticated.` and `Authenticated via environment variable.` as already signed in and skip launching login. Treat `Not authenticated.` and `Token expired.` as requiring login.
+
+Explain: `I can start GitHits sign-in now. It may open a browser tab where you approve or create your GitHits account. I will not ask you to paste secrets into chat.`
+
+Then run:
+
+```bash
+npx -y githits@latest login
+```
+
+If the browser cannot open automatically, or the session appears to be SSH/container/headless, use:
+
+```bash
+npx -y githits@latest login --no-browser
+```
+
+With `--no-browser`, ask the user to open the printed URL. Do not ask them to paste passwords, tokens, cookies, or OAuth codes back into chat.
+
+6. Verify setup after login and installation.
+
+Project-level verification:
+
+```bash
+npx -y githits@latest auth status
+npx -y githits@latest init --project --detect-agents --json
+```
+
+User-level verification:
+
+```bash
+npx -y githits@latest auth status
+npx -y githits@latest init --detect-agents --json
+```
+
+Confirm auth is active and selected tools are `already_configured` for the selected scope. If MCP configuration changed, tell the user to open a new agent session in the project or user environment so the tool reloads its MCP config.
+
+## Completion Response
+
+Report:
+
+- Which tools were configured or already configured.
+- Whether GitHits auth is active, requires browser approval, or could not be verified.
+- Whether the user needs to restart/open a new agent session.
+- Any failed tool setup with the exact tool name and error message.
+
+## Safety Rules
+
+- Do not collect or display secrets.
+- Do not write secrets into MCP config.
+- Do not ask the user to run commands manually unless you lack shell access.
+- Do not retry broad setup with `init --yes` after a failure; use the staged JSON flow and approved IDs.
+- If auth storage fails, read `references/troubleshooting.md` before suggesting recovery.
+
+Read `references/troubleshooting.md` for recovery paths when setup, login, storage, or verification fails.

package/skills/githits-onboarding/references/troubleshooting.md

@@ -0,0 +1,58 @@
+# GitHits Onboarding Troubleshooting
+
+Use these recovery paths only when the main onboarding flow fails or the environment prevents normal setup.
+
+## No Shell Access
+
+If you cannot run shell commands, explain that you cannot complete setup directly from the agent. Provide commands only if the user asks for manual steps.
+
+## npx Unavailable
+
+`npx -y githits@latest` requires Node/npm tooling. If `npx` is unavailable, try an already installed `githits` binary. Otherwise explain that Node/npm or the GitHits CLI is required before agent-driven setup can continue.
+
+## No Supported Tools Detected
+
+`init --detect-agents --json` detects supported coding tools and their GitHits MCP state. If no supported tools are detected, report that GitHits can still be used through the CLI where available, but automatic MCP setup needs a supported agent installed or detectable on this machine.
+
+## Browser Does Not Open
+
+Retry login with:
+
+```bash
+npx -y githits@latest login --no-browser
+```
+
+Ask the user to open the printed URL. Do not ask them to paste passwords, tokens, cookies, or OAuth codes into chat.
+
+## Authentication Timeout
+
+The login link expires after the timeout. Run a fresh login command to create a new link:
+
+```bash
+npx -y githits@latest login
+```
+
+Use `--no-browser` only if browser launch failed or the environment is headless.
+
+## Keychain Or Storage Failure
+
+If the CLI reports it cannot persist OAuth credentials, ask the user to unlock their system keychain and retry login.
+
+For automation or CI, the user can provide `GITHITS_API_TOKEN` in the environment outside chat. Do not ask them to paste the token into chat.
+
+As a last resort, the user can set `GITHITS_AUTH_STORAGE=file`, but warn that file storage is plaintext on disk.
+
+## Install-Agent Failures
+
+For `init --install-agents <ids> --json`, inspect `outcomes`. Report each failed tool by `name` and `message`. Do not retry with `init -y` or `init --yes` unless the user explicitly approves configuring every detected tool.
+
+## Verification Fails
+
+After setup, run:
+
+```bash
+npx -y githits@latest auth status
+npx -y githits@latest init --detect-agents --json
+```
+
+If auth is active but selected tools are not `already_configured`, report the specific mismatch and failed tool state. If tools are configured, tell the user to open a new agent session so MCP config changes are loaded.

package/skills/githits-package/SKILL.md

@@ -36,7 +36,7 @@ githits pkg vulns npm:lodash@4.17.21 --scope non_affecting
 
 githits pkg deps npm:express
 githits pkg deps npm:express --lifecycle all
-githits pkg deps npm:express --transitive --depth 3 --json
+githits pkg deps npm:express --depth 3 --json
 
 githits pkg changelog npm:express --limit 3
 githits pkg changelog npm:express --from 4.18.0 --to 4.19.0
@@ -51,7 +51,7 @@ githits pkg upgrade-review --package npm:zod@4.3.6..4.4.3 --package npm:lint-sta
 - Need current package health: start with `githits pkg info <registry:name>`.
 - Need security status for a specific installed version: use `githits pkg vulns <registry:name@version>`.
 - Need historical advisories that do not affect the inspected version: use `pkg vulns --scope non_affecting`; use `--scope all` for affected plus historical rows.
-- Need dependency footprint: start with `pkg deps`; add `--lifecycle all` for non-runtime groups and `--transitive` for aggregate transitive graph data.
+- Need dependency footprint: start with `pkg deps`; add `--lifecycle all` for non-runtime groups and `--depth <n>` for aggregate transitive graph data.
 - Need upgrade evidence for dependency updates, outdated package bumps, or lockfile changes: prefer `pkg upgrade-review` because it compares current vs target vulnerabilities, changelog range evidence, deprecation metadata, peer changes, dependency changes, and optional transitive evidence. It reports facts only; you still own the final assessment.
 - Need release notes without a current-to-target comparison: use `pkg changelog`; use `--from`/`--to` for ranges and `--no-body` for compact timelines.
 

package/skills/githits-package/references/package.md

@@ -18,9 +18,9 @@ Supported registries: npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems,
 
 `githits pkg deps <registry:name[@version]>` lists direct runtime dependencies by default.
 
-Flags: `--lifecycle runtime|development|build|peer|optional|all`, `--transitive`, `--depth 1-10`, `--verbose`, `--json`.
+Flags: `--lifecycle runtime|development|build|peer|optional|all`, `--depth 1-10`, `--verbose`, `--json`.
 
-Use `--transitive` before `--depth`; `--depth` without transitive traversal is invalid.
+Use `--depth` to request transitive output capped to that traversal depth. Omit it for direct dependencies only.
 
 ## Changelog
 

package/dist/shared/chunk-2w48kb4c.js

@@ -1,15 +0,0 @@
-import {
-  clearAutoLoginAuthSessionMetadata,
-  createAuthCommandDependencies,
-  createAuthStatusDependencies,
-  createContainer,
-  loadAutoLoginAuthSessionMetadata
-} from "./chunk-5xd5rcm9.js";
-import"./chunk-agpezzpd.js";
-export {
-  loadAutoLoginAuthSessionMetadata,
-  createContainer,
-  createAuthStatusDependencies,
-  createAuthCommandDependencies,
-  clearAutoLoginAuthSessionMetadata
-};