rovecode 0.3.2

package/src/cli/session-arg.ts

@@ -0,0 +1,30 @@
+/** A session id typed on the command line (aion hygiene h2, brought over 2026-09-07): the CLI's ONE gate for the entry
+ *  points that used to take an id straight into a path join — `rovecode --resume <id|prefix>` (main.ts hand-parses the
+ *  value) and `rovecode trace <id|prefix>`. Both resolve here through core/session-ops.ts resolveSession: validity
+ *  first (core/session-id.ts), then an exact id or a UNIQUE prefix among the sessions under the root; a miss or an
+ *  ambiguity is the usage error, never a fresh session dir under the typed name (which is what `--resume typo` used to
+ *  create, silently). A bad id is exit 2 with ONE stderr line; `fail` is injectable for tests. */
+
+import { describeBadSessionId } from "../core/session-id.ts";
+import { resolveSession } from "../core/session-ops.ts";
+
+const usageExit = (msg: string): never => {
+  process.stderr.write(`error: ${msg}\n`); // ONE stderr line
+  return process.exit(2);
+};
+
+/** `<what> <id>`: the id, or the usage error — missing, empty, `.`/`..`, a separator (core/session-id.ts). */
+export function sessionIdArg(what: string, id: string | undefined, fail: (msg: string) => never = usageExit): string {
+  if (id === undefined) return fail(`${what} needs a session id or prefix`);
+  const bad = describeBadSessionId(id);
+  return bad === undefined ? id : fail(`${what}: ${bad}`);
+}
+
+/** Validity (sessionIdArg) + resolution against the sessions under `root`: an exact id wins, else exactly ONE prefix
+ *  match; several or none is the usage error naming them (never the first hit, never a new directory). */
+export function resolveSessionArg(what: string, root: string, id: string | undefined, fail: (msg: string) => never = usageExit): string {
+  const wanted = sessionIdArg(what, id, fail);
+  const r = resolveSession(root, wanted);
+  if (r.ok) return r.id;
+  return fail(r.error.startsWith("no session matching") ? `${what}: ${r.error} in ${root} (rovecode sessions lists them)` : `${what}: ${r.error}`);
+}

package/src/cli/sessions-cmd.ts

@@ -0,0 +1,145 @@
+/** `rovecode sessions [--json]` (aion port #59, brought over 2026-09-07): the headless view of the TUI's /sessions picker
+ *  over the ONE scanner (core/session.ts scanSessions — no second directory walk). Rows carry id, created, updated, cwd
+ *  (the workspace whose sessions were listed — sessions are per project dir), the first prompt and the user-turn
+ *  count; newest (updatedAt) first. `--json` prints the row array; the text table prints the cwd once in its header
+ *  and, when there are any, ONE footer line counting the hollow directories (a meta.json, nothing ever written) from
+ *  the stat alone — they are not rows, and whether to delete them is Berkay's open question; the count keeps it
+ *  askable. Exit 0, also for an empty list.
+ *  Port #84 — four verbs over core/session-ops.ts: `rename <id|prefix> <title…>`, `delete <id|prefix> [--yes]`,
+ *  `fork <id|prefix> [--json]`, `search <terms…> [--json]`. Rows and the table show a set `title` (`--json` rows carry
+ *  the key ONLY when set). Ids resolve by the /resume rule BEFORE any write; a usage error (unknown verb, missing id,
+ *  bad / ambiguous / unknown id, empty title or query, an oversize fork) is exit 2 + ONE stderr line, nothing removed
+ *  or created. Nothing boots a runtime or provider. `--yes` (codex's DeleteConfirmation Skip, pattern only) skips the
+ *  y/N confirmation; a non-TTY stdin without it is refused (exit 2) — the TTY prompt itself (Bun's synchronous
+ *  `confirm`, default N) is not hermetically tested. `--json` / `--yes` are booleans: no dispatch.ts VALUE_FLAGS entry.
+ *  aion's `--cwd <dir>` is not brought: rovecode commands act on the cwd. */
+
+import { scanSessions } from "../core/session.ts";
+import { deleteSession, forkSession, oneLineTitle, renameSession, resolveSession, searchSessions, sessionsRoot, type SearchRow } from "../core/session-ops.ts";
+
+export interface SessionRow {
+  id: string;
+  /** ISO 8601 */
+  created: string;
+  updated: string;
+  cwd: string;
+  /** first user-message text, single line, ≤80 chars ("" for an empty session) */
+  firstPrompt: string;
+  /** user messages recorded in the session file (every branch) */
+  turns: number;
+  /** all entries (messages + event markers) */
+  entries: number;
+  /** the user-given title — the key is present ONLY when one is set */
+  title?: string;
+}
+
+export interface SessionListing { rows: SessionRow[]; hollow: number; root: string }
+
+/** the rows (sessions that hold something) plus the hollow count, from one scan */
+export function sessionListing(cwd: string): SessionListing {
+  const root = sessionsRoot(cwd);
+  const scan = scanSessions(root);
+  const rows = scan.sessions.map((s) => ({
+    id: s.id, created: new Date(s.createdAt).toISOString(), updated: new Date(s.updatedAt).toISOString(),
+    cwd, firstPrompt: s.preview, turns: s.turns, entries: s.entryCount,
+    ...(s.title !== undefined ? { title: s.title } : {}),
+  }));
+  return { rows, hollow: scan.hollow.length, root };
+}
+
+export function sessionRows(cwd: string): SessionRow[] {
+  return sessionListing(cwd).rows;
+}
+
+/** the one footer line for the hollow directories, or undefined when there are none */
+export function hollowLine(count: number, root: string): string | undefined {
+  if (count === 0) return undefined;
+  return `${count} empty session director${count === 1 ? "y" : "ies"} in ${root} — nothing was ever written to them`;
+}
+
+export function formatSessions(listing: SessionListing, json: boolean): string {
+  const { rows, hollow, root } = listing;
+  if (json) return JSON.stringify(rows);
+  const footer = hollowLine(hollow, root);
+  if (rows.length === 0) return [`no sessions in ${root} — a \`rovecode run\` or a TUI turn starts one`, ...(footer ? [footer] : [])].join("\n");
+  const lines = [`sessions in ${root} (newest first; --json for the full rows):`, `${"id".padEnd(36)}  ${"created".padEnd(24)}  turns  first prompt`];
+  for (const r of rows) lines.push(`${r.id.padEnd(36)}  ${r.created.padEnd(24)}  ${String(r.turns).padStart(5)}  ${r.title ?? (r.firstPrompt || "(empty session)")}`); // a title stands in for the first prompt
+  if (footer) lines.push(footer);
+  return lines.join("\n");
+}
+
+/** one search hit per line: session id8 · ISO time · entry id8 (or `title` for a title-tier hit) · [title] preview */
+export function formatSearchHit(r: SearchRow): string {
+  const where = r.entryId === "" ? "title" : r.entryId.slice(0, 8);
+  return `${r.sessionId.slice(0, 8)}  ${new Date(r.timestamp).toISOString()}  ${where.padEnd(8)}  ${r.title !== undefined ? `[${r.title}] ` : ""}${r.preview}`;
+}
+
+export const SESSIONS_USAGE = "usage: rovecode sessions [--json] | rename <id|prefix> <title…> | delete <id|prefix> [--yes] | fork <id|prefix> [--json] | search <terms…> [--json]";
+const VERBS: ReadonlySet<string> = new Set(["rename", "delete", "fork", "search"]);
+
+/** a token that is a flag, not a value: `-x`, `--x` (a lone `-` would be stdin, a value) */
+const isFlag = (a: string): boolean => a.length > 1 && a.startsWith("-");
+
+/** the words after the `sessions` token minus every flag token */
+export function sessionWords(argv: readonly string[]): string[] {
+  const at = argv.indexOf("sessions");
+  return at === -1 ? [] : argv.slice(at + 1).filter((a) => !isFlag(a));
+}
+
+export interface SessionsCmdIo {
+  out: (text: string) => void;
+  err: (text: string) => void;
+  /** stdin is a terminal (the y/N prompt is possible); default process.stdin.isTTY */
+  tty?: boolean;
+  /** the y/N prompt; default Bun's global confirm */
+  confirm?: (question: string) => boolean;
+}
+
+/** main.ts dispatch: the sessions of `cwd`. Returns the exit code. */
+export function cmdSessions(argv: readonly string[], cwd: string, io: Partial<SessionsCmdIo> = {}): number {
+  const out = io.out ?? ((t: string) => console.log(t));
+  const err = io.err ?? ((t: string) => process.stderr.write(`${t}\n`));
+  const usageError = (msg: string): number => { err(`error: ${msg} — ${SESSIONS_USAGE}`); return 2; }; // ONE stderr line, exit 2
+  const json = argv.includes("--json");
+  const words = sessionWords(argv);
+  const verb = words[0];
+  if (verb === undefined) { out(formatSessions(sessionListing(cwd), json)); return 0; }
+  if (!VERBS.has(verb)) return usageError(`unknown sessions verb "${verb}"`);
+  const root = sessionsRoot(cwd);
+  if (verb === "search") {
+    const q = words.slice(1).join(" ").trim();
+    if (q === "") return usageError("search needs at least one term");
+    const rows = searchSessions(root, q, 10);
+    if (json) out(JSON.stringify(rows));
+    else out(rows.length === 0 ? `no matches for "${q}" in ${root}` : rows.map(formatSearchHit).join("\n"));
+    return 0;
+  }
+  const ref = words[1];
+  if (ref === undefined) return usageError(`${verb} needs a session id or prefix`);
+  const found = resolveSession(root, ref); // validity + the /resume rule over readdir names — nothing is created or removed before this
+  if (!found.ok) return usageError(found.error);
+  if (verb === "rename") {
+    const title = oneLineTitle(words.slice(2).join(" "));
+    if (title === undefined) return usageError("rename needs a non-empty title");
+    renameSession(root, found.id, title);
+    out(`renamed ${found.id} → "${title}"`);
+    return 0;
+  }
+  if (verb === "fork") {
+    let r;
+    try { r = forkSession(root, found.summary); } catch (e) { return usageError(e instanceof Error ? e.message : String(e)); }
+    out(json ? JSON.stringify(r) : `${r.id}  fork of ${r.from.slice(0, 8)} · "${r.title}"`);
+    return 0;
+  }
+  // delete — codex DeleteConfirmation { Prompt, Skip }: `--yes` = Skip; Prompt only on a TTY (default N); otherwise refused
+  if (!argv.includes("--yes")) {
+    const tty = io.tty ?? process.stdin.isTTY === true;
+    if (!tty) return usageError(`delete ${found.id.slice(0, 8)} needs --yes when stdin is not a terminal`);
+    const label = found.summary.title ?? (found.summary.preview || "(empty session)");
+    const ask = io.confirm ?? ((q: string) => confirm(q));
+    if (!ask(`delete session ${found.id} (${label}, ${found.summary.entryCount} entries) and its checkpoints?`)) { out("delete cancelled — nothing removed"); return 0; }
+  }
+  const { removed } = deleteSession(cwd, root, found.id);
+  out(removed.length === 0 ? `nothing to remove for ${found.id}` : removed.map((p) => `removed ${p}`).join("\n"));
+  return 0;
+}

package/src/cli/setup.ts

@@ -0,0 +1,153 @@
+/** `rovecode setup` — connect a model in one sitting: pick a provider, name the model, paste the key
+ *  (masked, via auth.ts readSecret), one tiny real call, and the pick becomes the default in
+ *  ~/.rovecode/providers.json. Every step reads through an injectable seam (ask / secret / save /
+ *  probe) so the whole flow is unit-testable with scripted answers and no network. Piped stdin
+ *  (no TTY) prints the three-line recipe and exits 2 — a wizard must not consume a script's input.
+ *  Wording: core/voice.ts rules — rovecode speaks, short lines, every problem ends with "→ next:". */
+
+import { createInterface } from "node:readline";
+import { readSecret, saveCredential } from "../providers/auth.ts";
+import { PROVIDER_ID_RE, inferProtocol, isConfigured } from "../providers/provider-config.ts";
+import type { ProviderRegistry } from "../providers/registry.ts";
+import { next, noModelHint } from "../core/voice.ts";
+
+export interface ProbeResult { ok: boolean; model: string; detail: string }
+
+export interface SetupDeps {
+  registry: ProviderRegistry;
+  /** default console.log */
+  out?: (line: string) => void;
+  /** one plain-text answer (default: readline on stdin, echoed) */
+  ask?: (prompt: string) => Promise<string>;
+  /** one secret (default: readSecret — masked on a TTY) */
+  secret?: (prompt: string) => Promise<string>;
+  /** default auth.ts saveCredential */
+  save?: (id: string, secret: string, keyEnv: string) => void;
+  /** default registry.probe (one tiny real call) */
+  probe?: (id: string, model?: string) => Promise<ProbeResult>;
+  /** default process.stdin.isTTY === true */
+  tty?: boolean;
+}
+
+interface Pick { key: string; label: string; id?: string; local?: boolean; url?: "openai" | "anthropic" }
+
+/** the numbered menu: the common hosted providers, the two local servers, and two "your own URL" doors */
+export const SETUP_PICKS: readonly Pick[] = [
+  { key: "1", id: "anthropic", label: "anthropic — Claude models" },
+  { key: "2", id: "openai", label: "openai" },
+  { key: "3", id: "openrouter", label: "openrouter — many models behind one key" },
+  { key: "4", id: "deepseek", label: "deepseek" },
+  { key: "5", id: "groq", label: "groq" },
+  { key: "6", id: "ollama", label: "ollama — local, no key needed", local: true },
+  { key: "7", id: "lmstudio", label: "lmstudio — local, no key needed", local: true },
+  { key: "8", label: "another OpenAI-compatible URL (a proxy, vLLM, …)", url: "openai" },
+  { key: "9", label: "another Anthropic-protocol URL", url: "anthropic" },
+];
+
+export const SETUP_DONE = 'Done. Try:  rovecode "explain this repo"';
+
+/** one echoed line from the terminal — shared with main.ts's numbered model picker */
+export function askLine(prompt: string): Promise<string> {
+  return new Promise((resolve) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    let settled = false;
+    rl.question(prompt, (a) => { if (settled) return; settled = true; rl.close(); resolve(a.trim()); });
+    rl.once("close", () => { if (!settled) { settled = true; resolve(""); } });
+  });
+}
+
+/** exit code: 0 connected (or added with a clear next step), 2 not a TTY / cancelled / invalid input */
+export async function runSetup(deps: SetupDeps): Promise<number> {
+  const out = deps.out ?? console.log;
+  const ask = deps.ask ?? askLine;
+  const secret = deps.secret ?? ((p: string) => readSecret(p));
+  const save = deps.save ?? saveCredential;
+  const reg = deps.registry;
+  const probe = deps.probe ?? ((id: string, model?: string) => reg.probe(id, model));
+  const tty = deps.tty ?? process.stdin.isTTY === true;
+
+  if (!tty) { out(noModelHint("cli")); out("  (rovecode setup needs a terminal — this stdin is a pipe)"); return 2; }
+
+  out("◆ rovecode setup — let's connect a model. Two or three questions.");
+  out("");
+  for (const p of SETUP_PICKS) out(`  ${p.key}  ${p.label}`);
+  out("");
+  let pick: Pick | undefined;
+  for (let tries = 0; tries < 3 && pick === undefined; tries++) {
+    const a = (await ask("Which one? [1-9, empty = cancel]: ")).trim();
+    if (a.length === 0) { out(`cancelled — nothing changed. ${next("rovecode setup")} whenever you like`); return 2; }
+    pick = SETUP_PICKS.find((p) => p.key === a || p.id === a);
+    if (pick === undefined) out(`  "${a}" is not on the list — a number from 1 to 9, please.`);
+  }
+  if (pick === undefined) return 2;
+
+  // ---- the provider: a built-in, a keyless local server, or a URL of your own ----
+  let id: string;
+  if (pick.url !== undefined) {
+    id = (await ask("Short name for it (letters, digits, - _ .): ")).trim().toLowerCase();
+    if (!PROVIDER_ID_RE.test(id)) { out(`  "${id}" won't work as an id. ${next("rovecode setup, and pick a name like myproxy")}`); return 2; }
+    const baseUrl = (await ask("Base URL (e.g. https://host/v1): ")).trim();
+    if (!/^https?:\/\//.test(baseUrl)) { out(`  "${baseUrl}" is not an http(s) URL. ${next("rovecode setup")}`); return 2; }
+    const protocol = pick.url === "anthropic" ? "anthropic" : baseUrl.includes("anthropic.com") ? inferProtocol(baseUrl) : "openai";
+    const noKey = (await ask("Does it need an API key? [Y/n]: ")).trim().toLowerCase().startsWith("n");
+    const r = reg.add({ id, baseUrl, protocol, ...(noKey ? { noKey: true } : {}) }, "user");
+    if ("error" in r) { out(`  ${r.error}. ${next("rovecode setup")}`); return 2; }
+    out(`◆ ${id} registered (${protocol} protocol, ${baseUrl}).`);
+  } else {
+    id = pick.id!;
+    const known = reg.get(id);
+    if (known === undefined) { out(`  ${id} is missing from the built-in table — that is a bug. ${next("rovecode provider add " + id + " <baseUrl>")}`); return 2; }
+    if (pick.local === true && known.noKey !== true) {
+      // the built-in row expects a key env; a local server needs none — the user entry says so
+      const r = reg.add({ id, baseUrl: known.baseUrl, protocol: known.protocol, noKey: true, ...(known.defaultModel !== undefined ? { defaultModel: known.defaultModel } : {}) }, "user");
+      if ("error" in r) { out(`  ${r.error}. ${next("rovecode setup")}`); return 2; }
+      out(`◆ ${id} marked as a local server (${known.baseUrl}, no key).`);
+    }
+  }
+
+  // ---- the model ----
+  const spec = reg.get(id)!;
+  const suggested = spec.defaultModel;
+  const modelAnswer = (await ask(suggested !== undefined ? `Model id [${suggested}]: ` : "Model id (empty = choose later with rovecode model list): ")).trim();
+  const model = modelAnswer.length > 0 ? modelAnswer : suggested;
+
+  // ---- the key ----
+  let hasKey = isConfigured(spec);
+  if (!hasKey) {
+    const s = await secret(`${spec.keyEnv} (hidden): `);
+    if (s.trim().length === 0) {
+      out(`◆ no key stored — I can't call ${id} without one.`);
+      out(`  ${next(`rovecode auth set ${id}`)}   (or set ${spec.keyEnv} in your environment)`);
+    } else {
+      save(id, s.trim(), spec.keyEnv);
+      reg.refresh();
+      hasKey = true;
+      out(`◆ key stored for ${id} (hidden; ~/.rovecode/credentials.json).`);
+    }
+  } else out(`◆ ${id} already has a key (${spec.keySource === "stored" ? "stored" : `env ${spec.keyEnv}`}).`);
+
+  // ---- one tiny real call ----
+  if (hasKey && model !== undefined) {
+    out(`◆ testing ${id}/${model} …`);
+    const r = await probe(id, model);
+    if (r.ok) out(`  ${r.detail}`);
+    else {
+      out(`  that didn't work: ${r.detail}`);
+      out(`  ${next(`check the key and the URL, then rovecode provider test ${id} ${model}`)}`);
+    }
+  }
+
+  // ---- make it the default ----
+  if (model !== undefined) {
+    const d = reg.setDefault(`${id}/${model}`, "user");
+    if ("error" in d) { out(`  ${d.error}. ${next(`rovecode model use ${id}/<model>`)}`); return 2; }
+    out(`◆ default → ${d.provider}/${d.model} (~/.rovecode/providers.json; running TUIs switch live).`);
+  } else {
+    out(`◆ ${id} is set up but has no model yet.`);
+    out(`  ${next(`rovecode model list ${id}, then rovecode model use ${id}/<model>`)}`);
+  }
+  out("");
+  out(SETUP_DONE);
+  out("  or open the cockpit:  rovecode");
+  return 0;
+}

package/src/cli/skills-cmd.ts

@@ -0,0 +1,194 @@
+/** `rovecode skills list|validate|pack|install` (port #72): the agentskills.io-shaped skill catalogue on the command
+ *  line. Mirrors cli/mcp-market-cmd.ts — hand-parsed argv, an io seam, ONE dispatch line in main.ts — plus an
+ *  injectable fetch and DNS resolver for the URL install. Exit codes: 0 ok · 1 usage / strict finding / refused
+ *  overwrite / non-http(s) URL / symlink / a refused address · 2 io (unreadable, not an archive, unsafe entries, an
+ *  invalid staged skill, HTTP or network failure). `list` is the LENIENT loader the runtime uses (every loaded skill,
+ *  every loader warning, the files it refused); `validate` and `pack` are STRICT (spec violations are errors, unknown
+ *  keys notes, nothing is written after a finding). Scopes are skills/index.ts skillsDir(cwd, scope):
+ *  `<cwd>/.rovecode/skills`, or `<home>/skills` with --user (ROVECODE_HOME honoured). allowed-tools is never enforced.
+ *
+ *  `install <url>` goes through the SAME SSRF guard as web_fetch and web_search (tools/webfetch.ts ssrfDenyReason:
+ *  loopback, private, link-local and reserved ranges refused, names resolved through the injectable resolver) — on the
+ *  URL and on every redirect hop, http(s) only, ≤ 5 hops. The reason is that a human typing a URL is not the only
+ *  caller: a model with bash can run `rovecode skills install http://169.254.169.254/…`, and cloud metadata is exactly
+ *  what that guard is for. A CLI that skips the check its own tools make is the soft spot in the boundary, so do not
+ *  remove this. There is deliberately NO allow-private knob: an intranet-hosted archive is refused, and `curl` +
+ *  `skills install <file.tar.gz>` is the local path — one env knob is a decision for Berkay, not a default.
+ *  Body bounded at 64 MiB (webfetch readBounded) under a ref'd timeout. */
+
+import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { SKILL_FILE, SkillStore, skillsDir } from "../skills/index.ts";
+import { parseSkillFrontmatter, validateSkillMeta, type Validation } from "../skills/spec.ts";
+import { installFromBytes, installFromDir, MAX_ARCHIVE_BYTES, packSkill, SkillCmdError, type InstallResult } from "../skills/pack.ts";
+import { abortable, dnsResolver, readBounded, ssrfDenyReason, type FetchLike, type Resolver } from "../tools/webfetch.ts";
+
+export interface SkillsCmdIo { out(line: string): void; err(line: string): void }
+export interface SkillsCmdDeps {
+  io?: SkillsCmdIo;
+  /** the URL install's fetch (tests inject a loopback / scripted one) */
+  fetch?: FetchLike;
+  /** the SSRF guard's name resolver (tests inject one that answers for their loopback fixture) */
+  resolve?: Resolver;
+  /** the user-scope skills dir (default `<user state dir>/skills`) */
+  globalDir?: string;
+}
+const stdio: SkillsCmdIo = { out: (l) => console.log(l), err: (l) => console.error(l) };
+
+export const SKILLS_USAGE =
+  "usage: rovecode skills list [--json] | rovecode skills validate <dir> | rovecode skills pack <dir> [--out <file>] [--force] | " +
+  "rovecode skills install <dir|file.tar.gz|http(s)-url> [--user] [--force]";
+export const INSTALL_TIMEOUT_MS = 60_000;
+export const MAX_REDIRECTS = 5;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const URL_SCHEME = /^([a-z][a-z0-9+.-]*):\/\//i;
+
+/** Entry point: `args` are the argv words AFTER `skills`. Returns the exit code. */
+export async function cmdSkills(args: string[], cwd: string, deps: SkillsCmdDeps = {}): Promise<number> {
+  const io = deps.io ?? stdio;
+  const action = args[0] ?? "";
+  const rest = args.slice(1);
+  const flags = new Set(rest.filter((a) => a.startsWith("--")));
+  const outIx = rest.indexOf("--out");
+  const outFile = outIx !== -1 ? rest[outIx + 1] : undefined;
+  const positional = rest.filter((a, i) => !a.startsWith("--") && rest[i - 1] !== "--out");
+  const globalDir = deps.globalDir ?? skillsDir(cwd, "global");
+  try {
+    if (action === "list") return list(cwd, globalDir, flags.has("--json"), io);
+    if (action === "validate" && positional[0] !== undefined) return validate(resolve(cwd, positional[0]), io);
+    if (action === "pack" && positional[0] !== undefined) {
+      return await pack(resolve(cwd, positional[0]), outFile !== undefined ? resolve(cwd, outFile) : undefined, flags.has("--force"), cwd, io);
+    }
+    if (action === "install" && positional[0] !== undefined) {
+      const target = flags.has("--user") ? globalDir : skillsDir(cwd, "project");
+      return await install(positional[0], cwd, target, flags.has("--force"), deps.fetch ?? ((u, i) => fetch(u, i)), deps.resolve ?? dnsResolver, io);
+    }
+  } catch (err) {
+    io.err(`error: ${err instanceof Error ? err.message : String(err)}`);
+    return err instanceof SkillCmdError ? err.code : 2;
+  }
+  io.err(SKILLS_USAGE);
+  return 1;
+}
+
+function list(cwd: string, globalDir: string, json: boolean, io: SkillsCmdIo): number {
+  const r = new SkillStore(cwd, { globalDir }).scan();
+  const byPath = new Map<string, string[]>();
+  for (const w of r.warnings) byPath.set(w.path, [...(byPath.get(w.path) ?? []), w.reason]);
+  const rows = r.skills.map((s) => ({
+    name: s.name, version: s.version, scope: s.scope, path: s.path, dir: s.dir, description: s.fullDescription,
+    license: s.license, compatibility: s.compatibility, metadata: s.metadata, allowedTools: s.allowedTools,
+    warnings: byPath.get(s.path) ?? [],
+  }));
+  if (json) {
+    io.out(JSON.stringify({ skills: rows, invalid: r.invalid }, null, 2));
+    return 0;
+  }
+  if (rows.length === 0 && r.invalid.length === 0) {
+    io.out(`no skills installed (${skillsDir(cwd, "project")} or ${globalDir}) — rovecode skills install <dir|file.tar.gz|url>`);
+    return 0;
+  }
+  for (const row of rows) io.out(`${row.name.padEnd(24)} ${(row.version || "-").padEnd(10)} ${row.scope.padEnd(8)} ${row.path}`);
+  for (const row of rows) for (const w of row.warnings) io.err(`warning: ${row.path}: ${w}`);
+  for (const i of r.invalid) io.err(`warning: ${i.path}: not loaded — ${i.reason}`);
+  return 0;
+}
+
+/** The strict spec check of `<dir>/SKILL.md`; unreadable → 2, no frontmatter → a finding (1). */
+function strictCheck(dir: string): Validation {
+  const file = join(dir, SKILL_FILE);
+  let text: string;
+  try { text = readFileSync(file, "utf8"); }
+  catch (e) { throw new SkillCmdError(`cannot read ${file}: ${e instanceof Error ? e.message : String(e)}`, 2); }
+  const fm = parseSkillFrontmatter(text);
+  if (fm === null) throw new SkillCmdError(`${file}: missing or unterminated frontmatter block`, 1);
+  return validateSkillMeta(fm, basename(dir), "strict");
+}
+
+/** one stderr line per finding, notes on stdout; true when there are no errors */
+function report(v: Validation, dir: string, io: SkillsCmdIo): boolean {
+  for (const e of v.errors) io.err(`${join(dir, SKILL_FILE)}: ${e}`);
+  for (const n of v.notes) io.out(`note: ${n}`);
+  return v.errors.length === 0;
+}
+
+function validate(dir: string, io: SkillsCmdIo): number {
+  const v = strictCheck(dir);
+  if (!report(v, dir, io)) return 1;
+  io.out(`ok: ${v.meta.name}${v.meta.version ? ` (v${v.meta.version})` : ""} — ${join(dir, SKILL_FILE)}`);
+  return 0;
+}
+
+async function pack(dir: string, outFile: string | undefined, force: boolean, cwd: string, io: SkillsCmdIo): Promise<number> {
+  const v = strictCheck(dir);
+  if (!report(v, dir, io)) return 1; // any finding → nothing written
+  const out = outFile ?? join(cwd, `${v.meta.name}.tar.gz`);
+  if (existsSync(out) && !force) {
+    io.err(`error: ${out} already exists (use --force to overwrite)`);
+    return 1;
+  }
+  const bytes = await packSkill(dir, v.meta.name); // a symlink inside → SkillCmdError(1) before any write
+  writeFileSync(out, bytes);
+  io.out(`packed ${v.meta.name} → ${out} (${bytes.length} bytes)`);
+  return 0;
+}
+
+async function install(src: string, cwd: string, dir: string, force: boolean, fetchImpl: FetchLike, resolve_: Resolver, io: SkillsCmdIo): Promise<number> {
+  const scheme = URL_SCHEME.exec(src)?.[1]?.toLowerCase();
+  let result: InstallResult;
+  if (scheme !== undefined) {
+    if (scheme !== "http" && scheme !== "https") throw new SkillCmdError(`only http(s) URLs can be installed (got ${scheme}:)`, 1);
+    result = await installFromBytes(await download(src, fetchImpl, resolve_), dir, { force });
+  } else {
+    const path = resolve(cwd, src);
+    let isDir: boolean;
+    try { isDir = statSync(path).isDirectory(); }
+    catch { throw new SkillCmdError(`${path}: no such file or directory`, 2); }
+    result = isDir ? installFromDir(path, dir, { force }) : await installFromBytes(readFileSync(path), dir, { force });
+  }
+  io.out(`installed ${result.name}${result.version ? ` (v${result.version})` : ""} → ${result.path}`);
+  for (const w of result.warnings) io.err(`warning: ${w}`);
+  return 0;
+}
+
+/** The archive body under the SSRF guard (see the header): the address is checked BEFORE the request and again on
+ *  every redirect hop — `redirect: "manual"`, so a public URL cannot redirect us into the metadata service — http(s)
+ *  only, ≤ MAX_REDIRECTS. A REF'D timeout drives the abort (Bun's AbortSignal.timeout timer is unref'd — webfetch.ts
+ *  pattern). A refused address is 1 (nothing was fetched); non-2xx / network failure / over the cap are 2. */
+async function download(url: string, fetchImpl: FetchLike, resolve_: Resolver): Promise<Uint8Array> {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), INSTALL_TIMEOUT_MS);
+  (timer as unknown as { ref?: () => void }).ref?.();
+  const failure = (e: unknown): SkillCmdError => new SkillCmdError(
+    `download failed: ${ac.signal.aborted ? `timed out after ${INSTALL_TIMEOUT_MS}ms` : e instanceof Error ? e.message : String(e)}`, 2);
+  try {
+    let current = new URL(url);
+    let hops = 0;
+    for (;;) {
+      if (current.protocol !== "http:" && current.protocol !== "https:") {
+        throw new SkillCmdError(`only http(s) URLs can be installed (got ${current.protocol})`, 1);
+      }
+      let reason: string | null;
+      try { reason = await abortable(ssrfDenyReason(current.hostname, resolve_), ac.signal); }
+      catch (e) { throw failure(e); }
+      if (reason !== null) throw new SkillCmdError(`refused ${current.href}: ${reason}`, 1);
+      let res: Response;
+      try { res = await abortable(fetchImpl(current.href, { signal: ac.signal, redirect: "manual" }), ac.signal); }
+      catch (e) { throw failure(e); }
+      if (REDIRECT_STATUSES.has(res.status)) {
+        const location = res.headers.get("location");
+        await res.body?.cancel().catch(() => {});
+        if (!location) throw new SkillCmdError(`download failed: HTTP ${res.status} from ${current.href} without a Location header`, 2);
+        if (++hops > MAX_REDIRECTS) throw new SkillCmdError(`download failed: too many redirects (more than ${MAX_REDIRECTS}) starting from ${url}`, 2);
+        try { current = new URL(location, current); } catch { throw new SkillCmdError(`download failed: invalid redirect target ${location}`, 2); }
+        continue; // the guard runs again on the new host — that is the point of the manual loop
+      }
+      if (!res.ok) throw new SkillCmdError(`download failed: HTTP ${res.status} for ${current.href}`, 2);
+      const { bytes, truncated } = await readBounded(res, MAX_ARCHIVE_BYTES);
+      if (truncated) throw new SkillCmdError(`download exceeds ${MAX_ARCHIVE_BYTES} bytes`, 2);
+      return bytes;
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/cli/start-chat.ts

@@ -0,0 +1,65 @@
+/** Interactive startup only. The loading screen owns stdout through module loading, resume resolution,
+ *  runtime construction and the sandbox probe. runTui hands it over immediately before its first complete
+ *  frame. Plain chat never loads the renderers; optional network/cache work is not a readiness barrier. */
+import { join } from "node:path";
+import { startIntro } from "../core/intro.ts";
+import type { CliInvocation } from "./dispatch.ts";
+import pkg from "../../package.json";
+
+export async function startChat(cli: CliInvocation, argv: string[] = process.argv): Promise<void> {
+  if (cli.plain) {
+    const [{ runRepl }, { parseAddDirs }, { resolveBoot }] = await Promise.all([
+      import("./repl.ts"), import("./run-flags.ts"), import("./resume.ts"),
+    ]);
+    resolveBoot(argv, join(process.cwd(), ".rovecode", "sessions")); // keep the existing invalid-resume diagnostic
+    await runRepl({ yolo: cli.yolo, addDirs: parseAddDirs(argv) });
+    return;
+  }
+  const intro = startIntro({
+    write: (text) => { process.stdout.write(text); },
+    tty: process.stdout.isTTY === true && !argv.includes("--no-intro") && process.env.ROVECODE_INTRO !== "0",
+    version: pkg.version, holdUntilReady: true,
+    size: () => ({ columns: process.stdout.columns || 80, rows: process.stdout.rows || 24 }),
+    onResize: (paint) => { process.stdout.on("resize", paint); return () => { process.stdout.off("resize", paint); }; },
+  });
+  const ac = new AbortController();
+  let signalExit = 130;
+  const interrupt = () => { signalExit = 130; ac.abort(new Error("startup interrupted")); };
+  const terminate = () => { signalExit = 143; ac.abort(new Error("startup terminated")); };
+  const finish = () => {
+    intro.finish();
+    process.off("SIGINT", interrupt); process.off("SIGTERM", terminate);
+  };
+  // Also covers parsers that exit(2) instead of throwing. No raw input or keystroke consumption here.
+  process.once("exit", finish);
+  process.once("SIGINT", interrupt); process.once("SIGTERM", terminate);
+  const t0 = Number(process.env._ROVECODE_BOOT_T0 ?? -1);
+  const trace = (label: string) => { if (t0 >= 0) process.stderr.write(`[boot] +${Date.now() - t0}ms ${label}\n`); };
+  try {
+    trace("intro started");
+    intro.status("loading modules");
+    const [{ runTui }, { interactiveRenderer }, { parseAddDirs }, { resolveBoot }] = await Promise.all([
+      import("../tui/app.ts"), import("../tui/notify.ts"), import("./run-flags.ts"), import("./resume.ts"),
+    ]);
+    ac.signal.throwIfAborted();
+    trace("surface modules loaded");
+    intro.status("opening session");
+    const cwd = process.cwd();
+    const boot = resolveBoot(argv, join(cwd, ".rovecode", "sessions"));
+    const addDirs = parseAddDirs(argv);
+    await runTui({
+      yolo: cli.yolo, acceptEdits: cli.acceptEdits,
+      ...(cli.effort !== undefined ? { effort: cli.effort } : {}),
+      sessionId: boot.id, ...(boot.note !== undefined ? { bootNote: boot.note } : {}),
+      renderer: interactiveRenderer(cli, process.env, process.stdout, process.stdin, cwd),
+      ...(cli.pet !== undefined ? { pet: cli.pet } : {}), ...(addDirs.length > 0 ? { addDirs } : {}),
+      startup: { status: intro.status, finish, animationDone: intro.animationDone, signal: ac.signal },
+    });
+  } catch (error) {
+    if (ac.signal.aborted) { process.exitCode = signalExit; return; }
+    throw error;
+  } finally {
+    finish();
+    process.off("exit", finish);
+  }
+}

package/src/cli/trust-cmd.ts

@@ -0,0 +1,52 @@
+/** `rovecode trust` — the approval verb for every project file the trust gate covers (core/trust.ts): settings.json's
+ *  command-bearing keys, hooks.ts, sandbox.json, the MCP files. `trust show` says what each file WOULD do; `trust [--yes]`
+ *  approves them as they are now (a TTY confirms after the listing; off a TTY --yes is required); `trust untrust` withdraws.
+ *  `rovecode mcp trust` keeps working and acts on the MCP files only — the same store, so nothing already approved is lost. */
+
+import { rovecodeHome } from "../providers/auth.ts";
+import { projectTrustRows, trustRows, trustShowLines, untrustRows } from "../core/project-trust.ts";
+
+export const TRUST_USAGE = [
+  "usage: rovecode trust                 list this repo's gated files with what they would do, then approve them (asks on a TTY)",
+  "       rovecode trust --yes           approve without asking (after reading `trust show`)",
+  "       rovecode trust show            list only — nothing changes",
+  "       rovecode trust untrust         withdraw the approval; the files contribute nothing again until trusted",
+  "  gated: .rovecode/settings.json (verify, lsp, notify_command) · .rovecode/hooks.ts|js · .rovecode/sandbox.json · .rovecode/mcp.json · .mcp.json",
+  "  the store is ~/.rovecode/plugins.json (path → sha256): any edit to a file asks again",
+];
+
+export interface TrustCmdIo {
+  out?: (line: string) => void;
+  err?: (line: string) => void;
+  /** default rovecodeHome() */
+  home?: string;
+  /** default process.stdin.isTTY */
+  tty?: boolean;
+  /** the confirmation prompt (default Bun's confirm()) */
+  confirm?: (question: string) => Promise<boolean> | boolean;
+}
+
+export async function cmdTrust(argv: string[], cwd: string = process.cwd(), io: TrustCmdIo = {}): Promise<number> {
+  const out = io.out ?? ((l: string) => console.log(l));
+  const err = io.err ?? ((l: string) => console.error(l));
+  const home = io.home ?? rovecodeHome();
+  const words = argv.filter((a) => !a.startsWith("--"));
+  const yes = argv.includes("--yes");
+  const verb = words[0] ?? "";
+  if (verb === "-h" || verb === "help" || argv.includes("--help")) { for (const l of TRUST_USAGE) out(l); return 0; }
+  if (verb !== "" && verb !== "show" && verb !== "untrust") { err(`unknown trust command "${verb}"`); for (const l of TRUST_USAGE) err(l); return 2; }
+  const rows = projectTrustRows(cwd, home);
+  if (verb === "show") { for (const l of trustShowLines(rows)) out(l); return 0; }
+  if (verb === "untrust") { for (const l of untrustRows(home, rows)) out(l); return 0; }
+  if (rows.length === 0) { for (const l of trustShowLines(rows)) out(l); return 1; }
+  for (const l of trustShowLines(rows)) out(l);
+  if (!yes) {
+    const tty = io.tty ?? process.stdin.isTTY === true;
+    if (!tty) { err("nothing trusted: no terminal to confirm on — re-run with --yes after reading the lines above"); return 1; }
+    const ask = io.confirm ?? ((q: string) => confirm(q));
+    if (!(await ask("trust these files as they are now? [y/N]"))) { out("nothing trusted"); return 1; }
+  }
+  for (const l of trustRows(home, rows)) out(l);
+  out("restart rovecode to apply — an edit to any of these files asks again");
+  return 0;
+}