refactor(cli): decompose the cli.py monolith into a cli/ package

[donalddellapietra]

Summary

Splits the single 7,542-line sponsio/cli.py into a sponsio/cli/ package — one module per top-level command under commands/, one per command group under groups/, a root group in app.py, and cross-command helpers in _shared.py. Pure restructuring: no behavior change.

Type of change

• refactor: no behavior change

Before → after

sponsio/cli/
├── __init__.py      # registers all commands, re-exports public + internal API, main()
├── __main__.py      # python -m sponsio.cli
├── app.py           # root `cli` group
├── _shared.py       # cross-command helpers (_contract_guarantee, _resolve_entry, _parse_since, …)
├── commands/        # 18 modules: scan, onboard, validate, export, eval, doctor, init, mode, …
└── groups/          # 5 modules: plugin, host, skill, cursor, daemon

How compatibility is preserved

Many modules and tests do from sponsio.cli import X — the cli group, command callables (onboard, doctor, scan, …), and internal helpers (_resolve_entry, _patch_mode_in_yaml, _filter_invalid_contracts, _packaged_skill_source, _refresh_per_host_bundles, …). __init__ re-exports every one of those from its new home, so no external import changed. The sponsio.cli:main console-script entry and python -m sponsio.cli both still work.

Design notes

• Eight incremental commits, each independently verified (identical command set + green suite) before the next: scaffold → app → groups (daemon+cursor, skill, plugin, host) → _shared → commands.
• Two latent bugs fixed in passing: demo's repo_root was computed from __file__ depth (would break on the move) — now resolves via the package location; and a package needs __main__.py for python -m sponsio.cli (the plugin tests shell out via that form).
• Cross-module coupling is now explicit: onboard imports scan/mode helpers + host's runtime-mode resolver; export_sessions imports export's OTLP converters; host install reuses plugin's bucket bootstrap and skill's packaged-source resolver.
• Out of scope: plugin.py (1154) and host.py (1037) remain large — they're genuinely big groups (7 subcommands each); per-subcommand splitting is a possible follow-up.

Test plan

pytest -q                                    # 2296 passed, 26 skipped
ruff check sponsio/ tests/ scripts/          # clean
ruff format --check sponsio/ tests/ scripts/ # clean
python -m sponsio.cli --version              # works
python -m sponsio.cli scan --help            # works
python -c "from sponsio.cli import cli, onboard, doctor, scan, _resolve_entry, _patch_mode_in_yaml"  # back-compat

Command set unchanged: 23 top-level commands; subgroups skill(1)/plugin(7)/host(7)/daemon(3)/cursor(2).

Checklist

• pytest -v passes locally (2296 passed).
• ruff check / ruff format --check clean.
• No behavior change; no new dependencies.
• N/A: no user-visible surface change (CHANGELOG not updated — internal refactor).

Note: commits are not DCO Signed-off-by signed (per your earlier note, DCO isn't enabled on this repo).

🤖 Generated with Claude Code