feat(domain): add skill injection system for feature worktrees

[arielshad]

Summary

• Skill Injector Service: New ISkillInjectorService port interface and SkillInjectorService infrastructure implementation that copies curated local skills and installs remote skills (via npx skills add) into feature worktrees during creation
• TypeSpec domain models: SkillInjectionConfig, SkillSource, and SkillSourceType added to settings.tsp with generated types, JSON schema output, and settings factory defaults (7 curated local skills, enabled: false)
• Settings persistence: SQLite migration (050-add-skill-injection-config) adds skill_injection_enabled and skill_injection_skills columns; settings mapper handles serialization/deserialization of the new config
• CreateFeatureUseCase integration: Skill injection runs in Phase 2 (after spec init, before agent spawn), guarded by settings + optional injectSkills input override, with full error isolation (failures log warnings, never block feature creation)
• CLI flag: --inject-skills / --no-inject-skills on shep feat new for per-invocation override of the settings value
• Idempotency & commit prevention: Skills already present (checked via SKILL.md existence) are skipped; injected skills are appended to the worktree's .gitignore (only if not already git-tracked)
• Security: Input validation rejects shell injection characters and path traversal in skill source values; uses execFile instead of exec to avoid shell interpolation
• Cross-platform: All paths use path.join()/path.resolve(); 30-second timeout per remote skill installation

Evidence

Test Suite	Result
SkillInjectorService unit tests	21/21 passing — local deep-copy, idempotency, remote npx with timeout, .gitignore management, input validation
TypeSpec generated types tests	8/8 passing — SkillSourceType enum, SkillSource model, SkillInjectionConfig, WorkflowConfig integration
Settings mapper tests	73/73 passing (14 new) — toDatabase/fromDatabase serialization, null handling, round-trip
Settings defaults factory tests	35/35 passing (6 new) — enabled=false default, 7 curated local skills
CreateFeatureUseCase tests	57/57 passing (11 new) — inject when enabled, skip when disabled, settings override, error isolation
CLI flag tests	Verified via source inspection — Commander.js option, NewOptions interface, passthrough to input
TypeSpec compilation	Success — zero errors with tsp v0.60.1
Build	Success — zero TypeScript compilation errors

Spec

specs/081-skill-injector/ — 13 functional requirements, 9 non-functional requirements across 4 architecture layers (TypeSpec → domain → application → infrastructure → presentation).

Test plan

• All 5331 unit tests pass (pnpm test:unit)
• Build compiles without errors (pnpm build)
• Linting passes with zero warnings (pnpm lint:fix)
• TypeSpec compilation succeeds (pnpm tsp:compile)
• CI pipeline passes on push

Built with Shep 🐑 Shep Bot

[github-actions]

Dev Release Published

Artifact	Version	Install
npm	1.162.0-pr509.4102877	npm install -g @shepai/cli@1.162.0-pr509.4102877

---

_{Published from commit b02ee01 | View CI}