Skip to content

fix(cli): accept source prefixes in the wizard package prompt - #88

Merged
harlan-zw merged 2 commits into
skilld-dev:mainfrom
mrrobertkent:fix/wizard-source-prefixes
Aug 13, 2026
Merged

fix(cli): accept source prefixes in the wizard package prompt#88
harlan-zw merged 2 commits into
skilld-dev:mainfrom
mrrobertkent:fix/wizard-source-prefixes

Conversation

@mrrobertkent

Copy link
Copy Markdown
Contributor

Problem

The interactive wizard rejects the source prefixes documented for skilld add, with a stack trace rather than a message:

◇  Enter package names (space or comma-separated)
│  npm:unlighthouse
│
◑  npm:unlighthouse: npm registryError: Invalid package name: npm:unlighthouse
    at getCacheDir (core/prepare.ts)
    at resolvePkgDir
    at getShippedSkills
    at handleShippedSkills
    at npmResolver

■  Canceled

add normalises its inputs:

// src/commands/sync/add.ts
const items = rawInputs.map(parseSkillInput)

The wizard does not:

// src/cli.ts
selected = input.split(COMMA_OR_WHITESPACE_RE).map(s => s.trim()).filter(Boolean)

npm:unlighthouse travels as a literal package name until getCacheDir rejects it, and the throw ends the run.

Change

Both manual-entry prompts normalise through parseSkillInput. npm: prefixed and bare names resolve; other sources report where they belong:

gh:owner/repo is not an npm package. Install it with `skilld add gh:owner/repo`.

resolvePkgDir no longer propagates the validation error. It probes for an optional cache hit, so a name getCacheDir will not accept is a miss. Traversal is still rejected; it just no longer aborts a sync from a read path. An empty name also returns null rather than resolving to <cwd>/node_modules, which join produces for an empty segment.

Coverage

test/unit/pkg-dir-probe.test.ts covers resolvePkgDir returning null for npm:vue, gh:owner/repo, ../escape, and an empty name, and getShippedSkills reporting none for the same.

Docs

README notes that the documented prefixes work in the wizard prompt, and the prompt placeholder shows one.

mrrobertkent and others added 2 commits August 12, 2026 11:58
The wizard passed manually entered packages through unparsed, so the `npm:`
prefix documented for `skilld add` reached `getCacheDir` as a literal package
name and aborted the run. Normalise with `parseSkillInput` as `add` does, and
direct non-npm sources to `skilld add`.

`resolvePkgDir` treats an unusable name as a cache miss rather than
propagating the validation error, and rejects an empty name instead of
resolving to `node_modules`.
Preserve requested npm tags when the wizard strips source prefixes. Validate package names before probing node_modules so traversal inputs cannot escape the package directory.
@harlan-zw
harlan-zw merged commit deb56dc into skilld-dev:main Aug 13, 2026
1 check passed
@harlan-zw

Copy link
Copy Markdown
Collaborator

awesome, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants