@aident-ai/cli 0.1.8-rc.2 → 0.2.0-rc.0

package/README.md

@@ -97,8 +97,12 @@ providers to Loadout integrations, and starts selected Vault/OAuth connect flows
 
 `skills favorite` saves the account preference and immediately synchronizes all current favorites. `skills sync`
 reconciles each current public revision into `~/.agents/skills` and links it into supported harness-global Skill
-directories, where the deterministic `loadout-<slug>-<id>` name is available as a slash command. The CLI tracks its
-owned paths in `~/.aident/favorite-skills.json` and never overwrites or removes unmanaged paths.
+directories, where the deterministic `loadout-<slug>-<id>` name is available as a slash command. Its discovery
+description uses the reviewed display name and summary for the CLI's system language, with English fallback. The CLI
+tracks its owned paths in `~/.aident/favorite-skills.json` and never overwrites or removes unmanaged paths. During
+normal authenticated commands, the server compares the manifest state with the user's current favorites. When they
+differ, the CLI tells the agent to finish the current task and ask the user before running `aident skills sync`; it
+never synchronizes favorite Skills automatically.
 
 `billing balance` keeps `balance` and returns `currentCreditSource` for the currently selected wallet. The legacy
 `creditSource` alias remains available for compatibility. The response also returns `wallets.personal` plus
@@ -109,6 +113,9 @@ uncharged and historical rows return `null`. Team owners can pass `--scope team`
 active members instead of just their own: each entry adds `actingUserId`/`actingUserEmail`/`actingUserName`, and the
 summary adds a `byActingUser` breakdown. `--scope team` is rejected for anyone who isn't the owner of a team with
 credit sharing enabled; the default `--scope mine` behavior is unchanged.
+Successful self-owned rows can include `resultFiles` with a direct `downloadUrl` and nullable `expiresAt`, allowing a
+caller to recover persisted output after an interrupted response. Audit output does not expose internal asset IDs, and
+team scope does not expose another member's result files.
 
 ## Configuration
 

package/dist/cli.mjs

@@ -88,12 +88,12 @@ async function login(options) {
   const baseUrl = options.baseUrl.replace(/\/+$/, "");
   const writeInfo = options.format === "json" ? logErr : logInfo;
   if (options.oob)
-    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout);
+    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
   try {
-    return await loginLoopback(baseUrl, writeInfo);
+    return await loginLoopback(baseUrl, writeInfo, options.ref);
   } catch (err) {
     logErr(`Loopback OAuth failed (${err instanceof Error ? err.message : String(err)}). Falling back to OOB flow.`);
-    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout);
+    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
   }
 }
 async function refreshToken(creds) {
@@ -128,7 +128,7 @@ async function logout(creds) {
     return;
   });
 }
-async function loginLoopback(baseUrl, writeInfo) {
+async function loginLoopback(baseUrl, writeInfo, ref) {
   const verifier = base64UrlEncode(randomBytes(48));
   const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
   const state = base64UrlEncode(randomBytes(16));
@@ -143,6 +143,8 @@ async function loginLoopback(baseUrl, writeInfo) {
   authorizeUrl.searchParams.set("code_challenge", challenge);
   authorizeUrl.searchParams.set("code_challenge_method", "S256");
   authorizeUrl.searchParams.set("state", state);
+  if (ref)
+    authorizeUrl.searchParams.set("via", ref);
   const authorizeUrlString = authorizeUrl.toString();
   setExpectedOpenRedirectUrl(authorizeUrlString);
   const loginOpenUrl = buildLoginOpenUrl(port, state, authorizeUrlString);
@@ -158,7 +160,7 @@ async function loginLoopback(baseUrl, writeInfo) {
   const tok = await exchangeCode(baseUrl, clientId, code, redirectUri, verifier);
   return buildCreds(baseUrl, clientId, tok);
 }
-async function loginOob(baseUrl, writeInfo, promptOutput) {
+async function loginOob(baseUrl, writeInfo, promptOutput, ref) {
   const redirectUri = `${baseUrl}/mcp/oob`;
   const verifier = base64UrlEncode(randomBytes(48));
   const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
@@ -174,6 +176,8 @@ async function loginOob(baseUrl, writeInfo, promptOutput) {
     authorizeUrl.searchParams.set("code_challenge", challenge);
     authorizeUrl.searchParams.set("code_challenge_method", "S256");
     authorizeUrl.searchParams.set("state", state);
+    if (ref)
+      authorizeUrl.searchParams.set("via", ref);
     const authorizeUrlString = authorizeUrl.toString();
     writeInfo(`Opening browser for Aident login...`);
     writeInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
@@ -598,7 +602,7 @@ function normalizeBaseUrl(url) {
 }
 
 // src/version.ts
-var VERSION = "0.1.8-rc.2";
+var VERSION = "0.2.0-rc.0";
 
 // src/catalogCache.ts
 var CACHE_TTL_MS = 5 * 60 * 1000;
@@ -628,7 +632,13 @@ async function genWriteCachedCatalog(params, catalog) {
   } catch {}
 }
 function getCacheFile(params) {
-  const key = crypto.createHash("sha256").update([params.baseUrl, params.packageName, params.installedSkillVersion ?? "", VERSION].join("\x00")).digest("hex").slice(0, 16);
+  const key = crypto.createHash("sha256").update([
+    params.baseUrl,
+    params.packageName,
+    params.installedSkillVersion ?? "",
+    params.favoriteSkillsStateToken ?? "",
+    VERSION
+  ].join("\x00")).digest("hex").slice(0, 16);
   return join2(getAidentDir(), "cache", `catalog-${key}.json`);
 }
 function getCredentialFingerprint(accessToken) {
@@ -642,7 +652,7 @@ function isCommandCatalog(value) {
 }
 
 // src/loadoutSkill.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { lstat as lstat2, readdir as readdir2, readFile as readFile5, realpath as realpath2 } from "node:fs/promises";
 import { basename, dirname as dirname2, join as join6 } from "node:path";
 
@@ -5552,6 +5562,20 @@ async function isExecutable(path) {
   }
 }
 
+// ../web/shared/integrations/LoadoutFavoriteSkillSyncState.ts
+import { createHash as createHash2 } from "node:crypto";
+var AIDENT_FAVORITE_SKILLS_STATE_HEADER = "x-aident-favorite-skills-state";
+var LoadoutFavoriteSkillsStateTokenSchema = zod_default.string().regex(/^[a-f0-9]{64}$/);
+var LoadoutFavoriteSkillsUpdateSchema = zod_default.object({
+  stateToken: LoadoutFavoriteSkillsStateTokenSchema,
+  favoriteCount: zod_default.number().int().nonnegative(),
+  syncRequired: zod_default.boolean()
+}).strict();
+function getLoadoutFavoriteSkillsStateToken(skills) {
+  const state = skills.map(({ name, artifactVersionId }) => ({ name, artifactVersionId })).sort((left, right) => left.name.localeCompare(right.name));
+  return createHash2("sha256").update(JSON.stringify(state)).digest("hex");
+}
+
 // ../web/shared/loadout/LoadoutUpdatePolicy.ts
 var AIDENT_UPDATE_PROTOCOL_HEADER = "x-aident-update-protocol";
 var AIDENT_UPDATE_PROTOCOL_VERSION = "1";
@@ -5712,6 +5736,40 @@ var KNOWN_CLEAN_LOADOUT_SKILL_REQUIRED_FILE_GIT_BLOB_SHA1 = {
       "references/mcp.md": "4040ef157a84d9159bc8bbecd288741fd51dc751",
       "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
     }
+  ],
+  "0.4.12": [
+    {
+      "SKILL.md": "3808426c0802578a27e3ad984b24f546aa8cbe40",
+      "references/api.md": "fdd5a23a72e0afd2809472d004961f11e1959bd4",
+      "references/loadout.md": "3f6791826535bf458cb1ddcd24aee003af98a50d",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    },
+    {
+      "SKILL.md": "3808426c0802578a27e3ad984b24f546aa8cbe40",
+      "references/api.md": "a6a4ff7e106245697a1a6527f0ff0d3df729bfb3",
+      "references/loadout.md": "aa68ff08dafd97a268279b7cab532b3a4ce9d175",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    }
+  ],
+  "0.4.13": [
+    {
+      "SKILL.md": "abf6057514737bbf3ca4cffc511919fc254c87c2",
+      "references/api.md": "a6a4ff7e106245697a1a6527f0ff0d3df729bfb3",
+      "references/loadout.md": "25a696a0107055e250424b117cee34d282784935",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    }
+  ],
+  "0.4.14": [
+    {
+      "SKILL.md": "61d825a96dab110426d92cb80feb5fe40f7a010b",
+      "references/api.md": "240b913e8c85492f2441326033db91747c54863e",
+      "references/loadout.md": "be4dbd9e0aad75afe647800f64d2bb16c22d03a8",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    }
   ]
 };
 async function fetchLoadoutSkillMetadata(baseUrl) {
@@ -5734,7 +5792,7 @@ function isLoadoutSkillMetadata(value) {
   if (!value || typeof value !== "object")
     return false;
   const body = value;
-  return body.product === "loadout" && typeof body.skillUrl === "string" && typeof body.skillVersion === "string" && typeof body.updatedAt === "string" && typeof body.setupPrompt === "string" && typeof body.updatePrompt === "string" && typeof body.minCliVersion === "string" && typeof body.recommendedCliVersion === "string" && (body.localIntegrationMigrationPromptEnabled === undefined || typeof body.localIntegrationMigrationPromptEnabled === "boolean") && (body.updatePolicy === undefined || LoadoutUpdatePolicySchema.safeParse(body.updatePolicy).success) && Array.isArray(body.notices) && body.notices.every(isLoadoutSkillNotice);
+  return body.product === "loadout" && typeof body.skillUrl === "string" && typeof body.skillVersion === "string" && typeof body.updatedAt === "string" && typeof body.setupPrompt === "string" && typeof body.updatePrompt === "string" && typeof body.minCliVersion === "string" && typeof body.recommendedCliVersion === "string" && (body.localIntegrationMigrationPromptEnabled === undefined || typeof body.localIntegrationMigrationPromptEnabled === "boolean") && (body.updatePolicy === undefined || LoadoutUpdatePolicySchema.safeParse(body.updatePolicy).success) && (body.favoriteSkills === undefined || LoadoutFavoriteSkillsUpdateSchema.safeParse(body.favoriteSkills).success) && Array.isArray(body.notices) && body.notices.every(isLoadoutSkillNotice);
 }
 function isLocalIntegrationMigrationPromptEnabled(metadata) {
   return metadata?.localIntegrationMigrationPromptEnabled === true;
@@ -5844,7 +5902,7 @@ async function inspectLoadoutSkillDirectory(skillDirectory, managedReleasesRoot
   };
 }
 function computeLoadoutSkillRequiredFileDigest(files) {
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   for (const path of LOADOUT_SKILL_REQUIRED_FILES) {
     const content = getFileContent(files, path);
     if (content === undefined)
@@ -5867,7 +5925,7 @@ function computeLoadoutSkillArtifactSha256(files, version) {
       return { path, content };
     })
   });
-  return createHash2("sha256").update(body).digest("hex");
+  return createHash3("sha256").update(body).digest("hex");
 }
 function validateLoadoutSkillRequiredFileContents(files, expectedVersion) {
   const frontmatter = parseSkillFrontmatter(getFileContent(files, "SKILL.md") ?? "");
@@ -5961,7 +6019,7 @@ function getFileContent(files, path) {
   return files[path];
 }
 function computeGitBlobSha1(content) {
-  return createHash2("sha1").update(`blob ${content.byteLength}\x00`).update(content).digest("hex");
+  return createHash3("sha1").update(`blob ${content.byteLength}\x00`).update(content).digest("hex");
 }
 function isLoadoutSkillNotice(value) {
   if (!value || typeof value !== "object")
@@ -5972,6 +6030,7 @@ function isLoadoutSkillNotice(value) {
 
 // src/client.ts
 var CLI_CATALOG_DURATION_HEADER = "x-aident-cli-catalog-duration-ms";
+var CLI_LOCALE = Intl.DateTimeFormat().resolvedOptions().locale;
 
 class CliClient {
   creds;
@@ -5979,9 +6038,10 @@ class CliClient {
   packages;
   installedSkillVersion;
   loadoutSkillInventory;
+  favoriteSkillsStateToken;
   commandOperations = new Map;
   catalogDurationMs = null;
-  constructor(creds, credentialSource = "stored", packages, installedSkillVersion = null, loadoutSkillInventory = null) {
+  constructor(creds, credentialSource = "stored", packages, installedSkillVersion = null, loadoutSkillInventory = null, favoriteSkillsStateToken = null) {
     this.creds = creds;
     this.credentialSource = credentialSource;
     if (packages.length === 0)
@@ -5989,6 +6049,7 @@ class CliClient {
     this.packages = [...packages];
     this.installedSkillVersion = installedSkillVersion;
     this.loadoutSkillInventory = loadoutSkillInventory;
+    this.favoriteSkillsStateToken = favoriteSkillsStateToken;
   }
   get baseUrl() {
     return this.creds.base_url.replace(/\/+$/, "");
@@ -6059,13 +6120,15 @@ class CliClient {
       accessToken: this.creds.access_token,
       baseUrl: this.baseUrl,
       packageName,
-      installedSkillVersion: this.installedSkillVersion
+      installedSkillVersion: this.installedSkillVersion,
+      favoriteSkillsStateToken: this.favoriteSkillsStateToken
     };
     const cached = await genReadCachedCatalog(cacheParams);
     if (cached)
       return { status: 200, body: withValidLoadoutSkillMetadata(cached) };
     const headers = packageName === "loadout" ? {
-      ...this.installedSkillVersion ? { "x-aident-skill-version": this.installedSkillVersion } : {}
+      ...this.installedSkillVersion ? { "x-aident-skill-version": this.installedSkillVersion } : {},
+      ...this.favoriteSkillsStateToken ? { [AIDENT_FAVORITE_SKILLS_STATE_HEADER]: this.favoriteSkillsStateToken } : {}
     } : undefined;
     const path = this.catalogPath(packageName);
     let result;
@@ -6109,6 +6172,7 @@ class CliClient {
   async fetchJson(method, path, body, extraHeaders) {
     const headers = {
       Authorization: `Bearer ${this.creds.access_token}`,
+      "Accept-Language": CLI_LOCALE,
       "User-Agent": `@aident-ai/cli/${VERSION}`,
       [AIDENT_UPDATE_PROTOCOL_HEADER]: AIDENT_UPDATE_PROTOCOL_VERSION,
       ...extraHeaders
@@ -6474,7 +6538,7 @@ function getLocalHelp(version) {
       "aident config get <key>",
       "aident packages add <playbook|intern>",
       "aident doctor",
-      "aident setup [--client-name <name>]",
+      "aident setup [--client-name <name>] [--ref <code>]",
       "aident integrations migrate-local",
       "aident <domain> <command> [--flag value ...] [--json]"
     ],
@@ -6663,7 +6727,7 @@ function renderCommandHelp(catalog, domain, command, subcommand) {
 }
 
 // src/loadoutFavoriteSkills.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { lstat as lstat3, mkdir as mkdir6, readFile as readFile7, readlink, rename as rename2, rm as rm2, symlink, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import path from "node:path";
@@ -6737,7 +6801,7 @@ function assertPackage(pkg) {
     packageBytes += bytes;
     if (bytes !== file.sizeBytes)
       throw new Error(`Size mismatch: ${pkg.name}/${file.path}`);
-    if (createHash3("sha256").update(file.content).digest("hex") !== file.contentDigest) {
+    if (createHash4("sha256").update(file.content).digest("hex") !== file.contentDigest) {
       throw new Error(`Digest mismatch: ${pkg.name}/${file.path}`);
     }
   }
@@ -6760,7 +6824,7 @@ function entrypointContent(pkg, content) {
   return [
     "---",
     `name: ${quoteYaml(commandName(pkg))}`,
-    `description: ${quoteYaml(pkg.summary)}`,
+    `description: ${quoteYaml(`${pkg.displayName}: ${pkg.summary}`)}`,
     "---",
     `<!-- aident-loadout-skill name=${pkg.name} artifact-version=${pkg.artifactVersionId} -->`,
     "",
@@ -6785,7 +6849,7 @@ async function readManifest(home, env) {
       throw new Error("Unsupported manifest");
     const harnessRoots = new Set(getHarnessHosts(home, env).map(({ root }) => path.join(root, "skills")));
     for (const skill of value.skills) {
-      if (!LOADOUT_SKILL_NAME_PATTERN.test(skill.name) || !isCanonicalUuid(skill.artifactVersionId) || !/^loadout-[a-z0-9-]+-[0-9a-f]{8}$/.test(skill.commandName) || skill.installPath !== path.join(getCanonicalRoot(home, env), skill.commandName) || skill.linkPaths.some((linkPath) => !harnessRoots.has(path.dirname(linkPath)) || path.basename(linkPath) !== skill.commandName)) {
+      if (!LOADOUT_SKILL_NAME_PATTERN.test(skill.name) || !isCanonicalUuid(skill.artifactVersionId) || skill.displayName !== undefined && typeof skill.displayName !== "string" || skill.summary !== undefined && typeof skill.summary !== "string" || !/^loadout-[a-z0-9-]+-[0-9a-f]{8}$/.test(skill.commandName) || skill.installPath !== path.join(getCanonicalRoot(home, env), skill.commandName) || skill.linkPaths.some((linkPath) => !harnessRoots.has(path.dirname(linkPath)) || path.basename(linkPath) !== skill.commandName)) {
         throw new Error("Invalid favorite Skills ownership manifest");
       }
     }
@@ -6796,6 +6860,10 @@ async function readManifest(home, env) {
     throw error;
   }
 }
+async function getInstalledLoadoutFavoriteSkillsStateToken(home = getHome(), env = process.env) {
+  const manifest = await readManifest(home, env);
+  return getLoadoutFavoriteSkillsStateToken(manifest.skills);
+}
 async function writeManifest(home, manifest) {
   const manifestPath = getManifestPath(home);
   const temporaryPath = `${manifestPath}.${process.pid}.tmp`;
@@ -6871,7 +6939,7 @@ async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = p
       continue;
     }
     const allLinksExist = (await Promise.all(linkPaths.map(pathExists))).every(Boolean);
-    if (previous?.artifactVersionId === pkg.artifactVersionId && previous.installPath === installPath && previous.linkPaths.length === linkPaths.length && previous.linkPaths.every((linkPath) => linkPaths.includes(linkPath)) && await pathExists(installPath) && allLinksExist) {
+    if (previous?.artifactVersionId === pkg.artifactVersionId && previous.displayName === pkg.displayName && previous.summary === pkg.summary && previous.installPath === installPath && previous.linkPaths.length === linkPaths.length && previous.linkPaths.every((linkPath) => linkPaths.includes(linkPath)) && await pathExists(installPath) && allLinksExist) {
       result.unchanged.push(pkg.name);
       nextSkills.push(previous);
       continue;
@@ -6916,6 +6984,8 @@ async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = p
     nextSkills.push({
       name: pkg.name,
       artifactVersionId: pkg.artifactVersionId,
+      displayName: pkg.displayName,
+      summary: pkg.summary,
       commandName: nextCommandName,
       installPath,
       linkPaths
@@ -6968,7 +7038,7 @@ async function genReconcileFavoriteSkills(resolved, result, dependencies) {
 }
 
 // src/localIntegrationMigration.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readFile as readFile8 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { basename as basename2, join as join8 } from "node:path";
@@ -7370,7 +7440,7 @@ function withoutMatchText(candidate) {
   };
 }
 function buildCandidateId(candidate) {
-  return `local_${createHash4("sha256").update([candidate.localSource, candidate.localLabel, candidate.redactedLocator].join("\x00")).digest("hex").slice(0, 12)}`;
+  return `local_${createHash5("sha256").update([candidate.localSource, candidate.localLabel, candidate.redactedLocator].join("\x00")).digest("hex").slice(0, 12)}`;
 }
 function dedupeRawCandidates(candidates) {
   const byKey = new Map;
@@ -7575,6 +7645,16 @@ function buildCommandArgs(params) {
       continue;
     delete args[reserved];
   }
+  const unsupportedField = Object.keys(args).find((key) => !(key in props) && !(params.subcommand && key === "action"));
+  if (unsupportedField) {
+    const directField = unsupportedField.endsWith("File") ? unsupportedField.slice(0, -"File".length) : undefined;
+    return {
+      error: {
+        code: "invalid-input",
+        message: unsupportedField.includes("-") ? `Use camelCase input fields; --${unsupportedField} is not supported.` : `Unknown input field --${unsupportedField}.${directField && directField in props ? ` Pass --${directField} with the value directly.` : ""}`
+      }
+    };
+  }
   if (positionalJson?.args)
     remaining.pop();
   if (params.subcommand) {
@@ -7716,7 +7796,7 @@ import { homedir as homedir6 } from "node:os";
 import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute3, join as join9, relative as relative2, resolve as resolve2, sep } from "node:path";
 
 // src/loadoutSkillArtifact.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var MAX_LOADOUT_SKILL_ARTIFACT_BYTES = 512 * 1024;
 async function fetchLoadoutSkillArtifact(descriptorValue, expectedVersion, deps = {}) {
   const descriptor = LoadoutSkillArtifactDescriptorSchema.parse(descriptorValue);
@@ -7741,7 +7821,7 @@ async function fetchLoadoutSkillArtifact(descriptorValue, expectedVersion, deps
   if (bytes.byteLength !== descriptor.byteLength) {
     throw new Error(`Aident skill artifact size mismatch: expected ${descriptor.byteLength}, received ${bytes.byteLength}`);
   }
-  const artifactSha256 = createHash5("sha256").update(bytes).digest("hex");
+  const artifactSha256 = createHash6("sha256").update(bytes).digest("hex");
   if (artifactSha256 !== descriptor.sha256)
     throw new Error("Aident skill artifact SHA-256 mismatch");
   let parsed;
@@ -8880,6 +8960,14 @@ async function getLoadoutUpdateWarnings(params, injected = {}) {
       warnings.push(`Aident skill v${policy.skill.recommendedVersion} is recommended. Run \`${command}\` when you are ready.`);
     }
   }
+  if (metadata.favoriteSkills?.syncRequired && await claimNotice({
+    noticeId: "aident-favorite-skills-sync",
+    targetVersion: `0.0.0+favorites.${metadata.favoriteSkills.stateToken}`,
+    homeDir: params.homeDir,
+    intervalMs
+  })) {
+    warnings.push("Your local favorite Skills differ from your Aident favorites. After completing the current task, ask the user whether they want you to run `aident skills sync`.");
+  }
   if (cliNoticeShown || skillNoticeShown) {
     recordNotice(injected.recordNotice, cliNoticeShown && skillNoticeShown ? "cli_and_skill" /* CliAndSkill */ : cliNoticeShown ? "cli" /* Cli */ : "skill" /* Skill */);
   }
@@ -9007,6 +9095,13 @@ function getPreservedShadowBucket(count) {
   return "6+" /* SixOrMore */;
 }
 
+// ../web/shared/affiliate/AffiliateCode.ts
+var AFFILIATE_CODE_PATTERN = /^[A-Z0-9]{6,32}$/;
+function normalizeAffiliateCode(value) {
+  const normalized = value?.trim().toUpperCase();
+  return normalized && AFFILIATE_CODE_PATTERN.test(normalized) ? normalized : null;
+}
+
 // src/cli.ts
 var LOADOUT_CAPABILITIES_SEARCH_OPERATION = "loadout_capabilities_search";
 var LOADOUT_CAPABILITIES_EXECUTE_OPERATION = "loadout_capabilities_execute";
@@ -9475,7 +9570,12 @@ async function runSetup(parsed) {
     let credentials = await readCredentials();
     const hasEnvironmentToken = !!process.env.AIDENT_TOKEN?.trim();
     if ((!credentials || !credentialsForBaseUrl(credentials, options.baseUrl)) && !hasEnvironmentToken) {
-      credentials = await login({ baseUrl: options.baseUrl, format: parsed.format, oob: options.oob });
+      credentials = await login({
+        baseUrl: options.baseUrl,
+        format: parsed.format,
+        oob: options.oob,
+        ref: options.ref
+      });
       await writeCredentials(credentials);
     }
     const client = await getAuthenticatedClient(["loadout"]);
@@ -9521,7 +9621,7 @@ async function runSetup(parsed) {
 async function getSetupOptions(parsed) {
   if (parsed.positional.length !== 1)
     throw new Error("Usage: aident setup [flags]");
-  const allowedFlags = new Set(["base-url", "client-name", "oob"]);
+  const allowedFlags = new Set(["base-url", "client-name", "oob", "ref"]);
   const unknownFlag = Object.keys(parsed.flags).find((flag) => !allowedFlags.has(flag));
   if (unknownFlag)
     throw new Error(`Unknown setup flag: --${unknownFlag}`);
@@ -9529,10 +9629,15 @@ async function getSetupOptions(parsed) {
   const clientName = getOptionalStringFlag(parsed.flags, "client-name") ?? "Aident CLI";
   if (clientName.length > 160)
     throw new Error("--client-name must be at most 160 characters");
+  const rawRef = getOptionalStringFlag(parsed.flags, "ref");
+  const ref = normalizeAffiliateCode(rawRef) ?? undefined;
+  if (rawRef && !ref)
+    throw new Error("--ref must be a 6-32 character affiliate code");
   return {
     baseUrl: rawBaseUrl ? normalizeBaseUrl(rawBaseUrl) : await resolveDefaultBaseUrl(),
     clientName,
     oob: getBooleanUpdateFlag(parsed.flags, "oob"),
+    ref,
     persistBaseUrl: !!rawBaseUrl
   };
 }
@@ -9561,7 +9666,7 @@ function renderSetupHelp() {
     `${colors.bold}AIDENT SETUP${colors.reset}`,
     "",
     "USAGE:",
-    "  aident setup [--client-name <name>] [--base-url <url>] [--oob] [--json]",
+    "  aident setup [--client-name <name>] [--base-url <url>] [--ref <code>] [--oob] [--json]",
     "",
     "The setup command updates the CLI, installs or reconciles the verified Aident Skill globally, and opens sign-in when needed.",
     "It verifies Loadout access and records completion. AIDENT_TOKEN enables non-interactive authentication."
@@ -10253,7 +10358,10 @@ async function getRequestedPackages(parsed) {
 }
 async function getAuthenticatedClient(packages) {
   const activePackages = packages ?? await resolveDefaultPackages();
-  const skillInventory = await getLoadoutSkillInventory();
+  const [skillInventory, favoriteSkillsStateToken] = await Promise.all([
+    getLoadoutSkillInventory(),
+    getInstalledLoadoutFavoriteSkillsStateToken().catch(() => null)
+  ]);
   const installedSkillVersion = findInstalledLoadoutSkillVersionFromInventory(skillInventory);
   const envToken = process.env.AIDENT_TOKEN;
   const envBaseUrl = process.env.AIDENT_BASE_URL?.trim();
@@ -10263,7 +10371,7 @@ async function getAuthenticatedClient(packages) {
       base_url: normalizeBaseUrl(baseUrl2),
       client_id: "",
       access_token: envToken
-    }, "env", activePackages, installedSkillVersion, skillInventory);
+    }, "env", activePackages, installedSkillVersion, skillInventory, favoriteSkillsStateToken);
   }
   let creds = await readCredentials();
   if (!creds)
@@ -10282,7 +10390,7 @@ async function getAuthenticatedClient(packages) {
       creds = refreshed;
     }
   }
-  return new CliClient(creds, "stored", activePackages, installedSkillVersion, skillInventory);
+  return new CliClient(creds, "stored", activePackages, installedSkillVersion, skillInventory, favoriteSkillsStateToken);
 }
 var catalogCache = null;
 async function fetchCatalog(client, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aident-ai/cli",
-  "version": "0.1.8-rc.2",
+  "version": "0.2.0-rc.0",
   "description": "Aident CLI — umbrella access to Loadout integrations, Playbook automation, Intern tools, and the Aident platform.",
   "homepage": "https://aident.ai",
   "repository": {