Relax SessionId validation from `^[a-z][a-z0-9-]{1,63}$` to
`^[a-z][a-z0-9_-]{1,63}$`. Also updates sanitize_profile to preserve
underscores rather than mapping them to hyphens.
* feat(cli): restore skills install step and --target quick mode in setup
- Add setup/skills.rs porting the `npx skills add actionbook/actionbook`
integration from the previous actionbook-rs CLI. Defines SetupTarget
enum, SkillsResult, and both wizard-flow and quick-mode install paths.
- Wire Step 5 "Install Skills" into the setup wizard (TOTAL_STEPS 4 -> 5),
running after Save. Non-interactive / JSON mode auto-installs with -y;
interactive mode prompts Install / Skip.
- Add quick mode: `actionbook setup --target <agent>` skips the full
wizard and only runs skills install for the specified target. Restores
the CI / one-shot bootstrap path. Standalone target is special-cased
to skip entirely (no agent integration needed).
- Change --target flag from Option<String> to Option<SetupTarget> (clap
ValueEnum, kebab-case values: claude, codex, cursor, windsurf,
antigravity, opencode, standalone, all). Unknown values rejected at
parse time.
- Propagate skills install failure as CliError so CI / non-interactive
callers see a non-zero exit.
Scope: only packages/cli/src/setup/ plus the cli.rs test block. No
changes to browser, daemon, config, error types, or Cargo.toml.
* feat(cli): show API key input and guide extension install to CWS / GitHub Releases
- API key prompt switches from `Password` to `Input` so typed characters
echo by default. Users reported the hidden-by-default behavior felt
broken when pasting. `allow_empty` + the validation loop are unchanged.
- Extension mode now guides the user to install the Chrome extension:
- Primary: Chrome Web Store (recommended, one-click).
- Fallback: manual install from GitHub Releases when CWS is
unavailable (region-blocked, offline, corporate policy). 5-step
Load-unpacked flow covers download -> unzip -> chrome://extensions
-> Developer mode -> Load unpacked.
- Interactive flow asks "Installed from CWS?" -> if no, shows the
GitHub Releases path and asks "Loaded the unpacked extension?"
-> if no, errors with both URLs listed for out-of-band install.
- Non-interactive (`--browser extension`) text output lists both
URLs; JSON payload gains `recommended_install_source`,
`web_store_url`, `fallback_install_source`, `github_releases_url`.
- The GitHub Releases URL uses a tag-search query
`?q=%22Chrome+Extension%22&expanded=true` so users land directly on
extension releases (the repo mixes `actionbook-cli-v*`,
`actionbook-extension-v*`, and `actionbook-dify-plugin-v*` in the
same feed — a plain /releases URL buries the extension zip).
Tests: 292 lib passed. New: `test_chrome_web_store_url_is_canonical`,
`test_github_releases_url_is_extension_filtered`,
`test_apply_extension_mode_records_web_store_hint_in_json`.
* fix(cli): address Codex P1 review feedback on setup skills step
Two P1 issues flagged by Codex automated review on PR #499:
1. setup/skills.rs: JSON mode deadlock risk when `npx skills add`
output exceeds the OS pipe buffer (~16KB on macOS). The code used
`Stdio::piped()` for child stdout/stderr but then called `.status()`
instead of `.output()`, which does not drain the pipes. A verbose
skills install (common on first run) would fill the buffer and block
the child on write, hanging setup indefinitely in CI. Switch to
`Stdio::null()` in JSON mode to discard subprocess output entirely —
we already emit our own JSON status event, so the subprocess output
has no consumer anyway. Also close stdin in JSON mode (`Stdio::null`)
so a stray read attempt can't hang either.
2. setup/mod.rs: quick mode (`setup --target <agent>`) silently exited
with status 0 when npx was not available. `install_skills_for_target`
returns `SkillsAction::Prompted` in that case, but `run_target_only`
only mapped `SkillsAction::Failed` to an error. CI bootstrap relying
on `--target` would silently pass broken runs. Extract a pure helper
`target_only_exit_status` that maps every non-`Installed` outcome to
`CliError::Internal` with a target-specific message; in the `Prompted`
branch the message points at the Node.js install docs and the exact
`npx` command to retry manually. The full-wizard Skills step is
unchanged — there `Prompted` is still a soft prompt because the user
can finish setup without skills.
Add 4 unit tests on `target_only_exit_status` covering all four
`SkillsAction` variants, including a regression guard for the P1 #2
silent-success case.
Tests: 296 lib passed (71 in setup::, 4 new).
* fix(cli): tighten setup target quick mode semantics
* fix(cli): install setup target all for all agents
* style(cli): format setup quick mode tests and JSON output
* chore(cli): add changeset for setup improvements
mcfn