@catalyst-cloud/cli 0.16.35 → 0.16.36

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.16.36
+
+`catalyst setup --only codex-attribution` turns on Codex attribution on a machine that is already set up, without running the other setup steps. It adds the codex function to `~/.zshrc` and `~/.bashrc`, and on a Mac the login agent. Before it first changes an rc file, it keeps a byte-for-byte copy beside it, ending in `.before-codex-attribution`, and never overwrites an earlier copy. Running it again changes nothing. `--dry-run` shows exactly what it would add and changes nothing, and `--json` prints the result as one document.
+
+A scheduled `catalyst runner update` now sends the report of its previous run, as 0.16.34 described. Before, the report was dropped on the scheduled run, so nothing reached Catalyst. An applying `catalyst update` sends it too. `--check` still sends nothing.
+
 ## 0.16.35
 
 On a self-hosted machine set up before 0.16.33, the runner update agent kept running the CLI it was installed with, and that CLI could not update itself. The daily job installed newer versions into its own folder, but the agent never ran them. Installing this release globally (`npm install -g @catalyst-cloud/cli`) now points that agent at the newly installed copy. It only ever moves the agent to a newer catalyst, and keeps the agent's runner folder and PATH. It saves the previous agent file beside it, as `<file>.before-0.16.35`, so you can roll back. On a Mac it waits for an update already in progress to finish. An agent file you cannot change is left alone. Each outcome is written to the runner's `update.log`, and a failed attempt puts the agent back exactly as it was. The install itself never fails because of this. To turn it off, set `CATALYST_NO_AGENT_REPOINT=1`.

package/README.md

@@ -144,7 +144,7 @@ When Codex is on this computer (a `codex` command on your PATH, or `Codex.app` i
 
 On a Mac, setup also installs the `dev.catalystcloud.codex-attribution` LaunchAgent. It runs `catalyst codex-env --apply` when you log in, and again whenever Codex signs in to another account in its default home, so apps you start from the Dock or Finder, the Codex desktop app included, carry the same attributes. An app that is already open keeps the environment it started with. It picks up a change the next time it starts. On Linux, setup adds the shell function only. Without Codex, setup adds nothing and says it skipped this. Run `catalyst setup` again after you install Codex to add it.
 
-`catalyst status` ends with one line that says whether this is installed, which coding account the Codex home resolves to, and how old the cached account list is. `catalyst setup --no-shell-hook` skips all of it. `catalyst setup --remove-codex-attribution` removes it and runs nothing else. Each file goes back to exactly what it was before the block was added, the LaunchAgent is unloaded and deleted, and the two attributes it set (the coding account and the machine name) are taken back out of the launch environment. Attributes you set there yourself are kept. A fake HOME gets none of this.
+`catalyst status` ends with one line that says whether this is installed, which coding account the Codex home resolves to, and how old the cached account list is. `catalyst setup --no-shell-hook` skips all of it. On a machine that is already set up, `catalyst setup --only codex-attribution` adds just this and runs no other step. Before it first changes `~/.zshrc` or `~/.bashrc`, it keeps a copy of the file beside it, ending in `.before-codex-attribution`. Run again, it reports each file as unchanged. With `--dry-run` it prints the exact block each file would get and the LaunchAgent file, and changes nothing. `catalyst setup --remove-codex-attribution` removes it and runs nothing else. Each file goes back to exactly what it was before the block was added, the LaunchAgent is unloaded and deleted, and the two attributes it set (the coding account and the machine name) are taken back out of the launch environment. Attributes you set there yourself are kept. A fake HOME gets none of this.
 
 ### Headless setup (CI, image builds, agent VMs)
 

package/dist/args.js

@@ -103,7 +103,7 @@ export const FLAG_TABLES = {
             value: true,
             help: "resume at a verified onboarding step",
         },
-        only: { value: true, help: "run only the named onboarding step" },
+        only: { value: true, help: "run only the named onboarding step; codex-attribution adds only the Codex launch hooks, with no other step" },
         yes: { value: false, help: "accept the plan's default choices" },
         "dry-run": {
             value: false,
@@ -607,7 +607,7 @@ export const VERB_USAGE = {
     update: "update [--check] [--project <absolute path>] [--dir <runner directory>] | update sdk --project <absolute path> | update policy [<component> on|off] | update policy sdk on|off --project <absolute path> | update policy windows <HH:MM,...>|default [--time-zone <zone>] [--json]   (components: runner, supervisor, watchdog, cli, skills-cloud, skills-dev, replica)",
     setup: "setup [onboard options]   (sets up Catalyst step by step; same as catalyst onboard) | setup --engine <file> --engine-sha256 <hex> [-- <install options>]   (run by install.sh; install.sh --help lists the options)",
     login: "login [--base-url <url>] [--start-replica]   (keyless; or --key <personal-key> / CATALYST_CLOUD_TOKEN)",
-    onboard: "onboard [--team <ID|key>] [--repo <owner/name>]... [--coding-account <slot>] [--resume-from <step>] [--only <step>] [--local-sync] [--remove-local-data] [--runner|--no-runner] [--no-shell-hook] [--no-color] [--yes] [--dry-run] [--json] | onboard --remove-codex-attribution [--json] | onboard --headless [--key-file <path>] [--team ...] [--repo ...]... [--coding-account ...] [--runner yes|no] [--remove-local-data] [--json]",
+    onboard: "onboard [--team <ID|key>] [--repo <owner/name>]... [--coding-account <slot>] [--resume-from <step>] [--only <step>] [--local-sync] [--remove-local-data] [--runner|--no-runner] [--no-shell-hook] [--no-color] [--yes] [--dry-run] [--json] | onboard --only codex-attribution [--dry-run] [--json] | onboard --remove-codex-attribution [--json] | onboard --headless [--key-file <path>] [--team ...] [--repo ...]... [--coding-account ...] [--runner yes|no] [--remove-local-data] [--json]",
     install: "install [--skills-dir <dir>] [--force]",
     status: "status",
     notice: "notice",

package/dist/cli.js

@@ -51,7 +51,7 @@ import { cmdRepo } from "./repo.js";
 import { cmdLease, cmdWork } from "./lease.js";
 import { cmdLegacy } from "./legacy.js";
 import { cmdCodexEnv } from "./codex-env.js";
-import { codexAttributionAfterSetup, codexAttributionStatusLine, removeCodexAttribution, } from "./codex-attribution.js";
+import { codexAttributionAfterSetup, codexAttributionStatusLine, onlyCodexAttribution, removeCodexAttribution, } from "./codex-attribution.js";
 import { cmdIdentity } from "./identity.js";
 import { cmdMessages } from "./messages.js";
 import { cmdConnections } from "./connections.js";
@@ -88,6 +88,7 @@ export function usageText() {
         "  catalyst join ...   (deprecated alias of login; removed in the next minor version)",
         "  catalyst install [--skills-dir <dir>] [--force]   (repair path; your agent's own command installs the skills)",
         "  catalyst onboard [--resume-from <step>] [--only <step>] [--runner|--no-runner] [--no-shell-hook] [--yes] [--dry-run] [--json]",
+        "  catalyst setup --only codex-attribution [--dry-run] [--json]   (add only the Codex launch hook and login agent, keeping a copy of each rc file it changes)",
         "  catalyst setup --remove-codex-attribution   (take out the Codex launch hook and login agent setup added)",
         `  catalyst ${SETUP_USAGE}`,
         "  catalyst status | notice | me | ready | accounts",
@@ -307,6 +308,19 @@ export async function main(argv, ctx = defaultCtx(), deps = {}) {
                             ctx.stdout(line);
                     return removal.ok ? 0 : 1;
                 }
+                // CTC-6993: the Codex launch hooks alone, on an install that is already set up.
+                if (args.flags.only === "codex-attribution") {
+                    if (args.flags["no-shell-hook"] === true)
+                        throw new UsageError("--only codex-attribution adds the Codex launch hooks; --no-shell-hook says not to");
+                    deps.setupUi?.dispose();
+                    const only = onlyCodexAttribution(ctx, deps.codexAttribution, { dryRun: args.flags["dry-run"] === true });
+                    if (args.json)
+                        ctx.stdout(JSON.stringify({ ok: only.ok, dryRun: only.dryRun, files: only.files, backups: only.backups, agent: only.agent }));
+                    else
+                        for (const line of only.lines)
+                            ctx.stdout(line);
+                    return only.ok ? 0 : 1;
+                }
                 // Headless runs drop the terminal UI, browser sign-in and every browser action (CTC-4633).
                 const runOnboard = async (args, ctx, headless) => {
                     let ui = headless ? undefined : deps.setupUi;

package/dist/codex-attribution.js

@@ -223,44 +223,48 @@ function rcTarget(path, home) {
     return { kind: "file", target, mode: stat.mode & 0o7777 };
 }
 const message = (err) => err instanceof Error ? err.message : String(err);
-/** One file: add the block, replace it in place (a second copy is dropped), or leave the file alone.
- *  Null when the file does not exist and setup has no reason to create it. */
-export function installShellHook(file, home, ops = defaultFileOps) {
+export function planShellHook(file, home) {
     const where = rcTarget(file.path, home);
     if (where.kind === "skip")
-        return { path: file.path, state: "skipped", why: where.why };
+        return { outcome: { path: file.path, state: "skipped", why: where.why } };
     if (where.kind === "missing") {
         if (!file.wanted)
             return null;
-        writeRcAtomic(file.path, codexBlock({ created: true }), 0o644, ops);
-        return { path: file.path, state: "added" };
+        const block = codexBlock({ created: true });
+        return {
+            outcome: { path: file.path, state: "added" },
+            write: { target: file.path, data: Buffer.from(block, "latin1"), mode: 0o644, block, existed: false },
+        };
     }
     const before = readFileSync(where.target, "latin1");
     const blocks = findBlocks(before);
     if (blocks === "malformed")
         return {
-            path: file.path,
-            state: "skipped",
-            why: `it has a "${BLOCK_BEGIN}" or "${BLOCK_END}" line without its partner; fix or delete that line, then run catalyst setup again`,
+            outcome: {
+                path: file.path,
+                state: "skipped",
+                why: `it has a "${BLOCK_BEGIN}" or "${BLOCK_END}" line without its partner; fix or delete that line, then run catalyst setup again`,
+            },
         };
     if (definesCodex(outsideBlocks(before, blocks)))
         return {
-            path: file.path,
-            state: "skipped",
-            why: "it already defines codex itself, as a function or an alias. To use the hook, remove that definition and run catalyst setup again",
+            outcome: {
+                path: file.path,
+                state: "skipped",
+                why: "it already defines codex itself, as a function or an alias. To use the hook, remove that definition and run catalyst setup again",
+            },
         };
     let after;
+    let block;
     const first = blocks[0];
     if (first === undefined) {
-        after =
-            before === "" || before.endsWith("\n")
-                ? before + codexBlock()
-                : `${before}\n${codexBlock({ newlineAdded: true })}`;
+        const appended = before === "" || before.endsWith("\n");
+        block = codexBlock(appended ? {} : { newlineAdded: true });
+        after = appended ? before + block : `${before}\n${block}`;
     }
     else {
-        after =
-            before.slice(0, first.start) +
-                codexBlock({ created: first.created, newlineAdded: first.newlineAdded });
+        block = codexBlock({ created: first.created, newlineAdded: first.newlineAdded });
+        after = before.slice(0, first.start) + block;
         let cursor = first.end;
         for (const b of blocks.slice(1)) {
             after += before.slice(cursor, b.start);
@@ -269,9 +273,21 @@ export function installShellHook(file, home, ops = defaultFileOps) {
         after += before.slice(cursor);
     }
     if (after === before)
-        return { path: file.path, state: "unchanged" };
-    writeRcAtomic(where.target, Buffer.from(after, "latin1"), where.mode, ops);
-    return { path: file.path, state: first === undefined ? "added" : "replaced" };
+        return { outcome: { path: file.path, state: "unchanged" } };
+    return {
+        outcome: { path: file.path, state: first === undefined ? "added" : "replaced" },
+        write: { target: where.target, data: Buffer.from(after, "latin1"), mode: where.mode, block, existed: true },
+    };
+}
+/** One file: add the block, replace it in place (a second copy is dropped), or leave the file alone.
+ *  Null when the file does not exist and setup has no reason to create it. */
+export function installShellHook(file, home, ops = defaultFileOps) {
+    const plan = planShellHook(file, home);
+    if (plan === null)
+        return null;
+    if (plan.write)
+        writeRcAtomic(plan.write.target, plan.write.data, plan.write.mode, ops);
+    return plan.outcome;
 }
 /** One file: take every block out. Null when the file has none. */
 export function removeShellHook(path, home, ops = defaultFileOps) {
@@ -623,8 +639,128 @@ export function setupCodexAttribution(ctx, deps = {}) {
         lines.push(`Setup could not load the ${CODEX_ATTRIBUTION_LABEL} LaunchAgent (${agent.detail}), so apps started from the Dock do not name their coding account. Run catalyst setup again in Terminal on this Mac's desktop.`);
     return lines;
 }
+/** The copy `--only codex-attribution` keeps of an rc file before it first changes it. */
+export const RC_BACKUP_SUFFIX = ".before-codex-attribution";
+/** `catalyst setup --only codex-attribution`: the hooks setup adds after a full run, and nothing else.
+ *  Before it first changes an existing rc file it keeps a byte-for-byte copy beside it, and an earlier
+ *  copy is never overwritten, so the copy is what the file was before any hook. `dryRun` writes
+ *  nothing and prints the exact block each file would get and the exact agent file. */
+export function onlyCodexAttribution(ctx, deps = {}, options = {}) {
+    const dryRun = options.dryRun === true;
+    const result = {
+        ok: true,
+        dryRun,
+        files: [],
+        backups: [],
+        agent: { state: "other_home" },
+        lines: [],
+    };
+    if (!ownsHome(ctx.home, deps)) {
+        result.ok = false;
+        result.lines.push(`HOME (${ctx.home}) is not this account's home folder, so the Codex launch hooks were left alone. Run it as the account that uses Codex.`);
+        return result;
+    }
+    if (codexPresence(ctx, deps) === null) {
+        result.agent = { state: "codex_absent" };
+        result.lines.push(CODEX_ABSENT_LINE);
+        return result;
+    }
+    const ops = fileOps(deps);
+    const verb = { added: "add", replaced: "replace" };
+    for (const file of shellRcFiles(ctx)) {
+        let plan;
+        try {
+            plan = planShellHook(file, ctx.home);
+        }
+        catch (err) {
+            plan = { outcome: { path: file.path, state: "skipped", why: `it could not be read (${message(err)})` } };
+        }
+        if (plan === null)
+            continue;
+        const name = tilde(file.path, ctx.home);
+        const write = plan.write;
+        if (write === undefined) {
+            result.files.push(plan.outcome);
+            if (plan.outcome.state === "unchanged")
+                result.lines.push(`${name} already has the Codex launch hook (unchanged).`);
+            else if (plan.outcome.state === "skipped")
+                result.lines.push(`Left ${name} without the Codex launch hook: ${plan.outcome.why}.`);
+            continue;
+        }
+        const state = plan.outcome.state === "replaced" ? "replaced" : "added";
+        const backup = `${write.target}${RC_BACKUP_SUFFIX}`;
+        if (dryRun) {
+            result.files.push(plan.outcome);
+            result.lines.push(write.existed
+                ? `Would ${verb[state]} this block in ${name}, after keeping a copy of the file as ${tilde(backup, ctx.home)}${existsSync(backup) ? " (an earlier copy is already there and would be kept)" : ""}:`
+                : `Would create ${name} with this block:`, ...write.block.replace(/\n$/, "").split("\n"));
+            continue;
+        }
+        try {
+            if (write.existed) {
+                if (existsSync(backup))
+                    result.backups.push({ path: write.target, backup, kept: "earlier" });
+                else {
+                    writeRcAtomic(backup, readFileSync(write.target), write.mode, ops);
+                    result.backups.push({ path: write.target, backup, kept: "new" });
+                }
+            }
+            writeRcAtomic(write.target, write.data, write.mode, ops);
+        }
+        catch (err) {
+            result.ok = false;
+            const outcome = { path: file.path, state: "skipped", why: `it could not be written (${message(err)})` };
+            result.files.push(outcome);
+            result.lines.push(`Left ${name} without the Codex launch hook: ${outcome.why}.`);
+            continue;
+        }
+        result.files.push(plan.outcome);
+        const kept = result.backups.find((b) => b.path === write.target);
+        result.lines.push(`Codex launches from a terminal name their coding account: the codex function is in ${name} (${state}).` +
+            (kept === undefined
+                ? ""
+                : kept.kept === "new"
+                    ? ` The file as it was is kept at ${tilde(kept.backup, ctx.home)}.`
+                    : ` An earlier copy of the file is kept at ${tilde(kept.backup, ctx.home)}.`));
+    }
+    if (result.files.length === 0)
+        result.lines.push("No shell rc file got the Codex launch hook: there is no ~/.zshrc or ~/.bashrc, and your login shell is neither zsh nor bash.");
+    const d = resolved(ctx, deps);
+    if (d.platform !== "darwin") {
+        result.agent = { state: "not_macos" };
+        if (dryRun)
+            result.lines.push("Dry run: nothing was changed.");
+        return result;
+    }
+    if (dryRun) {
+        const path = codexAgentPlistPath(ctx.home);
+        const text = codexAgentPlist({ cli: d.cli, path: d.path, home: ctx.home });
+        const loaded = d.run("launchctl", ["print", `gui/${d.uid}/${CODEX_ATTRIBUTION_LABEL}`]).status === 0;
+        if (readOr(path) === text && loaded) {
+            result.agent = { state: "unchanged", path };
+            result.lines.push(`The ${CODEX_ATTRIBUTION_LABEL} LaunchAgent is loaded and unchanged.`);
+        }
+        else {
+            result.agent = { state: "would_load", path };
+            result.lines.push(`Would write ${tilde(path, ctx.home)} and load it:`, ...text.replace(/\n$/, "").split("\n"));
+        }
+        result.lines.push("Dry run: nothing was changed.");
+        return result;
+    }
+    const agent = installCodexAgent(ctx, deps);
+    result.agent = agent;
+    if (agent.state === "loaded")
+        result.lines.push(`Codex launches from the Dock name their coding account: the ${CODEX_ATTRIBUTION_LABEL} LaunchAgent is loaded. A Codex app that is already open picks this up the next time it starts.`);
+    else if (agent.state === "unchanged")
+        result.lines.push(`The ${CODEX_ATTRIBUTION_LABEL} LaunchAgent is loaded and unchanged.`);
+    else if (agent.state === "failed") {
+        result.ok = false;
+        result.lines.push(`Setup could not load the ${CODEX_ATTRIBUTION_LABEL} LaunchAgent (${agent.detail}), so apps started from the Dock do not name their coding account. Run catalyst setup --only codex-attribution again in Terminal on this Mac's desktop.`);
+    }
+    return result;
+}
 /** What a full setup run adds after its steps, done or waiting. A dry run, a run scoped with
- *  --only and --no-shell-hook add nothing. With --json the lines go to stderr, so stdout keeps its one
+ *  --only and --no-shell-hook add nothing (`--only codex-attribution` is its own path, above). With --json the lines go to stderr, so stdout keeps its one
  *  document. */
 export function codexAttributionAfterSetup(args, ctx, deps = {}) {
     if (args.flags["dry-run"] === true ||

package/dist/update.js

@@ -12,7 +12,7 @@
 // CLI, SDK and image versions retain their no-downgrade policies. Each adapter verifies its own
 // installed state, while this coordinator keeps one approval read and rechecks component holds.
 import { compareVersions, hostApproval, readApprovalCache, readMemberApproval, supportedReleaseLine, writeApprovalCache, } from "./approved-release.js";
-import { loadConfig } from "./config.js";
+import { loadConfig, readManifest } from "./config.js";
 import { applyCliUpdate } from "./update-cli.js";
 import { readInventory } from "./update-inventory.js";
 import { restartPending, restartReplica } from "./update-replica.js";
@@ -22,7 +22,7 @@ import { onboardStatePath, readOnboardJournal } from "./onboard.js";
 import { effectivePolicy, projectIdentityHolds, readUpdatePolicy, UPDATE_COMPONENTS, withMigratedHolds, } from "./update-policy.js";
 import { applySdkUpdate, inspectSdkProject } from "./update-sdk.js";
 import { DEFAULT_WINDOW_TIMES } from "./update-windows.js";
-import { decideRelease, isRecord, parseDesiredRelease, RELEASE_COMPONENTS, runRunnerUpdate, } from "./runner-update.js";
+import { decideRelease, isRecord, parseDesiredRelease, readReleaseState, RELEASE_COMPONENTS, runRunnerUpdate, updateReport, } from "./runner-update.js";
 export const COMPONENT_LABELS = {
     runner: "Runner",
     supervisor: "Supervisor",
@@ -51,18 +51,20 @@ function dailyUpdateOff(ctx) {
 export function readEffectivePolicy(ctx) {
     return withMigratedHolds(readUpdatePolicy(ctx.home), dailyUpdateOff(ctx));
 }
-/** An engine whose desired-release read happens once per pass, however many readers ask. */
+/** An engine whose desired-release read happens once per pass, however many readers ask. The first
+ *  reader's update report rides that one read, so the cloud hears the previous run's outcome
+ *  (CTC-6999: the report was dropped here, and no scheduled run ever sent one). */
 export function sharedReleaseRead(engine) {
     const reads = new Map();
-    const read = (dir, signal) => {
+    const read = (dir, signal, report) => {
         let pending = reads.get(dir);
         if (!pending) {
-            pending = engine.desiredRelease(dir, signal);
+            pending = engine.desiredRelease(dir, signal, report);
             reads.set(dir, pending);
         }
         return pending;
     };
-    return { ...engine, desiredRelease: read, read: (dir) => read(dir) };
+    return { ...engine, desiredRelease: read, read: (dir, report) => read(dir, undefined, report) };
 }
 function imageApproval(read) {
     const decision = decideRelease(null, read);
@@ -285,7 +287,8 @@ export async function runUpdate(ctx, options) {
     let images = null;
     if (inventory.images.installed) {
         engine = sharedReleaseRead(options.engine());
-        const read = await engine.read(options.imagesDir);
+        // An apply reports the previous run's outcome on its read, as `runner update` does; a check never does.
+        const read = await engine.read(options.imagesDir, options.mode === "apply" ? updateReport(readReleaseState(options.imagesDir), readManifest().version) : undefined);
         images = imageApproval(read);
         approval = hostApproval(read);
         // The runner's own read failed (Docker stopped, say): a signed-in CLI can still ask the member

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catalyst-cloud/cli",
-  "version": "0.16.35",
+  "version": "0.16.36",
   "description": "Set up Catalyst Cloud, check your tickets and manage your account from the command line.",
   "license": "MIT",
   "type": "module",

package/skills/catalyst-github/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Catalyst's GitHub: show a ticket's pull request with its checks, reviews and review threads, say whether it is mergeable under this repository's policy, and explain what a PR accumulates as the ticket moves (the branch, the draft, the rewrite, the force-pushes, the labels, the queue). Use when someone asks "show me the PR", "what are the checks saying", "why hasn't it merged", "what does the queue need", "what does that label mean", or wants the branch and merge conventions Catalyst follows.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # Catalyst's GitHub
 

package/skills/catalyst-linear/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Catalyst's view of Linear on the customer's own cloud account. Reads a ticket with its comments, relations, labels, linked pull requests and agent sessions inline, from the cloud API by default, with local replica reads available as an explicit opt-in, always naming the source; searches tickets, PRs, projects and initiatives; writes comments, card moves, labels and new tickets through the account's agent proxy as the app actor, with every route, stage id, label id and marker read from the account's contract. Knows what a ticket accumulates as Catalyst works it (phase-outcome comments, the document per phase, the agent session, the labels, the single blocks relation, the bookkeeping marker, the eyes acknowledgement). Use when a person says "show me the ticket", "what did Catalyst write on it", "comment on it", "move it", "label it" or "file a ticket". Not for raising a decision for a human (what-needs-me) and not for pull requests (catalyst-github).
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # Catalyst Linear
 

package/skills/catalyst-onboard/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Set up Catalyst Cloud and say whether setup is working. Walks a person from nothing to their first ticket running, one step at a time: the coding account, the project, the integrations and connected accounts, each repository's settings file, then one real ticket moving. Also logs this machine in, reads the readiness verdict with who can fix each failure, and checks the optional local replica. Use when someone says "set me up", "onboard me", "I just signed up", "get me started", "what do I do first", "log me in", "which account is this machine on", "am I set up", "what is missing", "why does nothing happen" or "is the replica running", when a login expired, or when a skill script exits 2 saying this machine is not connected. Does every step a key can do through the catalyst CLI, hands over the exact page for the steps only a browser can do, and never claims a step it did not watch succeed.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # Onboard me
 

package/skills/run-this-project/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Own one Catalyst Cloud project end to end until it closes. Use when the person says "run this project for me", "own this until it ships", "keep this moving", or hands you a project id or a set of tickets to drive. Subscribes to the account's event stream for the scope through the catalyst CLI, reacts to each change in the same turn, makes tickets ready and moves them to dispatch, parks what should stop, chases stalls, escalates inward, and keeps one status summary current. Writes to Linear as the app actor; never polls.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # Run this project
 

package/skills/unstick/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Get a stuck Catalyst Cloud ticket moving again. Use when the person asks "why is this parked and can you release it?", "unpark this", "get things flowing again", "the outage is over, retry what failed", or hands you a ticket that is not moving. Reads why nothing runs and what holds the ticket through the catalyst CLI, decides whether the recorded cause is fixed, previews the release, releases every governor holding the ticket the right way (or one failure class across a team), and raises an ask only for what a person has to do. Never releases a cause it cannot show changed without saying so.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # Unstick
 

package/skills/what-needs-me/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   The human's decision inbox on Catalyst Cloud, and the one way an agent raises a decision on their behalf. Use when the person asks "what needs me?", "what am I blocking?", or when active work is gated on a choice only they can make. Lists open asks ranked by how much open work each one holds, files an ask through the cloud's ask route with the account's own template, and records the answer so the held work releases. Never answers as the human, never duplicates an open ask.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # What needs me
 

package/skills/what-this-repo-needs/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   What environment variable names does this repository need, and where does each one come from? Scans the repository offline (no login, no network) and lists the names in three groups (build/test, deploy-only, bindings), each with where it was found, what uses it, and where a local value would come from. Never reads a value or prints one. Also checks the environment variable table in `.catalyst/catalyst.toml` offline. Use when someone asks "what does catalyst.env.json mean", "what env vars does this repo need", "why does the container need this", or before reviewing or writing the declaration.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # What this repository needs
 

package/skills/whats-happening/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Use for "what's happening?", "what machines do we have?", "how much capacity do we have?", "where are we?", "why is that stuck?", "what closed?", "what's next?", "how does this work?", "why did it do that?", "how does it prioritise?" and "what does this setting do, where is it set?" in Catalyst Cloud, or asks for something to be done rather than known. Reads the contract via catalyst CLI. Read-only: route work/decisions, never answer as the human.
 allowed-tools: Bash(catalyst:*) Bash(npx -p @catalyst-cloud/cli catalyst:*)
 ---
-<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.35 — written in this repository for customer accounts -->
+<!-- vendored-from: @catalyst-cloud/catalyst-skills@0.16.36 — written in this repository for customer accounts -->
 
 # What's happening