feat: auto-generate skill.ts from Pastel/Zod command metadata

.claude/settings.json

@@ -0,0 +1,84 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "entire hooks claude-code post-task"
+          }
+        ]
+      },
+      {
+        "matcher": "TodoWrite",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "entire hooks claude-code post-todo"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "entire hooks claude-code pre-task"
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "entire hooks claude-code session-end"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "entire hooks claude-code session-start"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "entire hooks claude-code stop"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "entire hooks claude-code user-prompt-submit"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "deny": [
+      "Read(./.entire/metadata/**)"
+    ]
+  }
+}

.claude/skills/release-cli/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: release-cli
+description: Run the full CLI release workflow — version bump, changelog, build, commit, push, and GitHub release. npm publish happens via trusted publishing in CI.
+user-invocable: true
+allowed-tools: Bash, Read, Edit, Write, Glob, Grep
+argument-hint: <patch|minor|major>
+---
+
+# Release CLI Workflow
+
+Execute the full release pipeline for `@1a35e1/sonar-cli`. The user invokes this skill with a semver bump type: `patch`, `minor`, or `major`.
+
+npm publishing uses **trusted publishing** via GitHub Actions OIDC — no OTP required. The `publish.yml` workflow triggers automatically when a GitHub release is created.
+
+## Argument Validation
+
+The argument MUST be one of: `patch`, `minor`, or `major`. If missing or invalid, print usage and stop:
+
+```
+Usage: /release-cli <patch|minor|major>
+```
+
+## Step 1: Pre-flight Checks
+
+Run these checks sequentially. Abort on the first failure with a clear message.
+
+1. **Clean working tree**: Run `git status --porcelain`. If output is non-empty, abort: "Working tree is not clean. Commit or stash changes first."
+2. **On main branch**: Run `git branch --show-current`. If not `main`, abort: "Must be on the main branch to release."
+3. **Build passes**: Run `pnpm build` (this runs `tsc`). If it fails, abort: "Build failed. Fix type errors before releasing."
+
+## Step 2: Version Bump
+
+1. Run `pnpm version <BUMP_TYPE> --no-git-tag-version` to bump the version in `package.json`.
+2. Read `package.json` and extract the new `"version"` field. Store it as `NEW_VERSION` for use in later steps.
+3. Print: "Version bumped to NEW_VERSION"
+
+## Step 3: Update CHANGELOG
+
+1. Collect commits since the last release. Run:
+   ```
+   git log --oneline $(git log --all --grep='chore: release' --format='%H' -1)..HEAD
+   ```
+   If no release commit is found, collect all commits with `git log --oneline`.
+
+2. Generate a new changelog section following the existing Keep a Changelog format. Use today's date (YYYY-MM-DD). Categorize commits under `### Added`, `### Fixed`, `### Changed`, etc. based on conventional commit prefixes (`feat:` -> Added, `fix:` -> Fixed, `chore:`/`refactor:` -> Changed). Omit empty categories. Each entry should be a bullet starting with the commit message in bold, with a short description if the message is clear enough.
+
+3. Insert the new section into `CHANGELOG.md` immediately after the header block (the `# Changelog` line and the two description lines). The new section goes BEFORE any existing `## [x.y.z]` sections.
+
+   Example format:
+   ```markdown
+   ## [0.3.0] - 2026-03-04
+
+   ### Added
+
+   - **feat: add foo command** — Description of the change.
+
+   ### Fixed
+
+   - **fix: bar edge case** — Description of the fix.
+   ```
+
+4. Print the generated changelog section for the user to review.
+
+## Step 4: Build + Drift Checks
+
+1. Run `pnpm build` to compile TypeScript to `dist/`. Abort if this fails.
+2. Run `pnpm drift:surface:update` to update the command surface snapshot.
+3. Run `pnpm drift:check` to verify all drift checks pass. Abort if any fail.
+
+## Step 5: Git Commit
+
+1. Stage exactly these files: `package.json`, `pnpm-lock.yaml`, `CHANGELOG.md`, `.drift/command-surface.snapshot.json`
+2. Commit with message: `chore: release NEW_VERSION`
+3. Print: "Committed: chore: release NEW_VERSION"
+
+## Step 6: Push + GitHub Release (Confirmation Gate)
+
+**ASK THE USER FOR CONFIRMATION** before proceeding:
+
+> Ready to push to remote and create GitHub release v{NEW_VERSION}. This will trigger npm publish via trusted publishing in CI. Proceed?
+
+If confirmed:
+1. Run `git push`
+2. Create a GitHub release using the changelog section from Step 3:
+   ```
+   gh release create v<NEW_VERSION> --title "v<NEW_VERSION>" --notes "<changelog section from step 3>"
+   ```
+3. Print the GitHub release URL from the `gh` output.
+4. Print: "npm publish will run automatically via GitHub Actions. Monitor at: https://github.com/1a35e1/sonar-cli/actions"
+
+If denied, remind the user they can push and create the release manually later.
+
+## Error Handling
+
+- If any command fails, print the full error output and abort immediately.
+- Do NOT continue past a failed step — each step depends on the previous one.
+- If push or release creation fails, the commit is already made locally. Inform the user they can retry with `git push` and `gh release create` manually.

.drift/command-surface.snapshot.json

@@ -0,0 +1,36 @@
+{
+  "source": "src/commands/**/*.tsx",
+  "commandCount": 30,
+  "commands": [
+    "sonar",
+    "sonar account",
+    "sonar account add",
+    "sonar account remove",
+    "sonar account rename",
+    "sonar account switch",
+    "sonar archive",
+    "sonar config",
+    "sonar config env",
+    "sonar config nuke",
+    "sonar config set",
+    "sonar config setup",
+    "sonar config skill",
+    "sonar data backup",
+    "sonar data path",
+    "sonar data pull",
+    "sonar data restore",
+    "sonar data sql",
+    "sonar data verify",
+    "sonar feed",
+    "sonar later",
+    "sonar refresh",
+    "sonar skip",
+    "sonar status",
+    "sonar topics",
+    "sonar topics add",
+    "sonar topics delete",
+    "sonar topics edit",
+    "sonar topics suggest",
+    "sonar topics view"
+  ]
+}

.entire/.gitignore

@@ -0,0 +1,4 @@
+tmp/
+settings.local.json
+metadata/
+logs/

.entire/settings.json

@@ -0,0 +1,5 @@
+{
+  "strategy": "manual-commit",
+  "enabled": true,
+  "telemetry": true
+}

.github/workflows/drift-checks.yml

@@ -0,0 +1,40 @@
+name: Drift Checks
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - feat/**
+      - phase-**
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Run drift checks
+        env:
+          CI: "true"
+          SONAR_API_URL: https://api.sonar.8640p.info/graphql
+        run: pnpm drift:check

.github/workflows/publish.yml

@@ -0,0 +1,47 @@
+name: Publish to npm
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.target_commitish }}
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.19.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Drift checks
+        env:
+          CI: "true"
+          SONAR_API_URL: https://api.sonar.8640p.info/graphql
+        run: pnpm drift:check
+
+      - name: Publish
+        run: pnpm publish --access public --no-git-checks --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}