@aident-ai/cli 0.1.8 → 0.2.0-rc.0

package/README.md

@@ -97,8 +97,12 @@ providers to Loadout integrations, and starts selected Vault/OAuth connect flows
 
 `skills favorite` saves the account preference and immediately synchronizes all current favorites. `skills sync`
 reconciles each current public revision into `~/.agents/skills` and links it into supported harness-global Skill
-directories, where the deterministic `loadout-<slug>-<id>` name is available as a slash command. The CLI tracks its
-owned paths in `~/.aident/favorite-skills.json` and never overwrites or removes unmanaged paths.
+directories, where the deterministic `loadout-<slug>-<id>` name is available as a slash command. Its discovery
+description uses the reviewed display name and summary for the CLI's system language, with English fallback. The CLI
+tracks its owned paths in `~/.aident/favorite-skills.json` and never overwrites or removes unmanaged paths. During
+normal authenticated commands, the server compares the manifest state with the user's current favorites. When they
+differ, the CLI tells the agent to finish the current task and ask the user before running `aident skills sync`; it
+never synchronizes favorite Skills automatically.
 
 `billing balance` keeps `balance` and returns `currentCreditSource` for the currently selected wallet. The legacy
 `creditSource` alias remains available for compatibility. The response also returns `wallets.personal` plus
@@ -109,6 +113,9 @@ uncharged and historical rows return `null`. Team owners can pass `--scope team`
 active members instead of just their own: each entry adds `actingUserId`/`actingUserEmail`/`actingUserName`, and the
 summary adds a `byActingUser` breakdown. `--scope team` is rejected for anyone who isn't the owner of a team with
 credit sharing enabled; the default `--scope mine` behavior is unchanged.
+Successful self-owned rows can include `resultFiles` with a direct `downloadUrl` and nullable `expiresAt`, allowing a
+caller to recover persisted output after an interrupted response. Audit output does not expose internal asset IDs, and
+team scope does not expose another member's result files.
 
 ## Configuration
 

package/dist/cli.mjs

@@ -88,12 +88,12 @@ async function login(options) {
   const baseUrl = options.baseUrl.replace(/\/+$/, "");
   const writeInfo = options.format === "json" ? logErr : logInfo;
   if (options.oob)
-    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout);
+    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
   try {
-    return await loginLoopback(baseUrl, writeInfo);
+    return await loginLoopback(baseUrl, writeInfo, options.ref);
   } catch (err) {
     logErr(`Loopback OAuth failed (${err instanceof Error ? err.message : String(err)}). Falling back to OOB flow.`);
-    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout);
+    return loginOob(baseUrl, writeInfo, options.format === "json" ? process.stderr : process.stdout, options.ref);
   }
 }
 async function refreshToken(creds) {
@@ -128,7 +128,7 @@ async function logout(creds) {
     return;
   });
 }
-async function loginLoopback(baseUrl, writeInfo) {
+async function loginLoopback(baseUrl, writeInfo, ref) {
   const verifier = base64UrlEncode(randomBytes(48));
   const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
   const state = base64UrlEncode(randomBytes(16));
@@ -143,6 +143,8 @@ async function loginLoopback(baseUrl, writeInfo) {
   authorizeUrl.searchParams.set("code_challenge", challenge);
   authorizeUrl.searchParams.set("code_challenge_method", "S256");
   authorizeUrl.searchParams.set("state", state);
+  if (ref)
+    authorizeUrl.searchParams.set("via", ref);
   const authorizeUrlString = authorizeUrl.toString();
   setExpectedOpenRedirectUrl(authorizeUrlString);
   const loginOpenUrl = buildLoginOpenUrl(port, state, authorizeUrlString);
@@ -158,7 +160,7 @@ async function loginLoopback(baseUrl, writeInfo) {
   const tok = await exchangeCode(baseUrl, clientId, code, redirectUri, verifier);
   return buildCreds(baseUrl, clientId, tok);
 }
-async function loginOob(baseUrl, writeInfo, promptOutput) {
+async function loginOob(baseUrl, writeInfo, promptOutput, ref) {
   const redirectUri = `${baseUrl}/mcp/oob`;
   const verifier = base64UrlEncode(randomBytes(48));
   const challenge = base64UrlEncode(createHash("sha256").update(verifier).digest());
@@ -174,6 +176,8 @@ async function loginOob(baseUrl, writeInfo, promptOutput) {
     authorizeUrl.searchParams.set("code_challenge", challenge);
     authorizeUrl.searchParams.set("code_challenge_method", "S256");
     authorizeUrl.searchParams.set("state", state);
+    if (ref)
+      authorizeUrl.searchParams.set("via", ref);
     const authorizeUrlString = authorizeUrl.toString();
     writeInfo(`Opening browser for Aident login...`);
     writeInfo(`If the browser does not open, visit: ${authorizeUrlString}`);
@@ -598,7 +602,7 @@ function normalizeBaseUrl(url) {
 }
 
 // src/version.ts
-var VERSION = "0.1.8";
+var VERSION = "0.2.0-rc.0";
 
 // src/catalogCache.ts
 var CACHE_TTL_MS = 5 * 60 * 1000;
@@ -628,7 +632,13 @@ async function genWriteCachedCatalog(params, catalog) {
   } catch {}
 }
 function getCacheFile(params) {
-  const key = crypto.createHash("sha256").update([params.baseUrl, params.packageName, params.installedSkillVersion ?? "", VERSION].join("\x00")).digest("hex").slice(0, 16);
+  const key = crypto.createHash("sha256").update([
+    params.baseUrl,
+    params.packageName,
+    params.installedSkillVersion ?? "",
+    params.favoriteSkillsStateToken ?? "",
+    VERSION
+  ].join("\x00")).digest("hex").slice(0, 16);
   return join2(getAidentDir(), "cache", `catalog-${key}.json`);
 }
 function getCredentialFingerprint(accessToken) {
@@ -642,7 +652,7 @@ function isCommandCatalog(value) {
 }
 
 // src/loadoutSkill.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { lstat as lstat2, readdir as readdir2, readFile as readFile5, realpath as realpath2 } from "node:fs/promises";
 import { basename, dirname as dirname2, join as join6 } from "node:path";
 
@@ -5552,6 +5562,20 @@ async function isExecutable(path) {
   }
 }
 
+// ../web/shared/integrations/LoadoutFavoriteSkillSyncState.ts
+import { createHash as createHash2 } from "node:crypto";
+var AIDENT_FAVORITE_SKILLS_STATE_HEADER = "x-aident-favorite-skills-state";
+var LoadoutFavoriteSkillsStateTokenSchema = zod_default.string().regex(/^[a-f0-9]{64}$/);
+var LoadoutFavoriteSkillsUpdateSchema = zod_default.object({
+  stateToken: LoadoutFavoriteSkillsStateTokenSchema,
+  favoriteCount: zod_default.number().int().nonnegative(),
+  syncRequired: zod_default.boolean()
+}).strict();
+function getLoadoutFavoriteSkillsStateToken(skills) {
+  const state = skills.map(({ name, artifactVersionId }) => ({ name, artifactVersionId })).sort((left, right) => left.name.localeCompare(right.name));
+  return createHash2("sha256").update(JSON.stringify(state)).digest("hex");
+}
+
 // ../web/shared/loadout/LoadoutUpdatePolicy.ts
 var AIDENT_UPDATE_PROTOCOL_HEADER = "x-aident-update-protocol";
 var AIDENT_UPDATE_PROTOCOL_VERSION = "1";
@@ -5712,6 +5736,40 @@ var KNOWN_CLEAN_LOADOUT_SKILL_REQUIRED_FILE_GIT_BLOB_SHA1 = {
       "references/mcp.md": "4040ef157a84d9159bc8bbecd288741fd51dc751",
       "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
     }
+  ],
+  "0.4.12": [
+    {
+      "SKILL.md": "3808426c0802578a27e3ad984b24f546aa8cbe40",
+      "references/api.md": "fdd5a23a72e0afd2809472d004961f11e1959bd4",
+      "references/loadout.md": "3f6791826535bf458cb1ddcd24aee003af98a50d",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    },
+    {
+      "SKILL.md": "3808426c0802578a27e3ad984b24f546aa8cbe40",
+      "references/api.md": "a6a4ff7e106245697a1a6527f0ff0d3df729bfb3",
+      "references/loadout.md": "aa68ff08dafd97a268279b7cab532b3a4ce9d175",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    }
+  ],
+  "0.4.13": [
+    {
+      "SKILL.md": "abf6057514737bbf3ca4cffc511919fc254c87c2",
+      "references/api.md": "a6a4ff7e106245697a1a6527f0ff0d3df729bfb3",
+      "references/loadout.md": "25a696a0107055e250424b117cee34d282784935",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    }
+  ],
+  "0.4.14": [
+    {
+      "SKILL.md": "61d825a96dab110426d92cb80feb5fe40f7a010b",
+      "references/api.md": "240b913e8c85492f2441326033db91747c54863e",
+      "references/loadout.md": "be4dbd9e0aad75afe647800f64d2bb16c22d03a8",
+      "references/mcp.md": "3e92c88b1ef94e863bd4ce977a36abc3a0df2138",
+      "references/troubleshooting.md": "f819915c8829b028630ef1f8f29ae9433a072ca8"
+    }
   ]
 };
 async function fetchLoadoutSkillMetadata(baseUrl) {
@@ -5734,7 +5792,7 @@ function isLoadoutSkillMetadata(value) {
   if (!value || typeof value !== "object")
     return false;
   const body = value;
-  return body.product === "loadout" && typeof body.skillUrl === "string" && typeof body.skillVersion === "string" && typeof body.updatedAt === "string" && typeof body.setupPrompt === "string" && typeof body.updatePrompt === "string" && typeof body.minCliVersion === "string" && typeof body.recommendedCliVersion === "string" && (body.localIntegrationMigrationPromptEnabled === undefined || typeof body.localIntegrationMigrationPromptEnabled === "boolean") && (body.updatePolicy === undefined || LoadoutUpdatePolicySchema.safeParse(body.updatePolicy).success) && Array.isArray(body.notices) && body.notices.every(isLoadoutSkillNotice);
+  return body.product === "loadout" && typeof body.skillUrl === "string" && typeof body.skillVersion === "string" && typeof body.updatedAt === "string" && typeof body.setupPrompt === "string" && typeof body.updatePrompt === "string" && typeof body.minCliVersion === "string" && typeof body.recommendedCliVersion === "string" && (body.localIntegrationMigrationPromptEnabled === undefined || typeof body.localIntegrationMigrationPromptEnabled === "boolean") && (body.updatePolicy === undefined || LoadoutUpdatePolicySchema.safeParse(body.updatePolicy).success) && (body.favoriteSkills === undefined || LoadoutFavoriteSkillsUpdateSchema.safeParse(body.favoriteSkills).success) && Array.isArray(body.notices) && body.notices.every(isLoadoutSkillNotice);
 }
 function isLocalIntegrationMigrationPromptEnabled(metadata) {
   return metadata?.localIntegrationMigrationPromptEnabled === true;
@@ -5844,7 +5902,7 @@ async function inspectLoadoutSkillDirectory(skillDirectory, managedReleasesRoot
   };
 }
 function computeLoadoutSkillRequiredFileDigest(files) {
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   for (const path of LOADOUT_SKILL_REQUIRED_FILES) {
     const content = getFileContent(files, path);
     if (content === undefined)
@@ -5867,7 +5925,7 @@ function computeLoadoutSkillArtifactSha256(files, version) {
       return { path, content };
     })
   });
-  return createHash2("sha256").update(body).digest("hex");
+  return createHash3("sha256").update(body).digest("hex");
 }
 function validateLoadoutSkillRequiredFileContents(files, expectedVersion) {
   const frontmatter = parseSkillFrontmatter(getFileContent(files, "SKILL.md") ?? "");
@@ -5961,7 +6019,7 @@ function getFileContent(files, path) {
   return files[path];
 }
 function computeGitBlobSha1(content) {
-  return createHash2("sha1").update(`blob ${content.byteLength}\x00`).update(content).digest("hex");
+  return createHash3("sha1").update(`blob ${content.byteLength}\x00`).update(content).digest("hex");
 }
 function isLoadoutSkillNotice(value) {
   if (!value || typeof value !== "object")
@@ -5972,6 +6030,7 @@ function isLoadoutSkillNotice(value) {
 
 // src/client.ts
 var CLI_CATALOG_DURATION_HEADER = "x-aident-cli-catalog-duration-ms";
+var CLI_LOCALE = Intl.DateTimeFormat().resolvedOptions().locale;
 
 class CliClient {
   creds;
@@ -5979,9 +6038,10 @@ class CliClient {
   packages;
   installedSkillVersion;
   loadoutSkillInventory;
+  favoriteSkillsStateToken;
   commandOperations = new Map;
   catalogDurationMs = null;
-  constructor(creds, credentialSource = "stored", packages, installedSkillVersion = null, loadoutSkillInventory = null) {
+  constructor(creds, credentialSource = "stored", packages, installedSkillVersion = null, loadoutSkillInventory = null, favoriteSkillsStateToken = null) {
     this.creds = creds;
     this.credentialSource = credentialSource;
     if (packages.length === 0)
@@ -5989,6 +6049,7 @@ class CliClient {
     this.packages = [...packages];
     this.installedSkillVersion = installedSkillVersion;
     this.loadoutSkillInventory = loadoutSkillInventory;
+    this.favoriteSkillsStateToken = favoriteSkillsStateToken;
   }
   get baseUrl() {
     return this.creds.base_url.replace(/\/+$/, "");
@@ -6059,13 +6120,15 @@ class CliClient {
       accessToken: this.creds.access_token,
       baseUrl: this.baseUrl,
       packageName,
-      installedSkillVersion: this.installedSkillVersion
+      installedSkillVersion: this.installedSkillVersion,
+      favoriteSkillsStateToken: this.favoriteSkillsStateToken
     };
     const cached = await genReadCachedCatalog(cacheParams);
     if (cached)
       return { status: 200, body: withValidLoadoutSkillMetadata(cached) };
     const headers = packageName === "loadout" ? {
-      ...this.installedSkillVersion ? { "x-aident-skill-version": this.installedSkillVersion } : {}
+      ...this.installedSkillVersion ? { "x-aident-skill-version": this.installedSkillVersion } : {},
+      ...this.favoriteSkillsStateToken ? { [AIDENT_FAVORITE_SKILLS_STATE_HEADER]: this.favoriteSkillsStateToken } : {}
     } : undefined;
     const path = this.catalogPath(packageName);
     let result;
@@ -6109,6 +6172,7 @@ class CliClient {
   async fetchJson(method, path, body, extraHeaders) {
     const headers = {
       Authorization: `Bearer ${this.creds.access_token}`,
+      "Accept-Language": CLI_LOCALE,
       "User-Agent": `@aident-ai/cli/${VERSION}`,
       [AIDENT_UPDATE_PROTOCOL_HEADER]: AIDENT_UPDATE_PROTOCOL_VERSION,
       ...extraHeaders
@@ -6474,7 +6538,7 @@ function getLocalHelp(version) {
       "aident config get <key>",
       "aident packages add <playbook|intern>",
       "aident doctor",
-      "aident setup [--client-name <name>]",
+      "aident setup [--client-name <name>] [--ref <code>]",
       "aident integrations migrate-local",
       "aident <domain> <command> [--flag value ...] [--json]"
     ],
@@ -6663,13 +6727,19 @@ function renderCommandHelp(catalog, domain, command, subcommand) {
 }
 
 // src/loadoutFavoriteSkills.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import { lstat as lstat3, mkdir as mkdir6, readFile as readFile7, readlink, rename as rename2, rm as rm2, symlink, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import path from "node:path";
 
 // ../web/shared/integrations/LoadoutSkillConstants.ts
 var LOADOUT_SKILL_ENTRYPOINT = "SKILL.md";
+var LOADOUT_SKILL_PLATFORM_SECTION_HEADING = "Aident Loadout Platform";
+var LOADOUT_SKILL_PLATFORM_SECTION = `## **${LOADOUT_SKILL_PLATFORM_SECTION_HEADING}**
+
+This Skill is authored, published, and distributed through [**Aident Loadout**](https://loadout.aident.ai/), a platform that enables agents to connect securely with more than 1,000 popular apps and tools.
+
+Before using this Skill, verify that the Aident Loadout Skill, CLI, Plugin, or MCP is installed globally in the current environment. If Aident Loadout is already available, continue with this Skill and complete any setup required by the selected integrations. If it is unavailable or its installation status is uncertain, follow the [**Aident Loadout setup instructions**](https://aident.ai/SETUP.md). After installation is verified, return to the campaign brief and continue.`;
 var LOADOUT_SKILL_NAME_PATTERN = /^skill:[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 var LOADOUT_SKILL_MAX_FILE_COUNT = 50;
 var LOADOUT_SKILL_MAX_PACKAGE_BYTES = 256 * 1024;
@@ -6731,7 +6801,7 @@ function assertPackage(pkg) {
     packageBytes += bytes;
     if (bytes !== file.sizeBytes)
       throw new Error(`Size mismatch: ${pkg.name}/${file.path}`);
-    if (createHash3("sha256").update(file.content).digest("hex") !== file.contentDigest) {
+    if (createHash4("sha256").update(file.content).digest("hex") !== file.contentDigest) {
       throw new Error(`Digest mismatch: ${pkg.name}/${file.path}`);
     }
   }
@@ -6754,7 +6824,7 @@ function entrypointContent(pkg, content) {
   return [
     "---",
     `name: ${quoteYaml(commandName(pkg))}`,
-    `description: ${quoteYaml(pkg.summary)}`,
+    `description: ${quoteYaml(`${pkg.displayName}: ${pkg.summary}`)}`,
     "---",
     `<!-- aident-loadout-skill name=${pkg.name} artifact-version=${pkg.artifactVersionId} -->`,
     "",
@@ -6779,7 +6849,7 @@ async function readManifest(home, env) {
       throw new Error("Unsupported manifest");
     const harnessRoots = new Set(getHarnessHosts(home, env).map(({ root }) => path.join(root, "skills")));
     for (const skill of value.skills) {
-      if (!LOADOUT_SKILL_NAME_PATTERN.test(skill.name) || !isCanonicalUuid(skill.artifactVersionId) || !/^loadout-[a-z0-9-]+-[0-9a-f]{8}$/.test(skill.commandName) || skill.installPath !== path.join(getCanonicalRoot(home, env), skill.commandName) || skill.linkPaths.some((linkPath) => !harnessRoots.has(path.dirname(linkPath)) || path.basename(linkPath) !== skill.commandName)) {
+      if (!LOADOUT_SKILL_NAME_PATTERN.test(skill.name) || !isCanonicalUuid(skill.artifactVersionId) || skill.displayName !== undefined && typeof skill.displayName !== "string" || skill.summary !== undefined && typeof skill.summary !== "string" || !/^loadout-[a-z0-9-]+-[0-9a-f]{8}$/.test(skill.commandName) || skill.installPath !== path.join(getCanonicalRoot(home, env), skill.commandName) || skill.linkPaths.some((linkPath) => !harnessRoots.has(path.dirname(linkPath)) || path.basename(linkPath) !== skill.commandName)) {
         throw new Error("Invalid favorite Skills ownership manifest");
       }
     }
@@ -6790,6 +6860,10 @@ async function readManifest(home, env) {
     throw error;
   }
 }
+async function getInstalledLoadoutFavoriteSkillsStateToken(home = getHome(), env = process.env) {
+  const manifest = await readManifest(home, env);
+  return getLoadoutFavoriteSkillsStateToken(manifest.skills);
+}
 async function writeManifest(home, manifest) {
   const manifestPath = getManifestPath(home);
   const temporaryPath = `${manifestPath}.${process.pid}.tmp`;
@@ -6865,7 +6939,7 @@ async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = p
       continue;
     }
     const allLinksExist = (await Promise.all(linkPaths.map(pathExists))).every(Boolean);
-    if (previous?.artifactVersionId === pkg.artifactVersionId && previous.installPath === installPath && previous.linkPaths.length === linkPaths.length && previous.linkPaths.every((linkPath) => linkPaths.includes(linkPath)) && await pathExists(installPath) && allLinksExist) {
+    if (previous?.artifactVersionId === pkg.artifactVersionId && previous.displayName === pkg.displayName && previous.summary === pkg.summary && previous.installPath === installPath && previous.linkPaths.length === linkPaths.length && previous.linkPaths.every((linkPath) => linkPaths.includes(linkPath)) && await pathExists(installPath) && allLinksExist) {
       result.unchanged.push(pkg.name);
       nextSkills.push(previous);
       continue;
@@ -6910,6 +6984,8 @@ async function reconcileLoadoutFavoriteSkills(payload, home = getHome(), env = p
     nextSkills.push({
       name: pkg.name,
       artifactVersionId: pkg.artifactVersionId,
+      displayName: pkg.displayName,
+      summary: pkg.summary,
       commandName: nextCommandName,
       installPath,
       linkPaths
@@ -6962,7 +7038,7 @@ async function genReconcileFavoriteSkills(resolved, result, dependencies) {
 }
 
 // src/localIntegrationMigration.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { readFile as readFile8 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { basename as basename2, join as join8 } from "node:path";
@@ -7364,7 +7440,7 @@ function withoutMatchText(candidate) {
   };
 }
 function buildCandidateId(candidate) {
-  return `local_${createHash4("sha256").update([candidate.localSource, candidate.localLabel, candidate.redactedLocator].join("\x00")).digest("hex").slice(0, 12)}`;
+  return `local_${createHash5("sha256").update([candidate.localSource, candidate.localLabel, candidate.redactedLocator].join("\x00")).digest("hex").slice(0, 12)}`;
 }
 function dedupeRawCandidates(candidates) {
   const byKey = new Map;
@@ -7569,6 +7645,16 @@ function buildCommandArgs(params) {
       continue;
     delete args[reserved];
   }
+  const unsupportedField = Object.keys(args).find((key) => !(key in props) && !(params.subcommand && key === "action"));
+  if (unsupportedField) {
+    const directField = unsupportedField.endsWith("File") ? unsupportedField.slice(0, -"File".length) : undefined;
+    return {
+      error: {
+        code: "invalid-input",
+        message: unsupportedField.includes("-") ? `Use camelCase input fields; --${unsupportedField} is not supported.` : `Unknown input field --${unsupportedField}.${directField && directField in props ? ` Pass --${directField} with the value directly.` : ""}`
+      }
+    };
+  }
   if (positionalJson?.args)
     remaining.pop();
   if (params.subcommand) {
@@ -7710,7 +7796,7 @@ import { homedir as homedir6 } from "node:os";
 import { basename as basename3, dirname as dirname4, isAbsolute as isAbsolute3, join as join9, relative as relative2, resolve as resolve2, sep } from "node:path";
 
 // src/loadoutSkillArtifact.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var MAX_LOADOUT_SKILL_ARTIFACT_BYTES = 512 * 1024;
 async function fetchLoadoutSkillArtifact(descriptorValue, expectedVersion, deps = {}) {
   const descriptor = LoadoutSkillArtifactDescriptorSchema.parse(descriptorValue);
@@ -7735,7 +7821,7 @@ async function fetchLoadoutSkillArtifact(descriptorValue, expectedVersion, deps
   if (bytes.byteLength !== descriptor.byteLength) {
     throw new Error(`Aident skill artifact size mismatch: expected ${descriptor.byteLength}, received ${bytes.byteLength}`);
   }
-  const artifactSha256 = createHash5("sha256").update(bytes).digest("hex");
+  const artifactSha256 = createHash6("sha256").update(bytes).digest("hex");
   if (artifactSha256 !== descriptor.sha256)
     throw new Error("Aident skill artifact SHA-256 mismatch");
   let parsed;
@@ -8874,6 +8960,14 @@ async function getLoadoutUpdateWarnings(params, injected = {}) {
       warnings.push(`Aident skill v${policy.skill.recommendedVersion} is recommended. Run \`${command}\` when you are ready.`);
     }
   }
+  if (metadata.favoriteSkills?.syncRequired && await claimNotice({
+    noticeId: "aident-favorite-skills-sync",
+    targetVersion: `0.0.0+favorites.${metadata.favoriteSkills.stateToken}`,
+    homeDir: params.homeDir,
+    intervalMs
+  })) {
+    warnings.push("Your local favorite Skills differ from your Aident favorites. After completing the current task, ask the user whether they want you to run `aident skills sync`.");
+  }
   if (cliNoticeShown || skillNoticeShown) {
     recordNotice(injected.recordNotice, cliNoticeShown && skillNoticeShown ? "cli_and_skill" /* CliAndSkill */ : cliNoticeShown ? "cli" /* Cli */ : "skill" /* Skill */);
   }
@@ -9001,6 +9095,13 @@ function getPreservedShadowBucket(count) {
   return "6+" /* SixOrMore */;
 }
 
+// ../web/shared/affiliate/AffiliateCode.ts
+var AFFILIATE_CODE_PATTERN = /^[A-Z0-9]{6,32}$/;
+function normalizeAffiliateCode(value) {
+  const normalized = value?.trim().toUpperCase();
+  return normalized && AFFILIATE_CODE_PATTERN.test(normalized) ? normalized : null;
+}
+
 // src/cli.ts
 var LOADOUT_CAPABILITIES_SEARCH_OPERATION = "loadout_capabilities_search";
 var LOADOUT_CAPABILITIES_EXECUTE_OPERATION = "loadout_capabilities_execute";
@@ -9469,7 +9570,12 @@ async function runSetup(parsed) {
     let credentials = await readCredentials();
     const hasEnvironmentToken = !!process.env.AIDENT_TOKEN?.trim();
     if ((!credentials || !credentialsForBaseUrl(credentials, options.baseUrl)) && !hasEnvironmentToken) {
-      credentials = await login({ baseUrl: options.baseUrl, format: parsed.format, oob: options.oob });
+      credentials = await login({
+        baseUrl: options.baseUrl,
+        format: parsed.format,
+        oob: options.oob,
+        ref: options.ref
+      });
       await writeCredentials(credentials);
     }
     const client = await getAuthenticatedClient(["loadout"]);
@@ -9515,7 +9621,7 @@ async function runSetup(parsed) {
 async function getSetupOptions(parsed) {
   if (parsed.positional.length !== 1)
     throw new Error("Usage: aident setup [flags]");
-  const allowedFlags = new Set(["base-url", "client-name", "oob"]);
+  const allowedFlags = new Set(["base-url", "client-name", "oob", "ref"]);
   const unknownFlag = Object.keys(parsed.flags).find((flag) => !allowedFlags.has(flag));
   if (unknownFlag)
     throw new Error(`Unknown setup flag: --${unknownFlag}`);
@@ -9523,10 +9629,15 @@ async function getSetupOptions(parsed) {
   const clientName = getOptionalStringFlag(parsed.flags, "client-name") ?? "Aident CLI";
   if (clientName.length > 160)
     throw new Error("--client-name must be at most 160 characters");
+  const rawRef = getOptionalStringFlag(parsed.flags, "ref");
+  const ref = normalizeAffiliateCode(rawRef) ?? undefined;
+  if (rawRef && !ref)
+    throw new Error("--ref must be a 6-32 character affiliate code");
   return {
     baseUrl: rawBaseUrl ? normalizeBaseUrl(rawBaseUrl) : await resolveDefaultBaseUrl(),
     clientName,
     oob: getBooleanUpdateFlag(parsed.flags, "oob"),
+    ref,
     persistBaseUrl: !!rawBaseUrl
   };
 }
@@ -9555,7 +9666,7 @@ function renderSetupHelp() {
     `${colors.bold}AIDENT SETUP${colors.reset}`,
     "",
     "USAGE:",
-    "  aident setup [--client-name <name>] [--base-url <url>] [--oob] [--json]",
+    "  aident setup [--client-name <name>] [--base-url <url>] [--ref <code>] [--oob] [--json]",
     "",
     "The setup command updates the CLI, installs or reconciles the verified Aident Skill globally, and opens sign-in when needed.",
     "It verifies Loadout access and records completion. AIDENT_TOKEN enables non-interactive authentication."
@@ -10247,7 +10358,10 @@ async function getRequestedPackages(parsed) {
 }
 async function getAuthenticatedClient(packages) {
   const activePackages = packages ?? await resolveDefaultPackages();
-  const skillInventory = await getLoadoutSkillInventory();
+  const [skillInventory, favoriteSkillsStateToken] = await Promise.all([
+    getLoadoutSkillInventory(),
+    getInstalledLoadoutFavoriteSkillsStateToken().catch(() => null)
+  ]);
   const installedSkillVersion = findInstalledLoadoutSkillVersionFromInventory(skillInventory);
   const envToken = process.env.AIDENT_TOKEN;
   const envBaseUrl = process.env.AIDENT_BASE_URL?.trim();
@@ -10257,7 +10371,7 @@ async function getAuthenticatedClient(packages) {
       base_url: normalizeBaseUrl(baseUrl2),
       client_id: "",
       access_token: envToken
-    }, "env", activePackages, installedSkillVersion, skillInventory);
+    }, "env", activePackages, installedSkillVersion, skillInventory, favoriteSkillsStateToken);
   }
   let creds = await readCredentials();
   if (!creds)
@@ -10276,7 +10390,7 @@ async function getAuthenticatedClient(packages) {
       creds = refreshed;
     }
   }
-  return new CliClient(creds, "stored", activePackages, installedSkillVersion, skillInventory);
+  return new CliClient(creds, "stored", activePackages, installedSkillVersion, skillInventory, favoriteSkillsStateToken);
 }
 var catalogCache = null;
 async function fetchCatalog(client, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aident-ai/cli",
-  "version": "0.1.8",
+  "version": "0.2.0-rc.0",
   "description": "Aident CLI — umbrella access to Loadout integrations, Playbook automation, Intern tools, and the Aident platform.",
   "homepage": "https://aident.ai",
   "repository": {