@catalyst-cloud/cli 0.16.33 → 0.16.34

package/dist/codex-env.js

@@ -0,0 +1,222 @@
+// codex-env.ts — `catalyst codex-env`: the OTEL_RESOURCE_ATTRIBUTES a Codex launch on this machine
+// carries, so every Codex token row names the coding-account slot it ran as and the machine it ran on
+// (CTC-6192 phase 2, CTC-6883). The slot comes from the local Codex login's `tokens.account_id`,
+// hashed and matched against the `loginSha256` the workspace's coding accounts carry (CTC-6848). The
+// account id, raw or hashed, never reaches the printed value: only the slot name does.
+// ⛔ `--print` and `--apply` never wait on the network. They answer from the cached map, and a
+// missing or stale map starts a detached `--refresh` that is never awaited.
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { hostname as osHostname } from "node:os";
+import { dirname, join } from "node:path";
+import { flagBool, flagString } from "./args.js";
+import { cliPath, codexAccountsCachePathFor, loadConfig, requireConfig } from "./config.js";
+import { detachSelf } from "./detach.js";
+import { CliError, UsageError } from "./errors.js";
+import { needsNewerCloud } from "./execution.js";
+import { apiClient } from "./transport.js";
+/** How long a fetched account map answers before a launch starts a background refresh. */
+export const CODEX_ACCOUNTS_TTL_SECONDS = 6 * 60 * 60;
+/** The runner's wire key (CTC-2786): never a bare `account`, which the collector reads as a workspace. */
+export const ACCOUNT_SLOT_ATTRIBUTE = "catalyst.account_slot";
+export const HOST_NAME_ATTRIBUTE = "host.name";
+/** A Codex login no cached coding account matches. Never a guess, never the account id. */
+export const UNREGISTERED_SLOT = "unregistered";
+/** No readable Codex login: the runner's `none:<reason>` convention. */
+export const NO_LOGIN_SLOT = "none:no-login";
+const LOGIN_HASH = /^[0-9a-f]{64}$/;
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+/** A command that could not start (no `launchctl` on PATH) has no status; it fails with its spawn error. */
+export const defaultRun = (cmd, args) => {
+    const r = spawnSync(cmd, args, { encoding: "utf8" });
+    return { status: r.status ?? 1, stderr: r.error ? r.error.message : r.stderr };
+};
+export function defaultCodexHome(ctx) {
+    const set = ctx.env.CODEX_HOME?.trim();
+    return set ? set : join(ctx.home, ".codex");
+}
+/** The local Codex login's account id: `tokens.account_id`, and no other field. A token is never read
+ *  out, logged or printed. A parse error's message can quote the file, so it is dropped unread. */
+export function readCodexAccountId(codexHome) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(codexHome, "auth.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+    const id = object(object(parsed)?.tokens)?.account_id;
+    return typeof id === "string" && id.length > 0 ? id : null;
+}
+/** The same hash the cloud stores (lowercase hex SHA-256 of the UTF-8 account id). */
+export function loginSha256(accountId) {
+    return createHash("sha256").update(accountId, "utf8").digest("hex");
+}
+export function resolveSlot(accountId, cache) {
+    if (accountId === null)
+        return NO_LOGIN_SLOT;
+    const hash = loginSha256(accountId);
+    return cache?.accounts.find((a) => a.loginSha256 === hash)?.accountSlot ?? UNREGISTERED_SLOT;
+}
+/** The runner's value rule (catalyst-cloud apps/runner/src/executors/harness-otel-env.ts:82-96): a
+ *  blank value is the literal `unknown`, and `,` and `=` are structure, so each becomes `_`. */
+export function attrValue(value) {
+    const trimmed = value.trim();
+    return (trimmed.length > 0 ? trimmed : "unknown").replace(/[,=]/g, "_");
+}
+/** `os.hostname()` up to its first `.`, as `hostname -s` prints it. */
+export function shortHostName(name) {
+    return name.split(".")[0];
+}
+/** Every pair already in `existing` is kept, in order and verbatim, except an earlier copy of a key
+ *  set here and any `account` key (CTC-2786), which this never passes on. The slot and the host name
+ *  are appended once each. */
+export function mergeResourceAttributes(existing, set) {
+    const ours = [
+        [ACCOUNT_SLOT_ATTRIBUTE, attrValue(set.slot)],
+        [HOST_NAME_ATTRIBUTE, attrValue(set.hostName)],
+    ];
+    const dropped = new Set([...ours.map(([key]) => key), "account"]);
+    const kept = (existing ?? "").split(",").filter((pair) => {
+        if (pair.trim() === "")
+            return false;
+        const eq = pair.indexOf("=");
+        return !dropped.has((eq === -1 ? pair : pair.slice(0, eq)).trim());
+    });
+    return [...kept, ...ours.map(([key, value]) => `${key}=${value}`)].join(",");
+}
+/** Only the slot and its login hash survive into the cache; every other account field is left out. */
+function codexAccounts(rows) {
+    return rows.flatMap((row) => {
+        const a = object(row);
+        return a && typeof a.accountSlot === "string" && typeof a.loginSha256 === "string" && LOGIN_HASH.test(a.loginSha256)
+            ? [{ accountSlot: a.accountSlot, loginSha256: a.loginSha256 }]
+            : [];
+    });
+}
+export function readCodexAccountsCache(home) {
+    try {
+        const parsed = object(JSON.parse(readFileSync(codexAccountsCachePathFor(home), "utf8")));
+        if (!parsed || typeof parsed.fetchedAt !== "string" || typeof parsed.workspace !== "string" || !Array.isArray(parsed.accounts))
+            return null;
+        return { fetchedAt: parsed.fetchedAt, workspace: parsed.workspace, accounts: codexAccounts(parsed.accounts) };
+    }
+    catch {
+        return null;
+    }
+}
+function writeCodexAccountsCache(home, cache) {
+    const path = codexAccountsCachePathFor(home);
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        const tmp = `${path}.tmp`;
+        writeFileSync(tmp, JSON.stringify(cache, null, 2) + "\n", { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        throw new CliError(`could not write ${path}: ${err instanceof Error ? err.message : String(err)}`, "codex-env-cache-write");
+    }
+    return path;
+}
+/** The workspace this machine is logged in to, or null. A broken config is the login verb's to report. */
+function configuredWorkspace(ctx) {
+    try {
+        return loadConfig(ctx.home)?.account ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function cacheState(ctx, cache) {
+    if (cache === null)
+        return "missing";
+    const fetchedMs = Date.parse(cache.fetchedAt);
+    if (!Number.isFinite(fetchedMs))
+        return "stale";
+    const ageSeconds = Math.max(0, Math.floor((ctx.now().getTime() - fetchedMs) / 1000));
+    return ageSeconds < CODEX_ACCOUNTS_TTL_SECONDS ? "fresh" : "stale";
+}
+/** Spawned detached and let go: the launch never waits for it, and a failed spawn is not a failed launch. */
+function startRefresh(ctx, deps) {
+    try {
+        (deps.detach ?? detachSelf)(deps.argv ?? [cliPath(), "codex-env", "--refresh"], ctx.env);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The value for one Codex home, from the cache only. Logged out, there is no map and no refresh. */
+export function codexLaunchEnv(ctx, codexHome, deps = {}) {
+    const workspace = configuredWorkspace(ctx);
+    const cached = workspace === null ? null : readCodexAccountsCache(ctx.home);
+    const cache = cached !== null && cached.workspace === workspace ? cached : null;
+    const state = cacheState(ctx, cache);
+    const refreshStarted = state !== "fresh" && workspace !== null && startRefresh(ctx, deps);
+    const slot = resolveSlot(readCodexAccountId(codexHome), cache);
+    const hostName = shortHostName((deps.hostname ?? osHostname)());
+    return {
+        value: mergeResourceAttributes(ctx.env.OTEL_RESOURCE_ATTRIBUTES, { slot, hostName }),
+        slot: attrValue(slot),
+        hostName: attrValue(hostName),
+        cache: state,
+        refreshStarted,
+    };
+}
+async function refreshCodexAccounts(args, ctx) {
+    const cfg = requireConfig(ctx);
+    const res = await apiClient(cfg, ctx).getJson("/api/v1/coding-accounts", {
+        accept: [404],
+    });
+    if (res.status === 404)
+        throw needsNewerCloud("codex-env --refresh", cfg);
+    const rows = Array.isArray(res.body) ? res.body : (res.body?.accounts ?? []);
+    const cache = { fetchedAt: ctx.now().toISOString(), workspace: cfg.account, accounts: codexAccounts(rows) };
+    const path = writeCodexAccountsCache(ctx.home, cache);
+    const n = cache.accounts.length;
+    if (args.json)
+        ctx.stdout(JSON.stringify({ path, fetchedAt: cache.fetchedAt, accounts: n }));
+    else
+        ctx.stdout(`Cached ${n} Codex coding account${n === 1 ? "" : "s"} for this workspace in ${path}. Launches read it for ${CODEX_ACCOUNTS_TTL_SECONDS / 3600} hours, then refresh it in the background.`);
+    return 0;
+}
+export async function cmdCodexEnv(args, ctx, deps = {}) {
+    const modes = ["print", "apply", "refresh"].filter((m) => flagBool(args, m));
+    if (modes.length !== 1)
+        throw new UsageError("codex-env needs exactly one of --print, --apply or --refresh");
+    const mode = modes[0];
+    const codexHome = flagString(args, "codex-home");
+    if (mode === "refresh") {
+        if (codexHome !== undefined)
+            throw new UsageError("--codex-home goes with --print; --refresh reads only the workspace");
+        return await refreshCodexAccounts(args, ctx);
+    }
+    if (mode === "apply") {
+        if (codexHome !== undefined)
+            throw new UsageError("--apply sets the environment for apps started from the Dock, which use the default Codex home; --codex-home goes with --print");
+        const platform = deps.platform ?? process.platform;
+        if (platform !== "darwin")
+            throw new CliError(`codex-env --apply sets the macOS login environment with launchctl, and this machine runs ${platform}. Export the output of catalyst codex-env --print instead.`, "codex-env-unsupported-platform");
+    }
+    const env = codexLaunchEnv(ctx, codexHome ?? defaultCodexHome(ctx), deps);
+    if (mode === "apply") {
+        const r = (deps.run ?? defaultRun)("launchctl", ["setenv", "OTEL_RESOURCE_ATTRIBUTES", env.value]);
+        if (r.status !== 0)
+            throw new CliError(`launchctl setenv failed (exit ${r.status}): ${r.stderr.trim()}`, "codex-env-launchctl");
+    }
+    if (args.json)
+        ctx.stdout(JSON.stringify({
+            OTEL_RESOURCE_ATTRIBUTES: env.value,
+            slot: env.slot,
+            hostName: env.hostName,
+            cache: env.cache,
+            refreshStarted: env.refreshStarted,
+            applied: mode === "apply",
+        }));
+    else if (mode === "print")
+        ctx.stdout(env.value);
+    else
+        ctx.stdout(`Apps started from now on carry OTEL_RESOURCE_ATTRIBUTES=${env.value}`);
+    return 0;
+}

package/dist/config.js

@@ -46,6 +46,10 @@ export function watchCursorPathFor(home) {
 export function discoveryCachePathFor(home) {
     return join(configDirFor(home), "auth-discovery.json");
 }
+/** CTC-6883 — the coding-account slots and Codex login hashes `codex-env` answers from (src/codex-env.ts). */
+export function codexAccountsCachePathFor(home) {
+    return join(configDirFor(home), "codex-accounts.json");
+}
 export function defaultReplicaDbFor(home) {
     return join(configDirFor(home), "replica.db");
 }

package/dist/runner-auto-update.js

@@ -19,11 +19,12 @@ function schedulerEnv() {
         ? { ...process.env, XDG_RUNTIME_DIR: runtime }
         : process.env;
 }
-const defaultRun = (cmd, args) => {
+/** Shared with the Codex attribution agent (codex-attribution.ts), which runs launchctl the same way. */
+export const defaultRun = (cmd, args) => {
     const r = spawnSync(cmd, args, { encoding: "utf8", timeout: 15_000, env: schedulerEnv() });
     return { status: r.status ?? 1, stdout: r.stdout ?? "", stderr: r.error ? r.error.message : (r.stderr ?? "") };
 };
-const xml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+export const xml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 /** systemd's own quoting for one ExecStart/Environment word. */
 const unitWord = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%")}"`;
 export function launchAgentPath(home) {
@@ -99,7 +100,8 @@ function ensureLingering(run, uid) {
     const linger = lingering(run, uid);
     return { linger, turnedOn: linger };
 }
-function writeFileAtomic(path, text) {
+/** Shared with the Codex attribution agent's plist (codex-attribution.ts). */
+export function writeFileAtomic(path, text) {
     mkdirSync(dirname(path), { recursive: true });
     const temp = `${path}.${process.pid}.tmp`;
     writeFileSync(temp, text, { mode: 0o644 });

package/dist/runner-update.js

@@ -1,7 +1,9 @@
 import { closeSync, existsSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { readManifest } from "./config.js";
 import { CliError } from "./errors.js";
 import { onboardStateRoot } from "./onboard.js";
+import { darwinThoughtsInstallRefusal } from "./onboard-runner-custody.js";
 import { dockerRunnerEngine, parseEnvText, persistedCustody, prepareRunnerImages, readEnvFile, runnerComposeArgs, spawnDocker, } from "./onboard-runner.js";
 // `catalyst runner update`: move this machine's self-hosted runner to the release Catalyst approved
 // (CTC-4646). The cloud names one approved runner, supervisor and watchdog by immutable digest with
@@ -225,12 +227,29 @@ async function running(engine, dir, images, signal) {
         return false;
     return engine.supervisorReadySinceStart(dir, signal);
 }
+const REPORT_DETAIL = /[^a-z0-9_:,.-]/g;
+/** The previous run's outcome as the release read reports it (CTC-6924), or undefined before the
+ *  first run. Only the fixed outcome vocabulary leaves the machine: anything outside the cloud's
+ *  detail characters becomes `_`, so an image reference cannot make the cloud drop the report. */
+export function updateReport(state, cliVersion) {
+    if (state.last === null)
+        return undefined;
+    return JSON.stringify({
+        v: 1,
+        outcome: state.last.outcome,
+        detail: state.last.detail.toLowerCase().replace(REPORT_DETAIL, "_").slice(0, 160),
+        applied: state.generation,
+        offered: state.last.generation,
+        atMs: state.last.atMs,
+        cli: /^\d{1,4}\.\d{1,4}\.\d{1,6}$/.test(cliVersion) ? cliVersion : null,
+    });
+}
 async function update(engine, options, now) {
     const { dir, signal } = options;
     const envPath = join(dir, ".env");
     const state = readReleaseState(dir);
     const done = (outcome, detail, extra = {}) => ({ outcome, detail, generation: state.generation, exitCode: 0, ...extra });
-    const read = await engine.desiredRelease(dir, signal);
+    const read = await engine.desiredRelease(dir, signal, options.check ? undefined : updateReport(state, readManifest().version));
     const decision = decideRelease(state.generation, read);
     if (decision.action === "retain")
         return decision.reason === "not_newer"
@@ -302,13 +321,22 @@ async function update(engine, options, now) {
     // Mac private thoughts storage records the supervisor image its helper runs. Every path that does
     // not end on the new release attests it back onto the images the machine keeps.
     const custodyInstalled = persistedCustody(dir, env) === "installed";
-    const restoreCustody = async (images) => !custodyInstalled || images === null || (await engine.custody(dir, images, signal)) === env.CATALYST_THOUGHTS_CUSTODY_AUTHORITY;
+    // Null when storage holds the installed authority on these images, else why not. Re-attestation
+    // keeps the installed authority; a different one would need setup, not an update.
+    const attestCustody = async (images) => {
+        const attested = await engine.custody(dir, images, signal);
+        if ("refused" in attested)
+            return attested.refused;
+        return attested.authority === env.CATALYST_THOUGHTS_CUSTODY_AUTHORITY ? null : "authority_changed";
+    };
+    const restoreCustody = async (images) => !custodyInstalled || images === null ? null : attestCustody(images);
     if (custodyInstalled) {
-        const authority = await engine.custody(dir, target, signal);
-        // Re-attestation keeps the installed authority. A different one would need setup, not an update.
-        if (authority === null || authority !== env.CATALYST_THOUGHTS_CUSTODY_AUTHORITY) {
-            const restored = await restoreCustody(rollbackImages ?? current);
-            return done(restored ? "retained" : "failed", restored ? "custody_reattest_failed" : "custody_restore_failed", { ...tagged, exitCode: restored ? 0 : 1 });
+        const refused = await attestCustody(target);
+        if (refused !== null) {
+            const restoreRefused = await restoreCustody(rollbackImages ?? current);
+            return restoreRefused === null
+                ? done("retained", `custody_reattest_failed:${refused}`, tagged)
+                : done("failed", `custody_restore_failed:${restoreRefused}`, { ...tagged, exitCode: 1 });
         }
     }
     // The boundary between phases: stop the supervisor so it admits nothing, then look again. A phase
@@ -344,9 +372,9 @@ async function update(engine, options, now) {
     if (rollbackText === null || rollbackImages === null)
         return done("failed", "new_supervisor_not_ready_no_previous", { ...tagged, exitCode: 1 });
     writePrivateAtomic(envPath, rollbackText);
-    const custodyBack = await restoreCustody(rollbackImages);
+    const custodyRefused = await restoreCustody(rollbackImages);
     const restored = (await engine.composeUp(dir, signal)) && (await waitReady(engine, dir, rollbackImages, options, now));
-    return done(restored && custodyBack ? "rolled_back" : "failed", !restored ? "rollback_not_ready" : custodyBack ? "new_supervisor_not_ready" : "custody_restore_failed", { ...tagged, exitCode: 1 });
+    return done(restored && custodyRefused === null ? "rolled_back" : "failed", !restored ? "rollback_not_ready" : custodyRefused === null ? "new_supervisor_not_ready" : `custody_restore_failed:${custodyRefused}`, { ...tagged, exitCode: 1 });
 }
 async function waitReady(engine, dir, images, options, now) {
     const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
@@ -419,10 +447,12 @@ export const DESIRED_RELEASE_SCRIPT = `(async () => {
   if (!state || state.version !== 1 || typeof state.secret !== "string" || !e ||
       typeof e.tenant !== "string" || typeof e.hostId !== "string" || !base) return out({ kind: "no_credential" });
   const tenant = Buffer.from(e.tenant, "utf8").toString("base64url");
+  const report = (process.env.CATALYST_UPDATE_REPORT || "").length <= 512 ? process.env.CATALYST_UPDATE_REPORT : "";
   try {
     const response = await fetch(new URL(${JSON.stringify(DESIRED_RELEASE_PATH)}, base).href, {
       redirect: "error", signal: AbortSignal.timeout(15000),
-      headers: { authorization: "Bearer ctc_host_" + tenant + "." + e.hostId + "." + state.secret, accept: "application/json" },
+      headers: { authorization: "Bearer ctc_host_" + tenant + "." + e.hostId + "." + state.secret, accept: "application/json",
+        ...(report ? { "x-catalyst-update-report": report } : {}) },
     });
     let body = null;
     try { body = await response.json(); } catch {}
@@ -447,11 +477,12 @@ export function dockerRunnerUpdateEngine(deps = {}) {
         }
     };
     return {
-        async desiredRelease(dir, signal) {
+        async desiredRelease(dir, signal, report) {
             const compose = runnerComposeArgs(dir);
             if (!compose)
                 return { kind: "no_credential" };
-            const read = await docker([...compose, "run", "--rm", "-T", "--no-deps", "--entrypoint", "bun", "supervisor", "-e", DESIRED_RELEASE_SCRIPT], { cwd: dir, signal, timeoutMs: 120_000 });
+            const reportEnv = report ? ["-e", `CATALYST_UPDATE_REPORT=${report}`] : [];
+            const read = await docker([...compose, "run", "--rm", "-T", "--no-deps", ...reportEnv, "--entrypoint", "bun", "supervisor", "-e", DESIRED_RELEASE_SCRIPT], { cwd: dir, signal, timeoutMs: 120_000 });
             if (read.code !== 0)
                 return { kind: "no_credential" };
             try {
@@ -484,13 +515,14 @@ export function dockerRunnerUpdateEngine(deps = {}) {
         },
         async custody(dir, images, signal) {
             if (!setup.nativeThoughtsCustody)
-                return null;
+                return { refused: "capability_missing" };
             try {
                 const result = await setup.nativeThoughtsCustody({ dir, supervisorImage: images.supervisor, runnerImage: images.runner }, signal);
-                return result.envAuthority;
+                return { authority: result.envAuthority };
             }
-            catch {
-                return null;
+            catch (error) {
+                // Only the installer's fixed reasons are recorded; other exception text can carry credentials.
+                return { refused: darwinThoughtsInstallRefusal(error) ?? "unclassified" };
             }
         },
         async services(dir, signal) {

package/dist/update-inventory.js

@@ -2,14 +2,15 @@
 // component is installed (with the version or image it runs), absent, or unknown with a reason;
 // unknown is never reported as current. Reading it starts no process, contacts no service, and a
 // machine with no runner installation never touches Docker.
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { exactVersion } from "./approved-release.js";
 import { loadConfig, packageRoot, readManifest, updatePackageName } from "./config.js";
 import { parseEnvText } from "./onboard-runner.js";
 import { replicaStatus, writerIsRunning } from "./replica.js";
 import { readReleaseState, RELEASE_COMPONENTS, RELEASE_ENV_KEYS, releaseReference, } from "./runner-update.js";
-import { installedBundleVersion, resolveSkillsDir, skillsSourceDir } from "./skills.js";
+import { resolveSkillsDir } from "./skills.js";
+import { inspectSkillInstallation } from "./update-skill-state.js";
 import { cloudPluginInventory } from "./update-plugin.js";
 export function imageInventory(dir) {
     const envPath = join(dir, ".env");
@@ -25,36 +26,20 @@ export function imageInventory(dir) {
     const references = Object.fromEntries(RELEASE_COMPONENTS.map((c) => [c, releaseReference(c, env[RELEASE_ENV_KEYS[c]])]));
     return { installed: true, dir, references, generation: readReleaseState(dir).generation };
 }
-function bundledSkillNames() {
-    try {
-        return readdirSync(skillsSourceDir(), { withFileTypes: true })
-            .filter((e) => e.isDirectory() && existsSync(join(skillsSourceDir(), e.name, "SKILL.md")))
-            .map((e) => e.name);
-    }
-    catch {
-        return [];
-    }
+function packInventory(ctx, cfg, pack) {
+    const dir = resolveSkillsDir({}, ctx, cfg);
+    const evidence = inspectSkillInstallation(ctx.home, ctx.env, pack, dir);
+    if (!evidence.present)
+        return { state: "not_installed", dir, evidence };
+    if (evidence.version !== null && evidence.candidate)
+        return { state: "installed", version: evidence.version, dir, evidence };
+    return { state: "unknown", reason: evidence.reason, dir, evidence };
 }
-/** The Cloud pack as installed in the agent skills directory, read from each skill's provenance line. */
 export function cloudPackInventory(ctx, cfg) {
-    const dir = resolveSkillsDir({}, ctx, cfg);
-    const found = installedBundleVersion(dir, bundledSkillNames());
-    if (found.version !== null) {
-        const version = exactVersion(found.version);
-        return version ? { state: "installed", version, dir } : { state: "unknown", reason: "version_unreadable", dir };
-    }
-    if (found.unstamped.length > 0)
-        return { state: "unknown", reason: "version_unstamped", dir };
-    return { state: "not_installed", dir };
+    return packInventory(ctx, cfg, "cloud");
 }
-/** The Dev pack ships from its own repository with no provenance stamp this CLI reads, so its
- *  presence is known (its `research-codebase` skill, as the onboarding guide checks) but its version
- *  is not. Unknown is never reported as current. */
 export function devPackInventory(ctx, cfg) {
-    const dir = resolveSkillsDir({}, ctx, cfg);
-    return existsSync(join(dir, "research-codebase", "SKILL.md"))
-        ? { state: "unknown", reason: "version_unrecorded", dir }
-        : { state: "not_installed", dir };
+    return packInventory(ctx, cfg, "dev");
 }
 export function replicaInventory(ctx, cfg) {
     if (!cfg)