skillfoxx 0.1.1 → 0.1.2

package/README.en.md

@@ -16,7 +16,7 @@ Requires Node.js 18.18 or newer.
 | `remove <entry>` | removes what SkillFoxx installed |
 | `update [entry]` | updates to the version SkillFoxx has rechecked |
 | `list` | shows what is installed |
-| `doctor` | checks installs: edited by hand, outdated, removed from the catalog |
+| `doctor` | checks installs: edited by hand, outdated, removed from the catalog, environment variables not set |
 | `search <query>` | searches the catalog |
 
 Options: `--agent claude-code,cursor` (or `all`), `--project`, `--global`, `-y`/`--yes`, `--force`, `--dry-run`, `--json`, `--lang ru|en`.
@@ -41,6 +41,7 @@ Without `--agent` the CLI picks the agent it runs inside, otherwise every agent
 - A key SkillFoxx did not install, or one edited by hand, is not replaced without `--force`.
 - In a project a secret never goes into a file: the CLI writes an environment variable reference if the agent supports it, otherwise it prints instructions and suggests installing with `--global`.
 - For the user scope the secret value goes into the agent config, the way the agents do it themselves. Lock files hold no values.
+- `doctor` checks required variables against the current environment (names and status only, no values; secrets are listed first among problems). On macOS an app opened from the Dock or Launchpad does not see exports from `~/.zshrc`: after `add`, such variables get a hint about `launchctl setenv` or starting the agent from a terminal where the variable is already set.
 
 ## Lock files
 

package/README.md

@@ -16,7 +16,7 @@ npx skillfoxx add mcp/vv-mcp-server
 | `remove <запись>` | удаляет то, что поставил SkillFoxx |
 | `update [запись]` | обновляет до версии, которую сверил SkillFoxx |
 | `list` | показывает установленное |
-| `doctor` | проверяет: изменено руками, устарело, снято из каталога |
+| `doctor` | проверяет: изменено руками, устарело, снято из каталога, не заданы переменные окружения |
 | `search <запрос>` | ищет в каталоге |
 
 Параметры: `--agent claude-code,cursor` (или `all`), `--project`, `--global`, `-y`/`--yes`, `--force`, `--dry-run`, `--json`, `--lang ru|en`.
@@ -41,6 +41,7 @@ Claude Code, Cursor, VS Code, Codex, Gemini CLI, Devin, Cline, Zoo Code, OpenCod
 - Ключ, который поставил не SkillFoxx или который изменили руками, без `--force` не заменяется.
 - В проекте секрет не пишется в файл никогда: пишется ссылка на переменную окружения, если агент ее понимает, иначе печатается инструкция и совет поставить с `--global`.
 - Для пользователя значение секрета пишется в конфиг агента, как это делают сами агенты. В lock-файле значений нет.
+- `doctor` сверяет обязательные переменные записей с текущим окружением (только имена и статус, без значений; секреты в списке проблем идут первыми). На macOS приложение, открытое из Dock или Launchpad, не видит экспорт из `~/.zshrc`: после `add` для таких переменных печатается подсказка про `launchctl setenv` или запуск агента из терминала, где переменная уже задана.
 
 ## Lock-файлы
 

package/dist/cli.js

@@ -20078,7 +20078,7 @@ var findOnPath = async (ctx, bin) => {
 };
 
 // src/version.ts
-var VERSION = true ? "0.1.1" : "0.0.0-dev";
+var VERSION = true ? "0.1.2" : "0.0.0-dev";
 
 // src/api.ts
 var DAY = 24 * 36e5;
@@ -22465,6 +22465,33 @@ var describePlan = (ctx, actions, root) => actions.map((a) => {
 var planJson = (actions, root) => actions.map(
   (a) => a.type === "mcp" ? { type: a.type, agent: a.agent, component: a.component.name, file: path5.relative(root, a.target.file), key: a.target.key } : { type: a.type, agent: "agent" in a ? a.agent : null, component: componentName(a.component), ...a.type === "manual" ? { reason: a.reason.en } : {} }
 );
+var LOCAL_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
+var isLocalHost = (url2) => {
+  try {
+    const host = new URL(url2).hostname.toLowerCase();
+    return LOCAL_HOSTS.has(host) || host.endsWith(".localhost");
+  } catch {
+    return false;
+  }
+};
+var remoteAuthWarnings = (ctx, recipe) => {
+  const warnings = [];
+  for (const c of recipe.components) {
+    if (c.kind !== "mcp-http" || isLocalHost(c.url)) continue;
+    const authVars = new Set(c.headers.filter((h) => h.secret).flatMap((h) => templateVars(h.value)));
+    const missing = [...authVars].filter((name2) => !ctx.env[name2]);
+    if (missing.length) {
+      warnings.push(
+        tr(
+          ctx,
+          `${clean(c.name)}: \u0441\u0435\u0440\u0432\u0435\u0440 ${clean(c.url)} \u0431\u0443\u0434\u0435\u0442 \u0432\u044B\u0437\u0432\u0430\u043D \u0431\u0435\u0437 \u0430\u0432\u0442\u043E\u0440\u0438\u0437\u0430\u0446\u0438\u0438, \u043F\u043E\u043A\u0430 \u043D\u0435 \u0437\u0430\u0434\u0430\u043D\u0430 \u043F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u0430\u044F \u043E\u043A\u0440\u0443\u0436\u0435\u043D\u0438\u044F ${missing.join(", ")}.`,
+          `${clean(c.name)}: the server ${clean(c.url)} will be called without authorization until the environment variable ${missing.join(", ")} is set.`
+        )
+      );
+    }
+  }
+  return warnings;
+};
 var manualNote = (ctx, action, entryUrl) => {
   const c = action.component;
   const who = action.agent ? agentDef(action.agent).title : tr(ctx, "\u0412\u0440\u0443\u0447\u043D\u0443\u044E", "By hand");
@@ -22569,6 +22596,14 @@ var downloadSkill = async (ctx, source, loaded, component2) => {
 };
 
 // src/lock.ts
+var recipeVars = (recipe) => {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of recipe.components) {
+    if (c.kind !== "mcp-stdio" && c.kind !== "mcp-http") continue;
+    for (const e of c.env) if (!out.has(e.name)) out.set(e.name, { name: e.name, required: e.required, secret: e.secret });
+  }
+  return [...out.values()];
+};
 var LOCK_FILE = "skillfoxx-lock.json";
 var exists2 = async (p) => Boolean(await stat4(p).catch(() => null));
 var upward = async (from, markers) => {
@@ -22605,6 +22640,7 @@ var lockPathOk = (scope, p) => {
   const abs = p.replace(/^[A-Za-z]:/, "");
   return abs.startsWith("/") && safeRelative(abs.slice(1));
 };
+var varOk = (v) => isObj(v) && isStr(v.name) && VAR_NAME.test(v.name) && typeof v.required === "boolean" && typeof v.secret === "boolean";
 var itemOk = (scope, i) => {
   if (!isObj(i)) return false;
   switch (i.kind) {
@@ -22625,7 +22661,7 @@ var itemOk = (scope, i) => {
 var entryOk = (scope, key, e) => {
   const m = ENTRY_KEY.exec(key);
   if (!m || !isObj(e)) return false;
-  return e.section === m[1] && e.slug === m[2] && e.scope === scope && isStr(e.recipeHash) && strOrNull(e.commitSha) && strOrNull(e.contentDigest) && isStr(e.status) && strOrNull(e.risk) && Array.isArray(e.agents) && e.agents.every(isAgent) && Array.isArray(e.items) && e.items.every((i) => itemOk(scope, i)) && isStr(e.installedAt) && isStr(e.updatedAt) && isStr(e.cliVersion);
+  return e.section === m[1] && e.slug === m[2] && e.scope === scope && isStr(e.recipeHash) && strOrNull(e.commitSha) && strOrNull(e.contentDigest) && isStr(e.status) && strOrNull(e.risk) && Array.isArray(e.agents) && e.agents.every(isAgent) && Array.isArray(e.items) && e.items.every((i) => itemOk(scope, i)) && (e.vars === void 0 || Array.isArray(e.vars) && e.vars.every(varOk)) && isStr(e.installedAt) && isStr(e.updatedAt) && isStr(e.cliVersion);
 };
 var readLock = async (file3, scope) => {
   let text;
@@ -22979,7 +23015,7 @@ var knownSecrets = async (ctx, p) => {
 var install = async (ctx, p) => {
   const backup = new Backup(ctx);
   const created = [];
-  const res = { items: [], notes: [], touched: /* @__PURE__ */ new Set(), cliInstalled: false };
+  const res = { items: [], notes: [], touched: /* @__PURE__ */ new Set(), cliInstalled: false, requiredEnvRefs: /* @__PURE__ */ new Set() };
   const prev = p.previous?.items ?? [];
   const owned = new Set(prev.flatMap((i) => i.kind === "skill" ? [lockItemTarget(ctx, p.scope, p.root, i)] : []).filter((x) => Boolean(x)));
   let rolledBack = null;
@@ -23087,6 +23123,7 @@ var installMcp = async (ctx, p, action, values, backup, prev, res) => {
   if (p.scope === "project" && action.agent === "codex") res.notes.push(tr(ctx, "Codex \u0447\u0438\u0442\u0430\u0435\u0442 .codex/config.toml \u0442\u043E\u043B\u044C\u043A\u043E \u0432 \u0434\u043E\u0432\u0435\u0440\u0435\u043D\u043D\u044B\u0445 \u043F\u0440\u043E\u0435\u043A\u0442\u0430\u0445.", "Codex reads .codex/config.toml only in trusted projects."));
   if (p.scope === "project" && action.agent === "amp") res.notes.push(tr(ctx, "Amp: \u043F\u043E\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u0435 \u0441\u0435\u0440\u0432\u0435\u0440 \u043A\u043E\u043C\u0430\u043D\u0434\u043E\u0439 amp mcp approve.", "Amp: approve the server with amp mcp approve."));
   if (r.references.length) res.notes.push(tr(ctx, `\u0417\u0430\u0434\u0430\u0439\u0442\u0435 \u043F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u044B\u0435 \u043E\u043A\u0440\u0443\u0436\u0435\u043D\u0438\u044F \u043F\u0435\u0440\u0435\u0434 \u0437\u0430\u043F\u0443\u0441\u043A\u043E\u043C \u0430\u0433\u0435\u043D\u0442\u0430: ${r.references.join(", ")}`, `Set environment variables before starting the agent: ${r.references.join(", ")}`));
+  for (const name2 of r.references) if (r.component.env.find((e) => e.name === name2)?.required) res.requiredEnvRefs.add(name2);
   if (r.secrets.length) res.notes.push(tr(ctx, `${title}: \u0437\u043D\u0430\u0447\u0435\u043D\u0438\u044F \u0441\u0435\u043A\u0440\u0435\u0442\u043E\u0432 \u0437\u0430\u043F\u0438\u0441\u0430\u043D\u044B \u0432 ${file3}.`, `${title}: secret values are stored in ${file3}.`));
 };
 var installCli = async (ctx, p, action, res) => {
@@ -23167,6 +23204,21 @@ var findInstalled = async (ctx, input2, flags) => {
 };
 
 // src/commands/add.ts
+var envHint = (ctx, names) => {
+  const list = names.join(", ");
+  if (ctx.platform === "darwin") {
+    return tr(
+      ctx,
+      `\u041F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u044B\u0435 \u043E\u043A\u0440\u0443\u0436\u0435\u043D\u0438\u044F \u043D\u0443\u0436\u043D\u044B \u0430\u0433\u0435\u043D\u0442\u0443 \u043F\u0440\u0438 \u0437\u0430\u043F\u0443\u0441\u043A\u0435: ${list}. \u041F\u0440\u0438\u043B\u043E\u0436\u0435\u043D\u0438\u0435, \u043E\u0442\u043A\u0440\u044B\u0442\u043E\u0435 \u0438\u0437 Dock \u0438\u043B\u0438 Launchpad, \u043D\u0435 \u0432\u0438\u0434\u0438\u0442 \u044D\u043A\u0441\u043F\u043E\u0440\u0442 \u0438\u0437 ~/.zshrc. \u0417\u0430\u0434\u0430\u0439\u0442\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u0438\u0435 \u043A\u043E\u043C\u0430\u043D\u0434\u043E\u0439 launchctl setenv \u0418\u041C\u042F \u0437\u043D\u0430\u0447\u0435\u043D\u0438\u0435 (\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0434\u043E \u043F\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043A\u0438) \u0438\u043B\u0438 \u0437\u0430\u043F\u0443\u0441\u043A\u0430\u0439\u0442\u0435 \u0430\u0433\u0435\u043D\u0442\u0430 \u0438\u0437 \u0442\u0435\u0440\u043C\u0438\u043D\u0430\u043B\u0430, \u0433\u0434\u0435 \u043F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u0430\u044F \u0443\u0436\u0435 \u0437\u0430\u0434\u0430\u043D\u0430, \u043D\u0430\u043F\u0440\u0438\u043C\u0435\u0440 open -a Cursor \u0438\u0437 \u044D\u0442\u043E\u0433\u043E \u0442\u0435\u0440\u043C\u0438\u043D\u0430\u043B\u0430.`,
+      `The agent needs these environment variables at launch: ${list}. An app opened from the Dock or Launchpad does not see exports from ~/.zshrc. Set the value with launchctl setenv NAME value (lasts until reboot), or start the agent from a terminal where the variable is already set, for example open -a Cursor from that terminal.`
+    );
+  }
+  return tr(
+    ctx,
+    `\u041F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u044B\u0435 \u043E\u043A\u0440\u0443\u0436\u0435\u043D\u0438\u044F \u043D\u0443\u0436\u043D\u044B \u0430\u0433\u0435\u043D\u0442\u0443 \u043F\u0440\u0438 \u0437\u0430\u043F\u0443\u0441\u043A\u0435: ${list}. \u0417\u0430\u0434\u0430\u0439\u0442\u0435 \u0438\u0445 \u0432 \u043F\u0440\u043E\u0444\u0438\u043B\u0435 \u043E\u0431\u043E\u043B\u043E\u0447\u043A\u0438 \u0438\u043B\u0438 \u0432 \u0441\u043E\u0431\u0441\u0442\u0432\u0435\u043D\u043D\u044B\u0445 \u043D\u0430\u0441\u0442\u0440\u043E\u0439\u043A\u0430\u0445 \u043E\u043A\u0440\u0443\u0436\u0435\u043D\u0438\u044F \u0430\u0433\u0435\u043D\u0442\u0430.`,
+    `The agent needs these environment variables at launch: ${list}. Set them in your shell profile or in the agent's own environment settings.`
+  );
+};
 var runAdd = async (ctx, args, flags) => {
   if (args.length !== 1) throw new CliError(64, tr(ctx, "\u0423\u043A\u0430\u0436\u0438\u0442\u0435 \u043E\u0434\u043D\u0443 \u0437\u0430\u043F\u0438\u0441\u044C: npx skillfoxx add <\u0440\u0430\u0437\u0434\u0435\u043B>/<slug>", "Name one entry: npx skillfoxx add <section>/<slug>"));
   const { section, slug } = await resolveTarget(ctx, args[0]);
@@ -23176,7 +23228,7 @@ var runAdd = async (ctx, args, flags) => {
   if (!g.ok) throw new CliError(g.code, g.message);
   const b = body;
   const recipe = b.recipe;
-  for (const w of [...g.warnings, ...await checkRuntimes(ctx, recipe)]) ctx.err(w);
+  for (const w of [...g.warnings, ...await checkRuntimes(ctx, recipe), ...remoteAuthWarnings(ctx, recipe)]) ctx.err(w);
   await riskConsent(ctx, g, Boolean(flags.yes));
   const scope = await pickScope(ctx, flags);
   const root = await rootFor(ctx, scope);
@@ -23207,12 +23259,15 @@ var runAdd = async (ctx, args, flags) => {
     scope,
     agents: [.../* @__PURE__ */ new Set([...previous?.agents ?? [], ...result.touched])],
     items: mergeItems(previous?.items ?? [], result.items),
+    vars: recipeVars(recipe),
     installedAt: previous?.installedAt ?? now,
     updatedAt: now,
     cliVersion: VERSION
   };
   await writeLock(lockFile, lock);
   for (const note of new Set(result.notes)) ctx.out(note);
+  const missingEnv = [...result.requiredEnvRefs].filter((n) => !ctx.env[n]);
+  if (missingEnv.length) ctx.out(envHint(ctx, missingEnv));
   await sendEvents(ctx, installEvents(key, result, previous ? "update" : "add"));
   ctx.out(tr(ctx, `\u0413\u043E\u0442\u043E\u0432\u043E: ${key}`, `Done: ${key}`));
   return 0;
@@ -23220,6 +23275,8 @@ var runAdd = async (ctx, args, flags) => {
 
 // src/commands/doctor.ts
 import { lstat as lstat3, stat as stat5 } from "node:fs/promises";
+var envRows = (ctx, key, scope, vars) => (vars ?? []).map((v) => ({ key, scope, name: v.name, required: v.required, secret: v.secret, status: ctx.env[v.name] ? "ok" : "missing" }));
+var envProblems = (ctx, rows) => rows.filter((r) => r.required && r.status === "missing").sort((a, b) => Number(b.secret) - Number(a.secret)).map((r) => ({ key: r.key, scope: r.scope, kind: "env", detail: r.secret ? tr(ctx, `${r.name} (\u0441\u0435\u043A\u0440\u0435\u0442)`, `${r.name} (secret)`) : r.name }));
 var localProblems = async (ctx, key, scope, entry, root) => {
   const out = [];
   for (const item of entry.items) {
@@ -23259,15 +23316,20 @@ var LABEL = {
   blocked: ["\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043A\u0430 \u0437\u0430\u0431\u043B\u043E\u043A\u0438\u0440\u043E\u0432\u0430\u043D\u0430", "installation is blocked"],
   unsupported: ["\u0430\u0432\u0442\u043E\u043C\u0430\u0442\u0438\u0447\u0435\u0441\u043A\u0430\u044F \u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043A\u0430 \u0431\u043E\u043B\u044C\u0448\u0435 \u043D\u0435 \u043F\u043E\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044F", "automatic install is no longer supported"],
   risk: ["\u0440\u0438\u0441\u043A \u0432\u044B\u0440\u043E\u0441 \u0434\u043E high", "risk went up to high"],
-  unchecked: ["\u043D\u0435 \u0443\u0434\u0430\u043B\u043E\u0441\u044C \u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C", "could not check"]
+  unchecked: ["\u043D\u0435 \u0443\u0434\u0430\u043B\u043E\u0441\u044C \u043F\u0440\u043E\u0432\u0435\u0440\u0438\u0442\u044C", "could not check"],
+  env: ["\u043F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u0430\u044F \u043E\u043A\u0440\u0443\u0436\u0435\u043D\u0438\u044F \u043D\u0435 \u0437\u0430\u0434\u0430\u043D\u0430", "environment variable is not set"]
 };
 var runDoctor = async (ctx, _args, flags) => {
   const problems = [];
+  const env = [];
   let checked = 0;
   for (const s of await lockScopes(ctx, flags)) {
     for (const [key, entry] of Object.entries(s.lock.entries)) {
       checked++;
       problems.push(...await localProblems(ctx, key, s.scope, entry, s.root));
+      const rows = envRows(ctx, key, s.scope, entry.vars);
+      env.push(...rows);
+      problems.push(...envProblems(ctx, rows));
       try {
         const body = await fetchRecipe(ctx, entry.section, entry.slug);
         const g = gate(ctx, body);
@@ -23284,9 +23346,13 @@ var runDoctor = async (ctx, _args, flags) => {
       }
     }
   }
-  if (flags.json) printJson(ctx, { checked, problems });
-  else if (!problems.length) ctx.out(tr(ctx, `\u041F\u0440\u043E\u0432\u0435\u0440\u0435\u043D\u043E \u0437\u0430\u043F\u0438\u0441\u0435\u0439: ${checked}, \u043F\u0440\u043E\u0431\u043B\u0435\u043C \u043D\u0435\u0442.`, `Entries checked: ${checked}, no problems.`));
-  else for (const p of problems) ctx.out(`${p.key}: ${tr(ctx, ...LABEL[p.kind])}, ${p.detail}`);
+  const optionalMissing = env.filter((r) => !r.required && r.status === "missing");
+  if (flags.json) printJson(ctx, { checked, problems, env });
+  else if (!problems.length && !optionalMissing.length) ctx.out(tr(ctx, `\u041F\u0440\u043E\u0432\u0435\u0440\u0435\u043D\u043E \u0437\u0430\u043F\u0438\u0441\u0435\u0439: ${checked}, \u043F\u0440\u043E\u0431\u043B\u0435\u043C \u043D\u0435\u0442.`, `Entries checked: ${checked}, no problems.`));
+  else {
+    for (const p of problems) ctx.out(`${p.key}: ${tr(ctx, ...LABEL[p.kind])}, ${p.detail}`);
+    for (const r of optionalMissing) ctx.out(tr(ctx, `${r.key}: \u043D\u0435\u043E\u0431\u044F\u0437\u0430\u0442\u0435\u043B\u044C\u043D\u0430\u044F \u043F\u0435\u0440\u0435\u043C\u0435\u043D\u043D\u0430\u044F \u043D\u0435 \u0437\u0430\u0434\u0430\u043D\u0430, ${r.name}`, `${r.key}: optional variable is not set, ${r.name}`));
+  }
   return problems.length ? 2 : 0;
 };
 
@@ -23486,6 +23552,7 @@ var runUpdate = async (ctx, args, flags) => {
         risk: body.risk.level ?? null,
         agents: [...result.touched],
         items: result.items,
+        vars: recipeVars(recipe),
         updatedAt: ctx.now().toISOString(),
         cliVersion: VERSION
       };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillfoxx",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Установка скиллов, MCP-серверов и CLI из каталога SkillFoxx в Claude Code, Cursor, Codex и другие агенты",
   "type": "module",
   "bin": { "skillfoxx": "dist/cli.js" },