[mrgoonie]

Closes #163. The skillx add code exists only on the branch of #120, which is still a draft, so this PR targets feat/skillx-add-command and lands with #120.

Changes

1. Bounded reads.
   • The clone uses --filter=blob:none, and the listing comes from tree objects. Only the blobs that discovery and the chosen skills need are fetched, in one batch each.
   • Sizes are read from the local object headers before any content. Content is then read in batches of at most 64 MiB, which replaces the old single 1 GiB maxBuffer.
   • A search path with more than 1,000 SKILL.md files is a usage_error. A SKILL.md over 1 MiB is skipped without its content being read, and front matter is parsed in chunks.
   • Example: github:torvalds/linux/Documentation now lists in under 3 s.
   • Limit: a blob that is fetched still downloads whole, because git cannot report a size first. Download time is bounded only by the 120 s timeout on each git call. The docs say this.
2. Credentials never on disk.
   • A URL token is removed from the URL that git sees. It is passed instead as an Authorization header through GIT_CONFIG_* environment entries, so it never appears in argv, .git/config or a credential helper.
   • Redirects are turned off whenever a header is passed. Otherwise git sends the header to whatever host a redirect points to; the isolated review reproduced this.
   • Temporary clones are removed on exit, and on SIGINT, SIGTERM or SIGHUP, including while git is running. The process exits with 130, 143 or 129.
3. Redaction.
   • Redaction now masks up to the last @ of a URL.
   • A URL whose password contains / is refused without being echoed. So is any URL with an @ that does not parse, or with an @ in its path, and any refused input that contains @.
4. /tree/<ref>/<path> with a / in the branch name. The ref is resolved against the remote with an exact-pattern git ls-remote, and the longest matching branch or tag wins.
5. Design gaps accepted for the first version. Commit-SHA refs are now documented as unsupported. The lock, update and scope gaps are tracked in feat(cli): close the accepted design gaps of skillx add (lock, update, commit refs) #166.

Validation

• pnpm typecheck passes for every workspace package.
• pnpm exec vitest run packages/cli: 24 files, 276 tests pass. The new tests cover:
  • a partial clone that never fetches a blob outside the skills;
  • skipping an over-size SKILL.md;
  • the 1,000-candidate cap;
  • resolving a branch name that contains /;
  • redaction and refusals;
  • removing the scratch directory and its handlers;
  • a redirect regression test that puts a real git http-backend on another host. This test fails, with the header leaked, when http.followRedirects=false is removed.
• Manual runs against the built CLI and live GitHub:
  • list, and install of pdf;
  • a /tree/cj/claude-api-resync/skills/pdf URL resolved to ref cj/claude-api-resync;
  • Ctrl+C at the confirm prompt: exit 130, temporary directory removed;
  • SIGINT to the process group while git clone was running: exit 130, no envelope, temporary directory removed;
  • a password containing /: refused with exit 2, not echoed;
  • a git-level check that the env-scoped header reaches only its own origin.
• An isolated reviewer subagent checked the change. Its findings (the redirect leak, the signal during git, overstated claims, the promisor check, echoes of inputs with @) are fixed in 54fc381.

---

Generated by Claude Code