viepilot 2.48.0 → 2.50.1

package/CHANGELOG.md

@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.50.1] - 2026-05-17
+
+### Fixed
+- **BUG** SharePoint sharing link download: forward FedAuth session cookies from WOPI page
+  redirect chain to the `download.aspx` download request — without these cookies the download
+  returned HTTP 401 or an HTML error page even though incognito browser worked fine.
+  `httpsGetRaw` now accumulates `Set-Cookie` headers across all hops; `downloadXlsx` retries
+  with cookies when the initial response is not a valid xlsx binary.
+
+## [2.50.0] - 2026-05-17
+
+### Added
+- **ENH-084** `vp-intake` Setup Wizard — AUQ-driven channel configuration (Phase 125):
+  - **Auto-trigger**: wizard runs automatically when `channels.json` has no real channels
+    (only scaffold stubs with `-example` IDs or `REPLACE_WITH_*` values)
+  - **`--setup` / `--config` flags**: force wizard even when channels already exist
+  - **4-type wizard** via `lib/intake/setup-wizard.cjs`: CSV/TSV, Google Sheets, Excel M365
+    (Graph API), SharePoint Sharing Link — collects all required fields via AUQ + free-text
+  - **Credentials guide**: for Google Sheets and M365, wizard prints step-by-step setup
+    instructions before asking for config values (no live validation)
+  - **Preview + confirm**: shows JSON preview of channel config before writing
+  - **`appendChannel()`**: strips scaffold stubs, preserves non-stub channels, appends new
+  - **`isStubChannel()` / `hasRealChannels()`**: stub detection helpers in `channels.cjs`
+  - **Auto-select after wizard**: if exactly 1 channel created → skips channel selection AUQ
+  - **`validateChannel` fix**: accepts `sharing_url` as valid alternative to `workbook_id`
+    for `excel_m365` channels (ENH-083 compatibility)
+  - **18 new tests** (1915 total): stub detection (5), hasRealChannels (5), appendChannel (2),
+    slugify (3), extractSpreadsheetId (3)
+  - `vp-intake` skill version bumped to **v1.1.0**
+
+## [2.49.0] - 2026-05-17
+
+### Added
+- **ENH-083** `vp-intake` — SharePoint sharing link + xlsx direct download support (Phase 124):
+  - **SharePoint anonymous sharing link** adapter: URLs matching `/:x:/g/` or `/:x:/r/` are
+    resolved via the SharePoint WOPI viewer page — `FileGetUrl` (temp-auth token) is scraped
+    from the HTML and used to download the xlsx file without OAuth credentials
+  - **xlsx parser** using SheetJS (`xlsx` npm package): downloaded xlsx Buffer is parsed to
+    `rows[][]` matching the Graph API response format; falls back to first sheet when the
+    configured sheet name is not found
+  - **`sharing_url` field** in `channels.json` (`excel_m365` type): optional alternative to
+    `workbook_id` for SharePoint "Anyone with the link" files; no credentials required
+  - **Redirect-following HTTP client** (`httpsGetRaw`): browser User-Agent, follows 301/302/307
+    chains needed for SharePoint sharing link flow
+  - **Routing logic in `readExcelM365`**: `sharing_url` present → anonymous WOPI flow;
+    `workbook_id` present → Graph API (OAuth); neither present → `AuthRequiredError` with guide
+  - **BUG_KEYWORDS extended**: `performance`, `slow`, `timeout`, `hang`, `freeze`,
+    `unresponsive`, `chậm`, `treo`, `tắc`, `không phản hồi` — "performance issue" now correctly
+    classifies as BUG instead of UNCLEAR
+  - **19 new tests** (1897 total): keyword expansion (8 tests), `isSharingLink` detection (5
+    tests), routing logic (3 tests), `parseXlsxBuffer` (3 tests)
+
 ## [2.48.0] - 2026-05-17
 
 ### Added

package/lib/intake/adapters/excel-m365.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 const fs    = require('fs');
+const os    = require('os');
 const path  = require('path');
 const https = require('https');
 
@@ -16,6 +17,9 @@ Microsoft 365 / Excel setup:
   5. In channels.json, set "workbook_id" to the file's drive item ID
      (visible in the file's URL on SharePoint/OneDrive)
   6. Re-run vp-intake
+
+For SharePoint sharing links ("Anyone with the link"), use "sharing_url" in channels.json
+instead of "workbook_id" — no credentials required.
 `;
 
 class AuthRequiredError extends Error {
@@ -35,6 +39,8 @@ function colLetterToIndex(letter) {
   return index - 1;
 }
 
+// ─── HTTP helpers ─────────────────────────────────────────────────────────────
+
 function httpsPost(url, body, headers) {
   return new Promise((resolve, reject) => {
     const payload = typeof body === 'string' ? body : JSON.stringify(body);
@@ -73,12 +79,66 @@ function httpsGet(url, headers) {
   });
 }
 
+/**
+ * Follow redirects and return {status, headers, body, cookies}.
+ * Cookies (Set-Cookie) are accumulated across all redirects and forwarded
+ * on each hop — required for SharePoint FedAuth session cookies.
+ */
+function httpsGetRaw(url, headers = {}, maxRedirects = 8) {
+  return new Promise((resolve, reject) => {
+    function doGet(currentUrl, remaining, accCookies) {
+      const urlObj = new URL(currentUrl);
+      const reqHeaders = {
+        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
+        ...headers,
+      };
+      if (accCookies) reqHeaders['Cookie'] = accCookies;
+
+      const req = https.request({
+        hostname: urlObj.hostname,
+        path: urlObj.pathname + urlObj.search,
+        method: 'GET',
+        headers: reqHeaders,
+      }, (res) => {
+        // Accumulate Set-Cookie headers across redirects
+        const setCookies = (res.headers['set-cookie'] || []).map((c) => c.split(';')[0]);
+        const newCookies = setCookies.length
+          ? [accCookies, ...setCookies].filter(Boolean).join('; ')
+          : accCookies;
+
+        if ([301, 302, 303, 307, 308].includes(res.statusCode) && res.headers.location && remaining > 0) {
+          let nextUrl = res.headers.location;
+          if (!nextUrl.startsWith('http')) {
+            nextUrl = `${urlObj.protocol}//${urlObj.host}${nextUrl}`;
+          }
+          // Drain response body before following redirect
+          res.resume();
+          return doGet(nextUrl, remaining - 1, newCookies);
+        }
+        const chunks = [];
+        res.on('data', (chunk) => chunks.push(chunk));
+        res.on('end', () => resolve({
+          status: res.statusCode,
+          headers: res.headers,
+          body: Buffer.concat(chunks),
+          cookies: newCookies,
+        }));
+      });
+      req.on('error', reject);
+      req.end();
+    }
+    doGet(url, maxRedirects, '');
+  });
+}
+
 function encodeFormData(obj) {
   return Object.entries(obj)
     .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
     .join('&');
 }
 
+// ─── Graph API (client credentials) ──────────────────────────────────────────
+
 async function getAccessToken(creds) {
   const now = Math.floor(Date.now() / 1000);
   if (_tokenCache && _tokenCache.expires_at > now + 60) {
@@ -101,7 +161,7 @@ async function getAccessToken(creds) {
   return res.access_token;
 }
 
-async function readExcelM365(channel, projectRoot) {
+async function readViaGraphApi(channel, projectRoot) {
   const root = projectRoot || process.cwd();
   const credPath = path.join(root, CREDENTIALS_REL);
 
@@ -126,12 +186,121 @@ async function readExcelM365(channel, projectRoot) {
   const response = await httpsGet(url, { Authorization: `Bearer ${token}` });
 
   if (!response.values || response.values.length === 0) return [];
+  return parseRowsWithColumnMap(response.values, channel.column_map);
+}
+
+// ─── SharePoint sharing link (anonymous WOPI) ─────────────────────────────────
 
-  const colMap = channel.column_map;
+/** Detect sharing link type: /:x:/g/ or /:x:/r/ paths */
+function isSharingLink(url) {
+  return /\/:x:\/[gr]\//.test(url);
+}
+
+/**
+ * Resolve a SharePoint anonymous sharing link to {downloadUrl, cookies}.
+ * Technique: load WOPI viewer page → scrape FileGetUrl (temp auth token embedded in HTML).
+ * Returns the cookies collected during the redirect chain — they must be forwarded
+ * when downloading (SharePoint FedAuth cookie is required for download.aspx).
+ */
+async function resolveSharePointDownloadUrl(sharingUrl) {
+  const { status, body, cookies } = await httpsGetRaw(sharingUrl);
+  if (status !== 200) {
+    throw new Error(`SharePoint sharing link returned HTTP ${status}. The link may be expired or restricted.`);
+  }
+
+  const html = body.toString('utf8');
+
+  // Scrape FileGetUrl — SharePoint embeds a temp-auth download URL in the viewer HTML
+  const match = html.match(/"FileGetUrl"\s*:\s*"([^"]+)"/);
+  if (!match) {
+    throw new Error('Could not extract download URL from SharePoint viewer page. The file may require sign-in.');
+  }
+
+  // Unescape JSON unicode escapes (& → &)
+  const downloadUrl = match[1].replace(/\\u([\da-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+  return { downloadUrl, cookies };
+}
+
+/**
+ * Download xlsx bytes.
+ * cookies: FedAuth cookies from WOPI page — required for download.aspx redirect chain.
+ */
+async function downloadXlsx(downloadUrl, cookies) {
+  const extraHeaders = { Accept: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,*/*' };
+  const { status, body } = await httpsGetRaw(downloadUrl, extraHeaders, 8);
+  if (status !== 200) {
+    // Retry with cookies if initial attempt fails (some SharePoint tenants need FedAuth)
+    if (cookies) {
+      const retry = await httpsGetRaw(downloadUrl, { ...extraHeaders, Cookie: cookies }, 8);
+      if (retry.status === 200 && retry.body.length > 100) return retry.body;
+    }
+    throw new Error(`Failed to download xlsx: HTTP ${status}`);
+  }
+  // If we got HTML instead of binary (redirect page), retry with cookies
+  const magic = body.slice(0, 4).toString('hex');
+  if (magic !== '504b0304' && cookies) {
+    const retry = await httpsGetRaw(downloadUrl, { ...extraHeaders, Cookie: cookies }, 8);
+    if (retry.status === 200 && retry.body.slice(0, 4).toString('hex') === '504b0304') {
+      return retry.body;
+    }
+  }
+  return body;
+}
+
+// ─── xlsx parser (SheetJS) ────────────────────────────────────────────────────
+
+/**
+ * Parse xlsx Buffer → array of row arrays (like response.values from Graph API).
+ * Uses the `xlsx` npm package (SheetJS).
+ */
+function parseXlsxBuffer(buffer, sheetName) {
+  let XLSX;
+  try {
+    XLSX = require('xlsx');
+  } catch {
+    throw new Error(
+      'The "xlsx" package is required to parse xlsx files from sharing links.\n' +
+      'Install it: npm install xlsx'
+    );
+  }
+
+  const workbook = XLSX.read(buffer, { type: 'buffer' });
+
+  let sheet;
+  if (sheetName && workbook.SheetNames.includes(sheetName)) {
+    sheet = workbook.Sheets[sheetName];
+  } else {
+    // Default to first sheet; warn if requested sheet not found
+    if (sheetName) {
+      process.stderr.write(`[vp-intake] Sheet "${sheetName}" not found. Using "${workbook.SheetNames[0]}" instead.\n`);
+    }
+    sheet = workbook.Sheets[workbook.SheetNames[0]];
+  }
+
+  if (!sheet) return [];
+
+  // Convert to array of arrays (raw values)
+  const rows = XLSX.utils.sheet_to_json(sheet, { header: 1, defval: '' });
+  return rows;
+}
+
+async function readViaSharingLink(channel) {
+  const sharingUrl = channel.sharing_url;
+  const { downloadUrl, cookies } = await resolveSharePointDownloadUrl(sharingUrl);
+  const xlsxBuffer = await downloadXlsx(downloadUrl, cookies);
+  const rows = parseXlsxBuffer(xlsxBuffer, channel.sheet_name || null);
+
+  if (!rows || rows.length === 0) return [];
+  return parseRowsWithColumnMap(rows, channel.column_map);
+}
+
+// ─── Common row → ticket mapper ───────────────────────────────────────────────
+
+function parseRowsWithColumnMap(values, colMap) {
   const tickets = [];
 
-  for (let i = 1; i < response.values.length; i++) {
-    const row = response.values[i];
+  for (let i = 1; i < values.length; i++) {
+    const row = values[i];
     const get = (field) => {
       const col = colMap[field];
       if (!col) return '';
@@ -147,7 +316,7 @@ async function readExcelM365(channel, projectRoot) {
       date:        get('date'),
       status:      get('status'),
       _source_row: i,
-      _channel_id: channel.id,
+      _channel_id: channel ? channel.id : undefined,
     };
 
     if (!ticket.title && !ticket.description) continue;
@@ -157,6 +326,40 @@ async function readExcelM365(channel, projectRoot) {
   return tickets;
 }
 
+// ─── Public entry point ───────────────────────────────────────────────────────
+
+async function readExcelM365(channel, projectRoot) {
+  // Sharing link mode: no credentials required
+  if (channel.sharing_url) {
+    if (isSharingLink(channel.sharing_url)) {
+      return readViaSharingLink(channel);
+    }
+    throw new Error(
+      `sharing_url "${channel.sharing_url}" is not a SharePoint sharing link.\n` +
+      'Sharing links look like: https://xxx.sharepoint.com/:x:/g/personal/xxx/EdXXX...\n' +
+      'For direct document links (Doc.aspx?sourcedoc=...), use workbook_id + credentials instead.'
+    );
+  }
+
+  // Graph API mode: requires workbook_id + credentials
+  if (!channel.workbook_id) {
+    throw new AuthRequiredError(
+      'excel_m365 channel requires either "sharing_url" (for SharePoint sharing links) or ' +
+      '"workbook_id" (for Graph API).' + SETUP_GUIDE
+    );
+  }
+
+  return readViaGraphApi(channel, projectRoot);
+}
+
 function clearTokenCache() { _tokenCache = null; }
 
-module.exports = { readExcelM365, AuthRequiredError, clearTokenCache };
+module.exports = {
+  readExcelM365,
+  AuthRequiredError,
+  clearTokenCache,
+  // exported for testing
+  isSharingLink,
+  resolveSharePointDownloadUrl,
+  parseXlsxBuffer,
+};

package/lib/intake/channels.cjs

@@ -93,8 +93,8 @@ function validateChannel(channel) {
   if (channel.type === 'google_sheets' && !channel.spreadsheet_id) {
     throw new Error(`Google Sheets channel "${channel.id}" must have a "spreadsheet_id" field`);
   }
-  if (channel.type === 'excel_m365' && !channel.workbook_id) {
-    throw new Error(`Excel/M365 channel "${channel.id}" must have a "workbook_id" field`);
+  if (channel.type === 'excel_m365' && !channel.workbook_id && !channel.sharing_url) {
+    throw new Error(`Excel/M365 channel "${channel.id}" must have "workbook_id" or "sharing_url"`);
   }
   return true;
 }
@@ -136,4 +136,45 @@ function initIntakeDir(projectRoot) {
   return { intakeDir, channelsPath, credentialsDir };
 }
 
-module.exports = { loadChannels, validateChannel, getChannelById, initIntakeDir, CHANNELS_SCAFFOLD };
+/** Returns true if the channel is an unfilled scaffold stub. */
+function isStubChannel(ch) {
+  if (!ch || !ch.id) return true;
+  if (ch.id.endsWith('-example')) return true;
+  return JSON.stringify(ch).includes('REPLACE_WITH_');
+}
+
+/** Returns true if channels array has at least one non-stub channel. */
+function hasRealChannels(channels) {
+  return Array.isArray(channels) && channels.some((ch) => !isStubChannel(ch));
+}
+
+/**
+ * Append a new channel to channels.json.
+ * Strips stub channels; preserves existing non-stub channels.
+ */
+function appendChannel(projectRoot, channelObj) {
+  initIntakeDir(projectRoot);
+  const channelsPath = path.join(projectRoot, CHANNELS_REL);
+  let existing = [];
+  try {
+    const parsed = JSON.parse(fs.readFileSync(channelsPath, 'utf8'));
+    existing = Array.isArray(parsed.channels) ? parsed.channels : [];
+  } catch {
+    existing = [];
+  }
+  const nonStubs = existing.filter((ch) => !isStubChannel(ch));
+  const updated = [...nonStubs, channelObj];
+  fs.writeFileSync(channelsPath, JSON.stringify({ channels: updated }, null, 2) + '\n', 'utf8');
+  return channelObj;
+}
+
+module.exports = {
+  loadChannels,
+  validateChannel,
+  getChannelById,
+  initIntakeDir,
+  CHANNELS_SCAFFOLD,
+  isStubChannel,
+  hasRealChannels,
+  appendChannel,
+};

package/lib/intake/classifier.cjs

@@ -3,8 +3,10 @@
 const BUG_KEYWORDS = [
   'bug', 'error', 'fail', 'crash', 'broken', 'fix', 'exception', 'regression',
   'wrong', 'incorrect', 'unexpected', 'null', 'undefined', '500', '404',
+  'performance', 'slow', 'timeout', 'hang', 'freeze', 'unresponsive',
   // Vietnamese
   'lỗi', 'sự cố', 'không hoạt động', 'hỏng', 'sai', 'vá lỗi', 'bị lỗi',
+  'chậm', 'treo', 'tắc', 'không phản hồi',
 ];
 
 const ENH_KEYWORDS = [

package/lib/intake/setup-wizard.cjs

@@ -0,0 +1,215 @@
+'use strict';
+
+const path = require('path');
+const { appendChannel, initIntakeDir } = require('./channels.cjs');
+const { isSharingLink } = require('./adapters/excel-m365.cjs');
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+function slugify(name) {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}
+
+function extractSpreadsheetId(urlOrId) {
+  const match = urlOrId.match(/\/spreadsheets\/d\/([a-zA-Z0-9_-]+)/);
+  return match ? match[1] : urlOrId.trim();
+}
+
+function printCredentialsGuide(type) {
+  if (type === 'google_sheets') {
+    return [
+      '',
+      '  Google Sheets — Service Account setup:',
+      '  1. Go to console.cloud.google.com → IAM & Admin → Service Accounts → Create',
+      '  2. Create a key (JSON) → download it',
+      '  3. Share your Google Sheet with the service account email',
+      '  4. Save the JSON key to: .viepilot/.credentials/google-service-account.json',
+      '',
+    ].join('\n');
+  }
+  if (type === 'excel_m365') {
+    return [
+      '',
+      '  Excel M365 — Azure App Registration:',
+      '  1. Go to portal.azure.com → Azure Active Directory → App Registrations → New',
+      '  2. Add API permission: Microsoft Graph → Files.Read.All (Application)',
+      '  3. Grant admin consent → Certificates & Secrets → New client secret',
+      '  4. Save to: .viepilot/.credentials/m365-credentials.json',
+      '     { "tenant_id": "...", "client_id": "...", "client_secret": "..." }',
+      '',
+    ].join('\n');
+  }
+  return '';
+}
+
+// ─── Per-type config collectors ───────────────────────────────────────────────
+
+async function collectCsvConfig(name, id, askFn) {
+  const filePath = await askFn('Đường dẫn file CSV/TSV? (relative to project root, vd: ./reports/tickets.csv)', null, false);
+  const titleCol = await askFn('Header tên cột TITLE là gì? (vd: summary)', null, false);
+  const descCol  = await askFn('Header tên cột DESCRIPTION là gì? (vd: details)', null, false);
+  const repCol   = await askFn('Header tên cột REPORTER? (để trống nếu không có)', null, false);
+  const dateCol  = await askFn('Header tên cột DATE? (để trống nếu không có)', null, false);
+
+  const column_map = { title: titleCol, description: descCol };
+  if (repCol)  column_map.reporter = repCol;
+  if (dateCol) column_map.date = dateCol;
+
+  return { id, type: 'csv', name, path: filePath, column_map };
+}
+
+async function collectGSheetsConfig(name, id, askFn) {
+  const rawId     = await askFn('Spreadsheet ID hoặc URL Google Sheets?', null, false);
+  const spreadId  = extractSpreadsheetId(rawId);
+  const sheetName = await askFn('Sheet name? (mặc định: Sheet1 — để trống dùng Sheet1)', null, false) || 'Sheet1';
+  const titleCol  = await askFn('Cột TITLE ở cột letter nào? (vd: B)', null, false);
+  const descCol   = await askFn('Cột DESCRIPTION? (vd: C)', null, false);
+  const repCol    = await askFn('Cột REPORTER? (optional, để trống nếu không có)', null, false);
+  const dateCol   = await askFn('Cột DATE? (optional)', null, false);
+
+  const column_map = { title: titleCol.toUpperCase(), description: descCol.toUpperCase() };
+  if (repCol)  column_map.reporter = repCol.toUpperCase();
+  if (dateCol) column_map.date = dateCol.toUpperCase();
+
+  return { id, type: 'google_sheets', name, spreadsheet_id: spreadId, sheet_name: sheetName, column_map };
+}
+
+async function collectM365Config(name, id, askFn) {
+  const workbookId = await askFn('Workbook ID? (từ SharePoint URL, dạng item ID)', null, false);
+  const sheetName  = await askFn('Sheet name? (mặc định: Sheet1)', null, false) || 'Sheet1';
+  const titleCol   = await askFn('Cột TITLE? (letter, vd: B)', null, false);
+  const descCol    = await askFn('Cột DESCRIPTION? (vd: C)', null, false);
+  const repCol     = await askFn('Cột REPORTER? (optional)', null, false);
+  const dateCol    = await askFn('Cột DATE? (optional)', null, false);
+
+  const column_map = { title: titleCol.toUpperCase(), description: descCol.toUpperCase() };
+  if (repCol)  column_map.reporter = repCol.toUpperCase();
+  if (dateCol) column_map.date = dateCol.toUpperCase();
+
+  return { id, type: 'excel_m365', name, workbook_id: workbookId, sheet_name: sheetName, column_map };
+}
+
+async function collectSharePointConfig(name, id, askFn) {
+  let sharingUrl = '';
+  while (!isSharingLink(sharingUrl)) {
+    sharingUrl = await askFn(
+      'SharePoint sharing URL? (dạng https://xxx.sharepoint.com/:x:/g/... hoặc /:x:/r/...)',
+      null,
+      false
+    );
+    if (!isSharingLink(sharingUrl)) {
+      process.stdout.write('  ⚠  URL không đúng định dạng sharing link. Vui lòng dán đúng URL chia sẻ.\n');
+    }
+  }
+
+  const sheetName = await askFn('Sheet name? (để trống = dùng sheet đầu tiên)', null, false) || '';
+  const titleCol  = await askFn('Cột TITLE? (letter, vd: B)', null, false);
+  const descCol   = await askFn('Cột DESCRIPTION? (vd: C)', null, false);
+  const repCol    = await askFn('Cột REPORTER? (optional)', null, false);
+  const dateCol   = await askFn('Cột DATE? (optional)', null, false);
+
+  const column_map = { title: titleCol.toUpperCase(), description: descCol.toUpperCase() };
+  if (repCol)  column_map.reporter = repCol.toUpperCase();
+  if (dateCol) column_map.date = dateCol.toUpperCase();
+
+  const ch = { id, type: 'excel_m365', name, sharing_url: sharingUrl, column_map };
+  if (sheetName) ch.sheet_name = sheetName;
+  return ch;
+}
+
+// ─── Single channel wizard ────────────────────────────────────────────────────
+
+const CHANNEL_TYPE_OPTIONS = [
+  { label: 'CSV / TSV file (local)',                 description: 'Đọc từ file .csv hoặc .tsv trên máy' },
+  { label: 'Google Sheets',                          description: 'Đọc từ Google Sheets qua Service Account' },
+  { label: 'Excel M365 — Graph API (Azure App)',     description: 'Đọc từ OneDrive/SharePoint qua Microsoft Graph API' },
+  { label: 'SharePoint Sharing Link (no credentials)', description: 'Dán link chia sẻ SharePoint — không cần cấu hình OAuth' },
+];
+
+async function wizardOneChannel(projectRoot, askFn) {
+  // Step 1 — loại channel
+  const typeChoice = await askFn(
+    'Bạn muốn cấu hình loại nguồn ticket nào?',
+    CHANNEL_TYPE_OPTIONS,
+    false
+  );
+
+  // Step 2 — display name → id
+  const name = await askFn('Tên hiển thị cho channel này? (vd: UAT Tickets Q2)', null, false);
+  const id   = slugify(name) || `channel-${Date.now()}`;
+
+  // Step 3 — collect per-type fields
+  let channelObj;
+  if (typeChoice === 'CSV / TSV file (local)') {
+    channelObj = await collectCsvConfig(name, id, askFn);
+  } else if (typeChoice === 'Google Sheets') {
+    process.stdout.write(printCredentialsGuide('google_sheets'));
+    channelObj = await collectGSheetsConfig(name, id, askFn);
+  } else if (typeChoice === 'Excel M365 — Graph API (Azure App)') {
+    process.stdout.write(printCredentialsGuide('excel_m365'));
+    channelObj = await collectM365Config(name, id, askFn);
+  } else {
+    // SharePoint Sharing Link
+    channelObj = await collectSharePointConfig(name, id, askFn);
+  }
+
+  // Step 4 — preview + confirm
+  process.stdout.write('\n  Preview cấu hình:\n');
+  process.stdout.write(JSON.stringify(channelObj, null, 2).split('\n').map(l => '  ' + l).join('\n'));
+  process.stdout.write('\n');
+
+  const confirm = await askFn('Lưu cấu hình này?', [
+    { label: 'Lưu',         description: 'Ghi channel vào channels.json' },
+    { label: 'Cấu hình lại', description: 'Nhập lại thông tin channel này' },
+    { label: 'Huỷ',          description: 'Bỏ qua channel này' },
+  ], false);
+
+  if (confirm === 'Cấu hình lại') {
+    return wizardOneChannel(projectRoot, askFn);
+  }
+  if (confirm === 'Huỷ') {
+    return null;
+  }
+
+  // Step 5 — write
+  appendChannel(projectRoot, channelObj);
+  process.stdout.write(`\n  ✓ Channel "${name}" đã được lưu vào .viepilot/intake/channels.json\n\n`);
+  return channelObj;
+}
+
+// ─── Public entry point ───────────────────────────────────────────────────────
+
+/**
+ * Run the interactive setup wizard.
+ * @param {string} projectRoot
+ * @param {Function} askFn  async (question, options, multiSelect) → string
+ * @returns {object|null}  last channel created, or null if none
+ */
+async function runSetupWizard(projectRoot, askFn) {
+  initIntakeDir(projectRoot);
+  process.stdout.write('\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n');
+  process.stdout.write(' VP-INTAKE ► Setup Wizard\n');
+  process.stdout.write('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n');
+
+  let lastCreated = null;
+
+  // eslint-disable-next-line no-constant-condition
+  while (true) {
+    const ch = await wizardOneChannel(projectRoot, askFn);
+    if (ch) lastCreated = ch;
+
+    const more = await askFn('Cấu hình thêm channel khác?', [
+      { label: 'Không — tiếp tục import', description: 'Chuyển sang chọn channel và import ticket' },
+      { label: 'Có — thêm channel',       description: 'Cấu hình thêm một nguồn ticket nữa' },
+    ], false);
+
+    if (more !== 'Có — thêm channel') break;
+  }
+
+  return lastCreated;
+}
+
+module.exports = { runSetupWizard, slugify, extractSpreadsheetId };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viepilot",
-  "version": "2.48.0",
+  "version": "2.50.1",
   "description": "**Autonomous Vibe Coding Framework / Bộ khung phát triển tự động có kiểm soát**",
   "main": "index.js",
   "bin": {
@@ -74,7 +74,8 @@
   },
   "dependencies": {
     "docx": "^9.0.0",
-    "pptxgenjs": "^3.12.0"
+    "pptxgenjs": "^3.12.0",
+    "xlsx": "^0.18.5"
   },
   "optionalDependencies": {
     "@googleapis/slides": "^1.0.0"

package/skills/vp-intake/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: vp-intake
 description: "Import and triage tickets from Excel/M365 Online, Google Sheets, or CSV/TSV files — classify as BUG/ENH, accept/decline via AskUserQuestion, write back to source, generate TRIAGE report"
-version: 1.0.0
+version: 1.1.0
 ---
 
 <greeting>
@@ -11,7 +11,7 @@ Output this banner as the **first** thing on every invocation — before questio
 
 ```
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
- VIEPILOT ► VP-INTAKE  v1.0.0 (fw 2.48.0)
+ VIEPILOT ► VP-INTAKE  v1.1.0 (fw 2.50.0)
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 ```
 </greeting>
@@ -78,13 +78,16 @@ session report.
 Optional flags:
 - `--channel <id>` : Skip channel selection, use this channel ID directly
 - `--dry-run` : Classify and show tickets without creating requests or writing back
+- `--setup` : Force setup wizard — configure a new channel now (even if channels already exist)
+- `--config` : Alias for `--setup`
 
 **Supported channel types:**
 | Type | Auth | Config field |
 |------|------|-------------|
 | `csv` | None | `path` (local file) |
 | `google_sheets` | Service Account JSON | `spreadsheet_id` + `sheet_name` |
-| `excel_m365` | Azure App Registration | `workbook_id` + `sheet_name` |
+| `excel_m365` (Graph API) | Azure App Registration | `workbook_id` + `sheet_name` |
+| `excel_m365` (sharing link) | None — anonymous | `sharing_url` |
 
 **Config file:** `.viepilot/intake/channels.json`
 **Credentials dir:** `.viepilot/.credentials/` (gitignored)
@@ -92,6 +95,36 @@ Optional flags:
 
 <process>
 
+### Step 0: Setup wizard detection (ENH-084)
+
+**Check wizard trigger conditions:**
+
+```js
+const args = parseArgs(VP_ARGS);
+const forceSetup = args.includes('--setup') || args.includes('--config');
+
+// Init dir + load channels
+initIntakeDir(projectRoot);          // lib/intake/channels.cjs
+const { channels } = loadChannels(projectRoot);
+const needsSetup = forceSetup || !hasRealChannels(channels);  // lib/intake/channels.cjs
+```
+
+**If `needsSetup` is true:**
+
+Call `runSetupWizard(projectRoot, askFn)` from `lib/intake/setup-wizard.cjs`.
+
+`askFn` wraps `AskUserQuestion` for structured option prompts, and falls back to free-text
+input for open-ended fields (column names, file paths, URLs).
+
+After wizard completes:
+- Reload channels from channels.json
+- If exactly 1 channel was just created → auto-select it and skip Step 3 (go to Step 4)
+- Otherwise → continue to Step 3 (channel select AUQ with all available real channels)
+
+**If `needsSetup` is false** and no `--setup` flag → skip Step 0 entirely, continue to Step 1.
+
+---
+
 ### Step 1: Init intake directory
 
 ```bash
@@ -102,13 +135,11 @@ This creates `.viepilot/intake/channels.json` (scaffold) and `.viepilot/.credent
 
 ### Step 2: Load channels
 
-Read `.viepilot/intake/channels.json`. If no channels configured (only example stubs remain),
-tell the user:
+Read `.viepilot/intake/channels.json`. If no real channels exist after Step 0:
 
 ```
 No channels configured yet.
-Edit .viepilot/intake/channels.json to add your ticket sources.
-Run vp-tools intake-init to see the config scaffold.
+Run /vp-intake --setup to configure a channel interactively.
 ```
 
 ### Step 3: Select channel (AUQ single-select)
@@ -188,6 +219,8 @@ options:
 </process>
 
 <success_criteria>
+- [ ] Setup wizard triggers automatically when no real channels exist (or --setup flag)
+- [ ] Wizard collects channel config via AUQ and writes to channels.json
 - [ ] Channels loaded from `.viepilot/intake/channels.json`
 - [ ] Correct adapter dispatched based on channel type
 - [ ] Tickets classified as BUG / ENH / UNCLEAR
@@ -211,6 +244,7 @@ options:
 | GitHub Copilot | ✅ Text fallback | Via `.agent.md` |
 
 **Prompts in this skill:**
+- Setup wizard: channel type, display name, field config, preview+confirm (Step 0)
 - Channel selection (Step 3)
 - Ticket accept/decline multi-select (Step 5)
 - Decline reason (Step 5)
@@ -218,6 +252,8 @@ options:
 - Next action (Step 8)
 
 ## Capabilities
+- **Setup wizard** (`--setup`): AUQ-driven channel configuration — writes directly to channels.json
+- Read tickets from SharePoint sharing links (anonymous WOPI download, no credentials)
 - Read tickets from Excel/Microsoft 365 Online via Microsoft Graph API
 - Read tickets from Google Sheets via Sheets API v4
 - Read tickets from local CSV/TSV files