howtofixcli 0.7.7 → 0.7.9

package/dist/oauth-login.js

@@ -1,568 +0,0 @@
-/**
- * Signing in to howtofix.id the way Claude Code signs in: a browser, not a
- * pasted token.
- *
- * ## Why this is a flow and not a request
- *
- * `/connect <token>` works and stays. But the token is the step people get
- * stuck on: find the panel, sign in, find the keys page, create a key, copy it,
- * come back. A browser login removes all of it — the CLI opens the page, the
- * user clicks once, and a key lands in the CLI.
- *
- * ## The two flows, and why both
- *
- * **Loopback (preferred).** The CLI listens on `127.0.0.1:<random port>`, sends
- * the browser to the panel with that address as the callback, and catches the
- * redirect. This is Claude Code's flow and it needs no code to copy. It requires
- * the panel to accept a client-supplied `redirect_uri` and to hand the issued key
- * to a non-browser client.
- *
- * **Device code (fallback).** For a remote box, a container, or a browser on
- * another machine, nothing can reach `127.0.0.1` on this host. The CLI asks the
- * panel for a short code, shows it, and polls until the user approves it in
- * their own browser. This is what `gh auth login` and the OAuth device grant do,
- * and it needs no callback at all.
- *
- * Both are spoken only when the panel offers them. Against a panel that has
- * neither — where howtofix.id is today — the CLI says exactly what is missing
- * instead of opening a browser onto a dead end.
- *
- * ## The order that matters
- *
- * The listener starts *before* the panel is asked for an authorize URL, because
- * the callback address has to contain the port the listener actually bound. A
- * redirect URI guessed before the socket exists is the classic way this flow
- * breaks on a machine where the port was taken.
- *
- * ## What is never done here
- *
- * No credential is printed, and the token that comes back is handed straight to
- * `/connect`'s existing path (verify, store, sync models, pick a model). This
- * module's whole job is to turn a browser click into that token.
- */
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { describeClient, signLoginRequest } from "./cli-auth.js";
-import { fingerprintParts, resolveHwid } from "./hwid.js";
-/** Where the panel lives. `api.` serves the API but not the OAuth routes. */
-export const PANEL_URL = "https://howtofix.id";
-/** How long to wait for the browser before giving up, in milliseconds. */
-export const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
-/** How often the device flow asks whether the user has approved yet. */
-export const POLL_INTERVAL_MS = 3_000;
-/** The path the loopback listener answers on. */
-export const CALLBACK_PATH = "/callback";
-/** A base64url string with no padding, as PKCE requires. */
-export function base64url(bytes) {
-    return bytes.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/** A fresh PKCE verifier. */
-export function createVerifier() {
-    return base64url(randomBytes(32));
-}
-/** The S256 challenge for a verifier. */
-export function createChallenge(verifier) {
-    return base64url(createHash("sha256").update(verifier).digest());
-}
-/** A CSRF state value. */
-export function createState() {
-    return base64url(randomBytes(16));
-}
-/**
- * The marker that tells the panel this is a CLI, not an API key.
- *
- * The panel has to tell two very different clients apart: a program holding an
- * `sk-` key, and this CLI asking to be signed in. A prefix on the fingerprint is
- * what carries that — it is present on every CLI request, it needs no secret, and
- * a key can never be mistaken for it. (Freebuff marks its own the same way.)
- */
-export const CLI_FINGERPRINT_PREFIX = "howtofix-cli-";
-/** The header that says which client is asking, for a server that logs by it. */
-export const CLIENT_HEADER = "x-howtofix-client";
-export const CLIENT_NAME = "cli";
-/**
- * A stable id for this machine, derived from the machine's own OS identity.
- *
- * Stable matters: the panel recognises the same CLI across runs, so a login
- * started in one run can be finished by the next — and, more importantly, so a
- * second sign-in from the same computer is recognised as the same computer
- * instead of piling up another device session. Before `hwid.ts` the inputs were
- * the hostname, the platform, the username and the CPU model, none of which is
- * hardware: one box had already produced two device sessions and two access
- * tokens under one fingerprint.
- *
- * Nothing here is a secret and nothing is persisted — the machine id is an HMAC
- * over the OS value, so the panel can match a machine without being handed its
- * serial number.
- *
- * The prefix is load-bearing: it is how the server distinguishes a CLI login
- * request from an API-key request without a key ever being sent.
- */
-export function createFingerprintId(parts) {
-    const stable = parts ?? fingerprintParts(resolveHwid());
-    return CLI_FINGERPRINT_PREFIX + createHash("sha256").update(stable.join("\u0000")).digest("hex").slice(0, 32);
-}
-/** The headers every CLI request carries. */
-export function clientHeaders() {
-    return { "content-type": "application/json", [CLIENT_HEADER]: CLIENT_NAME };
-}
-/** A real listener on `127.0.0.1`, on a port the OS picks. */
-export const openLoopbackListener = () => new Promise((resolve, reject) => {
-    const server = createServer();
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-        const { port } = server.address();
-        resolve({
-            port,
-            close: () => server.close(),
-            waitForCode: (state, signal) => new Promise((settle, fail) => {
-                const onRequest = (request, response) => {
-                    const url = new URL(request.url ?? "/", "http://127.0.0.1");
-                    if (url.pathname !== CALLBACK_PATH) {
-                        response.writeHead(404).end("not found");
-                        return;
-                    }
-                    const page = (title, detail) => response.writeHead(200, { "content-type": "text/html; charset=utf-8" }).end(`<!doctype html><meta charset="utf-8"><h2>${title}</h2><p>${detail}</p>`);
-                    const error = url.searchParams.get("error") ?? "";
-                    const code = url.searchParams.get("code") ?? "";
-                    const returnedState = url.searchParams.get("state") ?? "";
-                    if (error) {
-                        page("Sign-in was refused", "You can close this tab.");
-                        finish(new Error(`the browser reported: ${error}`));
-                        return;
-                    }
-                    if (!code || returnedState !== state) {
-                        // A wrong state is answered, not ignored: the browser is waiting.
-                        page("This callback did not belong to the login", "You can close this tab.");
-                        finish(new Error("the callback carried the wrong state"));
-                        return;
-                    }
-                    page("Signed in", "You can close this tab and go back to HowToFix.");
-                    finish(undefined, code);
-                };
-                const finish = (cause, code) => {
-                    server.off("request", onRequest);
-                    signal?.removeEventListener("abort", onAbort);
-                    if (cause)
-                        fail(cause);
-                    else
-                        settle(code);
-                };
-                const onAbort = () => finish(new Error("cancelled"));
-                signal?.addEventListener("abort", onAbort, { once: true });
-                server.on("request", onRequest);
-            }),
-        });
-    });
-});
-/** Report progress if anyone is listening; an omitted callback is not an error. */
-function notify(options, progress) {
-    options.onProgress?.(progress);
-}
-/** POST JSON and read JSON back, keeping the status for the caller to read. */
-async function postJson(fetchImpl, url, body, signal) {
-    const response = await fetchImpl(url, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(body),
-        signal,
-    });
-    let parsed = {};
-    try {
-        parsed = (await response.json());
-    }
-    catch {
-        // A non-JSON body (a proxy's HTML error page) leaves the status as the story.
-    }
-    const retryAfter = Number(response.headers?.get?.("retry-after"));
-    return {
-        status: response.status,
-        body: parsed,
-        retryAfterSeconds: Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : undefined,
-    };
-}
-/** The first non-empty string among the candidates. */
-function pickString(...candidates) {
-    for (const candidate of candidates) {
-        if (typeof candidate === "string" && candidate.trim() !== "")
-            return candidate.trim();
-    }
-    return undefined;
-}
-/** The first finite number among the candidates, or 0. Used for expiry stamps. */
-function pickNumber(...candidates) {
-    for (const candidate of candidates) {
-        if (typeof candidate === "number" && Number.isFinite(candidate))
-            return candidate;
-    }
-    return 0;
-}
-/** The code inside a login URL, for a panel that returns only the URL. */
-export function codeFromUrl(url) {
-    try {
-        const value = new URL(url).searchParams.get("code");
-        return value && value.trim() !== "" ? value.trim() : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** GET JSON, keeping the status for the caller to read. */
-async function getJson(fetchImpl, url, signal) {
-    const response = await fetchImpl(url, { headers: clientHeaders(), signal });
-    let parsed = {};
-    try {
-        parsed = (await response.json());
-    }
-    catch {
-        // A non-JSON body leaves the status as the story.
-    }
-    // The panel asks throttled clients to wait; honouring it is the difference
-    // between backing off and failing. Guarded because a panel (or a test
-    // double) is not required to send the header at all.
-    const retryAfter = Number(response.headers?.get?.("retry-after"));
-    return {
-        status: response.status,
-        body: parsed,
-        retryAfterSeconds: Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : undefined,
-    };
-}
-/** The API key inside a panel response, wherever the panel put it. */
-export function tokenFromResponse(body) {
-    const data = body.data;
-    const candidates = [body.token, body.api_key, body.apiKey, body.key, data?.token, data?.api_key, data?.apiKey, data?.key];
-    for (const candidate of candidates) {
-        if (typeof candidate === "string" && candidate.trim().startsWith("sk-"))
-            return candidate.trim();
-    }
-    return undefined;
-}
-/**
- * The credential pair a poll body carries, or undefined.
- *
- * The access token is the relay key; the other three fields are what renew it.
- * All four must be present for the pair to be usable — an access token with no
- * refresh token is the old, permanent-key behaviour, and storing it as a device
- * session would mean the panel lists a device that can never renew.
- */
-export function credentialFromResponse(body) {
-    const data = body.data;
-    const accessToken = pickString(body.token, data?.token);
-    const refreshToken = pickString(body.refresh_token, data?.refresh_token);
-    const deviceId = pickString(body.device_id, data?.device_id);
-    if (!accessToken || !refreshToken || !deviceId)
-        return undefined;
-    const accessExpiresAt = pickNumber(body.access_expires_at, data?.access_expires_at);
-    const refreshExpiresAt = pickNumber(body.refresh_expires_at, data?.refresh_expires_at);
-    return { accessToken, accessExpiresAt, refreshToken, deviceId, refreshExpiresAt };
-}
-/** A sentence from a panel error body, or a fallback. */
-function messageFrom(body, fallback) {
-    const message = body.message ?? body.error;
-    return typeof message === "string" && message.trim() ? message.trim() : fallback;
-}
-/**
- * Sign in through the browser and return an API key.
- *
- * Tries the loopback flow first — it is the one with no code to copy — and falls
- * back to the device flow when this machine cannot receive a callback. Every
- * failure is a sentence, because this runs from a slash command and an unhandled
- * rejection there kills the workbench.
- */
-export async function loginWithBrowser(options) {
-    const fetchImpl = options.fetchImpl ?? fetch;
-    const panel = (options.panelUrl ?? PANEL_URL).replace(/\/+$/, "");
-    const timeoutMs = options.timeoutMs ?? LOGIN_TIMEOUT_MS;
-    const shared = { ...options, panel, fetchImpl, timeoutMs };
-    // The fingerprint flow first: it needs no callback at all, so it works from a
-    // remote box, a container, and a browser on another machine alike.
-    const fingerprint = await fingerprintLogin(shared);
-    if (fingerprint.ok)
-        return fingerprint.result;
-    if (fingerprint.terminal)
-        return fingerprint.result;
-    const loopback = await loopbackLogin(shared);
-    if (loopback.ok)
-        return loopback.result;
-    // A refused exchange or a cancel is the user's answer, not a missing feature:
-    // asking again through another flow would only repeat the question.
-    if (loopback.terminal)
-        return loopback.result;
-    const device = await deviceLogin(shared);
-    if (device.ok)
-        return device;
-    return {
-        ok: false,
-        message: `${fingerprint.result.ok ? "" : fingerprint.result.message}; ` +
-            `${loopback.result.ok ? "" : loopback.result.message}; ${device.message}. ` +
-            `howtofix.id does not offer a browser login a local client can complete yet — ` +
-            `run /connect and paste a token from ${panel}/keys instead.`,
-    };
-}
-async function loopbackLogin(options) {
-    const verifier = createVerifier();
-    const state = createState();
-    let listener;
-    try {
-        // The socket first: the callback address must carry the port it really bound.
-        listener = await (options.loopback ?? openLoopbackListener)();
-        const redirectUri = `http://127.0.0.1:${listener.port}${CALLBACK_PATH}`;
-        const started = await postJson(options.fetchImpl, `${options.panel}/api/oauth/device/start`, { redirect_uri: redirectUri, code_challenge: createChallenge(verifier), code_challenge_method: "S256", state }, options.signal);
-        if (started.status === 404) {
-            return { ok: false, terminal: false, result: { ok: false, message: "the panel has no loopback login endpoint" } };
-        }
-        if (started.status >= 400) {
-            return {
-                ok: false,
-                terminal: false,
-                result: { ok: false, message: messageFrom(started.body, `the panel refused the login (${started.status})`) },
-            };
-        }
-        const authorizeUrl = typeof started.body.authorize_url === "string" ? started.body.authorize_url : "";
-        if (!authorizeUrl) {
-            return { ok: false, terminal: false, result: { ok: false, message: "the panel did not say where to send the browser" } };
-        }
-        notify(options, { kind: "browser", url: authorizeUrl });
-        const code = await withTimeout(listener.waitForCode(state, options.signal), options.timeoutMs);
-        const exchange = await postJson(options.fetchImpl, `${options.panel}/api/oauth/device/token`, { flow_token: started.body.flow_token, code, code_verifier: verifier }, options.signal);
-        if (exchange.status >= 400) {
-            return {
-                ok: false,
-                terminal: true,
-                result: { ok: false, message: messageFrom(exchange.body, `the panel refused the exchange (${exchange.status})`) },
-            };
-        }
-        const token = tokenFromResponse(exchange.body);
-        if (!token) {
-            return { ok: false, terminal: true, result: { ok: false, message: "the panel did not return an API key" } };
-        }
-        return { ok: true, result: { ok: true, token } };
-    }
-    catch (cause) {
-        const message = cause instanceof Error ? cause.message : String(cause);
-        // A cancel or a timeout is the user's answer; anything else might be a panel
-        // that only speaks the other flow, so the caller may still fall back.
-        const terminal = message === "cancelled";
-        return { ok: false, terminal, result: { ok: false, message } };
-    }
-    finally {
-        listener?.close();
-    }
-}
-/**
- * The fingerprint flow: ask for a login URL, show it, and poll until the user
- * has approved in their own browser.
- *
- * This is the one that needs nothing from the network but outbound HTTPS — no
- * loopback callback, no code to copy — which is why it is tried first. The CLI
- * signs the request so the panel can tell a real CLI from a script that merely
- * sends the same prefix, and it keeps the polling secret the panel hands back:
- * the code travels in the URL the user opens, so it cannot be the thing that
- * collects the key.
- */
-async function fingerprintLogin(options) {
-    const interval = options.pollIntervalMs ?? POLL_INTERVAL_MS;
-    const fingerprintId = options.fingerprintId ?? createFingerprintId();
-    // Describe the machine for the human on the approval page, and sign the whole
-    // request so the panel knows it is the CLI and not something wearing its name.
-    const clientInfo = options.clientInfo ?? describeClient();
-    const proof = signLoginRequest(fingerprintId, clientInfo);
-    try {
-        const started = await postJson(options.fetchImpl, `${options.panel}/api/auth/cli/code`, { fingerprintId, clientInfo, ...proof }, options.signal);
-        if (started.status === 404) {
-            return { ok: false, terminal: false, result: { ok: false, message: "the panel has no CLI login endpoint" } };
-        }
-        if (started.status === 401) {
-            return {
-                ok: false,
-                terminal: false,
-                result: {
-                    ok: false,
-                    message: "the panel did not recognise this build as the HowToFix CLI — update it with `npm install -g howtofixcli@latest`",
-                },
-            };
-        }
-        if (started.status === 429) {
-            // Throttled at the start, not refused. Falling through to the loopback and
-            // device flows here is actively misleading: they fail too, and the user is
-            // shown three unrelated errors instead of the one real cause. Say what
-            // happened and stop.
-            const wait = started.retryAfterSeconds ? ` Try again in ${Math.ceil(started.retryAfterSeconds / 60)} minute(s).` : "";
-            return {
-                ok: false,
-                terminal: true,
-                result: {
-                    ok: false,
-                    message: `too many sign-in attempts from this machine right now.${wait}`,
-                },
-            };
-        }
-        if (started.status >= 400) {
-            return {
-                ok: false,
-                terminal: false,
-                result: { ok: false, message: messageFrom(started.body, `the panel refused the login (${started.status})`) },
-            };
-        }
-        // The panel wraps its payload in `data` (its own success envelope), so read
-        // both shapes — a panel that answers flat must keep working.
-        const data = (started.body.data ?? {});
-        const url = pickString(started.body.login_url, data.login_url);
-        // The code is what the browser approves with, and it is in the URL; the
-        // secret is what collects the key and never leaves this process. Both are
-        // needed, and keeping them apart is what stops a leaked link yielding a key.
-        const code = pickString(started.body.code, data.code) ?? (url ? codeFromUrl(url) : undefined);
-        const secret = pickString(started.body.secret, data.secret);
-        if (!url || !code) {
-            return { ok: false, terminal: false, result: { ok: false, message: "the panel did not return a login URL" } };
-        }
-        if (!secret) {
-            // A panel that predates the split does not return one. The CLI still has
-            // to work against it, because the release order is CLI first and server
-            // second: refusing here would break every sign-in in the window between
-            // the two. So fall back to polling with the code alone, which is exactly
-            // the old behaviour and no worse than it. Once the panel is updated it
-            // always returns a secret and this branch stops being taken.
-            notify(options, { kind: "browser", url });
-            return await pollForToken(options, code, undefined);
-        }
-        notify(options, { kind: "browser", url });
-        return await pollForToken(options, code, secret);
-    }
-    catch (cause) {
-        const message = cause instanceof Error ? cause.message : String(cause);
-        return { ok: false, terminal: message === "cancelled", result: { ok: false, message } };
-    }
-}
-/**
- * Poll until the login is approved, the link dies, or the wait runs out.
- *
- * `secret` is sent when the panel gave one: the code travels in the URL the user
- * opens, so it cannot be the only thing that collects the key.
- */
-async function pollForToken(options, code, secret) {
-    const interval = options.pollIntervalMs ?? POLL_INTERVAL_MS;
-    const deadline = Date.now() + options.timeoutMs;
-    while (Date.now() < deadline) {
-        await sleep(interval, options.signal);
-        // `capability` tells the panel this build can renew an access token with a
-        // refresh token. The server uses it only to choose the credential's shape:
-        // a build that cannot renew is handed the permanent key it has always had,
-        // because a token that expires in hours would break it with no way back. A
-        // panel that predates the field ignores it and answers as before.
-        const query = new URLSearchParams(secret ? { code, secret } : { code });
-        query.set("capability", "device-refresh");
-        const poll = await getJson(options.fetchImpl, `${options.panel}/api/auth/cli/status?${query}`, options.signal);
-        if (poll.status === 404) {
-            return { ok: false, terminal: false, result: { ok: false, message: "the panel has no CLI login status endpoint" } };
-        }
-        if (poll.status === 403) {
-            return {
-                ok: false,
-                terminal: true,
-                result: { ok: false, message: "the panel rejected this poll — run /connect again" },
-            };
-        }
-        if (poll.status === 429) {
-            // Throttled, not refused. Wait as long as the panel asks — bounded, so a
-            // hostile or broken Retry-After cannot hang the login — then keep
-            // polling. A rate limit must never turn into a failed sign-in: the user
-            // is sitting there waiting for a login that would otherwise just die.
-            const waitMs = Math.min(Math.max(poll.retryAfterSeconds ?? 5, 1) * 1_000, 30_000);
-            await sleep(waitMs, options.signal);
-            continue;
-        }
-        const token = tokenFromResponse(poll.body);
-        if (token) {
-            // A panel that issues a device session returns the refresh half too, and
-            // the caller has to keep it: without it the access token simply expires in
-            // hours and the user is back at the browser. A panel that predates the pair
-            // returns only the token, which is the old behaviour and still works.
-            return { ok: true, result: { ok: true, token, credential: credentialFromResponse(poll.body) } };
-        }
-        const status = pickString(poll.body.data?.status, poll.body.status);
-        if (status === "expired") {
-            return {
-                ok: false,
-                terminal: true,
-                result: { ok: false, message: "the sign-in link expired before it was approved" },
-            };
-        }
-        if (poll.status >= 400) {
-            return {
-                ok: false,
-                terminal: true,
-                result: { ok: false, message: messageFrom(poll.body, `the panel refused the poll (${poll.status})`) },
-            };
-        }
-    }
-    return { ok: false, terminal: true, result: { ok: false, message: "the sign-in was not approved in time" } };
-}
-async function deviceLogin(options) {
-    const interval = options.pollIntervalMs ?? POLL_INTERVAL_MS;
-    try {
-        const started = await postJson(options.fetchImpl, `${options.panel}/api/oauth/device`, {}, options.signal);
-        if (started.status === 404)
-            return { ok: false, message: "the panel has no device-code endpoint" };
-        if (started.status >= 400) {
-            return { ok: false, message: messageFrom(started.body, `the panel refused the request (${started.status})`) };
-        }
-        const deviceCode = typeof started.body.device_code === "string" ? started.body.device_code : "";
-        const userCode = typeof started.body.user_code === "string" ? started.body.user_code : "";
-        const url = typeof started.body.verification_uri === "string" ? started.body.verification_uri : `${options.panel}/oauth/device`;
-        if (!deviceCode || !userCode)
-            return { ok: false, message: "the panel did not return a code to show" };
-        notify(options, { kind: "code", code: userCode, url });
-        const deadline = Date.now() + options.timeoutMs;
-        while (Date.now() < deadline) {
-            await sleep(interval, options.signal);
-            const poll = await postJson(options.fetchImpl, `${options.panel}/api/oauth/device/poll`, { device_code: deviceCode }, options.signal);
-            if (poll.status === 404)
-                return { ok: false, message: "the panel has no device-code poll endpoint" };
-            const status = typeof poll.body.status === "string" ? poll.body.status : "";
-            if (status === "pending")
-                continue;
-            if (status === "slow_down") {
-                await sleep(interval, options.signal);
-                continue;
-            }
-            if (status === "denied")
-                return { ok: false, message: "the sign-in was refused in the browser" };
-            if (status === "expired")
-                return { ok: false, message: "the code expired; run /connect again" };
-            const token = tokenFromResponse(poll.body);
-            if (token)
-                return { ok: true, token };
-            if (poll.status >= 400) {
-                return { ok: false, message: messageFrom(poll.body, `the panel refused the poll (${poll.status})`) };
-            }
-        }
-        return { ok: false, message: "the code was not approved in time" };
-    }
-    catch (cause) {
-        return { ok: false, message: cause instanceof Error ? cause.message : String(cause) };
-    }
-}
-/** Reject after `ms`, so a login that is never finished does not hang forever. */
-function withTimeout(promise, ms) {
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => reject(new Error("the sign-in was not finished in time")), ms);
-        promise.then((value) => {
-            clearTimeout(timer);
-            resolve(value);
-        }, (cause) => {
-            clearTimeout(timer);
-            reject(cause);
-        });
-    });
-}
-/** A sleep a cancel can cut short. */
-function sleep(ms, signal) {
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(resolve, ms);
-        signal?.addEventListener("abort", () => {
-            clearTimeout(timer);
-            reject(new Error("cancelled"));
-        }, { once: true });
-    });
-}

package/dist/paths.js

@@ -1,61 +0,0 @@
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-import { installedPresetSkillPaths } from "./presets.js";
-/**
- * The directory the config root is resolved against.
- *
- * `os.homedir()` returns `$HOME` verbatim on POSIX, so a relative or
- * trailing-slash `HOME` (a wrapper script that did `HOME=./sandbox`, a
- * container that exported it oddly) makes every derived path relative — the
- * config root, the session store, the rewind shadow repos. Everything then
- * lands wherever the process happens to be, and the "project scope walk" would
- * start treating `$HOME` itself as a project directory. Resolve it once, to an
- * absolute path, so a non-canonical HOME cannot leak into a path.
- *
- * The environment variable is preferred when set, matching how the SDK resolves
- * its own root, and `HOWTOFIX_HOME` is accepted as an override for tests.
- */
-function homeDirectory() {
-    const configured = (process.env.HOWTOFIX_HOME ?? process.env.HOME ?? "").trim();
-    return resolve(configured || homedir());
-}
-/** Config root. Everything HowToFix writes lives here, never in the SDK's own config dir. */
-export const AGENT_DIR = process.env.HOWTOFIX_CODING_AGENT_DIR?.trim() || join(homeDirectory(), ".howtofix", "agent");
-/** User-global skills. The SDK already scans AGENT_DIR/skills; this is the same path, named. */
-export const USER_SKILLS_DIR = join(AGENT_DIR, "skills");
-/** Project skills that do not live under the SDK's unrenameable `.hxf/` directory. */
-export function projectSkillsDir(cwd) {
-    return join(cwd, ".howtofix", "skills");
-}
-/**
- * The skill directories to hand the SDK resource loader for a project, in
- * order. Order is load-bearing: the loader is first-wins on a name collision
- * (it logs a diagnostic and keeps the entry already in its map), so the user's
- * project skills come first and preset skills are the fallback — a user skill
- * of the same name wins. The global user skill dirs are discovered by the SDK
- * ahead of everything here and win over both.
- *
- * Nothing else is added. The rule suite that used to be injected here is now an
- * ordinary preset (`presets/quality/antislop/`), so it reaches the model only
- * after `/preset` installs it — the same opt-in every other preset gets. A
- * suite that loads whether or not anyone asked is not a catalogue, it is a
- * hidden default, and it made `/skills` disagree with what the user had chosen.
- */
-export function additionalSkillPaths(cwd) {
-    const paths = [projectSkillsDir(cwd)];
-    // Skills from presets the user installed. Only installed ones: a preset that
-    // was merely offered must not put anything into the prompt.
-    paths.push(...installedPresetSkillPaths(cwd));
-    return paths;
-}
-export const AGENTS_STORE_DIR = join(AGENT_DIR, "agents");
-export const USAGE_CACHE_PATH = join(AGENT_DIR, "usage-cache.json");
-/** Where `s` in the workflow panel writes the script behind a run. */
-export const WORKFLOWS_DIR = join(AGENT_DIR, "workflows");
-/**
- * The SDK resolves its config paths (agent dir, sessions, auth, models) from
- * HXF_CODING_AGENT_DIR. Pin that to ~/.howtofix/agent before any session exists.
- */
-export function pinAgentDir() {
-    process.env.HXF_CODING_AGENT_DIR = AGENT_DIR;
-}