vskill 1.0.14 → 1.0.15

package/dist/commands/auth.js

@@ -0,0 +1,273 @@
+// ---------------------------------------------------------------------------
+// auth.ts — `vskill auth {login,status,logout}`.
+//
+// Device Flow (RFC 8628) against github.com directly:
+//   1. POST https://github.com/login/device/code
+//        body:  client_id=<VSKILL_GITHUB_CLIENT_ID>&scope=read:user
+//        resp:  { device_code, user_code, verification_uri, interval, expires_in }
+//   2. Display formatted user_code (XXXX-XXXX) + verification_uri.
+//      Optionally open the URL in the user's default browser.
+//   3. Poll https://github.com/login/oauth/access_token every `interval` seconds
+//        body:  client_id=...&device_code=...&grant_type=urn:ietf:params:oauth:grant-type:device_code
+//        resp:  { access_token, ... } | { error: "authorization_pending" | "slow_down" | "expired_token" | "access_denied" }
+//      slow_down → bump interval +5s.
+//      authorization_pending → keep polling.
+//      expired_token / access_denied → abort.
+//   4. GET https://api.github.com/user with Bearer token to confirm + print login.
+//   5. Persist token via keychain.
+//
+// All network operations go through dependency-injected `fetchImpl` so tests
+// never hit the real github.com.
+// ---------------------------------------------------------------------------
+import { getDefaultKeychain } from "../lib/keychain.js";
+const DEVICE_CODE_URL = "https://github.com/login/device/code";
+const TOKEN_URL = "https://github.com/login/oauth/access_token";
+const USER_URL = "https://api.github.com/user";
+const DEFAULT_SCOPE = "read:user";
+function isPollError(r) {
+    return typeof r.error === "string";
+}
+function formatUserCode(code) {
+    // GitHub returns 8 alphanumerics like "ABCD1234" — render as ABCD-1234.
+    if (code.length === 8)
+        return `${code.slice(0, 4)}-${code.slice(4)}`;
+    return code;
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function postForm(fetchImpl, url, body, version) {
+    const params = new URLSearchParams(body);
+    return fetchImpl(url, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+            "User-Agent": `vskill/${version}`,
+        },
+        body: params.toString(),
+    });
+}
+async function getJson(fetchImpl, url, token, version) {
+    const res = await fetchImpl(url, {
+        method: "GET",
+        headers: {
+            Accept: "application/vnd.github+json",
+            Authorization: `Bearer ${token}`,
+            "User-Agent": `vskill/${version}`,
+        },
+    });
+    let body = null;
+    try {
+        body = await res.json();
+    }
+    catch {
+        body = null;
+    }
+    return { status: res.status, body };
+}
+async function loginCmd(deps) {
+    const { io, fetchImpl, sleep, version } = deps;
+    const keychain = deps.keychain ?? getDefaultKeychain();
+    const clientId = deps.clientId ?? process.env.VSKILL_GITHUB_CLIENT_ID ?? "";
+    if (!clientId) {
+        io.stderr.write("vskill auth login: VSKILL_GITHUB_CLIENT_ID is not set. " +
+            "Set it to the Skill Studio GitHub App's client_id, then retry.\n");
+        return 2;
+    }
+    // --- Step 1: device code -------------------------------------------------
+    let dcRes;
+    try {
+        dcRes = await postForm(fetchImpl, DEVICE_CODE_URL, {
+            client_id: clientId,
+            scope: DEFAULT_SCOPE,
+        }, version);
+    }
+    catch (err) {
+        io.stderr.write(`vskill auth login: network error contacting github.com (${err.message})\n`);
+        return 1;
+    }
+    if (!dcRes.ok) {
+        io.stderr.write(`vskill auth login: device-code request failed (HTTP ${dcRes.status})\n`);
+        return 1;
+    }
+    const dc = (await dcRes.json());
+    io.stdout.write(`\nTo authenticate, visit:\n  ${dc.verification_uri}\n\n`);
+    io.stdout.write(`And enter the code:\n  ${formatUserCode(dc.user_code)}\n\n`);
+    io.stdout.write(`(Waiting for authorization. This window will poll every ${dc.interval}s.)\n`);
+    if (io.openBrowser) {
+        try {
+            await io.openBrowser(dc.verification_uri);
+        }
+        catch {
+            // Non-fatal — the user can copy/paste the URL.
+        }
+    }
+    // --- Step 2: poll --------------------------------------------------------
+    let interval = Math.max(1, dc.interval);
+    const deadline = Date.now() + (dc.expires_in * 1000);
+    let accessToken = null;
+    while (Date.now() < deadline) {
+        await sleep(interval * 1000);
+        let pollRes;
+        try {
+            pollRes = await postForm(fetchImpl, TOKEN_URL, {
+                client_id: clientId,
+                device_code: dc.device_code,
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+            }, version);
+        }
+        catch (err) {
+            io.stderr.write(`vskill auth login: network error during polling (${err.message})\n`);
+            return 1;
+        }
+        let body;
+        try {
+            body = (await pollRes.json());
+        }
+        catch {
+            io.stderr.write("vskill auth login: malformed token response from github.com\n");
+            return 1;
+        }
+        if (!isPollError(body) && body.access_token) {
+            accessToken = body.access_token;
+            break;
+        }
+        if (isPollError(body)) {
+            switch (body.error) {
+                case "authorization_pending":
+                    continue;
+                case "slow_down":
+                    interval += 5;
+                    continue;
+                case "expired_token":
+                    io.stderr.write("vskill auth login: device code expired before authorization. Please try again.\n");
+                    return 1;
+                case "access_denied":
+                    io.stderr.write("vskill auth login: authorization denied by user.\n");
+                    return 1;
+                default:
+                    io.stderr.write(`vskill auth login: unexpected error from github.com: ${body.error}\n`);
+                    return 1;
+            }
+        }
+    }
+    if (!accessToken) {
+        io.stderr.write("vskill auth login: timed out waiting for authorization.\n");
+        return 1;
+    }
+    // --- Step 3: confirm via /user + persist ---------------------------------
+    const user = await getJson(fetchImpl, USER_URL, accessToken, version);
+    if (user.status !== 200 || !user.body || typeof user.body.login !== "string") {
+        io.stderr.write(`vskill auth login: token saved but /user verification failed (HTTP ${user.status})\n`);
+        keychain.setGitHubToken(accessToken);
+        return 1;
+    }
+    const login = user.body.login;
+    keychain.setGitHubToken(accessToken);
+    io.stdout.write(`\nLogged in as @${login}.\n`);
+    return 0;
+}
+async function statusCmd(args, deps) {
+    const { io, fetchImpl, version } = deps;
+    const keychain = deps.keychain ?? getDefaultKeychain();
+    const json = args.includes("--json");
+    const refresh = args.includes("--refresh") || args.includes("--validate");
+    const token = keychain.getGitHubToken();
+    if (!token) {
+        if (json) {
+            io.stdout.write(JSON.stringify({ loggedIn: false }) + "\n");
+        }
+        else {
+            io.stdout.write("Not logged in. Run `vskill auth login`.\n");
+        }
+        return 1;
+    }
+    // Default behavior: validate via /user (cheap, ~50ms) so the user knows the
+    // token still works. --json controls output shape; --refresh is accepted for
+    // clarity but in this MVP it has the same effect as the default path.
+    void refresh;
+    const user = await getJson(fetchImpl, USER_URL, token, version);
+    if (user.status === 401) {
+        if (json) {
+            io.stdout.write(JSON.stringify({ loggedIn: false, reason: "token_invalid" }) + "\n");
+        }
+        else {
+            io.stderr.write("Token is invalid or expired. Run `vskill auth login`.\n");
+        }
+        return 1;
+    }
+    if (user.status !== 200 || !user.body) {
+        if (json) {
+            io.stdout.write(JSON.stringify({ loggedIn: true, validated: false, status: user.status }) + "\n");
+        }
+        else {
+            io.stdout.write(`Token present but /user returned HTTP ${user.status}. Network or scope issue.\n`);
+        }
+        return 1;
+    }
+    const u = user.body;
+    if (json) {
+        io.stdout.write(JSON.stringify({ loggedIn: true, login: u.login, id: u.id }) + "\n");
+    }
+    else {
+        io.stdout.write(`Logged in as @${u.login} (id=${u.id}).\n`);
+    }
+    return 0;
+}
+async function logoutCmd(deps) {
+    const { io } = deps;
+    const keychain = deps.keychain ?? getDefaultKeychain();
+    const had = keychain.clearGitHubToken();
+    if (had) {
+        io.stdout.write("Logged out. GitHub token cleared from keychain.\n");
+        return 0;
+    }
+    io.stdout.write("Logged out. (No GitHub token was stored.)\n");
+    return 0;
+}
+function usage(io) {
+    io.stdout.write([
+        "Usage: vskill auth <subcommand>",
+        "",
+        "Subcommands:",
+        "  login           Sign in via GitHub Device Flow",
+        "  status [--json] [--refresh]  Show current GitHub identity",
+        "  logout          Clear stored GitHub credentials",
+        "",
+    ].join("\n"));
+}
+export async function authCommand(argv, deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const sleep = deps.sleep ?? defaultSleep;
+    const version = deps.version ?? "vskill";
+    const io = deps.io;
+    const sub = argv[0];
+    let exit = 0;
+    switch (sub) {
+        case "login":
+            exit = await loginCmd({ ...deps, fetchImpl, sleep, version });
+            break;
+        case "status":
+            exit = await statusCmd(argv.slice(1), { ...deps, fetchImpl, sleep: deps.sleep ?? defaultSleep, version });
+            break;
+        case "logout":
+            exit = await logoutCmd(deps);
+            break;
+        case undefined:
+        case "--help":
+        case "-h":
+            usage(io);
+            exit = sub ? 0 : 1;
+            break;
+        default:
+            io.stderr.write(`unknown subcommand: ${sub}\n`);
+            usage(io);
+            exit = 1;
+            break;
+    }
+    if (deps.io.exit)
+        deps.io.exit(exit);
+    return exit;
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iDAAiD;AACjD,EAAE;AACF,sDAAsD;AACtD,iDAAiD;AACjD,oEAAoE;AACpE,mFAAmF;AACnF,mEAAmE;AACnE,8DAA8D;AAC9D,iFAAiF;AACjF,sGAAsG;AACtG,6HAA6H;AAC7H,sCAAsC;AACtC,6CAA6C;AAC7C,8CAA8C;AAC9C,mFAAmF;AACnF,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,iCAAiC;AACjC,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAiB,MAAM,oBAAoB,CAAC;AAqBvE,MAAM,eAAe,GAAG,sCAAsC,CAAC;AAC/D,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAE/C,MAAM,aAAa,GAAG,WAAW,CAAC;AAmBlC,SAAS,WAAW,CAAC,CAAa;IAChC,OAAO,OAAQ,CAAe,CAAC,KAAK,KAAK,QAAQ,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,wEAAwE;IACxE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,SAAuB,EACvB,GAAW,EACX,IAA4B,EAC5B,OAAe;IAEf,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,SAAS,CAAC,GAAG,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;YACnD,YAAY,EAAE,UAAU,OAAO,EAAE;SAClC;QACD,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,SAAuB,EACvB,GAAW,EACX,KAAa,EACb,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,YAAY,EAAE,UAAU,OAAO,EAAE;SAClC;KACF,CAAC,CAAC;IACH,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAA0F;IAChH,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,KAAK,CACb,yDAAyD;YACvD,kEAAkE,CACrE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4EAA4E;IAC5E,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE;YACjD,SAAS,EAAE,QAAQ;YACnB,KAAK,EAAE,aAAa;SACrB,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA4D,GAAa,CAAC,OAAO,KAAK,CAAC,CAAC;QACxG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAC1F,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAmB,CAAC;IAElD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,CAAC,gBAAgB,MAAM,CAAC,CAAC;IAC3E,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,cAAc,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9E,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,CAAC,QAAQ,OAAO,CAAC,CAAC;IAE/F,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrD,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAC7B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE;gBAC7C,SAAS,EAAE,QAAQ;gBACnB,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,UAAU,EAAE,8CAA8C;aAC3D,EAAE,OAAO,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAqD,GAAa,CAAC,OAAO,KAAK,CAAC,CAAC;YACjG,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAe,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;YACjF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;YAChC,MAAM;QACR,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,KAAK,uBAAuB;oBAC1B,SAAS;gBACX,KAAK,WAAW;oBACd,QAAQ,IAAI,CAAC,CAAC;oBACd,SAAS;gBACX,KAAK,eAAe;oBAClB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;oBACpG,OAAO,CAAC,CAAC;gBACX,KAAK,eAAe;oBAClB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;oBACtE,OAAO,CAAC,CAAC;gBACX;oBACE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,wDAAwD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;oBACxF,OAAO,CAAC,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAQ,IAAI,CAAC,IAA2B,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,sEAAsE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QACxG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,KAAK,GAAI,IAAI,CAAC,IAA0B,CAAC,KAAK,CAAC;IACrD,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACrC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,KAAK,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,IAAgF;IACvH,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;IAExC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,EAAE,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,KAAK,OAAO,CAAC;IACb,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,IAAI,IAAI,EAAE,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpG,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,IAAI,CAAC,MAAM,6BAA6B,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAqC,CAAC;IACrD,IAAI,IAAI,EAAE,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqB;IAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IACxC,IAAI,GAAG,EAAE,CAAC;QACR,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,KAAK,CAAC,EAAiB;IAC9B,EAAE,CAAC,MAAM,CAAC,KAAK,CACb;QACE,iCAAiC;QACjC,EAAE;QACF,cAAc;QACd,kDAAkD;QAClD,6DAA6D;QAC7D,mDAAmD;QACnD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC;IACzC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9D,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1G,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,KAAK,CAAC,EAAE,CAAC,CAAC;YACV,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM;QACR;YACE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;YAChD,KAAK,CAAC,EAAE,CAAC,CAAC;YACV,IAAI,GAAG,CAAC,CAAC;YACT,MAAM;IACV,CAAC;IAED,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI;QAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/clone-prompts.d.ts

@@ -0,0 +1,13 @@
+export interface ConfirmPromptOptions {
+    /** When true, bypass all prompts and return true. */
+    yes?: boolean;
+    /** Override TTY detection (defaults to process.stdin.isTTY). */
+    stdinIsTTY?: boolean;
+}
+export declare function confirmPrompt(message: string, opts?: ConfirmPromptOptions): Promise<boolean>;
+export declare function promptInput(message: string): Promise<string>;
+/**
+ * Prompt the user to choose one of N labelled options. Returns the chosen
+ * index. Re-prompts on bad input.
+ */
+export declare function promptChoice(message: string, labels: string[]): Promise<number>;

package/dist/commands/clone-prompts.js

@@ -0,0 +1,67 @@
+// ---------------------------------------------------------------------------
+// vskill clone — interactive prompts (TTY-only, readline-based)
+// ---------------------------------------------------------------------------
+// Mirrors the pattern used in src/commands/remove.ts (createInterface + a
+// promise-wrapped question). Falls back to non-interactive defaults when
+// stdin is not a TTY so the CLI is scriptable in CI.
+// ---------------------------------------------------------------------------
+import { createInterface } from "node:readline";
+export async function confirmPrompt(message, opts = {}) {
+    if (opts.yes)
+        return true;
+    const isTTY = opts.stdinIsTTY ?? process.stdin.isTTY;
+    if (!isTTY) {
+        process.stderr.write("refusing to prompt in non-TTY context — re-run with --yes to confirm\n");
+        return false;
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolveAns) => {
+        rl.question(`${message} (y/N): `, (answer) => {
+            rl.close();
+            resolveAns(answer.trim().toLowerCase() === "y");
+        });
+    });
+}
+export async function promptInput(message) {
+    if (!process.stdin.isTTY)
+        return "";
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolveAns) => {
+        rl.question(`${message} `, (answer) => {
+            rl.close();
+            resolveAns(answer.trim());
+        });
+    });
+}
+/**
+ * Prompt the user to choose one of N labelled options. Returns the chosen
+ * index. Re-prompts on bad input.
+ */
+export async function promptChoice(message, labels) {
+    if (!process.stdin.isTTY)
+        return 0;
+    console.log(message);
+    for (let i = 0; i < labels.length; i++) {
+        console.log(`  [${i + 1}] ${labels[i]}`);
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const askOnce = () => new Promise((resolveAns) => {
+        rl.question(`Pick 1-${labels.length}: `, (answer) => {
+            resolveAns(answer.trim());
+        });
+    });
+    try {
+        while (true) {
+            const raw = await askOnce();
+            const n = Number.parseInt(raw, 10);
+            if (Number.isInteger(n) && n >= 1 && n <= labels.length) {
+                return n - 1;
+            }
+            console.log(`  invalid — enter a number between 1 and ${labels.length}.`);
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+//# sourceMappingURL=clone-prompts.js.map

package/dist/commands/clone-prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone-prompts.js","sourceRoot":"","sources":["../../src/commands/clone-prompts.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gEAAgE;AAChE,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,qDAAqD;AACrD,8EAA8E;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAShD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,OAA6B,EAAE;IAE/B,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wEAAwE,CACzE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAU,CAAC,UAAU,EAAE,EAAE;QACzC,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,OAAO,CAAS,CAAC,UAAU,EAAE,EAAE;QACxC,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE;YACpC,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,MAAgB;IAClE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,OAAO,CAAS,CAAC,UAAU,EAAE,EAAE;QACjC,EAAE,CAAC,QAAQ,CAAC,UAAU,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAClD,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACL,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,4CAA4C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}

package/dist/commands/clone.d.ts

@@ -0,0 +1,70 @@
+import { type RunGh } from "../clone/github-scaffold.js";
+import type { CloneResult, CloneTargetKind, ReferenceMatch, SkillSource, SkillSourceLocation } from "../clone/types.js";
+export interface CloneCommandOptions {
+    target?: CloneTargetKind;
+    path?: string;
+    plugin?: string;
+    pluginName?: string;
+    author?: string;
+    namespace?: string;
+    github?: boolean;
+    force?: boolean;
+    source?: SkillSourceLocation;
+    dryRun?: boolean;
+    /** Auto-confirm all prompts (--yes / -y). */
+    yes?: boolean;
+    /** Override home — used for tests. */
+    home?: string;
+    /** Override cwd — used for tests. */
+    cwd?: string;
+    /** Injectable `gh` adapter for tests. */
+    runGh?: RunGh;
+    /** When true, error messages are thrown instead of printed (used for tests / whole-plugin path). */
+    throwOnError?: boolean;
+}
+declare function slugify(name: string): string;
+/**
+ * Recursively scan a skill directory for cross-skill references and
+ * self-name occurrences across SKILL.md and any .md files in subdirectories
+ * (e.g., agents/*.md). Operates on the staged `.tmp` content so the report
+ * reflects what actually got copied.
+ */
+declare function scanCopiedSkill(stagingDir: string, oldSkillName: string): Promise<{
+    refs: ReferenceMatch[];
+    selfNames: ReferenceMatch[];
+}>;
+/**
+ * Validate the staged clone: SKILL.md must parse and any `agents/*.md`
+ * referenced by frontmatter must exist. Throws on any inconsistency.
+ */
+declare function validateStagedClone(stagingDir: string): Promise<void>;
+interface ResolvedCloneArgs {
+    source: SkillSource;
+    targetKind: CloneTargetKind;
+    newSkillBase: string;
+    newSkillFullName: string;
+    author: string;
+    namespace: string;
+    finalDir: string;
+    pluginRoot?: string;
+    pluginName?: string;
+}
+declare function resolveArgs(positionalSource: string, opts: CloneCommandOptions, homePath: string, cwdPath: string): Promise<ResolvedCloneArgs>;
+/**
+ * Run the clone pipeline. Returns the CloneResult on success. On failure,
+ * cleans up every staged `.tmp` path before propagating the error.
+ *
+ * The function is exported for use by the whole-plugin path (T-010) and unit
+ * tests; the CLI entry point is `cloneCommand` below.
+ */
+export declare function runCloneOnce(resolved: ResolvedCloneArgs, opts: CloneCommandOptions): Promise<CloneResult>;
+/** CLI entry point (Commander action). */
+export declare function cloneCommand(source: string | undefined, opts: CloneCommandOptions): Promise<void>;
+/**
+ * Whole-plugin clone path (T-010). Delegated to its own module is overkill —
+ * the orchestration is small and shares all the same primitives.
+ */
+declare function runWholePluginClone(pluginName: string, opts: CloneCommandOptions, homePath: string, cwdPath: string): Promise<void>;
+/** Re-exports for tests. */
+export { resolveArgs, validateStagedClone, scanCopiedSkill, slugify, runWholePluginClone };
+export type { ResolvedCloneArgs };