@cargo-ai/cli 1.0.123 → 1.0.124

package/build/api.d.ts

@@ -10,5 +10,11 @@ export declare function createApi(opts: {
      */
     getAccessToken: AccessTokenProvider | undefined;
     workspaceUuid: string | undefined;
+    /**
+     * Names the command in `x-cargo-origin-command`, for the requests the
+     * backend cannot attribute from the route: a dry run reads the same public
+     * routes as any catalog lookup and creates no run.
+     */
+    command?: string;
 }): Api;
 //# sourceMappingURL=api.d.ts.map

package/build/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,GAAG,EAAY,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAIhF,YAAY,EAAE,GAAG,EAAE,CAAC;AAQpB,wBAAgB,SAAS,CAAC,IAAI,EAAE;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAChD,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC,GAAG,GAAG,CAeN"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,GAAG,EAAY,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,KAAK,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAIhF,YAAY,EAAE,GAAG,EAAE,CAAC;AAQpB,wBAAgB,SAAS,CAAC,IAAI,EAAE;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAChD,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,GAAG,CAeN"}

package/build/api.js

@@ -10,7 +10,7 @@ export function createApi(opts) {
         baseUrl: opts.baseUrl,
         workspaceUuid: opts.workspaceUuid,
         getAccessToken: opts.getAccessToken,
-        origin: ORIGIN,
+        origin: { ...ORIGIN, command: opts.command },
         // A saved session outlives the workspace list baked into its token, so a
         // workspace granted since signing in reads as a 401 until the token is
         // reissued. Renew and retry rather than telling the user to sign in again.

package/build/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiKzC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,GACrB,IAAI,CAyEN"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+KzC,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,GACrB,IAAI,CAgFN"}

package/build/commands/doctor.js

@@ -4,7 +4,7 @@ import { createApi } from "../api.js";
 import { getConfig } from "../config.js";
 import { getCredentialsPath } from "../credentials.js";
 import { collectSetupIssues, readSkillsPin } from "../setupIssues.js";
-import { fetchLatestVersion, isOutdated, UPDATE_COMMAND } from "../version.js";
+import { fetchLatestSkillsPin, fetchLatestVersion, isOutdated, UPDATE_COMMAND, } from "../version.js";
 import { colors, ExitCodes, outputJson } from "./runHandler.js";
 const LOGIN_COMMAND = "cargo-ai login --oauth";
 const STATUS_PAGE = "https://status.getcargo.io";
@@ -26,7 +26,7 @@ function buildCliCheck(currentVersion, latestVersion) {
         upToDate: true,
     };
 }
-function buildSkillsPinCheck(currentVersion) {
+function buildSkillsPinCheck(currentVersion, latestSkillsPin) {
     const pin = readSkillsPin();
     if (pin === undefined) {
         return { found: false };
@@ -39,17 +39,22 @@ function buildSkillsPinCheck(currentVersion) {
             matchesCli: true,
         };
     }
+    // Whichever side is behind is the side to update: an older CLI cannot run
+    // what the skills ask of it, and older skills describe commands this CLI
+    // has moved on from. Stale skills only get a fix once a newer bundle is
+    // published; before that, `skills add` reinstalls the same pin.
+    const cliBehind = isOutdated(currentVersion, pin.version);
+    const newerSkills = latestSkillsPin !== undefined && isOutdated(pin.version, latestSkillsPin);
     return {
         found: true,
         pinned: pin.version,
         path: pin.path,
         matchesCli: false,
-        // Whichever side is behind is the side to update: an older CLI cannot run
-        // what the skills ask of it, and older skills describe commands this CLI
-        // has moved on from.
-        fix: isOutdated(currentVersion, pin.version)
-            ? UPDATE_COMMAND
-            : "npx skills add getcargohq/cargo-skills",
+        ...(cliBehind === true
+            ? { fix: UPDATE_COMMAND }
+            : newerSkills === true
+                ? { fix: "npx skills add getcargohq/cargo-skills" }
+                : {}),
     };
 }
 async function checkApi(config) {
@@ -138,8 +143,15 @@ Examples:
         catch {
             latestVersion = undefined;
         }
+        let latestSkillsPin;
+        try {
+            latestSkillsPin = await fetchLatestSkillsPin();
+        }
+        catch {
+            latestSkillsPin = undefined;
+        }
         const cli = buildCliCheck(currentVersion, latestVersion);
-        const skillsPin = buildSkillsPinCheck(currentVersion);
+        const skillsPin = buildSkillsPinCheck(currentVersion, latestSkillsPin);
         const config = getConfig();
         const credentials = {
             source: config.source,
@@ -154,6 +166,7 @@ Examples:
         const offline = collectSetupIssues({
             currentVersion,
             latestVersion,
+            latestSkillsPin,
         });
         const apiIssue = describeApiIssue(api);
         const issues = apiIssue === undefined

package/build/commands/orchestration/action.d.ts

@@ -1,4 +1,6 @@
 import type { Command } from "commander";
 import type { Api } from "../../api.js";
-export declare function registerActionCommands(parent: Command, getApi: () => Api, getPublicApi: () => Api): void;
+export declare const ACTION_LIST_COMMAND = "orchestration.action.list";
+export declare const DRY_RUN_COMMAND = "orchestration.action.execute.dry-run";
+export declare function registerActionCommands(parent: Command, getApi: () => Api, getPublicApi: (command?: string) => Api): void;
 //# sourceMappingURL=action.d.ts.map

package/build/commands/orchestration/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/action.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAuBxC,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,EACjB,YAAY,EAAE,MAAM,GAAG,GACtB,IAAI,CA6UN"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/action.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AA0BxC,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAC/D,eAAO,MAAM,eAAe,yCAAyC,CAAC;AAEtE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,EACjB,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,GACtC,IAAI,CA6UN"}

package/build/commands/orchestration/action.js

@@ -4,6 +4,11 @@ import { parseBooleanOption } from "../../utils/booleanOption.js";
 import { describesOutput } from "../../utils/sampleFromSchema.js";
 import { applyRecordsLimit, ExitCodes, failWith, handleApiCall, info, outputJson, parseJson, parsePositiveInt, pollUntilFinished, } from "../runHandler.js";
 import { noteSignedOut, SIGNED_OUT_NOTICE } from "../signedOutNotice.js";
+// Sent as `x-cargo-origin-command` on the public reads these two make, so the
+// backend can count agents browsing the catalog and dry-running an action
+// before (or without) signing up. Neither leaves a run behind to count.
+export const ACTION_LIST_COMMAND = "orchestration.action.list";
+export const DRY_RUN_COMMAND = "orchestration.action.execute.dry-run";
 export function registerActionCommands(parent, getApi, getPublicApi) {
     const action = parent
         .command("action")
@@ -71,7 +76,7 @@ Examples:
             : parsePositiveInt(opts.limit, "--limit");
         const query = queryTerms.length === 0 ? undefined : queryTerms.join(" ");
         noteSignedOut();
-        const result = await handleApiCall(() => getPublicApi().orchestration.action.list({
+        const result = await handleApiCall(() => getPublicApi(ACTION_LIST_COMMAND).orchestration.action.list({
             query,
             kind,
             integrationSlug: opts.integrationSlug,
@@ -204,7 +209,7 @@ Examples:
  */
 async function dryRunAction(getPublicApi, actionPayload, data) {
     const target = dryRunTarget(actionPayload);
-    const api = getPublicApi();
+    const api = getPublicApi(DRY_RUN_COMMAND);
     const label = target.kind === "connector"
         ? `${target.integrationSlug}.${target.actionSlug}`
         : `native.${target.actionSlug}`;

package/build/commands/orchestration/index.d.ts

@@ -1,4 +1,4 @@
 import type { Command } from "commander";
 import type { Api } from "../../api.js";
-export declare function registerOrchestrationCommands(parent: Command, getApi: () => Api, getPublicApi: () => Api): void;
+export declare function registerOrchestrationCommands(parent: Command, getApi: () => Api, getPublicApi: (command?: string) => Api): void;
 //# sourceMappingURL=index.d.ts.map

package/build/commands/orchestration/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAexC,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,EACjB,YAAY,EAAE,MAAM,GAAG,GACtB,IAAI,CA0BN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/orchestration/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAexC,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,GAAG,EACjB,YAAY,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,GACtC,IAAI,CA0BN"}

package/build/index.js

@@ -34,7 +34,7 @@ import { registerWorkspaceManagementCommands } from "./commands/workspaceManagem
 import { getConfig } from "./config.js";
 import { buildPaletteLayout } from "./paletteLayout.js";
 import { collectSetupIssues, isSignedIn } from "./setupIssues.js";
-import { cachedLatestVersion, maybeRefreshUpdateCache, } from "./updateNotifier.js";
+import { cachedLatestSkillsPin, cachedLatestVersion, maybeRefreshUpdateCache, } from "./updateNotifier.js";
 const require = createRequire(import.meta.url);
 const { version } = require("../package.json");
 const program = new Command();
@@ -127,6 +127,7 @@ program.hook("preAction", (_program, action) => {
     printSetupIssues(collectSetupIssues({
         currentVersion: version,
         latestVersion: cachedLatestVersion(),
+        latestSkillsPin: cachedLatestSkillsPin(),
     }));
 });
 /** The top-level group a subcommand belongs to (`connection`, not `list`). */
@@ -150,9 +151,9 @@ const getApi = () => {
 // up. Signed in, it still sends the token, which
 // is what keeps a workspace's own custom integrations in what it returns.
 // Every other command keeps `getApi`, which refuses to run without a token.
-const getPublicApi = () => {
+const getPublicApi = (command) => {
     const { baseUrl, getAccessToken, workspaceUuid } = getConfig();
-    return createApi({ baseUrl, getAccessToken, workspaceUuid });
+    return createApi({ baseUrl, getAccessToken, workspaceUuid, command });
 };
 // Where the palette finds answers for an option that wants an id. Keyed by the
 // flag, because `--model-uuid` asks the same question in all 28 places it
@@ -297,7 +298,13 @@ async function openPalette(startPath) {
     // Probed once: this shells out to `which` per candidate agent, and nobody
     // installs a coding agent from inside the palette.
     const agents = availableCodingAgents();
-    const collectIssues = () => collectSetupIssues({ currentVersion: version, latestVersion });
+    // Read after the refresh above, which fetches the skills pin alongside.
+    const latestSkillsPin = cachedLatestSkillsPin();
+    const collectIssues = () => collectSetupIssues({
+        currentVersion: version,
+        latestVersion,
+        latestSkillsPin,
+    });
     // Re-read after each command: signing in or out from inside the palette
     // changes both what the setup line says and which rows are worth pinning.
     // The cwd is re-tested too — a command can create a project in it.

package/build/setupIssues.d.ts

@@ -11,6 +11,14 @@ export type SetupIssueInput = {
      * palette and the pre-command header pass the cache; `doctor` fetches live.
      */
     latestVersion?: string;
+    /**
+     * The pin of the latest published skills bundle, from the same cache (or a
+     * live fetch in `doctor`). Skills that are older than this CLI are only
+     * worth reporting when it is newer than the installed pin: the bundle is
+     * released after the CLI, so until it is, `skills add` installs the same
+     * stale pin and the warning has nothing to offer.
+     */
+    latestSkillsPin?: string;
 };
 /**
  * The two facts this reads off the machine. Injected so the rules — which side

package/build/setupIssues.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setupIssues.d.ts","sourceRoot":"","sources":["../src/setupIssues.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,UAAU,EACV,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAM3B,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAErC,MAAM,MAAM,eAAe,GAAG;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,aAAa,EAAE,MAAM,SAAS,GAAG,SAAS,CAAC;CAC5C,CAAC;AAIF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,GAAE,cAA4B,GACjC,UAAU,EAAE,CAyCd"}
+{"version":3,"file":"setupIssues.d.ts","sourceRoot":"","sources":["../src/setupIssues.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,UAAU,EACV,aAAa,EAEd,MAAM,mBAAmB,CAAC;AAM3B,YAAY,EAAE,SAAS,EAAE,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;AAErC,MAAM,MAAM,eAAe,GAAG;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,OAAO,CAAC;IAC1B,aAAa,EAAE,MAAM,SAAS,GAAG,SAAS,CAAC;CAC5C,CAAC;AAIF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,eAAe,EACtB,IAAI,GAAE,cAA4B,GACjC,UAAU,EAAE,CAgDd"}

package/build/setupIssues.js

@@ -32,13 +32,19 @@ export function collectSetupIssues(input, deps = machineDeps) {
         // The pin records the CLI the installed skills were written against. Which
         // side is behind decides the fix: an older CLI cannot run what the skills
         // ask of it, and older skills describe commands this CLI has moved on from.
-        issues.push({
-            key: "skills-pin-mismatch",
-            label: `skills expect CLI ${pin.version}`,
-            fix: isOutdated(input.currentVersion, pin.version) === true
-                ? UPDATE_COMMAND
-                : SKILLS_INSTALL_COMMAND,
-        });
+        // Stale skills are only reported once a newer bundle is published: every
+        // CLI release ships before its skills, and a fix that reinstalls the same
+        // pin is a warning nobody can clear.
+        const cliBehind = isOutdated(input.currentVersion, pin.version) === true;
+        const newerSkills = input.latestSkillsPin !== undefined &&
+            isOutdated(pin.version, input.latestSkillsPin) === true;
+        if (cliBehind === true || newerSkills === true) {
+            issues.push({
+                key: "skills-pin-mismatch",
+                label: `skills expect CLI ${pin.version}`,
+                fix: cliBehind === true ? UPDATE_COMMAND : SKILLS_INSTALL_COMMAND,
+            });
+        }
     }
     return issues;
 }

package/build/updateNotifier.d.ts

@@ -4,6 +4,12 @@
  * then simply omits the outdated-CLI issue rather than guessing.
  */
 export declare function cachedLatestVersion(): string | undefined;
+/**
+ * Pin of the latest published skills bundle, from the same cache. No network.
+ * Undefined when it was never fetched: the header then cannot tell whether
+ * stale skills have anything to update to, and says nothing.
+ */
+export declare function cachedLatestSkillsPin(): string | undefined;
 /**
  * Refresh the registry cache at most once per 24h. Returns the latest version
  * we now know about, so a caller that is about to render setup issues (the

package/build/updateNotifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"updateNotifier.d.ts","sourceRoot":"","sources":["../src/updateNotifier.ts"],"names":[],"mappings":"AAgBA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAYxD;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwB3E"}
+{"version":3,"file":"updateNotifier.d.ts","sourceRoot":"","sources":["../src/updateNotifier.ts"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAYxD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAY1D;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAwC3E"}

package/build/updateNotifier.js

@@ -1,4 +1,4 @@
-import { fetchLatestVersion, readUpdateCache, writeUpdateCache, } from "./version.js";
+import { fetchLatestSkillsPin, fetchLatestVersion, readUpdateCache, writeUpdateCache, } from "./version.js";
 const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // once per day
 const NOTIFY_FETCH_TIMEOUT_MS = 1500;
 const isDisabled = () => {
@@ -20,6 +20,21 @@ export function cachedLatestVersion() {
     }
     return cache.latestVersion;
 }
+/**
+ * Pin of the latest published skills bundle, from the same cache. No network.
+ * Undefined when it was never fetched: the header then cannot tell whether
+ * stale skills have anything to update to, and says nothing.
+ */
+export function cachedLatestSkillsPin() {
+    if (isDisabled() === true) {
+        return undefined;
+    }
+    const cache = readUpdateCache();
+    if (cache === undefined) {
+        return undefined;
+    }
+    return cache.latestSkillsPin;
+}
 /**
  * Refresh the registry cache at most once per 24h. Returns the latest version
  * we now know about, so a caller that is about to render setup issues (the
@@ -41,8 +56,23 @@ export async function maybeRefreshUpdateCache() {
         let cache = readUpdateCache();
         const now = Date.now();
         if (cache === undefined || now - cache.lastCheck > CHECK_INTERVAL_MS) {
-            const latestVersion = await fetchLatestVersion(NOTIFY_FETCH_TIMEOUT_MS);
-            cache = { lastCheck: now, latestVersion };
+            // The skills pin is a nicety: its failure must not lose the CLI version,
+            // nor the pin an earlier check already knew, since the next try is a day
+            // away.
+            const [latestVersion, fetchedSkillsPin] = await Promise.all([
+                fetchLatestVersion(NOTIFY_FETCH_TIMEOUT_MS),
+                fetchLatestSkillsPin(NOTIFY_FETCH_TIMEOUT_MS).catch(() => undefined),
+            ]);
+            const latestSkillsPin = fetchedSkillsPin !== undefined
+                ? fetchedSkillsPin
+                : cache !== undefined
+                    ? cache.latestSkillsPin
+                    : undefined;
+            cache = {
+                lastCheck: now,
+                latestVersion,
+                ...(latestSkillsPin !== undefined ? { latestSkillsPin } : {}),
+            };
             writeUpdateCache(cache);
         }
         return cache.latestVersion;

package/build/version.d.ts

@@ -4,6 +4,11 @@ export type UpdateCache = {
     lastCheck: number;
     /** Latest version reported by the npm registry at that time. */
     latestVersion: string;
+    /**
+     * The pin of the latest published skills bundle at that time. Absent in
+     * caches written before it existed, and when that fetch failed.
+     */
+    latestSkillsPin?: string;
 };
 /**
  * Fetch the latest published version of the CLI from the npm registry.
@@ -11,6 +16,11 @@ export type UpdateCache = {
  * decide whether to surface or swallow the failure.
  */
 export declare function fetchLatestVersion(timeoutMs?: number): Promise<string>;
+/**
+ * Fetch the CLI version the latest published skills bundle is pinned to.
+ * Throws on network error, timeout, or a body that is not a version.
+ */
+export declare function fetchLatestSkillsPin(timeoutMs?: number): Promise<string>;
 /**
  * Compare two semver-ish strings. Returns 1 if `a > b`, -1 if `a < b`, 0 if
  * equal. Only the major.minor.patch core is compared numerically; a version

package/build/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,cAAc,wCAAwC,CAAC;AAEpE,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,GAAE,MAAiC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAsBzD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAOzD"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,cAAc,wCAAwC,CAAC;AAEpE,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,GAAE,MAAiC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,GAAE,MAAiC,GAC3C,OAAO,CAAC,MAAM,CAAC,CAgBjB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B1D;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnE;AAED,wBAAgB,eAAe,IAAI,WAAW,GAAG,SAAS,CAyBzD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAOzD"}

package/build/version.js

@@ -2,6 +2,9 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "./credentials.js";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org/@cargo-ai/cli/latest";
+// The CLI version the latest published skills bundle was written against: the
+// same file `skills add` installs as the local pin.
+const SKILLS_PIN_URL = "https://raw.githubusercontent.com/getcargohq/cargo-skills/main/cargo/cli-version";
 const DEFAULT_FETCH_TIMEOUT_MS = 1500;
 const UPDATE_CACHE_FILE = join(getConfigDir(), "update-check.json");
 export const UPDATE_COMMAND = "npm install -g @cargo-ai/cli@latest";
@@ -24,6 +27,23 @@ export async function fetchLatestVersion(timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
     }
     return body.version;
 }
+/**
+ * Fetch the CLI version the latest published skills bundle is pinned to.
+ * Throws on network error, timeout, or a body that is not a version.
+ */
+export async function fetchLatestSkillsPin(timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+    const response = await fetch(SKILLS_PIN_URL, {
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (response.ok === false) {
+        throw new Error(`skills pin fetch returned HTTP ${response.status}`);
+    }
+    const pin = (await response.text()).trim();
+    if (/^\d+\.\d+\.\d+/.test(pin) === false) {
+        throw new Error("skills pin response is not a version");
+    }
+    return pin;
+}
 /**
  * Compare two semver-ish strings. Returns 1 if `a > b`, -1 if `a < b`, 0 if
  * equal. Only the major.minor.patch core is compared numerically; a version
@@ -72,6 +92,9 @@ export function readUpdateCache() {
             return {
                 lastCheck: parsed.lastCheck,
                 latestVersion: parsed.latestVersion,
+                ...(typeof parsed.latestSkillsPin === "string"
+                    ? { latestSkillsPin: parsed.latestSkillsPin }
+                    : {}),
             };
         }
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cargo-ai/cli",
-  "version": "1.0.123",
+  "version": "1.0.124",
   "mcpName": "io.github.getcargohq/cargo",
   "private": false,
   "license": "UNLICENSED",
@@ -72,7 +72,7 @@
     "format:check": "prettier --check ."
   },
   "dependencies": {
-    "@ai-sdk/harness": "^1.0.144",
+    "@ai-sdk/harness": "1.0.144",
     "@ai-sdk/harness-claude-code": "1.0.148",
     "@cargo-ai/api": "^1.0.101",
     "@cargo-ai/app-sdk": "^1.0.11",
@@ -86,7 +86,7 @@
     "commander": "^12.1.0",
     "jsonschema": "^1.4.1",
     "tsx": "^4.19.2",
-    "undici": "^7.29.1",
+    "undici": "^7.30.1",
     "uuid": "^14.0.0"
   },
   "devDependencies": {