@dadado/agent-kit-cli 4.2.2

package/dist/index.js

@@ -0,0 +1,3119 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { defineCommand as defineCommand11, runMain } from "citty";
+
+// src/commands/add.ts
+import { defineCommand } from "citty";
+
+// src/lifecycle/apply.ts
+import { copyFile, mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
+import path3 from "path";
+
+// src/manifest/types.ts
+var MANIFEST_FILENAME = "agent-kit.json";
+var MANIFEST_RELATIVE_PATH = `.cursor/${MANIFEST_FILENAME}`;
+var MANIFEST_SCHEMA_VERSION = 1;
+var DEFAULT_PROTECTED_PATHS = [
+  ".cursor/HANDOFF.md",
+  ".cursor/plans/**",
+  ".cursor/memory/**",
+  ".cursor/context/**"
+];
+var DOMAIN_PACK_IDS = [
+  "cybersec",
+  "devops",
+  "engineering-architecture",
+  "clean-code",
+  "project-management",
+  "context-management",
+  "quality"
+];
+
+// src/utils/fs.ts
+import { constants } from "fs";
+import { access, mkdir, readFile, readdir, writeFile } from "fs/promises";
+import path from "path";
+async function fileExists(target) {
+  try {
+    await access(target, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readJson(target) {
+  if (!await fileExists(target)) return null;
+  const raw = await readFile(target, "utf8");
+  return JSON.parse(raw);
+}
+async function writeJson(target, data) {
+  await ensureDir(path.dirname(target));
+  await writeFile(target, `${JSON.stringify(data, null, 2)}
+`, "utf8");
+}
+async function ensureDir(target) {
+  await mkdir(target, { recursive: true });
+}
+async function listDirectory(rootDir) {
+  return readdir(rootDir);
+}
+
+// src/lifecycle/paths.ts
+import path2 from "path";
+function resolveContained(root, rel) {
+  const rootAbs = path2.resolve(root);
+  const candidate = path2.resolve(rootAbs, rel);
+  const relToRoot = path2.relative(rootAbs, candidate);
+  if (relToRoot.startsWith("..") || path2.isAbsolute(relToRoot)) {
+    throw new Error(`Path escapes registry/project root: ${rel}`);
+  }
+  return candidate;
+}
+function toPosixRel(root, absPath) {
+  return path2.relative(root, absPath).split(path2.sep).join("/");
+}
+
+// src/lifecycle/glob.ts
+function normalizeRelPath(input) {
+  return input.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+/g, "/");
+}
+function matchSegments(patternParts, pathParts) {
+  let pi = 0;
+  let si = 0;
+  while (pi < patternParts.length && si < pathParts.length) {
+    const p = patternParts[pi] ?? "";
+    if (p === "**") {
+      if (pi === patternParts.length - 1) return true;
+      for (let skip = si; skip <= pathParts.length; skip++) {
+        if (matchSegments(patternParts.slice(pi + 1), pathParts.slice(skip))) return true;
+      }
+      return false;
+    }
+    const segment = pathParts[si] ?? "";
+    if (p.includes("*") || p.includes("?")) {
+      const re = new RegExp(
+        `^${p.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`
+      );
+      if (!re.test(segment)) return false;
+    } else if (p !== segment) {
+      return false;
+    }
+    pi += 1;
+    si += 1;
+  }
+  while (pi < patternParts.length && patternParts[pi] === "**") pi += 1;
+  return pi === patternParts.length && si === pathParts.length;
+}
+function matchesAnyGlob(relPath, globs) {
+  const normalized = normalizeRelPath(relPath);
+  const pathParts = normalized.split("/").filter(Boolean);
+  for (const glob of globs) {
+    const pattern = normalizeRelPath(glob);
+    if (matchSegments(pattern.split("/").filter(Boolean), pathParts)) return true;
+  }
+  return false;
+}
+
+// src/lifecycle/protected.ts
+function resolveProtectedGlobs(manifest) {
+  const fromManifest = manifest?.protected ?? [];
+  const overrides = (manifest?.overrides ?? []).map((o) => o.path);
+  const merged = [...DEFAULT_PROTECTED_PATHS, ...fromManifest, ...overrides];
+  return [...new Set(merged.map(normalizeRelPath))];
+}
+function isProtectedPath(relPath, globs) {
+  return matchesAnyGlob(relPath, globs);
+}
+
+// src/lifecycle/apply.ts
+function emptyStats() {
+  return { written: [], skippedProtected: [], missing: [], unchanged: [] };
+}
+function mergeStats(into, from) {
+  into.written.push(...from.written);
+  into.skippedProtected.push(...from.skippedProtected);
+  into.missing.push(...from.missing);
+  into.unchanged.push(...from.unchanged);
+  return into;
+}
+async function copyRegistryFile(registryRoot, projectRoot, sourceRel, targetRel, protectedGlobs) {
+  const targetNorm = targetRel.split(path3.sep).join("/");
+  if (isProtectedPath(targetNorm, protectedGlobs)) {
+    return "skipped-protected";
+  }
+  const sourceAbs = resolveContained(registryRoot, sourceRel);
+  const targetAbs = resolveContained(projectRoot, targetRel);
+  try {
+    await readFile2(sourceAbs);
+  } catch {
+    return "missing-source";
+  }
+  let existing = null;
+  try {
+    existing = await readFile2(targetAbs, "utf8");
+  } catch {
+    existing = null;
+  }
+  const next = await readFile2(sourceAbs, "utf8");
+  if (existing === next) return "unchanged";
+  await mkdir2(path3.dirname(targetAbs), { recursive: true });
+  await copyFile(sourceAbs, targetAbs);
+  return "written";
+}
+function recordOutcome(stats, targetRel, outcome) {
+  const rel = targetRel.split(path3.sep).join("/");
+  switch (outcome) {
+    case "written":
+      stats.written.push(rel);
+      break;
+    case "skipped-protected":
+      stats.skippedProtected.push(rel);
+      break;
+    case "missing-source":
+      stats.missing.push(rel);
+      break;
+    case "unchanged":
+      stats.unchanged.push(rel);
+      break;
+  }
+}
+async function saveManifest(projectRoot, manifest) {
+  const target = path3.join(projectRoot, MANIFEST_RELATIVE_PATH);
+  const payload = {
+    ...manifest,
+    schemaVersion: MANIFEST_SCHEMA_VERSION,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeJson(target, payload);
+  return toPosixRel(projectRoot, target);
+}
+function buildManifest(input) {
+  const manifest = {
+    schemaVersion: 1,
+    version: input.version,
+    protected: input.protected ?? [...DEFAULT_PROTECTED_PATHS]
+  };
+  if (input.profile) manifest.profile = input.profile;
+  if (input.packs?.length) manifest.packs = [...new Set(input.packs)].sort();
+  if (input.skills?.length) manifest.skills = [...new Set(input.skills)].sort();
+  if (input.registryUrl || input.registryRef) {
+    manifest.registry = {};
+    if (input.registryUrl) manifest.registry.url = input.registryUrl;
+    if (input.registryRef) manifest.registry.ref = input.registryRef;
+  }
+  return manifest;
+}
+function upsertIdList(list, id) {
+  return [.../* @__PURE__ */ new Set([...list ?? [], id])].sort();
+}
+
+// src/utils/logger.ts
+import { cyan, green, red, yellow } from "kolorist";
+var logger = {
+  info(message) {
+    console.log(cyan("info"), message);
+  },
+  success(message) {
+    console.log(green("done"), message);
+  },
+  warn(message) {
+    console.log(yellow("warn"), message);
+  },
+  error(message) {
+    console.error(red("error"), message);
+  }
+};
+
+// src/lifecycle/report.ts
+function logApplyStats(stats) {
+  if (stats.written.length > 0) {
+    logger.success(`Wrote ${stats.written.length} file(s)`);
+    for (const p of stats.written) logger.info(`  + ${p}`);
+  }
+  if (stats.unchanged.length > 0) {
+    logger.info(`Unchanged: ${stats.unchanged.length}`);
+  }
+  if (stats.skippedProtected.length > 0) {
+    logger.warn(`Skipped protected (L3): ${stats.skippedProtected.length}`);
+    for (const p of stats.skippedProtected) logger.info(`  ~ ${p}`);
+  }
+  if (stats.missing.length > 0) {
+    logger.warn(`Missing in registry: ${stats.missing.length}`);
+    for (const p of stats.missing) logger.info(`  ? ${p}`);
+  }
+}
+
+// src/registry/resolve.ts
+import { execFile } from "child_process";
+import { createHash } from "crypto";
+import { homedir } from "os";
+import path4 from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var DEFAULT_REGISTRY_URL = "https://github.com/agent-kit-startup/agent-kit";
+var DEFAULT_REGISTRY_REF = "main";
+var SAFE_URL = /^https:\/\/[^\s]+$/;
+var SAFE_REF = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+function assertSafeRegistrySource(url, ref) {
+  if (!SAFE_URL.test(url)) {
+    throw new Error(
+      `Refusing registry url "${url}": only https:// URLs are allowed. Use --registry <local-path> for local checkouts.`
+    );
+  }
+  if (!SAFE_REF.test(ref)) {
+    throw new Error(`Refusing registry ref "${ref}": invalid characters or leading "-".`);
+  }
+}
+function gitEnv() {
+  return { ...process.env, GIT_ALLOW_PROTOCOL: "https" };
+}
+function cacheKey(url, ref) {
+  return createHash("sha256").update(`${url}@${ref}`).digest("hex").slice(0, 16);
+}
+async function hasRegistryIndex(root) {
+  return fileExists(path4.join(root, "registry", "registry.json"));
+}
+async function cloneRegistry(url, ref, dest) {
+  const { mkdir: mkdir5 } = await import("fs/promises");
+  await mkdir5(path4.dirname(dest), { recursive: true });
+  try {
+    await execFileAsync("git", ["clone", "--depth", "1", "--branch", ref, "--", url, dest], {
+      env: gitEnv()
+    });
+  } catch {
+    await execFileAsync("git", ["clone", "--depth", "1", "--", url, dest], { env: gitEnv() });
+    await execFileAsync("git", ["checkout", ref, "--"], { cwd: dest, env: gitEnv() });
+  }
+}
+async function refreshCache(cacheDir) {
+  try {
+    await execFileAsync("git", ["fetch", "--depth", "1", "origin"], {
+      cwd: cacheDir,
+      env: gitEnv()
+    });
+    await execFileAsync("git", ["reset", "--hard", "FETCH_HEAD"], {
+      cwd: cacheDir,
+      env: gitEnv()
+    });
+  } catch {
+  }
+}
+async function resolveRegistryRoot(options) {
+  if (options.registryPath) {
+    const root = path4.resolve(options.registryPath);
+    if (!await hasRegistryIndex(root)) {
+      throw new Error(`No registry/registry.json under --registry ${root}`);
+    }
+    return { root, source: "flag" };
+  }
+  const envPath = process.env.AGENT_KIT_REGISTRY;
+  if (envPath) {
+    const root = path4.resolve(envPath);
+    if (!await hasRegistryIndex(root)) {
+      throw new Error(`No registry/registry.json under AGENT_KIT_REGISTRY=${root}`);
+    }
+    return { root, source: "env", url: options.registryUrl, ref: options.registryRef };
+  }
+  if (await hasRegistryIndex(options.cwd)) {
+    return {
+      root: path4.resolve(options.cwd),
+      source: "cwd",
+      url: options.registryUrl,
+      ref: options.registryRef
+    };
+  }
+  const url = options.registryUrl ?? DEFAULT_REGISTRY_URL;
+  const ref = options.registryRef ?? DEFAULT_REGISTRY_REF;
+  assertSafeRegistrySource(url, ref);
+  const dest = path4.join(homedir(), ".cache", "agent-kit", "registry", cacheKey(url, ref));
+  if (await hasRegistryIndex(dest)) {
+    if (options.refresh) await refreshCache(dest);
+    return { root: dest, source: "remote-cache", url, ref };
+  }
+  await cloneRegistry(url, ref, dest);
+  if (!await hasRegistryIndex(dest)) {
+    throw new Error(`Cloned ${url}@${ref} but registry/registry.json is missing`);
+  }
+  return { root: dest, source: "remote-cache", url, ref };
+}
+
+// src/lifecycle/resolve-cli.ts
+async function resolveRegistryFromCli(options) {
+  const fromManifest = options.manifest?.registry;
+  return resolveRegistryRoot({
+    cwd: options.cwd,
+    registryPath: options.registry,
+    registryUrl: options.url ?? fromManifest?.url,
+    registryRef: options.ref ?? fromManifest?.ref,
+    refresh: options.refresh
+  });
+}
+var REGISTRY_CLI_ARGS = {
+  registry: {
+    type: "string",
+    description: "Local path to a kit checkout that contains registry/"
+  },
+  url: {
+    type: "string",
+    description: "Remote registry git URL (default: public agent-kit)"
+  },
+  ref: {
+    type: "string",
+    description: "Git ref for remote registry (branch or tag)"
+  },
+  refresh: {
+    type: "boolean",
+    description: "Refresh cached remote registry",
+    default: false
+  }
+};
+
+// src/lifecycle/version.ts
+var KIT_VERSION = "3.0.0";
+
+// src/manifest/index.ts
+import path5 from "path";
+
+// src/manifest/parse.ts
+var SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var KEBAB_ID = /^[a-z][a-z0-9-]*$/;
+var ManifestValidationError = class extends Error {
+  constructor(message, issues) {
+    super(message);
+    this.issues = issues;
+    this.name = "ManifestValidationError";
+  }
+  issues;
+};
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertStringArray(label, value, issues) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    issues.push(`${label} must be an array`);
+    return void 0;
+  }
+  const out = [];
+  for (let i = 0; i < value.length; i++) {
+    const item = value[i];
+    if (typeof item !== "string" || item.length === 0) {
+      issues.push(`${label}[${i}] must be a non-empty string`);
+      continue;
+    }
+    out.push(item);
+  }
+  return out;
+}
+function assertKebabIdArray(label, value, issues) {
+  const arr = assertStringArray(label, value, issues);
+  if (!arr) return arr;
+  for (let i = 0; i < arr.length; i++) {
+    if (!KEBAB_ID.test(arr[i] ?? "")) {
+      issues.push(`${label}[${i}] must match ${KEBAB_ID}`);
+    }
+  }
+  return arr;
+}
+function parseOverrides(value, issues) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    issues.push("overrides must be an array");
+    return void 0;
+  }
+  const out = [];
+  for (let i = 0; i < value.length; i++) {
+    const item = value[i];
+    if (!isPlainObject(item)) {
+      issues.push(`overrides[${i}] must be an object`);
+      continue;
+    }
+    if (typeof item.path !== "string" || item.path.length === 0) {
+      issues.push(`overrides[${i}].path must be a non-empty string`);
+      continue;
+    }
+    const entry = { path: item.path };
+    if (item.replaces !== void 0) {
+      if (typeof item.replaces !== "string" || item.replaces.length === 0) {
+        issues.push(`overrides[${i}].replaces must be a non-empty string`);
+      } else {
+        entry.replaces = item.replaces;
+      }
+    }
+    if (item.note !== void 0) {
+      if (typeof item.note !== "string") {
+        issues.push(`overrides[${i}].note must be a string`);
+      } else {
+        entry.note = item.note;
+      }
+    }
+    out.push(entry);
+  }
+  return out;
+}
+function parseAgentKitManifest(raw) {
+  const issues = [];
+  if (!isPlainObject(raw)) {
+    throw new ManifestValidationError("Manifest must be a JSON object", ["root must be object"]);
+  }
+  const { $schema: _schema, ...rest } = raw;
+  void _schema;
+  if (rest.schemaVersion !== MANIFEST_SCHEMA_VERSION) {
+    issues.push(`schemaVersion must be ${MANIFEST_SCHEMA_VERSION}`);
+  }
+  if (typeof rest.version !== "string" || !SEMVER.test(rest.version)) {
+    issues.push("version must be a semver string");
+  }
+  if (rest.profile !== void 0 && (typeof rest.profile !== "string" || rest.profile.length === 0)) {
+    issues.push("profile must be a non-empty string");
+  }
+  const packs = assertKebabIdArray("packs", rest.packs, issues);
+  const skills = assertKebabIdArray("skills", rest.skills, issues);
+  const protectedPaths = assertStringArray("protected", rest.protected, issues);
+  const overrides = parseOverrides(rest.overrides, issues);
+  let registry;
+  if (rest.registry !== void 0) {
+    if (!isPlainObject(rest.registry)) {
+      issues.push("registry must be an object");
+    } else {
+      registry = {};
+      if (rest.registry.url !== void 0) {
+        if (typeof rest.registry.url !== "string") {
+          issues.push("registry.url must be a string");
+        } else {
+          registry.url = rest.registry.url;
+        }
+      }
+      if (rest.registry.ref !== void 0) {
+        if (typeof rest.registry.ref !== "string" || rest.registry.ref.length === 0) {
+          issues.push("registry.ref must be a non-empty string");
+        } else {
+          registry.ref = rest.registry.ref;
+        }
+      }
+    }
+  }
+  if (rest.installedAt !== void 0 && typeof rest.installedAt !== "string") {
+    issues.push("installedAt must be a string");
+  }
+  const allowed = /* @__PURE__ */ new Set([
+    "schemaVersion",
+    "version",
+    "profile",
+    "packs",
+    "skills",
+    "protected",
+    "overrides",
+    "registry",
+    "installedAt"
+  ]);
+  for (const key of Object.keys(rest)) {
+    if (!allowed.has(key)) {
+      issues.push(`unknown field: ${key}`);
+    }
+  }
+  if (issues.length > 0) {
+    throw new ManifestValidationError(`Invalid agent-kit.json (${issues.length} issue(s))`, issues);
+  }
+  const manifest = {
+    schemaVersion: 1,
+    version: rest.version
+  };
+  if (typeof rest.profile === "string") manifest.profile = rest.profile;
+  if (packs) manifest.packs = packs;
+  if (skills) manifest.skills = skills;
+  if (protectedPaths) manifest.protected = protectedPaths;
+  if (overrides) manifest.overrides = overrides;
+  if (registry) manifest.registry = registry;
+  if (typeof rest.installedAt === "string") manifest.installedAt = rest.installedAt;
+  return manifest;
+}
+
+// src/manifest/index.ts
+async function loadAgentKitManifest(cwd) {
+  const target = path5.join(cwd, MANIFEST_RELATIVE_PATH);
+  const raw = await readJson(target);
+  if (raw === null) return null;
+  return parseAgentKitManifest(raw);
+}
+
+// src/registry/client.ts
+import path6 from "path";
+async function loadRegistry(rootDir) {
+  const indexPath = path6.join(rootDir, "registry", "registry.json");
+  const index = await readJson(indexPath);
+  if (!index) throw new Error(`Registry not found at ${indexPath}`);
+  return index;
+}
+function allSkills(index) {
+  return [...index.skills.core, ...index.skills.community];
+}
+function allPacks(index) {
+  return index.packs ?? [];
+}
+async function findSkill(rootDir, skillId) {
+  const index = await loadRegistry(rootDir);
+  const skill = allSkills(index).find((item) => item.id === skillId);
+  if (!skill) throw new Error(`Skill '${skillId}' not found in registry.`);
+  return skill;
+}
+async function findPack(rootDir, packId) {
+  const index = await loadRegistry(rootDir);
+  const pack = allPacks(index).find((item) => item.id === packId);
+  if (!pack) throw new Error(`Pack '${packId}' not found in registry.`);
+  return pack;
+}
+
+// src/registry/install.ts
+import { readFile as readFile3 } from "fs/promises";
+import path7 from "path";
+function targetForMember(member) {
+  switch (member.kind) {
+    case "skill": {
+      const category = member.source.includes("/core/") ? "core" : "community";
+      return {
+        sourceRel: path7.posix.join(member.source, "SKILL.md"),
+        targetRel: path7.posix.join(".cursor", "skills", category, member.id, "SKILL.md")
+      };
+    }
+    case "rule":
+      return {
+        sourceRel: member.source,
+        targetRel: path7.posix.join(".cursor", "rules", path7.posix.basename(member.source))
+      };
+    case "agent":
+      return {
+        sourceRel: member.source,
+        targetRel: path7.posix.join(".cursor", "agents", path7.posix.basename(member.source))
+      };
+    case "command":
+      return {
+        sourceRel: member.source,
+        targetRel: path7.posix.join(".cursor", "commands", path7.posix.basename(member.source))
+      };
+    case "hook": {
+      const targetRel = member.source.startsWith(".cursor/") ? member.source : path7.posix.join(".cursor", "hooks", path7.posix.basename(member.source));
+      return { sourceRel: member.source, targetRel };
+    }
+    case "template": {
+      const base = path7.posix.basename(member.source);
+      if (member.source.includes("/context-management/") || member.source.includes("/engineering-architecture/")) {
+        return {
+          sourceRel: member.source,
+          targetRel: path7.posix.join(".cursor", "context", "templates", base)
+        };
+      }
+      return {
+        sourceRel: member.source,
+        targetRel: path7.posix.join("templates", base)
+      };
+    }
+    default: {
+      const _exhaustive = member.kind;
+      throw new Error(`Unsupported pack member kind: ${_exhaustive}`);
+    }
+  }
+}
+async function installSkill(registryRoot, projectRoot, skill, options = {}) {
+  const stats = emptyStats();
+  const category = skill.path.includes("/core/") ? "core" : "community";
+  const sourceRel = path7.posix.join(skill.path, "SKILL.md");
+  const targetRel = path7.posix.join(".cursor", "skills", category, skill.id, "SKILL.md");
+  const outcome = await copyRegistryFile(
+    registryRoot,
+    projectRoot,
+    sourceRel,
+    targetRel,
+    options.protectedGlobs ?? []
+  );
+  recordOutcome(stats, targetRel, outcome);
+  return stats;
+}
+async function installSkillsByIds(registryRoot, projectRoot, skillIds, options = {}) {
+  const index = await readJson(path7.join(registryRoot, "registry", "registry.json"));
+  const stats = emptyStats();
+  if (!index) return stats;
+  const pool = allSkills(index);
+  for (const id of skillIds) {
+    const skill = pool.find((s) => s.id === id);
+    if (!skill) {
+      stats.missing.push(id);
+      continue;
+    }
+    mergeStats(stats, await installSkill(registryRoot, projectRoot, skill, options));
+  }
+  return stats;
+}
+async function loadPackManifest(registryRoot, packId) {
+  const summary = await findPack(registryRoot, packId);
+  const manifestPath = resolveContained(registryRoot, path7.join(summary.path, "pack.json"));
+  const manifest = await readJson(manifestPath);
+  if (!manifest) throw new Error(`Pack manifest not found at ${manifestPath}`);
+  return manifest;
+}
+async function installPack(registryRoot, projectRoot, packId, options = {}) {
+  await loadRegistry(registryRoot);
+  const packManifest = await loadPackManifest(registryRoot, packId);
+  const stats = emptyStats();
+  const protectedGlobs = options.protectedGlobs ?? [];
+  for (const member of packManifest.members) {
+    const { sourceRel, targetRel } = targetForMember(member);
+    const outcome = await copyRegistryFile(
+      registryRoot,
+      projectRoot,
+      sourceRel,
+      targetRel,
+      protectedGlobs
+    );
+    recordOutcome(stats, targetRel, outcome);
+  }
+  return stats;
+}
+function packMemberTargets(member) {
+  return targetForMember(member);
+}
+
+// src/commands/add.ts
+var addCommand = defineCommand({
+  meta: {
+    name: "add",
+    description: "Install a skill or L1 pack from the registry into the project."
+  },
+  args: {
+    id: {
+      type: "positional",
+      description: "Skill id or pack id from registry"
+    },
+    skill: {
+      type: "boolean",
+      description: "Force treat id as a skill (when pack shares the same id)",
+      default: false
+    },
+    pack: {
+      type: "boolean",
+      description: "Force treat id as a pack (when skill shares the same id)",
+      default: false
+    },
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    ...REGISTRY_CLI_ARGS
+  },
+  async run({ args }) {
+    if (!args.id) throw new Error("Provide an id: agent-kit add <skill|pack>");
+    if (args.skill && args.pack) {
+      throw new Error("Use only one of --skill or --pack");
+    }
+    const existing = await loadAgentKitManifest(args.cwd);
+    const registry = await resolveRegistryFromCli({
+      cwd: args.cwd,
+      registry: args.registry,
+      url: args.url,
+      ref: args.ref,
+      refresh: args.refresh,
+      manifest: existing
+    });
+    const protectedGlobs = resolveProtectedGlobs(existing);
+    const index = await loadRegistry(registry.root);
+    const asSkill = allSkills(index).find((s) => s.id === args.id);
+    const asPack = allPacks(index).find((p) => p.id === args.id);
+    const base = existing ? { ...existing } : buildManifest({
+      version: KIT_VERSION,
+      profile: "default",
+      registryUrl: registry.url,
+      registryRef: registry.ref
+    });
+    const finish = async (kind, id) => {
+      if (kind === "skill") base.skills = upsertIdList(base.skills, id);
+      else base.packs = upsertIdList(base.packs, id);
+      if (registry.url || registry.ref) {
+        base.registry = {
+          url: registry.url ?? base.registry?.url,
+          ref: registry.ref ?? base.registry?.ref
+        };
+      }
+      base.version = KIT_VERSION;
+      await saveManifest(args.cwd, base);
+    };
+    if (args.skill) {
+      const skill = await findSkill(registry.root, args.id);
+      const stats = await installSkill(registry.root, args.cwd, skill, { protectedGlobs });
+      logApplyStats(stats);
+      await finish("skill", skill.id);
+      logger.success(`Skill '${skill.id}' added.`);
+      return;
+    }
+    if (args.pack) {
+      const pack = await findPack(registry.root, args.id);
+      const stats = await installPack(registry.root, args.cwd, pack.id, { protectedGlobs });
+      logApplyStats(stats);
+      await finish("pack", pack.id);
+      logger.success(`Pack '${pack.id}' added.`);
+      return;
+    }
+    if (asSkill && asPack) {
+      throw new Error(
+        `'${args.id}' is both a skill and a pack. Disambiguate: agent-kit add --skill ${args.id} | agent-kit add --pack ${args.id}`
+      );
+    }
+    if (asSkill) {
+      const stats = await installSkill(registry.root, args.cwd, asSkill, { protectedGlobs });
+      logApplyStats(stats);
+      await finish("skill", asSkill.id);
+      logger.success(`Skill '${asSkill.id}' added.`);
+      return;
+    }
+    if (asPack) {
+      const stats = await installPack(registry.root, args.cwd, asPack.id, { protectedGlobs });
+      logApplyStats(stats);
+      await finish("pack", asPack.id);
+      logger.success(`Pack '${asPack.id}' added.`);
+      return;
+    }
+    throw new Error(`'${args.id}' not found as skill or pack in registry.`);
+  }
+});
+
+// src/commands/contribute.ts
+import { defineCommand as defineCommand2 } from "citty";
+
+// src/lifecycle/contribute.ts
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
+import path8 from "path";
+
+// src/lifecycle/contribute-gate.ts
+var SECRET_PATTERNS = [
+  {
+    code: "secret-aws",
+    re: /AKIA[0-9A-Z]{16}/,
+    message: "Looks like an AWS access key id"
+  },
+  {
+    code: "secret-private-key",
+    re: /-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----/,
+    message: "Contains a private key block"
+  },
+  {
+    code: "secret-bearer",
+    re: /(?:api[_-]?key|token|secret|password)\s*[:=]\s*['"][^'"]{12,}['"]/i,
+    message: "Looks like an inline API key / token / password"
+  },
+  {
+    code: "secret-github-pat",
+    re: /\bghp_[A-Za-z0-9]{20,}\b/,
+    message: "Looks like a GitHub personal access token"
+  }
+];
+var HYGIENE_PATTERNS = [
+  {
+    code: "meta-agent",
+    re: /\b(como IA|as an AI|no meu racioc[ií]nio|vou usar a tool|contexto do chat)\b/i,
+    message: "Agent metalinguage \u2014 not allowed in versioned kit artifacts"
+  },
+  {
+    code: "session-transient",
+    re: /\b(conforme falamos|no chat anterior|WIP do agente|hoje eu configurei)\b/i,
+    message: "Session / chat-transient wording \u2014 rewrite in project voice"
+  }
+];
+var BLOCKED_PATH_GLOBS = [
+  /^\.cursor\/HANDOFF\.md$/i,
+  /^\.cursor\/plans\//i,
+  /^\.cursor\/memory\//i,
+  /^\.cursor\/context\//i,
+  /^\.env/i,
+  /(^|\/)credentials?\./i,
+  /(^|\/)secrets?\./i
+];
+var MAX_BYTES = 2e5;
+function gateContributePath(projectRel) {
+  const posix = projectRel.split("\\").join("/");
+  const issues = [];
+  for (const re of BLOCKED_PATH_GLOBS) {
+    if (re.test(posix)) {
+      issues.push({
+        code: "path-blocked",
+        message: `Path is session/L3 or secret-like \u2014 cannot contribute: ${posix}`
+      });
+    }
+  }
+  return issues;
+}
+function gateContributeContent(content, projectRel) {
+  const issues = [...gateContributePath(projectRel)];
+  const bytes = Buffer.byteLength(content, "utf8");
+  if (bytes > MAX_BYTES) {
+    issues.push({
+      code: "too-large",
+      message: `File too large (${bytes} bytes; max ${MAX_BYTES})`
+    });
+  }
+  for (const p of SECRET_PATTERNS) {
+    if (p.re.test(content)) issues.push({ code: p.code, message: p.message });
+  }
+  for (const p of HYGIENE_PATTERNS) {
+    if (p.re.test(content)) issues.push({ code: p.code, message: p.message });
+  }
+  return { ok: issues.length === 0, issues };
+}
+
+// src/lifecycle/l0.ts
+var L0_ARTIFACTS = [
+  // Rules
+  {
+    source: ".cursor/rules/cursor-plan-handoff.mdc",
+    target: ".cursor/rules/cursor-plan-handoff.mdc"
+  },
+  {
+    source: ".cursor/rules/context-guardian.mdc",
+    target: ".cursor/rules/context-guardian.mdc"
+  },
+  {
+    source: ".cursor/rules/cursor-skills-git-workflow.mdc",
+    target: ".cursor/rules/cursor-skills-git-workflow.mdc"
+  },
+  {
+    source: ".cursor/rules/cursor-skills-general.mdc",
+    target: ".cursor/rules/cursor-skills-general.mdc"
+  },
+  { source: ".cursor/rules/ux-tone.mdc", target: ".cursor/rules/ux-tone.mdc" },
+  {
+    source: ".cursor/rules/agent-output-hygiene.mdc",
+    target: ".cursor/rules/agent-output-hygiene.mdc"
+  },
+  {
+    source: ".cursor/rules/docs-professional-standard.mdc",
+    target: ".cursor/rules/docs-professional-standard.mdc"
+  },
+  { source: ".cursor/rules/memory-loop.mdc", target: ".cursor/rules/memory-loop.mdc" },
+  {
+    source: "registry/rules/git-secrets-safety.mdc",
+    target: ".cursor/rules/git-secrets-safety.mdc"
+  },
+  // Commands
+  {
+    source: ".cursor/commands/start-project.md",
+    target: ".cursor/commands/start-project.md"
+  },
+  {
+    source: ".cursor/commands/continue-plan.md",
+    target: ".cursor/commands/continue-plan.md"
+  },
+  {
+    source: ".cursor/commands/run-plan.md",
+    target: ".cursor/commands/run-plan.md"
+  },
+  // Deprecated aliases of /run-plan (kept so existing references keep working)
+  {
+    source: ".cursor/commands/run-plan-loop.md",
+    target: ".cursor/commands/run-plan-loop.md"
+  },
+  {
+    source: ".cursor/commands/run-plan-orchestrated.md",
+    target: ".cursor/commands/run-plan-orchestrated.md"
+  },
+  { source: ".cursor/commands/handoff.md", target: ".cursor/commands/handoff.md" },
+  { source: ".cursor/commands/summary.md", target: ".cursor/commands/summary.md" },
+  {
+    source: ".cursor/commands/git-staging.md",
+    target: ".cursor/commands/git-staging.md"
+  },
+  { source: ".cursor/commands/git-prod.md", target: ".cursor/commands/git-prod.md" },
+  // Secrets gate (structural)
+  {
+    source: ".cursor/hooks/pre-commit/check-secrets.sh",
+    target: ".cursor/hooks/pre-commit/check-secrets.sh"
+  },
+  // Native Cursor agent hooks (session context + handoff on compact)
+  {
+    source: ".cursor/hooks.json",
+    target: ".cursor/hooks.json"
+  },
+  {
+    source: ".cursor/hooks/agent/session-plan-guard.py",
+    target: ".cursor/hooks/agent/session-plan-guard.py"
+  },
+  {
+    source: ".cursor/hooks/agent/precompact-handoff.py",
+    target: ".cursor/hooks/agent/precompact-handoff.py"
+  },
+  // Git spine docs at project root (not a nested agent-kit/ copy)
+  {
+    source: "autogit/gitupdate.md",
+    target: "autogit/gitupdate.md"
+  },
+  {
+    source: "autogit/plan-routine.md",
+    target: "autogit/plan-routine.md"
+  }
+];
+
+// src/lifecycle/contribute.ts
+async function readLocal(projectRoot, rel) {
+  try {
+    return await readFile4(resolveContained(projectRoot, rel), "utf8");
+  } catch {
+    return null;
+  }
+}
+async function buildRegistryPathMap(registryRoot, manifest) {
+  const map = /* @__PURE__ */ new Map();
+  for (const a of L0_ARTIFACTS) {
+    map.set(a.target.split(path8.sep).join("/"), a.source.split(path8.sep).join("/"));
+  }
+  for (const packId of manifest.packs ?? []) {
+    const pack = await loadPackManifest(registryRoot, packId);
+    for (const member of pack.members) {
+      const { sourceRel, targetRel } = packMemberTargets(member);
+      map.set(targetRel.split(path8.sep).join("/"), sourceRel.split(path8.sep).join("/"));
+    }
+  }
+  if ((manifest.skills ?? []).length > 0) {
+    const index = await loadRegistry(registryRoot);
+    const pool = allSkills(index);
+    for (const id of manifest.skills ?? []) {
+      const skill = pool.find((s) => s.id === id);
+      if (!skill) continue;
+      const category = skill.path.includes("/core/") ? "core" : "community";
+      const sourceRel = path8.posix.join(skill.path, "SKILL.md");
+      const targetRel = path8.posix.join(".cursor", "skills", category, skill.id, "SKILL.md");
+      map.set(targetRel, sourceRel);
+    }
+  }
+  return map;
+}
+function guessRegistryPath(projectRel) {
+  const p = projectRel.split(path8.sep).join("/");
+  if (p.startsWith(".cursor/skills/") && p.endsWith("/SKILL.md")) {
+    const rest = p.slice(".cursor/skills/".length);
+    const parts = rest.split("/");
+    if (parts.length === 3 && (parts[0] === "core" || parts[0] === "community")) {
+      return path8.posix.join("registry/skills", rest);
+    }
+    const skillId = parts[0];
+    if (parts.length === 2 && skillId) {
+      return path8.posix.join("registry/skills", "community", skillId, "SKILL.md");
+    }
+  }
+  if (p.startsWith(".cursor/rules/")) {
+    return p;
+  }
+  if (p.startsWith(".cursor/commands/")) {
+    return p;
+  }
+  if (p.startsWith(".cursor/agents/")) {
+    return p;
+  }
+  if (p.startsWith(".cursor/hooks/")) {
+    return p;
+  }
+  if (p.startsWith("autogit/")) {
+    return p;
+  }
+  return null;
+}
+async function planContribute(options) {
+  const includeDrift = options.includeDrift !== false;
+  const pathMap = await buildRegistryPathMap(options.registryRoot, options.manifest);
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = async (kind, projectPath, registryPath) => {
+    const key = projectPath.split(path8.sep).join("/");
+    if (seen.has(key)) return;
+    seen.add(key);
+    const content = await readLocal(options.projectRoot, projectPath);
+    if (content === null) {
+      return;
+    }
+    if (kind === "drift") {
+      try {
+        const upstream = await readFile4(
+          resolveContained(options.registryRoot, registryPath),
+          "utf8"
+        );
+        if (upstream === content) return;
+      } catch {
+      }
+    }
+    const gate = gateContributeContent(content, key);
+    candidates.push({
+      kind,
+      projectPath: key,
+      registryPath,
+      gateOk: gate.ok,
+      issues: gate.issues
+    });
+  };
+  if (includeDrift) {
+    for (const [projectPath, registryPath] of pathMap) {
+      await push("drift", projectPath, registryPath);
+    }
+  }
+  for (const raw of options.extraPaths ?? []) {
+    const projectPath = raw.split(path8.sep).join("/");
+    const blocked = gateContributePath(projectPath);
+    if (blocked.length > 0) {
+      if (!seen.has(projectPath)) {
+        seen.add(projectPath);
+        candidates.push({
+          kind: "path",
+          projectPath,
+          registryPath: "",
+          gateOk: false,
+          issues: blocked
+        });
+      }
+      continue;
+    }
+    const mapped = pathMap.get(projectPath) ?? guessRegistryPath(projectPath);
+    if (!mapped) {
+      candidates.push({
+        kind: "path",
+        projectPath,
+        registryPath: "",
+        gateOk: false,
+        issues: [
+          {
+            code: "unmapped",
+            message: "Cannot map to a registry path \u2014 pass an installed kit artifact or .cursor/{rules,commands,skills,agents,hooks}/*"
+          }
+        ]
+      });
+      continue;
+    }
+    await push("path", projectPath, mapped);
+  }
+  return {
+    candidates,
+    accepted: candidates.filter((c) => c.gateOk),
+    rejected: candidates.filter((c) => !c.gateOk)
+  };
+}
+async function writeContributeToRegistry(projectRoot, registryRoot, accepted) {
+  const written = [];
+  for (const c of accepted) {
+    if (!c.registryPath) continue;
+    const content = await readFile4(resolveContained(projectRoot, c.projectPath), "utf8");
+    const dest = resolveContained(registryRoot, c.registryPath);
+    await mkdir3(path8.dirname(dest), { recursive: true });
+    await writeFile2(dest, content, "utf8");
+    written.push(c.registryPath);
+  }
+  return written;
+}
+function formatPrBody(accepted) {
+  const bullets = accepted.map((c) => `- \`${c.projectPath}\` \u2192 \`${c.registryPath}\``).join("\n");
+  return [
+    "## Summary",
+    "Upstream contribution from a consumer project via `agent-kit contribute`.",
+    "",
+    "### Files",
+    bullets || "- (none)",
+    "",
+    "## Checklist",
+    "- [ ] Anti-slop / hygiene gate passed locally",
+    "- [ ] No secrets or session state (HANDOFF/plans/memory)",
+    "- [ ] Docs / registry index updated if this adds a skill or pack member",
+    ""
+  ].join("\n");
+}
+
+// src/commands/contribute.ts
+function parsePaths(raw) {
+  if (!raw?.trim()) return [];
+  return [
+    ...new Set(
+      raw.split(",").map((s) => s.trim()).filter(Boolean)
+    )
+  ];
+}
+var contributeCommand = defineCommand2({
+  meta: {
+    name: "contribute",
+    description: "Propose upstream changes: detect local drift/new kit artifacts, run anti-slop gate, optionally write into a kit checkout for a PR."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    path: {
+      type: "string",
+      description: "Comma-separated project-relative paths to contribute (new or edited)"
+    },
+    drift: {
+      type: "boolean",
+      description: "Include drifted installed L0/pack/skill files vs registry (default: true)",
+      default: true
+    },
+    write: {
+      type: "boolean",
+      description: "Copy accepted files into the local kit/registry checkout (--registry required / resolved)",
+      default: false
+    },
+    ...REGISTRY_CLI_ARGS
+  },
+  async run({ args }) {
+    const manifest = await loadAgentKitManifest(args.cwd);
+    if (!manifest) {
+      logger.warn("No .cursor/agent-kit.json \u2014 run agent-kit install first.");
+      return;
+    }
+    const registry = await resolveRegistryFromCli({
+      cwd: args.cwd,
+      registry: args.registry,
+      url: args.url,
+      ref: args.ref,
+      refresh: args.refresh,
+      manifest
+    });
+    if (registry.source !== "flag" && args.write) {
+      logger.warn(
+        "contribute --write needs a local kit checkout. Pass --registry /path/to/agent-kit."
+      );
+      return;
+    }
+    logger.info(`Registry: ${registry.root} (${registry.source})`);
+    const plan = await planContribute({
+      registryRoot: registry.root,
+      projectRoot: args.cwd,
+      manifest,
+      extraPaths: parsePaths(args.path),
+      includeDrift: args.drift
+    });
+    console.log(
+      `Contribute plan: accepted=${plan.accepted.length} rejected=${plan.rejected.length} (drift scan=${args.drift})`
+    );
+    if (plan.candidates.length === 0) {
+      logger.success("Nothing to contribute (no drift / no --path).");
+      return;
+    }
+    for (const c of plan.candidates) {
+      const mark = c.gateOk ? "ok" : "FAIL";
+      console.log(
+        `${mark.padEnd(4)} ${c.kind.padEnd(5)} ${c.projectPath} \u2192 ${c.registryPath || "(unmapped)"}`
+      );
+      for (const issue of c.issues) {
+        console.log(`       [${issue.code}] ${issue.message}`);
+      }
+    }
+    if (plan.accepted.length === 0) {
+      logger.warn("No files passed the contribute gate.");
+      return;
+    }
+    console.log("\n--- Suggested PR body ---\n");
+    console.log(formatPrBody(plan.accepted));
+    if (!args.write) {
+      logger.info(
+        "Dry run. Re-run with --write --registry /path/to/agent-kit to copy accepted files into the kit checkout, then open a PR (gh pr create --base main)."
+      );
+      return;
+    }
+    const written = await writeContributeToRegistry(args.cwd, registry.root, plan.accepted);
+    logger.success(`Wrote ${written.length} file(s) into ${registry.root}`);
+    for (const p of written) console.log(`  + ${p}`);
+    console.log("\nNext (HITL \u2014 review before push):");
+    console.log(`  cd ${registry.root}`);
+    console.log("  git checkout -b contribute/<short-topic>");
+    console.log('  git add <files> && git commit -m "feat: contribute <topic> from consumer"');
+    console.log("  git push -u origin HEAD");
+    console.log('  gh pr create --base main --title "feat: contribute <topic>" --body-file -');
+  }
+});
+
+// src/commands/diff.ts
+import { defineCommand as defineCommand3 } from "citty";
+
+// src/lifecycle/diff.ts
+import { readFile as readFile5 } from "fs/promises";
+import path9 from "path";
+async function readIfExists(abs) {
+  try {
+    return await readFile5(abs, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function comparePair(registryRoot, projectRoot, sourceRel, targetRel, protectedGlobs) {
+  const posixTarget = targetRel.split(path9.sep).join("/");
+  if (isProtectedPath(posixTarget, protectedGlobs)) {
+    return { path: posixTarget, status: "protected" };
+  }
+  let sourceAbs;
+  try {
+    sourceAbs = resolveContained(registryRoot, sourceRel);
+  } catch {
+    return { path: posixTarget, status: "missing-registry" };
+  }
+  const registryContent = await readIfExists(sourceAbs);
+  if (registryContent === null) {
+    return { path: posixTarget, status: "missing-registry" };
+  }
+  let targetAbs;
+  try {
+    targetAbs = resolveContained(projectRoot, targetRel);
+  } catch {
+    return { path: posixTarget, status: "missing-local" };
+  }
+  const localContent = await readIfExists(targetAbs);
+  if (localContent === null) return { path: posixTarget, status: "missing-local" };
+  if (localContent === registryContent) return { path: posixTarget, status: "match" };
+  return { path: posixTarget, status: "drift" };
+}
+async function diffAgainstRegistry(registryRoot, projectRoot, manifest) {
+  const protectedGlobs = resolveProtectedGlobs(manifest);
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  const pushUnique = async (sourceRel, targetRel) => {
+    const key = targetRel.split(path9.sep).join("/");
+    if (seen.has(key)) return;
+    seen.add(key);
+    entries.push(
+      await comparePair(registryRoot, projectRoot, sourceRel, targetRel, protectedGlobs)
+    );
+  };
+  for (const a of L0_ARTIFACTS) {
+    await pushUnique(a.source, a.target);
+  }
+  for (const packId of manifest.packs ?? []) {
+    const pack = await loadPackManifest(registryRoot, packId);
+    for (const member of pack.members) {
+      const { sourceRel, targetRel } = packMemberTargets(member);
+      await pushUnique(sourceRel, targetRel);
+    }
+  }
+  if ((manifest.skills ?? []).length > 0) {
+    const index = await loadRegistry(registryRoot);
+    const pool = allSkills(index);
+    for (const id of manifest.skills ?? []) {
+      const skill = pool.find((s) => s.id === id);
+      if (!skill) {
+        entries.push({ path: `skill:${id}`, status: "missing-registry" });
+        continue;
+      }
+      const category = skill.path.includes("/core/") ? "core" : "community";
+      const sourceRel = path9.posix.join(skill.path, "SKILL.md");
+      const targetRel = path9.posix.join(".cursor", "skills", category, skill.id, "SKILL.md");
+      await pushUnique(sourceRel, targetRel);
+    }
+  }
+  return entries;
+}
+function summarizeDiff(entries) {
+  const summary = {
+    match: 0,
+    drift: 0,
+    "missing-local": 0,
+    "missing-registry": 0,
+    protected: 0
+  };
+  for (const e of entries) summary[e.status] += 1;
+  return summary;
+}
+
+// src/commands/diff.ts
+var diffCommand = defineCommand3({
+  meta: {
+    name: "diff",
+    description: "Compare installed kit artifacts to the registry (respects L3 protected)."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    all: {
+      type: "boolean",
+      description: "Include matching files in the report",
+      default: false
+    },
+    ...REGISTRY_CLI_ARGS
+  },
+  async run({ args }) {
+    const manifest = await loadAgentKitManifest(args.cwd);
+    if (!manifest) {
+      logger.warn("No .cursor/agent-kit.json \u2014 run agent-kit install first.");
+      return;
+    }
+    const registry = await resolveRegistryFromCli({
+      cwd: args.cwd,
+      registry: args.registry,
+      url: args.url,
+      ref: args.ref,
+      refresh: args.refresh,
+      manifest
+    });
+    logger.info(`Registry: ${registry.root} (${registry.source})`);
+    const entries = await diffAgainstRegistry(registry.root, args.cwd, manifest);
+    const summary = summarizeDiff(entries);
+    console.log(
+      `Summary: match=${summary.match} drift=${summary.drift} missing-local=${summary["missing-local"]} missing-registry=${summary["missing-registry"]} protected=${summary.protected}`
+    );
+    const rows = args.all ? entries : entries.filter((e) => e.status !== "match");
+    if (rows.length === 0) {
+      logger.success("No drift (matches only).");
+      return;
+    }
+    for (const e of rows) {
+      console.log(`${e.status.padEnd(18)} ${e.path}`);
+    }
+  }
+});
+
+// src/commands/handoff.ts
+import { spawn } from "child_process";
+import { readFile as readFile6, readdir as readdir2, writeFile as writeFile3 } from "fs/promises";
+import path10 from "path";
+import { defineCommand as defineCommand4 } from "citty";
+
+// src/types.ts
+var GIT_PLATFORM_META = {
+  github: {
+    cli: "gh",
+    prTerm: "Pull Request",
+    prCommand: "gh pr create",
+    ciDefault: "github-actions"
+  },
+  gitlab: {
+    cli: "glab",
+    prTerm: "Merge Request",
+    prCommand: "glab mr create",
+    ciDefault: "gitlab-ci"
+  },
+  bitbucket: {
+    cli: "bb",
+    prTerm: "Pull Request",
+    prCommand: "bb pr create",
+    ciDefault: "bitbucket-pipelines"
+  },
+  "azure-devops": {
+    cli: "az repos",
+    prTerm: "Pull Request",
+    prCommand: "az repos pr create",
+    ciDefault: "azure-pipelines"
+  },
+  gitea: { cli: "tea", prTerm: "Pull Request", prCommand: "tea pr create", ciDefault: "none" }
+};
+var CI_PLATFORM_FILES = {
+  "github-actions": ".github/workflows",
+  "gitlab-ci": ".gitlab-ci.yml",
+  "azure-pipelines": "azure-pipelines.yml",
+  "bitbucket-pipelines": "bitbucket-pipelines.yml",
+  jenkins: "Jenkinsfile",
+  circleci: ".circleci/config.yml",
+  travis: ".travis.yml"
+};
+var PM_TOOL_LABELS = {
+  clickup: "ClickUp",
+  jira: "Jira",
+  linear: "Linear",
+  asana: "Asana",
+  "github-issues": "GitHub Issues",
+  "github-projects": "GitHub Projects",
+  "azure-boards": "Azure Boards",
+  trello: "Trello",
+  shortcut: "Shortcut",
+  notion: "Notion",
+  youtrack: "YouTrack",
+  none: "None"
+};
+
+// src/commands/handoff.ts
+function parsePlanFrontmatter(raw) {
+  const match = raw.match(/^---\n([\s\S]*?)\n---/);
+  if (!match?.[1]) return null;
+  const block = match[1];
+  const name = block.match(/^name:\s*(.+)$/m)?.[1]?.trim();
+  const todos = [];
+  const todoBlocks = block.matchAll(/- id:\s*(\S+)\s*\n\s*content:\s*(.+)\n\s*status:\s*(\S+)/g);
+  for (const m of todoBlocks) {
+    if (m[1] && m[2] && m[3]) {
+      todos.push({ id: m[1], content: m[2].replace(/^["']|["']$/g, ""), status: m[3] });
+    }
+  }
+  return { name, todos };
+}
+async function findActivePlan(plansDir) {
+  if (!await fileExists(plansDir)) return null;
+  const files = (await readdir2(plansDir)).filter((f) => f.endsWith(".plan.md")).sort().reverse();
+  for (const file of files) {
+    const raw = await readFile6(path10.join(plansDir, file), "utf8");
+    const fm = parsePlanFrontmatter(raw);
+    if (fm?.todos?.some((t) => t.status !== "completed" && t.status !== "cancelled")) {
+      return { file, raw };
+    }
+  }
+  return files[0] ? { file: files[0], raw: await readFile6(path10.join(plansDir, files[0]), "utf8") } : null;
+}
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 16);
+}
+async function loadProfile(rootDir) {
+  const configPath = path10.join(rootDir, ".cursor", "agent-kit.config.json");
+  try {
+    return await readJson(configPath);
+  } catch {
+    return null;
+  }
+}
+function buildRoutines(profile) {
+  const lines = [];
+  const workflow = profile?.git.workflow;
+  if (workflow === "homolog-prod") {
+    lines.push("- [ ] `git staging` - move changes to staging");
+    lines.push("- [ ] `git prod` - promote to production (after approval)");
+  } else {
+    lines.push("- [ ] Commit, push and open PR/MR");
+  }
+  const pmTools = profile?.services.projectManagement;
+  if (pmTools && pmTools.length > 0) {
+    const labels = pmTools.map((t) => PM_TOOL_LABELS[t]).join(", ");
+    lines.push(`- [ ] Update tasks in ${labels} (if applicable)`);
+  }
+  lines.push("- [ ] Review CHANGELOG");
+  return lines;
+}
+function closingInstruction(profile) {
+  const pmTools = profile?.services.projectManagement;
+  if (pmTools && pmTools.length > 0) {
+    const labels = pmTools.map((t) => PM_TOOL_LABELS[t]).join(", ");
+    return `All todos completed. Check git staging/prod and update ${labels} if applicable.`;
+  }
+  return "All todos completed. Check commit/push and PR/MR.";
+}
+function buildHandoff(planFile, fm, profile) {
+  const completed = fm.todos?.filter((t) => t.status === "completed") ?? [];
+  const pending = fm.todos?.filter((t) => t.status === "pending") ?? [];
+  const inProgress = fm.todos?.filter((t) => t.status === "in_progress") ?? [];
+  const nextTodo = inProgress[0] ?? pending[0];
+  const completedPhase = completed.length;
+  const totalPhases = fm.todos?.length ?? 0;
+  const routines = buildRoutines(profile);
+  return [
+    `# Handoff - ${fm.name ?? planFile}`,
+    "",
+    `- **Plan:** ${planFile}`,
+    `- **Last updated:** ${now()}`,
+    `- **Progress:** ${completedPhase}/${totalPhases} todos completed`,
+    "",
+    "## Completed",
+    ...completed.length > 0 ? completed.map((t) => `- [x] \`${t.id}\`: ${t.content}`) : ["- (none)"],
+    "",
+    "## In progress",
+    ...inProgress.length > 0 ? inProgress.map((t) => `- [ ] \`${t.id}\`: ${t.content}`) : ["- (none)"],
+    "",
+    "## Pending",
+    ...pending.length > 0 ? pending.map((t) => `- [ ] \`${t.id}\`: ${t.content}`) : ["- (none)"],
+    "",
+    "## Instruction for Next Agent",
+    "",
+    nextTodo ? `Continue from todo \`${nextTodo.id}\`: ${nextTodo.content}.` : closingInstruction(profile),
+    "",
+    "## Suggested routines",
+    "",
+    ...routines,
+    "",
+    "---",
+    "*Generated by `agent-kit handoff`. To resume: open new conversation and say `/continue-plan`.*",
+    ""
+  ].join("\n");
+}
+function printV3Guidance() {
+  logger.info("No plan in .cursor/plans/ and no ./cursor-handoff in this directory.");
+  logger.info(
+    "Create a plan with todos or update .cursor/HANDOFF.md manually (/handoff command in Cursor)."
+  );
+  logger.info("Resume in IDE: /resume, summaries and transcripts.");
+}
+function runCursorHandoff(scriptPath, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("sh", [scriptPath, "handoff"], {
+      cwd,
+      stdio: "inherit"
+    });
+    child.on("error", (err) => reject(err));
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}
+var handoffCommand = defineCommand4({
+  meta: {
+    name: "handoff",
+    description: "Write .cursor/HANDOFF.md from the active Cursor plan, or run ./cursor-handoff handoff when no plan exists."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Project root directory",
+      default: process.cwd()
+    }
+  },
+  async run({ args }) {
+    const profile = await loadProfile(args.cwd);
+    const plansDir = path10.join(args.cwd, ".cursor", "plans");
+    const handoffPath = path10.join(args.cwd, ".cursor", "HANDOFF.md");
+    const plan = await findActivePlan(plansDir);
+    if (plan) {
+      const fm = parsePlanFrontmatter(plan.raw);
+      if (fm) {
+        await ensureDir(path10.join(args.cwd, ".cursor"));
+        const content = buildHandoff(plan.file, fm, profile);
+        await writeFile3(handoffPath, content, "utf8");
+        logger.success("HANDOFF.md updated: .cursor/HANDOFF.md");
+        logger.info(
+          `Plan: ${plan.file} (${fm.todos?.filter((t) => t.status === "completed").length}/${fm.todos?.length} completed)`
+        );
+        logger.info("");
+        logger.info("Suggested next steps:");
+        let n = 1;
+        for (const line of buildRoutines(profile)) {
+          logger.info(`  ${n}. ${line.replace(/^- \[ \] /, "")}`);
+          n += 1;
+        }
+        logger.info("");
+        logger.info("To resume: open new conversation and say /continue-plan");
+        return;
+      }
+      logger.warn(`Plan ${plan.file} without valid frontmatter; trying legacy flow.`);
+    }
+    const scriptPath = path10.join(args.cwd, "cursor-handoff");
+    if (!await fileExists(scriptPath)) {
+      printV3Guidance();
+      return;
+    }
+    if (process.platform === "win32") {
+      logger.warn(
+        "cursor-handoff is a shell script. On Windows, run in Git Bash or WSL: sh cursor-handoff handoff"
+      );
+      printV3Guidance();
+      return;
+    }
+    try {
+      const code = await runCursorHandoff(scriptPath, args.cwd);
+      if (code !== 0) {
+        process.exitCode = code;
+      }
+    } catch (err) {
+      logger.warn(`Failed to execute cursor-handoff: ${String(err)}`);
+      printV3Guidance();
+    }
+  }
+});
+
+// src/commands/init.ts
+import path23 from "path";
+import { intro, outro } from "@clack/prompts";
+import { defineCommand as defineCommand5 } from "citty";
+
+// src/generator/index.ts
+import { writeFile as writeFile9 } from "fs/promises";
+import path16 from "path";
+
+// src/generator/agents-md.ts
+import { writeFile as writeFile4 } from "fs/promises";
+import path11 from "path";
+
+// src/generator/platform.ts
+function gitProviderLabel(profile) {
+  const p = profile.git.provider;
+  if (!p || p === "other") return "Git";
+  const labels = {
+    github: "GitHub",
+    gitlab: "GitLab",
+    bitbucket: "Bitbucket",
+    "azure-devops": "Azure DevOps",
+    gitea: "Gitea"
+  };
+  return labels[p] ?? "Git";
+}
+function gitCliTool(profile) {
+  const p = profile.git.provider;
+  if (!p || p === "other") return "git";
+  return GIT_PLATFORM_META[p]?.cli ?? "git";
+}
+function prTerminology(profile) {
+  const p = profile.git.provider;
+  if (!p || p === "other") return "PR/MR";
+  return GIT_PLATFORM_META[p]?.prTerm ?? "PR/MR";
+}
+function pmToolsList(profile) {
+  const tools = profile.services.projectManagement;
+  if (!tools || tools.length === 0) return "";
+  return tools.map((t) => PM_TOOL_LABELS[t]).join(", ");
+}
+function pmRoutineLine(profile) {
+  const label = pmToolsList(profile);
+  if (!label) return "";
+  return `- Update tasks in ${label} (if applicable)`;
+}
+function ciLabel(profile) {
+  const labels = {
+    "github-actions": "GitHub Actions",
+    "gitlab-ci": "GitLab CI",
+    "azure-pipelines": "Azure Pipelines",
+    "bitbucket-pipelines": "Bitbucket Pipelines",
+    jenkins: "Jenkins",
+    circleci: "CircleCI",
+    travis: "Travis CI"
+  };
+  return labels[profile.infra.ci] ?? "";
+}
+function devopsFlowSummary(profile) {
+  const parts = [];
+  const provider = gitProviderLabel(profile);
+  parts.push(`Git: ${provider}`);
+  if (profile.git.workflow !== "unknown") {
+    const workflowLabels = {
+      "trunk-based": "trunk-based",
+      "feature-pr": `feature branch \u2192 ${prTerminology(profile)} \u2192 main`,
+      gitflow: "gitflow (develop/release/main)",
+      "homolog-prod": "staging \u2192 production"
+    };
+    parts.push(`Workflow: ${workflowLabels[profile.git.workflow] ?? profile.git.workflow}`);
+  }
+  const ci = ciLabel(profile);
+  if (ci) parts.push(`CI/CD: ${ci}`);
+  const pm = pmToolsList(profile);
+  if (pm) parts.push(`Project mgmt: ${pm}`);
+  return parts.join(" | ");
+}
+
+// src/generator/agents-md.ts
+async function generateAgentsMd(profile) {
+  const target = path11.join(profile.rootDir, "AGENTS.md");
+  const flow = devopsFlowSummary(profile);
+  const prTerm = prTerminology(profile);
+  const content = `# AGENTS.md
+
+Project configured with Agent Kit v3.
+
+## Detected context
+- Stack: ${profile.stack.language}${profile.stack.framework ? ` (${profile.stack.framework})` : ""}
+- IDE: ${profile.ide.ide} (${profile.ide.plan})
+- ${flow}
+
+## Guidelines
+1. Prefer small, verifiable changes.
+2. Adapt response depth to user's IDE plan/model.
+3. Use /worktree for experiments, /best-of-n for critical decisions (Cursor 3.0).
+4. Security review before merge.
+5. Always create a ${prTerm} \u2014 never push directly to main.
+`;
+  await writeFile4(target, content, "utf8");
+}
+
+// src/generator/cursor.ts
+import { writeFile as writeFile5 } from "fs/promises";
+import path12 from "path";
+function buildGitWorkflowRule(profile) {
+  const prTerm = prTerminology(profile);
+  const cli = gitCliTool(profile);
+  const provider = gitProviderLabel(profile);
+  const pm = pmToolsList(profile);
+  const lines = [
+    "# Git Workflow",
+    `- Platform: ${provider} | CLI: \`${cli}\``,
+    "- Use Conventional Commits (feat:, fix:, docs:, refactor:, chore:, perf:, test:).",
+    "- For risky changes, prefer /worktree (isolated git worktree).",
+    "- For comparing approaches, use /best-of-n."
+  ];
+  if (profile.git.workflow === "homolog-prod") {
+    lines.push(
+      "- Flow: development \u2192 staging \u2192 production.",
+      `- Create ${prTerm} targeting the staging branch; merge to main only via promotion.`,
+      "- NEVER commit directly to main."
+    );
+  } else if (profile.git.workflow === "feature-pr") {
+    lines.push(
+      `- Flow: feature branch \u2192 ${prTerm} \u2192 main.`,
+      `- Always create a ${prTerm} for review before merging.`
+    );
+  } else if (profile.git.workflow === "gitflow") {
+    lines.push(
+      "- Flow: feature \u2192 develop \u2192 release \u2192 main.",
+      `- Create ${prTerm} targeting develop for features, main for releases.`
+    );
+  }
+  if (pm) {
+    lines.push(`- After merge: update task status in ${pm} if integration is available.`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function buildHandoffRule(profile) {
+  const pm = pmRoutineLine(profile);
+  const routines = ["- Suggest routines: git commit/push, review CHANGELOG."];
+  if (pm) routines.push(`${pm}.`);
+  return `# Handoff \u2014 State in File
+- After completing each task: save .cursor/HANDOFF.md with progress and next steps.
+- Update to-dos in the plan (.cursor/plans/) when completing or starting a task.
+- One HANDOFF per project \u2014 source of truth for continuity.
+${routines.join("\n")}
+- To resume: /continue-plan in a new conversation.
+- Native features (summaries, /resume, transcripts, Agents Window) complement \u2014 not replace.
+- Context at ~60%: save handoff and suggest new conversation.
+`;
+}
+function cursorRulesByPlan(profile) {
+  if (profile.ide.plan === "cursor-free") {
+    return [
+      {
+        filename: "01-core.mdc",
+        content: `# Core Rule
+- Respond directly and concisely.
+- Focus on small changes and local validation.
+- Size each task for ~50% of context window.
+`
+      },
+      {
+        filename: "02-handoff.mdc",
+        content: buildHandoffRule(profile)
+      }
+    ];
+  }
+  return [
+    {
+      filename: "01-core.mdc",
+      content: `# Core Rule
+- Execute tasks end-to-end whenever possible.
+- Prioritize security, tests, and architectural consistency.
+- Size each task for ~50% of context window.
+`
+    },
+    {
+      filename: "02-git-workflow.mdc",
+      content: buildGitWorkflowRule(profile)
+    },
+    {
+      filename: "03-handoff.mdc",
+      content: buildHandoffRule(profile)
+    },
+    {
+      filename: "04-ide-guide.mdc",
+      content: `# Cursor Guide
+- Use Agents Window for parallelism \u2014 each agent reads HANDOFF before acting.
+- Use Await for long-running processes.
+- Transcripts and @mentions for cross-reference.
+- /worktree for risky changes.
+- /best-of-n to compare approaches.
+`
+    }
+  ];
+}
+async function generateCursorArtifacts(profile) {
+  const rulesDir = path12.join(profile.rootDir, ".cursor", "rules");
+  const skillsDir = path12.join(profile.rootDir, ".cursor", "skills", "core");
+  const agentsDir = path12.join(profile.rootDir, ".cursor", "agents");
+  const commandsDir = path12.join(profile.rootDir, ".cursor", "commands");
+  await Promise.all([
+    ensureDir(rulesDir),
+    ensureDir(skillsDir),
+    ensureDir(agentsDir),
+    ensureDir(commandsDir)
+  ]);
+  const rules = cursorRulesByPlan(profile);
+  await Promise.all(
+    rules.map((rule) => writeFile5(path12.join(rulesDir, rule.filename), rule.content, "utf8"))
+  );
+  const includeAgents = profile.ide.plan !== "cursor-free";
+  if (includeAgents) {
+    await writeFile5(
+      path12.join(agentsDir, "security-reviewer.md"),
+      "# Security Reviewer\n\nFocus on auth, PII, secrets, injection, and logging.\n",
+      "utf8"
+    );
+  }
+  const ci = ciLabel(profile);
+  const provider = gitProviderLabel(profile);
+  const statusLines = [
+    "# /agent-kit-status",
+    "",
+    "Show current profile and active components.",
+    "",
+    "## DevOps Flow",
+    `- Git: ${provider} (${profile.git.workflow})`
+  ];
+  if (ci) statusLines.push(`- CI/CD: ${ci}`);
+  const pm = pmToolsList(profile);
+  if (pm) statusLines.push(`- Project management: ${pm}`);
+  statusLines.push("");
+  await writeFile5(
+    path12.join(commandsDir, "agent-kit-status.md"),
+    `${statusLines.join("\n")}
+`,
+    "utf8"
+  );
+}
+
+// src/generator/git-hooks.ts
+import { chmod, writeFile as writeFile6 } from "fs/promises";
+import path13 from "path";
+async function generateGitHooks(profile) {
+  if (!profile.installHooks) return;
+  const hooksDir = path13.join(profile.rootDir, ".git", "hooks");
+  await ensureDir(hooksDir);
+  const preCommitPath = path13.join(hooksDir, "pre-commit");
+  const preCommit = `#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v rg >/dev/null 2>&1; then
+  rg -n --hidden --glob '!node_modules/**' '(AKIA|BEGIN PRIVATE KEY|xoxb-)' . && {
+    echo "Potential secret detected. Commit blocked."
+    exit 1
+  } || true
+fi
+`;
+  await writeFile6(preCommitPath, preCommit, "utf8");
+  await chmod(preCommitPath, 493);
+}
+
+// src/generator/vscode.ts
+import { writeFile as writeFile7 } from "fs/promises";
+import path14 from "path";
+async function generateVSCodeArtifacts(profile) {
+  const vscodeDir = path14.join(profile.rootDir, ".vscode");
+  const githubDir = path14.join(profile.rootDir, ".github");
+  await Promise.all([ensureDir(vscodeDir), ensureDir(githubDir)]);
+  await writeFile7(
+    path14.join(vscodeDir, "settings.json"),
+    `${JSON.stringify(
+      {
+        "editor.formatOnSave": true,
+        "editor.codeActionsOnSave": {
+          "source.fixAll": "explicit"
+        },
+        "files.autoSave": "afterDelay"
+      },
+      null,
+      2
+    )}
+`,
+    "utf8"
+  );
+  const provider = gitProviderLabel(profile);
+  const prTerm = prTerminology(profile);
+  await writeFile7(
+    path14.join(githubDir, "copilot-instructions.md"),
+    `# Copilot Instructions
+
+- Keep code changes small and testable.
+- Use Conventional Commits (feat:, fix:, docs:, etc.).
+- Prefer security-safe defaults.
+- Git platform: ${provider}. Always create a ${prTerm} for review.
+`,
+    "utf8"
+  );
+  if (profile.ide.plan === "vscode-pro") {
+    await writeFile7(
+      path14.join(vscodeDir, "security-review.agent.md"),
+      "# Security Review Agent\n\nSpecialized mode for security review.\n",
+      "utf8"
+    );
+  }
+}
+
+// src/generator/windsurf.ts
+import { writeFile as writeFile8 } from "fs/promises";
+import path15 from "path";
+async function generateWindsurfArtifacts(profile) {
+  const provider = gitProviderLabel(profile);
+  const prTerm = prTerminology(profile);
+  const content = `# Windsurf Rules
+- Keep instructions concise and objective.
+- Prefer small diffs and explicit validation.
+- Apply security review before merge.
+- Use Conventional Commits (feat:, fix:, docs:, etc.).
+- Git: ${provider}. Create a ${prTerm} for every change.
+`;
+  await writeFile8(path15.join(profile.rootDir, ".windsurfrules"), content, "utf8");
+}
+
+// src/generator/index.ts
+async function generateFromProfile(profile) {
+  await generateAgentsMd(profile);
+  await generateGitHooks(profile);
+  if (profile.ide.ide === "cursor" || profile.ide.plan.startsWith("cursor")) {
+    await generateCursorArtifacts(profile);
+  }
+  if (profile.ide.ide === "vscode" || profile.ide.plan.startsWith("vscode")) {
+    await generateVSCodeArtifacts(profile);
+  }
+  if (profile.ide.ide === "windsurf" || profile.ide.plan === "windsurf") {
+    await generateWindsurfArtifacts(profile);
+  }
+  if (profile.ide.plan === "default") {
+    await Promise.all([
+      generateCursorArtifacts(profile),
+      generateVSCodeArtifacts(profile),
+      generateWindsurfArtifacts(profile)
+    ]);
+  }
+  const pluginDir = path16.join(profile.rootDir, ".cursor-plugin");
+  await ensureDir(pluginDir);
+  await writeFile9(
+    path16.join(pluginDir, "plugin.json"),
+    `${JSON.stringify(
+      {
+        name: "agent-kit",
+        displayName: "Agent Kit",
+        author: "agent-kit-startup",
+        description: "Bootstrap de ambiente dev com IA (Cursor, VS Code, Windsurf)",
+        keywords: ["agents", "context", "automation", "multi-ide"],
+        license: "MIT",
+        version: "3.0.0"
+      },
+      null,
+      2
+    )}
+`,
+    "utf8"
+  );
+}
+
+// src/scanner/scan.ts
+import path22 from "path";
+
+// src/scanner/detect-git.ts
+import { execFile as execFile2 } from "child_process";
+import path17 from "path";
+import { promisify as promisify2 } from "util";
+var exec = promisify2(execFile2);
+function detectProvider(remoteUrl) {
+  if (!remoteUrl) return void 0;
+  if (remoteUrl.includes("github")) return "github";
+  if (remoteUrl.includes("gitlab")) return "gitlab";
+  if (remoteUrl.includes("bitbucket")) return "bitbucket";
+  if (remoteUrl.includes("dev.azure.com") || remoteUrl.includes("visualstudio.com"))
+    return "azure-devops";
+  if (remoteUrl.includes("gitea") || remoteUrl.includes("codeberg")) return "gitea";
+  return "other";
+}
+function inferWorkflow(currentBranch) {
+  if (!currentBranch) return "unknown";
+  if (currentBranch === "main" || currentBranch === "master") return "feature-pr";
+  if (currentBranch.includes("develop") || currentBranch.includes("release")) return "gitflow";
+  if (currentBranch.includes("staging") || currentBranch.includes("homolog")) return "homolog-prod";
+  return "feature-pr";
+}
+async function runGit(args, rootDir) {
+  try {
+    const { stdout } = await exec("git", args, { cwd: rootDir });
+    return stdout.trim();
+  } catch {
+    return void 0;
+  }
+}
+async function detectGit(rootDir) {
+  const hasGit = await fileExists(path17.join(rootDir, ".git"));
+  if (!hasGit) return { workflow: "unknown" };
+  const remoteUrl = await runGit(["remote", "get-url", "origin"], rootDir);
+  const currentBranch = await runGit(["branch", "--show-current"], rootDir);
+  return {
+    provider: detectProvider(remoteUrl),
+    remoteUrl,
+    currentBranch,
+    workflow: inferWorkflow(currentBranch)
+  };
+}
+
+// src/scanner/detect-ide.ts
+import path18 from "path";
+async function detectIde(rootDir) {
+  const hasCursor = await fileExists(path18.join(rootDir, ".cursor"));
+  const hasVSCode = await fileExists(path18.join(rootDir, ".vscode"));
+  const hasWindsurf = await fileExists(path18.join(rootDir, ".windsurfrules"));
+  if (hasCursor) return { ide: "cursor", plan: "cursor-pro" };
+  if (hasVSCode) return { ide: "vscode", plan: "vscode-pro" };
+  if (hasWindsurf) return { ide: "windsurf", plan: "windsurf" };
+  return { ide: "unknown", plan: "default" };
+}
+
+// src/scanner/detect-infra.ts
+import path19 from "path";
+async function detectInfra(rootDir) {
+  const docker = await fileExists(path19.join(rootDir, "Dockerfile")) || await fileExists(path19.join(rootDir, "docker-compose.yml")) || await fileExists(path19.join(rootDir, "docker-compose.yaml"));
+  const kubernetes = await fileExists(path19.join(rootDir, "k8s")) || await fileExists(path19.join(rootDir, "kubernetes"));
+  let ci = "none";
+  for (const [platform, filePath] of Object.entries(CI_PLATFORM_FILES)) {
+    if (await fileExists(path19.join(rootDir, filePath))) {
+      ci = platform;
+      break;
+    }
+  }
+  return { docker, kubernetes, ci };
+}
+
+// src/scanner/detect-services.ts
+import { readFile as readFile7 } from "fs/promises";
+import path20 from "path";
+async function detectProjectManagement(rootDir) {
+  const tools = [];
+  const mcpConfigPaths = [
+    path20.join(rootDir, ".cursor", "mcp.json"),
+    path20.join(rootDir, "mcp.json")
+  ];
+  for (const configPath of mcpConfigPaths) {
+    if (!await fileExists(configPath)) continue;
+    try {
+      const raw = await readFile7(configPath, "utf8");
+      const lower = raw.toLowerCase();
+      if (lower.includes("clickup")) tools.push("clickup");
+      if (lower.includes("jira") || lower.includes("atlassian")) tools.push("jira");
+      if (lower.includes("linear")) tools.push("linear");
+      if (lower.includes("asana")) tools.push("asana");
+      if (lower.includes("youtrack")) tools.push("youtrack");
+      if (lower.includes("shortcut")) tools.push("shortcut");
+    } catch {
+    }
+  }
+  if (await fileExists(path20.join(rootDir, ".github", "ISSUE_TEMPLATE"))) {
+    tools.push("github-issues");
+  }
+  if (await fileExists(path20.join(rootDir, ".github", "projects"))) {
+    tools.push("github-projects");
+  }
+  return [...new Set(tools)];
+}
+async function detectServices(rootDir) {
+  const hasPrisma = await fileExists(path20.join(rootDir, "prisma/schema.prisma"));
+  const hasSequelize = await fileExists(path20.join(rootDir, "sequelize"));
+  const hasDrizzle = await fileExists(path20.join(rootDir, "drizzle.config.ts"));
+  const hasKnex = await fileExists(path20.join(rootDir, "knexfile.ts"));
+  const hasTypeorm = await fileExists(path20.join(rootDir, "ormconfig.json"));
+  const database = hasPrisma || hasSequelize || hasDrizzle || hasKnex || hasTypeorm ? "postgresql" : void 0;
+  const orm = hasPrisma ? "prisma" : hasDrizzle ? "drizzle" : hasSequelize ? "sequelize" : hasKnex ? "knex" : hasTypeorm ? "typeorm" : void 0;
+  const projectManagement = await detectProjectManagement(rootDir);
+  return {
+    database,
+    orm,
+    projectManagement: projectManagement.length > 0 ? projectManagement : void 0
+  };
+}
+
+// src/scanner/detect-stack.ts
+import path21 from "path";
+var PROJECT_MARKERS = [
+  "package.json",
+  "requirements.txt",
+  "pyproject.toml",
+  "go.mod",
+  "Gemfile",
+  "pom.xml",
+  "build.gradle",
+  "composer.json",
+  "Cargo.toml"
+];
+async function detectStack(rootDir) {
+  const hasAnyProjectMarker = (await Promise.all(PROJECT_MARKERS.map((item) => fileExists(path21.join(rootDir, item))))).some(Boolean);
+  const hasPackageJson = await fileExists(path21.join(rootDir, "package.json"));
+  if (hasPackageJson) {
+    const hasNextConfig = await fileExists(path21.join(rootDir, "next.config.js")) || await fileExists(path21.join(rootDir, "next.config.mjs")) || await fileExists(path21.join(rootDir, "next.config.ts"));
+    const hasNestConfig = await fileExists(path21.join(rootDir, "nest-cli.json"));
+    return {
+      language: "node",
+      framework: hasNextConfig ? "nextjs" : hasNestConfig ? "nestjs" : "node",
+      packageManager: "pnpm",
+      hasProjectFiles: hasAnyProjectMarker
+    };
+  }
+  if (await fileExists(path21.join(rootDir, "pyproject.toml"))) {
+    return { language: "python", framework: "python", hasProjectFiles: hasAnyProjectMarker };
+  }
+  if (await fileExists(path21.join(rootDir, "go.mod"))) {
+    return { language: "go", framework: "go", hasProjectFiles: hasAnyProjectMarker };
+  }
+  if (await fileExists(path21.join(rootDir, "Cargo.toml"))) {
+    return { language: "rust", framework: "rust", hasProjectFiles: hasAnyProjectMarker };
+  }
+  if (await fileExists(path21.join(rootDir, "composer.json"))) {
+    return { language: "php", framework: "php", hasProjectFiles: hasAnyProjectMarker };
+  }
+  return { language: "unknown", hasProjectFiles: hasAnyProjectMarker };
+}
+
+// src/scanner/scan.ts
+var GREENFIELD_SAFE_FILES = /* @__PURE__ */ new Set([
+  ".git",
+  ".gitignore",
+  "LICENSE",
+  "README.md",
+  ".cursor",
+  ".vscode"
+]);
+function isGreenfieldByEntries(entries) {
+  const meaningful = entries.filter((entry) => !GREENFIELD_SAFE_FILES.has(entry));
+  return meaningful.length === 0;
+}
+async function runScanner(rootDir) {
+  const normalizedRoot = path22.resolve(rootDir);
+  const entries = await listDirectory(normalizedRoot);
+  const stack = await detectStack(normalizedRoot);
+  const isGreenfield = isGreenfieldByEntries(entries) || !stack.hasProjectFiles;
+  return {
+    rootDir: normalizedRoot,
+    isGreenfield,
+    stack,
+    git: await detectGit(normalizedRoot),
+    ide: await detectIde(normalizedRoot),
+    infra: await detectInfra(normalizedRoot),
+    services: await detectServices(normalizedRoot)
+  };
+}
+
+// src/utils/prompts.ts
+import { cancel, confirm, isCancel, multiselect, select, text } from "@clack/prompts";
+function ensureNotCancelled(value) {
+  if (isCancel(value)) {
+    cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  return value;
+}
+async function askIdeAndPlan(current) {
+  const ide = ensureNotCancelled(
+    await select({
+      message: "Which is your main IDE?",
+      initialValue: current.ide === "unknown" ? void 0 : current.ide,
+      options: [
+        { label: "Cursor", value: "cursor" },
+        { label: "VS Code", value: "vscode" },
+        { label: "Windsurf", value: "windsurf" },
+        { label: "Other", value: "other" }
+      ]
+    })
+  );
+  const plan = ensureNotCancelled(
+    await select({
+      message: "What's your IDE plan?",
+      initialValue: current.plan === "default" ? void 0 : current.plan,
+      options: [
+        { label: "Cursor Free", value: "cursor-free" },
+        { label: "Cursor Pro / Business", value: "cursor-pro" },
+        { label: "VS Code + Copilot Free", value: "vscode-free" },
+        { label: "VS Code + Copilot Pro / Business", value: "vscode-pro" },
+        { label: "Windsurf", value: "windsurf" },
+        { label: "Don't know / default", value: "default" }
+      ]
+    })
+  );
+  return { ide, plan };
+}
+async function askGitWorkflow(current) {
+  return ensureNotCancelled(
+    await select({
+      message: "What's your Git workflow?",
+      initialValue: current === "unknown" ? void 0 : current,
+      options: [
+        { label: "trunk-based (direct to main)", value: "trunk-based" },
+        { label: "feature branch -> PR/MR -> main", value: "feature-pr" },
+        { label: "gitflow (develop/release/main)", value: "gitflow" },
+        { label: "staging -> production (staging -> main)", value: "homolog-prod" }
+      ]
+    })
+  );
+}
+async function askProjectManagement(existing = []) {
+  return ensureNotCancelled(
+    await multiselect({
+      message: "Do you use any project management system?",
+      initialValues: existing,
+      options: [
+        { label: "GitHub Issues / Projects", value: "github-issues" },
+        { label: "Jira", value: "jira" },
+        { label: "Linear", value: "linear" },
+        { label: "ClickUp", value: "clickup" },
+        { label: "Azure Boards", value: "azure-boards" },
+        { label: "Asana", value: "asana" },
+        { label: "Trello", value: "trello" },
+        { label: "Shortcut", value: "shortcut" },
+        { label: "Notion", value: "notion" },
+        { label: "YouTrack", value: "youtrack" }
+      ],
+      required: false
+    })
+  );
+}
+async function runExistingProjectWizard(scan) {
+  const ide = await askIdeAndPlan(scan.ide);
+  const workflow = await askGitWorkflow(scan.git.workflow);
+  const projectManagement = await askProjectManagement(scan.services.projectManagement ?? []);
+  const installHooks = ensureNotCancelled(
+    await confirm({
+      message: "Install git hooks? (pre-commit: secrets + lint)",
+      initialValue: true
+    })
+  );
+  return {
+    rootDir: scan.rootDir,
+    stack: scan.stack,
+    git: { ...scan.git, workflow },
+    ide,
+    infra: scan.infra,
+    services: {
+      ...scan.services,
+      projectManagement: projectManagement.length > 0 ? projectManagement : void 0
+    },
+    installHooks,
+    selectedCoreComponents: [
+      "git-workflow",
+      "security-review",
+      "clean-code",
+      "docs-repo",
+      "ide-guide"
+    ]
+  };
+}
+async function runGreenfieldWizard(scan) {
+  const language = ensureNotCancelled(
+    await select({
+      message: "What will be the main stack?",
+      options: [
+        { label: "Node.js (JavaScript/TypeScript)", value: "node" },
+        { label: "Python", value: "python" },
+        { label: "Go", value: "go" },
+        { label: "Ruby", value: "ruby" },
+        { label: "Java / Kotlin", value: "java" },
+        { label: "PHP", value: "php" },
+        { label: "Rust", value: "rust" },
+        { label: "C# / .NET", value: "dotnet" },
+        { label: "Other", value: "other" }
+      ]
+    })
+  );
+  const framework = ensureNotCancelled(
+    await text({
+      message: "Main framework? (ex: nextjs, nestjs, django, rails, spring, none)",
+      placeholder: "none",
+      initialValue: "none",
+      validate(value) {
+        return value.trim().length === 0 ? "Enter a framework or 'none'" : void 0;
+      }
+    })
+  );
+  const database = ensureNotCancelled(
+    await select({
+      message: "Will you use a database?",
+      options: [
+        { label: "PostgreSQL", value: "postgresql" },
+        { label: "MySQL", value: "mysql" },
+        { label: "MongoDB", value: "mongodb" },
+        { label: "SQLite", value: "sqlite" },
+        { label: "SQL Server", value: "sqlserver" },
+        { label: "None for now", value: "none" }
+      ]
+    })
+  );
+  const orm = ensureNotCancelled(
+    await text({
+      message: "ORM / query builder?",
+      placeholder: "prisma, drizzle, sequelize, typeorm, none",
+      initialValue: "none"
+    })
+  );
+  const ide = await askIdeAndPlan(scan.ide);
+  const workflow = await askGitWorkflow(scan.git.workflow);
+  const projectManagement = await askProjectManagement();
+  const installHooks = ensureNotCancelled(
+    await confirm({
+      message: "Install git hooks? (pre-commit: secrets + lint)",
+      initialValue: true
+    })
+  );
+  return {
+    rootDir: scan.rootDir,
+    stack: {
+      language,
+      framework: framework === "none" ? void 0 : framework,
+      hasProjectFiles: false
+    },
+    git: {
+      ...scan.git,
+      workflow
+    },
+    ide,
+    infra: scan.infra,
+    services: {
+      database: database === "none" ? void 0 : database,
+      orm: orm === "none" ? void 0 : orm,
+      projectManagement: projectManagement.length > 0 ? projectManagement : void 0
+    },
+    installHooks,
+    selectedCoreComponents: [
+      "git-workflow",
+      "security-review",
+      "clean-code",
+      "docs-repo",
+      "ide-guide"
+    ]
+  };
+}
+
+// src/commands/init.ts
+var initCommand = defineCommand5({
+  meta: {
+    name: "init",
+    description: "Run scanner + wizard + generation setup."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Project root directory",
+      default: process.cwd()
+    }
+  },
+  async run({ args }) {
+    intro("agent-kit v3.0.0");
+    const scan = await runScanner(args.cwd);
+    logger.info(`Root: ${scan.rootDir}`);
+    logger.info(
+      scan.isGreenfield ? "Empty repo detected (greenfield)." : "Existing project detected."
+    );
+    const profile = scan.isGreenfield ? await runGreenfieldWizard(scan) : await runExistingProjectWizard(scan);
+    const configPath = path23.join(scan.rootDir, ".cursor", "agent-kit.config.json");
+    await writeJson(configPath, profile);
+    logger.success(`Profile saved in ${configPath}`);
+    await generateFromProfile(profile);
+    try {
+      const registry = await resolveRegistryRoot({ cwd: scan.rootDir });
+      const stats = await installSkillsByIds(
+        registry.root,
+        scan.rootDir,
+        profile.selectedCoreComponents
+      );
+      if (stats.written.length > 0) {
+        logger.success(`Skills installed: ${stats.written.join(", ")}`);
+      } else if (stats.missing.length > 0) {
+        logger.warn(`Skills not found in registry: ${stats.missing.join(", ")}`);
+      } else {
+        logger.info("No new skills to copy (already installed or empty selection).");
+      }
+    } catch {
+      logger.info(
+        "Registry unavailable in this directory: use agent-kit install / agent-kit add <id> with --registry or remote cache."
+      );
+    }
+    outro("Setup completed.");
+  }
+});
+
+// src/commands/install.ts
+import { defineCommand as defineCommand6 } from "citty";
+
+// src/lifecycle/sync.ts
+async function installL0(registryRoot, projectRoot, protectedGlobs) {
+  const stats = emptyStats();
+  for (const artifact of L0_ARTIFACTS) {
+    const outcome = await copyRegistryFile(
+      registryRoot,
+      projectRoot,
+      artifact.source,
+      artifact.target,
+      protectedGlobs
+    );
+    recordOutcome(stats, artifact.target, outcome);
+  }
+  return stats;
+}
+async function syncFromManifest(registryRoot, projectRoot, manifest) {
+  const protectedGlobs = resolveProtectedGlobs(manifest);
+  const stats = emptyStats();
+  mergeStats(stats, await installL0(registryRoot, projectRoot, protectedGlobs));
+  for (const packId of manifest.packs ?? []) {
+    mergeStats(stats, await installPack(registryRoot, projectRoot, packId, { protectedGlobs }));
+  }
+  const skillIds = manifest.skills ?? [];
+  if (skillIds.length > 0) {
+    await loadRegistry(registryRoot);
+    mergeStats(
+      stats,
+      await installSkillsByIds(registryRoot, projectRoot, skillIds, { protectedGlobs })
+    );
+  }
+  return stats;
+}
+
+// src/commands/install.ts
+function parsePackList(raw) {
+  if (!raw?.trim()) return [];
+  return [
+    ...new Set(
+      raw.split(",").map((s) => s.trim()).filter(Boolean)
+    )
+  ];
+}
+var installCommand = defineCommand6({
+  meta: {
+    name: "install",
+    description: "Bootstrap L0 (+ optional packs) from the registry and write agent-kit.json."
+  },
+  args: {
+    profile: {
+      type: "positional",
+      description: "Install profile name stored in the manifest (default: default)",
+      required: false
+    },
+    pack: {
+      type: "string",
+      description: `Comma-separated L1 pack ids (e.g. cybersec,devops). Known: ${DOMAIN_PACK_IDS.join(", ")}`
+    },
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    ...REGISTRY_CLI_ARGS
+  },
+  async run({ args }) {
+    const packs = parsePackList(args.pack);
+    for (const id of packs) {
+      if (!DOMAIN_PACK_IDS.includes(id)) {
+        logger.warn(`Pack '${id}' is not in the known L1 list \u2014 will still try registry.`);
+      }
+    }
+    const existing = await loadAgentKitManifest(args.cwd);
+    const registry = await resolveRegistryFromCli({
+      cwd: args.cwd,
+      registry: args.registry,
+      url: args.url,
+      ref: args.ref,
+      refresh: args.refresh,
+      manifest: existing
+    });
+    logger.info(`Registry: ${registry.root} (${registry.source})`);
+    const draft = buildManifest({
+      version: KIT_VERSION,
+      profile: args.profile ?? existing?.profile ?? "default",
+      packs: packs.length > 0 ? packs : existing?.packs,
+      skills: existing?.skills,
+      protected: existing?.protected,
+      registryUrl: registry.url ?? existing?.registry?.url,
+      registryRef: registry.ref ?? existing?.registry?.ref
+    });
+    let stats;
+    if ((draft.packs?.length ?? 0) > 0 || (draft.skills?.length ?? 0) > 0) {
+      stats = await syncFromManifest(registry.root, args.cwd, draft);
+    } else {
+      const protectedGlobs = resolveProtectedGlobs(draft);
+      stats = await installL0(registry.root, args.cwd, protectedGlobs);
+    }
+    const manifestPath = await saveManifest(args.cwd, draft);
+    logApplyStats(stats);
+    logger.success(`Manifest written: ${manifestPath}`);
+  }
+});
+
+// src/commands/run-plan.ts
+import path27 from "path";
+import { defineCommand as defineCommand7 } from "citty";
+
+// src/plan-loop/backends.ts
+import { execFileSync, spawn as spawn2 } from "child_process";
+import { createWriteStream } from "fs";
+async function which(bin) {
+  try {
+    const out = execFileSync("which", [bin], { encoding: "utf8" }).trim();
+    return out || null;
+  } catch {
+    return null;
+  }
+}
+function spawnLogged(command, args, logPath) {
+  return new Promise((resolve, reject) => {
+    const out = createWriteStream(logPath, { flags: "w" });
+    const child = spawn2(command, args, {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const onData = (chunk) => {
+      process.stdout.write(chunk);
+      out.write(chunk);
+    };
+    child.stdout?.on("data", onData);
+    child.stderr?.on("data", onData);
+    child.on("error", (err) => {
+      out.end();
+      reject(err);
+    });
+    child.on("close", (code) => {
+      out.end(() => resolve({ exitCode: code ?? 1 }));
+    });
+  });
+}
+var cursorAgentBackend = {
+  id: "cursor-agent",
+  async resolve() {
+    return which("cursor-agent");
+  },
+  async run(opts) {
+    const args = [
+      "-p",
+      "--force",
+      "--sandbox",
+      "disabled",
+      "--output-format",
+      "stream-json",
+      "--workspace",
+      opts.workspace
+    ];
+    if (opts.model) {
+      args.push("--model", opts.model);
+    }
+    args.push(opts.prompt);
+    return spawnLogged("cursor-agent", args, opts.logPath);
+  }
+};
+var claudeBackend = {
+  id: "claude",
+  async resolve() {
+    return which("claude");
+  },
+  async run(_opts) {
+    throw new Error(
+      "Backend 'claude' is reserved but not implemented yet. Use --backend cursor-agent."
+    );
+  }
+};
+var BACKENDS = {
+  "cursor-agent": cursorAgentBackend,
+  claude: claudeBackend
+};
+function getBackend(id) {
+  const backend = BACKENDS[id];
+  if (!backend) {
+    throw new Error(`Unknown backend '${id}'. Supported: ${Object.keys(BACKENDS).join(", ")}`);
+  }
+  return backend;
+}
+function listBackendIds() {
+  return Object.keys(BACKENDS);
+}
+
+// src/plan-loop/run-loop.ts
+import { mkdir as mkdir4, readFile as readFile10, rm, unlink } from "fs/promises";
+import path26 from "path";
+
+// src/plan-loop/external-review.ts
+import { spawn as spawn3 } from "child_process";
+import path24 from "path";
+var SCRIPT_REL = path24.join("scripts", "plan-external-review.sh");
+function isPlanExhaustedReason(reason) {
+  const r = reason.trim().toLowerCase();
+  if (!r) return false;
+  if (r.includes("plan exhausted")) return true;
+  if (r.includes("nothing to do")) return true;
+  if (r.includes("no implementable")) return true;
+  if (/\ball\s+(implementable\s+)?to-?dos?\b/.test(r) && (r.includes("completed") || r.includes("done") || r.includes("exhausted"))) {
+    return true;
+  }
+  return false;
+}
+function shouldArmExternalPlanReview(input) {
+  if (input.pending === 0) return true;
+  if (input.stopReason && isPlanExhaustedReason(input.stopReason)) return true;
+  return false;
+}
+async function armExternalPlanReview(root, deps = {}) {
+  const spawnFn = deps.spawnFn ?? spawn3;
+  const existsFn = deps.existsFn ?? fileExists;
+  const log = deps.log ?? ((line) => console.log(line));
+  const scriptPath = path24.join(root, SCRIPT_REL);
+  if (!await existsFn(scriptPath)) {
+    log(
+      `tip: ${SCRIPT_REL} missing. Manual: /plan-external-review (enable externalPlanReview in .cursor/context/config.json).`
+    );
+    return { invoked: false, exitCode: null, output: "" };
+  }
+  log("Plan exhausted: arming optional external plan review (opt-in handled by script)...");
+  return new Promise((resolve) => {
+    const child = spawnFn("bash", [scriptPath], {
+      cwd: root,
+      env: process.env
+    });
+    let output = "";
+    const append = (chunk) => {
+      const s = String(chunk);
+      output += s;
+      process.stdout.write(s);
+    };
+    child.stdout?.on("data", append);
+    child.stderr?.on("data", (chunk) => {
+      const s = String(chunk);
+      output += s;
+      process.stderr.write(s);
+    });
+    child.on("error", (err) => {
+      log(
+        `tip: external plan review launcher failed (${err.message}). Manual: ${SCRIPT_REL} or /plan-external-review`
+      );
+      resolve({ invoked: true, exitCode: null, output });
+    });
+    child.on("close", (code) => {
+      if (code !== 0 && code !== null) {
+        log(
+          `tip: external plan review exited ${code} (ignored; does not fail the loop). Manual: ${SCRIPT_REL} or /plan-external-review`
+        );
+      }
+      resolve({ invoked: true, exitCode: code, output });
+    });
+  });
+}
+
+// src/plan-loop/plan-state.ts
+import { readFile as readFile8, readdir as readdir3 } from "fs/promises";
+import path25 from "path";
+function countPendingTodos(raw) {
+  const lines = raw.split(/\r?\n/);
+  let inFront = 0;
+  let cont = false;
+  let n = 0;
+  for (const line of lines) {
+    if (line === "---") {
+      inFront += 1;
+      continue;
+    }
+    if (inFront !== 1) continue;
+    const idMatch = line.match(/^- id:\s*(\S+)/);
+    if (idMatch?.[1]) {
+      cont = idMatch[1] === "dogfood-poc";
+    }
+    if (/content:.*[Cc]ont[ií]nuo/.test(line)) {
+      cont = true;
+    }
+    if (/status:\s*(pending|in_progress)\b/.test(line) && !cont) {
+      n += 1;
+    }
+  }
+  return n;
+}
+async function findActivePlanFile(plansDir) {
+  if (!await fileExists(plansDir)) return null;
+  const files = (await readdir3(plansDir)).filter((f) => f.endsWith(".plan.md")).sort();
+  return files[0] ? path25.join(plansDir, files[0]) : null;
+}
+async function readPlan(planPath) {
+  return readFile8(planPath, "utf8");
+}
+
+// src/plan-loop/sentinel.ts
+import { readFile as readFile9 } from "fs/promises";
+var SENTINEL_RE = /LOOP_TICK_RESULT:\s*(continue|stop(?:\s*[—\-].*)?)/i;
+function takeFromText(text2) {
+  if (!text2) return null;
+  const m = SENTINEL_RE.exec(text2);
+  if (!m?.[1]) return null;
+  const raw = m[1].trim();
+  if (raw.toLowerCase().startsWith("stop")) {
+    const reason = raw.slice(4).replace(/^[—\-\s]+/, "").trim() || "requested by agent";
+    return { kind: "stop", reason };
+  }
+  return { kind: "continue" };
+}
+function parseSentinelFromLog(content) {
+  let last = null;
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (!trimmed.startsWith("{")) {
+      const hit = takeFromText(trimmed);
+      if (hit) last = hit;
+      continue;
+    }
+    try {
+      const ev = JSON.parse(trimmed);
+      if (ev.type === "result" && typeof ev.result === "string") {
+        const hit = takeFromText(ev.result);
+        if (hit) last = hit;
+      }
+      const parts = ev.message?.content;
+      if (Array.isArray(parts)) {
+        for (const part of parts) {
+          if (part && typeof part === "object" && part.type === "text" && typeof part.text === "string") {
+            const hit = takeFromText(part.text);
+            if (hit) last = hit;
+          }
+        }
+      }
+    } catch {
+      const hit = takeFromText(trimmed);
+      if (hit) last = hit;
+    }
+  }
+  return last ?? { kind: "missing" };
+}
+async function parseSentinelFromLogFile(logPath) {
+  try {
+    const content = await readFile9(logPath, "utf8");
+    return parseSentinelFromLog(content);
+  } catch {
+    return { kind: "missing" };
+  }
+}
+function formatSentinelLine(sentinel) {
+  if (sentinel.kind === "continue") return "LOOP_TICK_RESULT: continue";
+  if (sentinel.kind === "stop") return `LOOP_TICK_RESULT: stop - ${sentinel.reason}`;
+  return "";
+}
+
+// src/plan-loop/run-loop.ts
+var TICK_PROMPT = '/run-plan - single tick from the headless runner (agent-kit run-plan). Read .cursor/HANDOFF.md and the active plan in .cursor/plans/. Mark the next to-do as in_progress in the frontmatter, execute ONLY that to-do, mark completed and update HANDOFF. If there is a commitable diff: run /git-staging without asking for confirmation. NEVER /git-prod. Do NOT re-arm an internal Loop skill - the external runner starts the next agent. End the response with exactly one line: "LOOP_TICK_RESULT: continue" if implementable to-dos remain, or "LOOP_TICK_RESULT: stop - <reason>" (plan exhausted, external blocker, or human decision needed).';
+function stamp() {
+  const d = /* @__PURE__ */ new Date();
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}${p(d.getMilliseconds(), 3)}`;
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function runPlanLoop(opts) {
+  const plansDir = path26.join(opts.root, ".cursor", "plans");
+  const stopFile = path26.join(opts.root, ".cursor", "loop.stop");
+  const logDir = path26.join(opts.root, ".cursor", "loop-logs");
+  const planPath = await findActivePlanFile(plansDir);
+  if (!planPath) {
+    logger.error("No active plan in .cursor/plans/");
+    return 1;
+  }
+  const pending = async () => countPendingTodos(await readPlan(planPath));
+  await mkdir4(logDir, { recursive: true });
+  try {
+    await unlink(stopFile);
+  } catch {
+  }
+  const onSigInt = () => {
+    console.log("");
+    console.log("Loop interrupted (Ctrl+C). State saved in HANDOFF by the last tick.");
+    process.exit(130);
+  };
+  process.on("SIGINT", onSigInt);
+  try {
+    console.log(`Active plan: ${path26.basename(planPath)}`);
+    console.log(`Pending to-dos: ${await pending()} | max ticks: ${opts.maxTicks}`);
+    console.log(`Backend: ${opts.backend.id}`);
+    if (opts.dryRun) {
+      console.log("--dry-run: no agent will be started. Tick prompt:");
+      console.log(TICK_PROMPT);
+      return 0;
+    }
+    const binary = await opts.backend.resolve();
+    if (!binary) {
+      logger.error(`${opts.backend.id} not found on PATH`);
+      return 1;
+    }
+    let tick = 0;
+    let stopReason;
+    let planExhausted = false;
+    while (true) {
+      tick += 1;
+      if (tick > opts.maxTicks) {
+        console.log(`Budget of ${opts.maxTicks} ticks reached - stopping. Run again to continue.`);
+        break;
+      }
+      if (await fileExists(stopFile)) {
+        console.log(`Stop file found (${stopFile}) - stopping.`);
+        try {
+          await rm(stopFile, { force: true });
+        } catch {
+        }
+        break;
+      }
+      const before = await pending();
+      if (before === 0) {
+        console.log("Plan exhausted (0 pending to-dos) - nothing to do.");
+        planExhausted = true;
+        break;
+      }
+      const logPath = path26.join(logDir, `tick-${stamp()}.log`);
+      const relLog = path26.relative(opts.root, logPath);
+      console.log("");
+      console.log(`=== tick ${tick}/${opts.maxTicks} - pending: ${before} - log: ${relLog} ===`);
+      let agentExit = 0;
+      try {
+        const result = await opts.backend.run({
+          workspace: opts.root,
+          prompt: TICK_PROMPT,
+          model: opts.model,
+          logPath
+        });
+        agentExit = result.exitCode;
+      } catch (err) {
+        logger.error(String(err));
+        return 1;
+      }
+      try {
+        const logText = await readFile10(logPath, "utf8");
+        if (logText.includes("Too many MCP tools")) {
+          console.log(
+            "Too many MCP tools for the headless model - disable servers (cursor-agent mcp disable <id>) and run again."
+          );
+          break;
+        }
+      } catch {
+      }
+      if (agentExit !== 0) {
+        console.log(
+          `${opts.backend.id} exited with code ${agentExit} - stopping. See log: ${logPath}`
+        );
+        break;
+      }
+      const sentinel = await parseSentinelFromLogFile(logPath);
+      const after = await pending();
+      if (sentinel.kind === "continue") {
+      } else if (sentinel.kind === "stop") {
+        console.log(`Agent requested stop: ${formatSentinelLine(sentinel)}`);
+        stopReason = sentinel.reason;
+        if (after === 0 || isPlanExhaustedReason(sentinel.reason)) {
+          planExhausted = true;
+        }
+        break;
+      } else if (after < before) {
+        console.log(
+          `warn: tick without sentinel, but progress (${before} -> ${after}) - continuing.`
+        );
+      } else {
+        console.log(
+          `Tick without sentinel and no progress (${before} -> ${after}) - stopping for safety.`
+        );
+        break;
+      }
+      if (after === 0) {
+        console.log("All to-dos completed. Suggesting /git-prod stays with the human (HITL).");
+        planExhausted = true;
+        break;
+      }
+      if (opts.sleepSeconds > 0) {
+        await sleep(opts.sleepSeconds * 1e3);
+      }
+    }
+    const pendingNow = await pending();
+    console.log("");
+    console.log(
+      `Loop finished after ${tick} tick(s). Pending now: ${pendingNow}. Logs in ${path26.relative(opts.root, logDir)}/`
+    );
+    if (planExhausted || shouldArmExternalPlanReview({ pending: pendingNow, stopReason })) {
+      await armExternalPlanReview(opts.root);
+    }
+    return 0;
+  } finally {
+    process.off("SIGINT", onSigInt);
+  }
+}
+
+// src/commands/run-plan.ts
+var runPlanCommand = defineCommand7({
+  meta: {
+    name: "run-plan",
+    description: "Headless continuous plan runner: one fresh agent per tick (LOOP_TICK_RESULT contract). Never git-prod."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Project root (default: current directory)",
+      default: process.cwd()
+    },
+    "max-ticks": {
+      type: "string",
+      description: "Maximum ticks before stopping (default: 10)",
+      default: "10"
+    },
+    model: {
+      type: "string",
+      description: "Optional model id passed to the agent backend",
+      default: ""
+    },
+    sleep: {
+      type: "string",
+      description: "Seconds to sleep between ticks (default: 5)",
+      default: "5"
+    },
+    backend: {
+      type: "string",
+      description: `Agent backend (${listBackendIds().join(" | ")}; default: cursor-agent)`,
+      default: "cursor-agent"
+    },
+    "dry-run": {
+      type: "boolean",
+      description: "Print the tick prompt and exit without starting an agent",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const maxTicks = Number.parseInt(String(args["max-ticks"]), 10);
+    const sleepSeconds = Number.parseFloat(String(args.sleep));
+    if (!Number.isFinite(maxTicks) || maxTicks < 1) {
+      logger.error("--max-ticks must be a positive integer");
+      process.exitCode = 1;
+      return;
+    }
+    if (!Number.isFinite(sleepSeconds) || sleepSeconds < 0) {
+      logger.error("--sleep must be a non-negative number");
+      process.exitCode = 1;
+      return;
+    }
+    let backend;
+    try {
+      backend = getBackend(String(args.backend));
+    } catch (err) {
+      logger.error(String(err));
+      process.exitCode = 1;
+      return;
+    }
+    const code = await runPlanLoop({
+      root: path27.resolve(args.cwd),
+      maxTicks,
+      sleepSeconds,
+      model: args.model ? String(args.model) : void 0,
+      dryRun: Boolean(args["dry-run"]),
+      backend
+    });
+    process.exitCode = code;
+  }
+});
+
+// src/commands/scan.ts
+import { defineCommand as defineCommand8 } from "citty";
+var scanCommand = defineCommand8({
+  meta: {
+    name: "scan",
+    description: "Scan the current repository and print detected profile."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      description: "Project root directory",
+      default: process.cwd()
+    }
+  },
+  async run({ args }) {
+    const result = await runScanner(args.cwd);
+    logger.info(`Scan completed for ${result.rootDir}`);
+    logger.info(`Path: ${result.isGreenfield ? "greenfield" : "existing project"}`);
+    console.log(JSON.stringify(result, null, 2));
+  }
+});
+
+// src/commands/status.ts
+import path28 from "path";
+import { defineCommand as defineCommand9 } from "citty";
+var statusCommand = defineCommand9({
+  meta: {
+    name: "status",
+    description: "Show Agent Kit distribution status (manifest + optional wizard profile)."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    json: {
+      type: "boolean",
+      description: "Print raw JSON for manifest and profile",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const manifest = await loadAgentKitManifest(args.cwd);
+    const profilePath = path28.join(args.cwd, ".cursor", "agent-kit.config.json");
+    const profile = await readJson(profilePath);
+    if (args.json) {
+      console.log(
+        JSON.stringify(
+          {
+            manifest: manifest ?? null,
+            profile: profile ?? null
+          },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    if (!manifest) {
+      logger.warn(`No ${MANIFEST_RELATIVE_PATH} \u2014 run agent-kit install.`);
+    } else {
+      const protectedGlobs = resolveProtectedGlobs(manifest);
+      console.log("Agent Kit status");
+      console.log(`  version:    ${manifest.version}`);
+      console.log(`  profile:    ${manifest.profile ?? "(none)"}`);
+      console.log(`  packs:      ${(manifest.packs ?? []).join(", ") || "(none)"}`);
+      console.log(`  skills:     ${(manifest.skills ?? []).length} listed`);
+      console.log(`  protected:  ${protectedGlobs.length} glob(s) (L3 safe on update)`);
+      console.log(
+        `  registry:   ${manifest.registry?.url ?? "(default)"} @ ${manifest.registry?.ref ?? "(default)"}`
+      );
+      if (manifest.installedAt) console.log(`  installed:  ${manifest.installedAt}`);
+    }
+    if (profile) {
+      console.log("Wizard profile (agent-kit.config.json): present");
+      console.log(`  IDE:        ${profile.ide?.ide ?? "?"}`);
+      console.log(`  core picks: ${(profile.selectedCoreComponents ?? []).join(", ") || "(none)"}`);
+    } else {
+      logger.info("No wizard profile \u2014 optional; run agent-kit init for generators.");
+    }
+  }
+});
+
+// src/commands/update.ts
+import { defineCommand as defineCommand10 } from "citty";
+var updateCommand = defineCommand10({
+  meta: {
+    name: "update",
+    description: "Re-apply L0/packs/skills from the registry; never overwrites L3 protected paths."
+  },
+  args: {
+    cwd: {
+      type: "string",
+      default: process.cwd()
+    },
+    ...REGISTRY_CLI_ARGS
+  },
+  async run({ args }) {
+    const existing = await loadAgentKitManifest(args.cwd);
+    if (!existing) {
+      logger.warn("No .cursor/agent-kit.json \u2014 run agent-kit install first.");
+      return;
+    }
+    const registry = await resolveRegistryFromCli({
+      cwd: args.cwd,
+      registry: args.registry,
+      url: args.url,
+      ref: args.ref,
+      refresh: args.refresh,
+      manifest: existing
+    });
+    logger.info(`Registry: ${registry.root} (${registry.source})`);
+    const next = buildManifest({
+      version: KIT_VERSION,
+      profile: existing.profile,
+      packs: existing.packs,
+      skills: existing.skills,
+      protected: existing.protected,
+      registryUrl: registry.url ?? existing.registry?.url,
+      registryRef: registry.ref ?? existing.registry?.ref
+    });
+    if (existing.overrides?.length) next.overrides = existing.overrides;
+    const stats = await syncFromManifest(registry.root, args.cwd, next);
+    await saveManifest(args.cwd, next);
+    logApplyStats(stats);
+    logger.success("Update complete (L3 protected paths left untouched).");
+  }
+});
+
+// src/index.ts
+var main = defineCommand11({
+  meta: {
+    name: "agent-kit",
+    description: "Developer bootstrapper for AI-assisted IDEs"
+  },
+  subCommands: {
+    init: initCommand,
+    install: installCommand,
+    scan: scanCommand,
+    add: addCommand,
+    status: statusCommand,
+    update: updateCommand,
+    diff: diffCommand,
+    contribute: contributeCommand,
+    handoff: handoffCommand,
+    "run-plan": runPlanCommand
+  }
+});
+runMain(main);