wyvrnpm 2.11.0 → 2.12.2

package/src/commands/configure.js

@@ -1,92 +1,92 @@
-'use strict';
-
-const { readConfig, writeConfig, getConfigPath } = require('../config');
-const log = require('../logger');
-
-/** wyvrnpm configure list */
-function list() {
-  const config = readConfig();
-
-  console.log(`Config: ${getConfigPath()}\n`);
-
-  printSection('Install Sources', config.installSources);
-  console.log('');
-  printSection('Publish Sources', config.publishSources);
-}
-
-function printSection(title, sources) {
-  console.log(`${title}:`);
-  if (sources.length === 0) {
-    console.log('  (none)');
-    return;
-  }
-  for (const src of sources) {
-    const auth = authLabel(src);
-    console.log(`  ${src.name.padEnd(20)} ${src.url}${auth ? '  ' + auth : ''}`);
-  }
-}
-
-function authLabel(src) {
-  if (src.profile)  return `[profile: ${src.profile}]`;
-  if (src.tokenEnv) return `[token-env: ${src.tokenEnv}]`;
-  if (src.token)    return '[token: ***]';
-  return '';
-}
-
-/**
- * wyvrnpm configure add-source --kind install|publish --name <name> --url <url>
- *                               [--profile <profile>] [--token <token>]
- */
-function addSource(argv) {
-  const { kind, name, url, profile, token } = argv;
-  // yargs delivers --token-env as argv['token-env']; accept both shapes
-  // so programmatic callers with camelCase also work.
-  const tokenEnv = argv.tokenEnv ?? argv['token-env'];
-
-  if (token && tokenEnv) {
-    log.error('Pass --token OR --token-env, not both. --token-env is preferred for CI and shared setups (EVALUATION.md S8).');
-    process.exit(1);
-  }
-
-  const config = readConfig();
-  const key = kind === 'install' ? 'installSources' : 'publishSources';
-
-  const entry = { name, url };
-  if (profile)  entry.profile  = profile;
-  if (token)    entry.token    = token;
-  if (tokenEnv) entry.tokenEnv = tokenEnv;
-
-  const idx = config[key].findIndex((s) => s.name === name);
-  if (idx !== -1) {
-    config[key][idx] = entry;
-    log.info(`Updated ${kind} source "${name}"`);
-  } else {
-    config[key].push(entry);
-    log.info(`Added ${kind} source "${name}"`);
-  }
-
-  writeConfig(config);
-  log.info(`Saved to ${getConfigPath()}`);
-}
-
-/**
- * wyvrnpm configure remove-source --kind install|publish --name <name>
- */
-function removeSource(argv) {
-  const { kind, name } = argv;
-  const config = readConfig();
-  const key = kind === 'install' ? 'installSources' : 'publishSources';
-
-  const before = config[key].length;
-  config[key] = config[key].filter((s) => s.name !== name);
-
-  if (config[key].length === before) {
-    log.error(`No ${kind} source named "${name}"`);
-    process.exit(1);
-  }
-
-  writeConfig(config);
-  log.info(`Removed ${kind} source "${name}"`);
-}
-
-module.exports = { list, addSource, removeSource };
+'use strict';
+
+const { readConfig, writeConfig, getConfigPath } = require('../config');
+const log = require('../logger');
+
+/** wyvrnpm configure list */
+function list() {
+  const config = readConfig();
+
+  console.log(`Config: ${getConfigPath()}\n`);
+
+  printSection('Install Sources', config.installSources);
+  console.log('');
+  printSection('Publish Sources', config.publishSources);
+}
+
+function printSection(title, sources) {
+  console.log(`${title}:`);
+  if (sources.length === 0) {
+    console.log('  (none)');
+    return;
+  }
+  for (const src of sources) {
+    const auth = authLabel(src);
+    console.log(`  ${src.name.padEnd(20)} ${src.url}${auth ? '  ' + auth : ''}`);
+  }
+}
+
+function authLabel(src) {
+  if (src.profile)  return `[profile: ${src.profile}]`;
+  if (src.tokenEnv) return `[token-env: ${src.tokenEnv}]`;
+  if (src.token)    return '[token: ***]';
+  return '';
+}
+
+/**
+ * wyvrnpm configure add-source --kind install|publish --name <name> --url <url>
+ *                               [--profile <profile>] [--token <token>]
+ */
+function addSource(argv) {
+  const { kind, name, url, profile, token } = argv;
+  // yargs delivers --token-env as argv['token-env']; accept both shapes
+  // so programmatic callers with camelCase also work.
+  const tokenEnv = argv.tokenEnv ?? argv['token-env'];
+
+  if (token && tokenEnv) {
+    log.error('Pass --token OR --token-env, not both. --token-env is preferred for CI and shared setups (EVALUATION.md S8).');
+    process.exit(1);
+  }
+
+  const config = readConfig();
+  const key = kind === 'install' ? 'installSources' : 'publishSources';
+
+  const entry = { name, url };
+  if (profile)  entry.profile  = profile;
+  if (token)    entry.token    = token;
+  if (tokenEnv) entry.tokenEnv = tokenEnv;
+
+  const idx = config[key].findIndex((s) => s.name === name);
+  if (idx !== -1) {
+    config[key][idx] = entry;
+    log.info(`Updated ${kind} source "${name}"`);
+  } else {
+    config[key].push(entry);
+    log.info(`Added ${kind} source "${name}"`);
+  }
+
+  writeConfig(config);
+  log.info(`Saved to ${getConfigPath()}`);
+}
+
+/**
+ * wyvrnpm configure remove-source --kind install|publish --name <name>
+ */
+function removeSource(argv) {
+  const { kind, name } = argv;
+  const config = readConfig();
+  const key = kind === 'install' ? 'installSources' : 'publishSources';
+
+  const before = config[key].length;
+  config[key] = config[key].filter((s) => s.name !== name);
+
+  if (config[key].length === before) {
+    log.error(`No ${kind} source named "${name}"`);
+    process.exit(1);
+  }
+
+  writeConfig(config);
+  log.info(`Removed ${kind} source "${name}"`);
+}
+
+module.exports = { list, addSource, removeSource };

package/src/commands/init.js

@@ -1,70 +1,70 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { defaultManifest, writeManifest } = require('../manifest');
-const { LOCAL_OVERLAY_FILENAME } = require('../conf');
-const log = require('../logger');
-
-// The wyvrn.local.json overlay must never be committed — it is by design
-// per-developer state. init writes a gitignore entry; existing projects
-// get a one-line nudge from install (see install.js) when the file is
-// present but not ignored.
-const GITIGNORE_MARKER_LINE = '# wyvrnpm — per-developer conf overlay (never commit)';
-
-function ensureGitignoreEntry(rootDir) {
-  const gitignorePath = path.join(rootDir, '.gitignore');
-  const desiredLines  = [GITIGNORE_MARKER_LINE, LOCAL_OVERLAY_FILENAME];
-
-  let existing = '';
-  if (fs.existsSync(gitignorePath)) {
-    existing = fs.readFileSync(gitignorePath, 'utf8');
-    const hasEntry = existing.split(/\r?\n/).some((l) => l.trim() === LOCAL_OVERLAY_FILENAME);
-    if (hasEntry) return { action: 'already-present', path: gitignorePath };
-  }
-
-  const needsLeadingNewline = existing.length > 0 && !existing.endsWith('\n');
-  const block = (needsLeadingNewline ? '\n' : '') + desiredLines.join('\n') + '\n';
-  fs.writeFileSync(gitignorePath, existing + block, 'utf8');
-  return {
-    action: existing.length > 0 ? 'appended' : 'created',
-    path:   gitignorePath,
-  };
-}
-
-/**
- * Initialises a new wyvrn.json manifest in the project root.
- * If a manifest already exists the command exits early without overwriting it.
- *
- * @param {object} argv - Parsed yargs arguments.
- * @param {string} argv.manifest - Path to the manifest file.
- * @param {string} argv.root - Project root directory.
- * @returns {Promise<void>}
- */
-async function init(argv) {
-  const manifestPath = path.resolve(argv.manifest);
-  const rootDir = path.resolve(argv.root);
-
-  if (fs.existsSync(manifestPath)) {
-    log.info(`Manifest already exists at ${manifestPath}`);
-    return;
-  }
-
-  const projectName = path.basename(rootDir);
-  const manifest = defaultManifest(projectName);
-
-  writeManifest(manifestPath, manifest);
-
-  const gitignore = ensureGitignoreEntry(rootDir);
-  if (gitignore.action === 'created') {
-    log.info(`Created .gitignore at ${gitignore.path} with ${LOCAL_OVERLAY_FILENAME} exclusion`);
-  } else if (gitignore.action === 'appended') {
-    log.info(`Added ${LOCAL_OVERLAY_FILENAME} to ${gitignore.path}`);
-  }
-
-  log.success(`Created manifest at ${manifestPath}`);
-}
-
-module.exports = init;
-module.exports.ensureGitignoreEntry  = ensureGitignoreEntry;
-module.exports.GITIGNORE_MARKER_LINE = GITIGNORE_MARKER_LINE;
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { defaultManifest, writeManifest } = require('../manifest');
+const { LOCAL_OVERLAY_FILENAME } = require('../conf');
+const log = require('../logger');
+
+// The wyvrn.local.json overlay must never be committed — it is by design
+// per-developer state. init writes a gitignore entry; existing projects
+// get a one-line nudge from install (see install.js) when the file is
+// present but not ignored.
+const GITIGNORE_MARKER_LINE = '# wyvrnpm — per-developer conf overlay (never commit)';
+
+function ensureGitignoreEntry(rootDir) {
+  const gitignorePath = path.join(rootDir, '.gitignore');
+  const desiredLines  = [GITIGNORE_MARKER_LINE, LOCAL_OVERLAY_FILENAME];
+
+  let existing = '';
+  if (fs.existsSync(gitignorePath)) {
+    existing = fs.readFileSync(gitignorePath, 'utf8');
+    const hasEntry = existing.split(/\r?\n/).some((l) => l.trim() === LOCAL_OVERLAY_FILENAME);
+    if (hasEntry) return { action: 'already-present', path: gitignorePath };
+  }
+
+  const needsLeadingNewline = existing.length > 0 && !existing.endsWith('\n');
+  const block = (needsLeadingNewline ? '\n' : '') + desiredLines.join('\n') + '\n';
+  fs.writeFileSync(gitignorePath, existing + block, 'utf8');
+  return {
+    action: existing.length > 0 ? 'appended' : 'created',
+    path:   gitignorePath,
+  };
+}
+
+/**
+ * Initialises a new wyvrn.json manifest in the project root.
+ * If a manifest already exists the command exits early without overwriting it.
+ *
+ * @param {object} argv - Parsed yargs arguments.
+ * @param {string} argv.manifest - Path to the manifest file.
+ * @param {string} argv.root - Project root directory.
+ * @returns {Promise<void>}
+ */
+async function init(argv) {
+  const manifestPath = path.resolve(argv.manifest);
+  const rootDir = path.resolve(argv.root);
+
+  if (fs.existsSync(manifestPath)) {
+    log.info(`Manifest already exists at ${manifestPath}`);
+    return;
+  }
+
+  const projectName = path.basename(rootDir);
+  const manifest = defaultManifest(projectName);
+
+  writeManifest(manifestPath, manifest);
+
+  const gitignore = ensureGitignoreEntry(rootDir);
+  if (gitignore.action === 'created') {
+    log.info(`Created .gitignore at ${gitignore.path} with ${LOCAL_OVERLAY_FILENAME} exclusion`);
+  } else if (gitignore.action === 'appended') {
+    log.info(`Added ${LOCAL_OVERLAY_FILENAME} to ${gitignore.path}`);
+  }
+
+  log.success(`Created manifest at ${manifestPath}`);
+}
+
+module.exports = init;
+module.exports.ensureGitignoreEntry  = ensureGitignoreEntry;
+module.exports.GITIGNORE_MARKER_LINE = GITIGNORE_MARKER_LINE;

package/src/commands/install-skill.js

@@ -1,115 +1,115 @@
-'use strict';
-
-const fs   = require('fs');
-const os   = require('os');
-const path = require('path');
-const AdmZip = require('adm-zip');
-
-const { assertAllSafeZipEntryNames } = require('../zip-safe');
-const log = require('../logger');
-
-// ---------------------------------------------------------------------------
-// `wyvrnpm install-skill --claude`
-//
-// Copies the bundled wyvrnpm Agent Skill (claude/skills/wyvrnpm.skill) into
-// the user's Claude Code skills directory so Claude picks it up automatically.
-//
-// Works for both install shapes:
-//   - `npm i -g wyvrnpm` → skill zip ships under <pkg>/claude/skills/
-//   - `git clone` of this repo → same path, just not from node_modules
-//
-// Destination, per target:
-//   --claude  → %USERPROFILE%\.claude\skills\wyvrnpm\  (Windows)
-//               ~/.claude/skills/wyvrnpm/               (macOS / Linux)
-// ---------------------------------------------------------------------------
-
-const SKILL_NAME = 'wyvrnpm';
-
-function bundledSkillPath() {
-  // __dirname = <pkg>/src/commands; the .skill zip lives at
-  // <pkg>/claude/skills/wyvrnpm.skill.
-  return path.resolve(__dirname, '..', '..', 'claude', 'skills', `${SKILL_NAME}.skill`);
-}
-
-function claudeSkillsDir() {
-  const home = os.homedir();
-  if (!home) throw new Error('cannot resolve user home directory');
-  return path.join(home, '.claude', 'skills');
-}
-
-function rmrf(target) {
-  if (!fs.existsSync(target)) return;
-  fs.rmSync(target, { recursive: true, force: true });
-}
-
-function installForClaude({ force, dryRun }) {
-  const zipPath = bundledSkillPath();
-  if (!fs.existsSync(zipPath)) {
-    log.error(`bundled skill not found at ${zipPath}`);
-    log.error('this is a packaging bug — please file an issue');
-    process.exit(1);
-  }
-
-  const skillsDir = claudeSkillsDir();
-  const destDir   = path.join(skillsDir, SKILL_NAME);
-  const destZip   = path.join(skillsDir, `${SKILL_NAME}.skill`);
-
-  log.info(`Source      : ${zipPath}`);
-  log.info(`Destination : ${destDir}`);
-
-  if (fs.existsSync(destDir) && !force) {
-    log.warn(`${destDir} already exists`);
-    log.warn('re-run with --force to overwrite');
-    process.exit(1);
-  }
-
-  if (dryRun) {
-    log.info('(--dry-run) would remove existing skill dir and zip, then extract fresh copy');
-    return;
-  }
-
-  fs.mkdirSync(skillsDir, { recursive: true });
-  rmrf(destDir);
-  rmrf(destZip);
-
-  const zip = new AdmZip(zipPath);
-  // Zip Slip defense-in-depth (EVALUATION.md S2). The shipped .skill zip
-  // is trusted-by-provenance, but validating consistently keeps the
-  // attack surface flat across all extraction call sites.
-  assertAllSafeZipEntryNames(
-    zip.getEntries().map((e) => e.entryName),
-    `${SKILL_NAME}.skill`,
-  );
-  zip.extractAllTo(skillsDir, /* overwrite */ true);
-  fs.copyFileSync(zipPath, destZip);
-
-  if (!fs.existsSync(path.join(destDir, 'SKILL.md'))) {
-    log.error(`extraction produced no SKILL.md under ${destDir}`);
-    log.error('the bundled .skill zip may be malformed');
-    process.exit(1);
-  }
-
-  log.success(`Installed ${SKILL_NAME} skill to ${destDir}`);
-  log.info('Claude Code will pick it up on next session start.');
-}
-
-async function installSkill(argv) {
-  const targets = [];
-  if (argv.claude) targets.push('claude');
-
-  if (targets.length === 0) {
-    log.error('no target specified — pass --claude');
-    log.error('(more targets may be added in future releases)');
-    process.exit(1);
-  }
-
-  for (const target of targets) {
-    if (target === 'claude') {
-      installForClaude({ force: !!argv.force, dryRun: !!argv['dry-run'] });
-    }
-  }
-}
-
-module.exports = installSkill;
-module.exports.bundledSkillPath = bundledSkillPath;
-module.exports.claudeSkillsDir  = claudeSkillsDir;
+'use strict';
+
+const fs   = require('fs');
+const os   = require('os');
+const path = require('path');
+const AdmZip = require('adm-zip');
+
+const { assertAllSafeZipEntryNames } = require('../zip-safe');
+const log = require('../logger');
+
+// ---------------------------------------------------------------------------
+// `wyvrnpm install-skill --claude`
+//
+// Copies the bundled wyvrnpm Agent Skill (claude/skills/wyvrnpm.skill) into
+// the user's Claude Code skills directory so Claude picks it up automatically.
+//
+// Works for both install shapes:
+//   - `npm i -g wyvrnpm` → skill zip ships under <pkg>/claude/skills/
+//   - `git clone` of this repo → same path, just not from node_modules
+//
+// Destination, per target:
+//   --claude  → %USERPROFILE%\.claude\skills\wyvrnpm\  (Windows)
+//               ~/.claude/skills/wyvrnpm/               (macOS / Linux)
+// ---------------------------------------------------------------------------
+
+const SKILL_NAME = 'wyvrnpm';
+
+function bundledSkillPath() {
+  // __dirname = <pkg>/src/commands; the .skill zip lives at
+  // <pkg>/claude/skills/wyvrnpm.skill.
+  return path.resolve(__dirname, '..', '..', 'claude', 'skills', `${SKILL_NAME}.skill`);
+}
+
+function claudeSkillsDir() {
+  const home = os.homedir();
+  if (!home) throw new Error('cannot resolve user home directory');
+  return path.join(home, '.claude', 'skills');
+}
+
+function rmrf(target) {
+  if (!fs.existsSync(target)) return;
+  fs.rmSync(target, { recursive: true, force: true });
+}
+
+function installForClaude({ force, dryRun }) {
+  const zipPath = bundledSkillPath();
+  if (!fs.existsSync(zipPath)) {
+    log.error(`bundled skill not found at ${zipPath}`);
+    log.error('this is a packaging bug — please file an issue');
+    process.exit(1);
+  }
+
+  const skillsDir = claudeSkillsDir();
+  const destDir   = path.join(skillsDir, SKILL_NAME);
+  const destZip   = path.join(skillsDir, `${SKILL_NAME}.skill`);
+
+  log.info(`Source      : ${zipPath}`);
+  log.info(`Destination : ${destDir}`);
+
+  if (fs.existsSync(destDir) && !force) {
+    log.warn(`${destDir} already exists`);
+    log.warn('re-run with --force to overwrite');
+    process.exit(1);
+  }
+
+  if (dryRun) {
+    log.info('(--dry-run) would remove existing skill dir and zip, then extract fresh copy');
+    return;
+  }
+
+  fs.mkdirSync(skillsDir, { recursive: true });
+  rmrf(destDir);
+  rmrf(destZip);
+
+  const zip = new AdmZip(zipPath);
+  // Zip Slip defense-in-depth (EVALUATION.md S2). The shipped .skill zip
+  // is trusted-by-provenance, but validating consistently keeps the
+  // attack surface flat across all extraction call sites.
+  assertAllSafeZipEntryNames(
+    zip.getEntries().map((e) => e.entryName),
+    `${SKILL_NAME}.skill`,
+  );
+  zip.extractAllTo(skillsDir, /* overwrite */ true);
+  fs.copyFileSync(zipPath, destZip);
+
+  if (!fs.existsSync(path.join(destDir, 'SKILL.md'))) {
+    log.error(`extraction produced no SKILL.md under ${destDir}`);
+    log.error('the bundled .skill zip may be malformed');
+    process.exit(1);
+  }
+
+  log.success(`Installed ${SKILL_NAME} skill to ${destDir}`);
+  log.info('Claude Code will pick it up on next session start.');
+}
+
+async function installSkill(argv) {
+  const targets = [];
+  if (argv.claude) targets.push('claude');
+
+  if (targets.length === 0) {
+    log.error('no target specified — pass --claude');
+    log.error('(more targets may be added in future releases)');
+    process.exit(1);
+  }
+
+  for (const target of targets) {
+    if (target === 'claude') {
+      installForClaude({ force: !!argv.force, dryRun: !!argv['dry-run'] });
+    }
+  }
+}
+
+module.exports = installSkill;
+module.exports.bundledSkillPath = bundledSkillPath;
+module.exports.claudeSkillsDir  = claudeSkillsDir;