@floomhq/floom 1.0.14 → 1.0.17

package/dist/install.js

@@ -1,13 +1,14 @@
 import { constants } from "node:fs";
 import { lstat, mkdir, open } from "node:fs/promises";
-import { createHash } from "node:crypto";
+import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import ora from "ora";
 import { readConfig, resolveApiUrl } from "./config.js";
 import { getJson } from "./lib/api.js";
 import { c, symbols } from "./ui.js";
 import { FloomError } from "./errors.js";
-import { resolveSkillsDir, skillsDirHint } from "./targets.js";
+import { normalizeRemotePackageFiles, packageHash, sha256Bytes } from "./package.js";
+import { manifestKey, markSynced, readSyncManifest, withSyncLock, writeSyncManifest } from "./sync-manifest.js";
 const SLUG_RE = /^[A-Za-z0-9_-]{1,128}$/;
 const FD_PATH_ROOT = "/proc/self/fd";
 function slugFromInput(input) {
@@ -21,23 +22,33 @@ function slugFromInput(input) {
         return trimmed.replace(/\.(md|json)$/i, "");
     }
 }
+function skillsDir(target) {
+    if (target === "codex") {
+        const codexHome = process.env.CODEX_HOME ?? join(homedir(), ".codex");
+        return process.env.CODEX_SKILLS_DIR ?? join(codexHome, "skills");
+    }
+    return process.env.CLAUDE_SKILLS_DIR ?? join(homedir(), ".claude", "skills");
+}
 function skillPath(root, slug) {
+    return join(root, slug, "SKILL.md");
+}
+function legacySkillPath(root, slug) {
     return join(root, `${slug}.md`);
 }
+function skillsDirHint(target) {
+    return target === "codex" ? "CODEX_SKILLS_DIR" : "CLAUDE_SKILLS_DIR";
+}
 function setupCommand(target) {
     return `npx -y @floomhq/floom setup --target ${target} --yes`;
 }
-function sha256(input) {
-    return createHash("sha256").update(input).digest("hex");
-}
-async function localHash(path) {
+async function readLocalFile(path) {
     try {
         const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
         try {
             const stat = await handle.stat();
             if (!stat.isFile())
                 throw new FloomError("Local path is blocked by an existing file or directory.");
-            return sha256(await handle.readFile("utf8"));
+            return await handle.readFile();
         }
         finally {
             await handle.close();
@@ -55,6 +66,47 @@ async function localHash(path) {
         throw err;
     }
 }
+async function localPackageHash(root, slug, target, files) {
+    const main = await readLocalFile(target);
+    if (main === null) {
+        const legacy = await readLocalFile(legacySkillPath(root, slug));
+        if (legacy !== null && files.length === 0)
+            return packageHash(legacy.toString("utf8"), []);
+        return null;
+    }
+    const localFiles = [];
+    for (const file of files) {
+        const bytes = await readLocalFile(join(dirname(target), file.path));
+        if (bytes === null)
+            return null;
+        localFiles.push({ path: file.path, bytes, sha256: file.sha256 });
+    }
+    return packageHash(main.toString("utf8"), localFiles);
+}
+async function markInstallSynced(root, slug, files) {
+    const manifest = await readSyncManifest();
+    for (const file of files) {
+        markSynced(manifest, manifestKey(root, file.target), slug, file.hash);
+    }
+    await writeSyncManifest(manifest);
+}
+async function preflightInstallPackage(root, files, opts) {
+    for (const file of files) {
+        await ensureSafeParentDirectory(root, file.target);
+        const existing = await readLocalFile(file.target);
+        if (existing === null)
+            continue;
+        if (sha256Buffer(existing) === file.hash)
+            continue;
+        if (opts.force)
+            continue;
+        return file.target;
+    }
+    return null;
+}
+function sha256Buffer(input) {
+    return sha256Bytes(input);
+}
 async function writeInstallFile(root, target, body) {
     const parent = await openSafeParentDirectory(root, target);
     let handle = null;
@@ -67,8 +119,9 @@ async function writeInstallFile(root, target, body) {
         await parent.close();
     }
 }
-async function overwriteInstallFile(target, body) {
-    const handle = await open(target, constants.O_WRONLY | constants.O_TRUNC | constants.O_NOFOLLOW);
+async function overwriteInstallFile(root, target, body) {
+    const parent = await openSafeParentDirectory(root, target);
+    const handle = await open(childCreatePath(parent, dirname(target), basename(target)), constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o600);
     try {
         const stat = await handle.stat();
         if (!stat.isFile())
@@ -77,6 +130,7 @@ async function overwriteInstallFile(target, body) {
     }
     finally {
         await handle.close();
+        await parent.close();
     }
 }
 async function openSafeParentDirectory(root, target) {
@@ -89,7 +143,7 @@ function childCreatePath(parent, fallbackParent, name) {
     return join(resolve(fallbackParent), name);
 }
 async function writeAll(handle, body) {
-    const buffer = Buffer.from(body, "utf8");
+    const buffer = Buffer.isBuffer(body) ? body : Buffer.from(body, "utf8");
     let offset = 0;
     while (offset < buffer.length) {
         const result = await handle.write(buffer, offset, buffer.length - offset, offset);
@@ -142,14 +196,14 @@ async function assertSafeDirectory(path) {
 }
 export async function install(slugInput, opts = {}) {
     const targetAgent = opts.target ?? "claude";
-    const root = resolveSkillsDir(targetAgent);
+    const root = skillsDir(targetAgent);
     const slug = slugFromInput(slugInput);
     if (!SLUG_RE.test(slug)) {
         throw new FloomError(`Invalid skill slug: ${slugInput}`);
     }
     const cfg = await readConfig();
     const apiUrl = resolveApiUrl(cfg);
-    const spinner = opts.json ? null : ora({ text: c.dim(`Adding ${slug}...`), color: "yellow" }).start();
+    const spinner = ora({ text: c.dim(`Adding ${slug}...`), color: "yellow" }).start();
     let detail;
     try {
         detail = await getJson(`${apiUrl}/api/v1/skills/${encodeURIComponent(slug)}`, "fetch skill", cfg?.accessToken);
@@ -158,75 +212,94 @@ export async function install(slugInput, opts = {}) {
         }
     }
     catch (err) {
-        spinner?.stop();
-        throw err;
-    }
-    try {
-        await mkdir(root, { recursive: true, mode: 0o700 });
-    }
-    catch (err) {
-        if (err.code === "EEXIST") {
-            throw new FloomError(`${skillsDirHint(targetAgent)} points to a file, not a directory.`, `Set ${skillsDirHint(targetAgent)} to a directory, or remove the file blocking it.`);
-        }
+        spinner.stop();
         throw err;
     }
     const target = skillPath(root, slug);
-    const remoteHash = sha256(detail.body_md);
-    const existing = await localHash(target);
-    let action;
-    if (existing === remoteHash) {
-        action = "unchanged";
-    }
-    else if (existing !== null && opts.force) {
+    const remotePackageFiles = normalizeRemotePackageFiles(detail.package_files ?? detail.files);
+    const installFiles = [
+        { target, bytes: detail.body_md, hash: sha256Bytes(detail.body_md) },
+        ...remotePackageFiles.map((file) => ({
+            target: join(dirname(target), file.path),
+            bytes: file.bytes,
+            hash: file.sha256,
+        })),
+    ];
+    const remoteHash = packageHash(detail.body_md, remotePackageFiles);
+    let action = "installed";
+    let manifestWarning = null;
+    await withSyncLock(async () => {
         try {
-            await overwriteInstallFile(target, detail.body_md);
+            await mkdir(root, { recursive: true, mode: 0o700 });
         }
         catch (err) {
-            const code = err.code;
-            if (code === "ELOOP")
-                throw new FloomError("Local path is a symbolic link.", "Move or delete the local path, then run `npx -y @floomhq/floom add` again.");
+            if (err.code === "EEXIST") {
+                throw new FloomError(`${skillsDirHint(targetAgent)} points to a file, not a directory.`, `Set ${skillsDirHint(targetAgent)} to a directory, or remove the file blocking it.`);
+            }
             throw err;
         }
-        action = "updated";
-    }
-    else if (existing !== null) {
-        throw new FloomError("Local skill already exists with different content.", "Run `npx -y @floomhq/floom add <link> --force` to replace it, or move the local file first.");
-    }
-    else {
-        try {
-            await writeInstallFile(root, target, detail.body_md);
+        await ensureSafeParentDirectory(root, target);
+        const existing = await localPackageHash(root, slug, target, remotePackageFiles);
+        const conflictingTarget = await preflightInstallPackage(root, installFiles, opts.force ? { force: true } : {});
+        if (conflictingTarget) {
+            throw new FloomError("Local skill already exists with different content.", `Run \`npx -y @floomhq/floom add <link> --force\` to replace it, or move the local file first: ${relative(root, conflictingTarget).split(sep).join("/")}`);
         }
-        catch (err) {
-            const code = err.code;
-            if (code === "EEXIST") {
-                throw new FloomError("Local skill already exists with different content.", "Run `npx -y @floomhq/floom add <link> --force` to replace it, or move the local file first.");
+        if (existing === remoteHash) {
+            action = "unchanged";
+        }
+        else if (existing !== null && opts.force) {
+            try {
+                await overwriteInstallFile(root, target, detail.body_md);
+                for (const file of remotePackageFiles) {
+                    await overwriteInstallFile(root, join(dirname(target), file.path), file.bytes);
+                }
+            }
+            catch (err) {
+                const code = err.code;
+                if (code === "ELOOP")
+                    throw new FloomError("Local path is a symbolic link.", "Move or delete the local path, then run `npx -y @floomhq/floom add` again.");
+                throw err;
             }
-            if (code === "ELOOP") {
-                throw new FloomError("Local path is a symbolic link.", "Move or delete the local path, then run `npx -y @floomhq/floom add` again.");
+            action = "updated";
+        }
+        else if (existing !== null) {
+            throw new FloomError("Local skill already exists with different content.", "Run `npx -y @floomhq/floom add <link> --force` to replace it, or move the local file first.");
+        }
+        else {
+            try {
+                await writeInstallFile(root, target, detail.body_md);
+                for (const file of remotePackageFiles) {
+                    await writeInstallFile(root, join(dirname(target), file.path), file.bytes);
+                }
             }
-            if (code === "ENOENT") {
-                throw new FloomError("Local path changed during install.", "Run `npx -y @floomhq/floom add` again.");
+            catch (err) {
+                const code = err.code;
+                if (code === "EEXIST") {
+                    throw new FloomError("Local skill already exists with different content.", "Move or delete the local file, then run `npx -y @floomhq/floom add` again.");
+                }
+                if (code === "ELOOP") {
+                    throw new FloomError("Local path is a symbolic link.", "Move or delete the local path, then run `npx -y @floomhq/floom add` again.");
+                }
+                if (code === "ENOENT") {
+                    throw new FloomError("Local path changed during install.", "Run `npx -y @floomhq/floom add` again.");
+                }
+                throw err;
             }
-            throw err;
+            action = "installed";
         }
-        action = "installed";
-    }
-    const result = {
-        slug,
-        title: detail.title,
-        action,
-        target: targetAgent,
-        path: target,
-        content_hash: remoteHash,
-    };
-    spinner?.stop();
-    if (opts.json) {
-        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-        return;
-    }
+        try {
+            await markInstallSynced(root, slug, installFiles);
+        }
+        catch (err) {
+            manifestWarning = err instanceof Error ? err.message : String(err);
+        }
+    });
+    spinner.stop();
     process.stdout.write(`\n${symbols.ok}  [floom] ${action} ${c.bold(slug)}\n`);
-    process.stdout.write(`   ${c.dim(target)}\n\n`);
-    process.stdout.write(`   ${c.dim("No Floom account was required. This is a one-time local Markdown install; run add --force or update to replace it. Save or follow skills after login when you want sync/MCP.")}\n\n`);
+    process.stdout.write(`   ${c.dim(dirname(target))}\n\n`);
+    if (manifestWarning) {
+        process.stdout.write(`   ${c.yellow("!")} ${c.dim(`Installed, but sync tracking was not updated: ${manifestWarning}`)}\n\n`);
+    }
     process.stdout.write(`   ${c.bold("Next")}\n`);
     if (opts.setup) {
         process.stdout.write(`   ${c.dim("1.")} Floom is connecting ${targetAgent === "claude" ? "Claude Code" : "Codex"} now.\n`);

package/dist/library.js

@@ -3,7 +3,6 @@ import { readConfig, resolveApiUrl } from "./config.js";
 import { deleteRequest, getJson, postJson, putJson } from "./lib/api.js";
 import { c, symbols } from "./ui.js";
 import { FloomError } from "./errors.js";
-import { resolveSkillsDir } from "./targets.js";
 function formatLibraryRow(lib) {
     const name = lib.name ?? c.dim("(unnamed)");
     const vis = c.dim(`[${lib.visibility}]`);
@@ -46,8 +45,7 @@ export async function libraryCreate(opts) {
     });
     process.stdout.write(`\n${symbols.ok}  Library created: ${c.cyan(result.slug)}\n`);
     process.stdout.write(`   ${c.dim("API:")}  ${apiUrl}/api/v1/libraries/${result.slug}\n`);
-    process.stdout.write(`   ${c.dim("Follow:")} npx -y @floomhq/floom library subscribe ${result.slug}\n`);
-    process.stdout.write(`   ${c.dim("Sync:")}   npx -y @floomhq/floom sync\n\n`);
+    process.stdout.write(`   ${c.dim("Sync:")} floom library subscribe ${result.slug}\n\n`);
 }
 export async function libraryAddSkill(opts) {
     const cfg = await readConfig();
@@ -79,10 +77,8 @@ export async function librarySubscribe(slug) {
         throw new FloomError("Not signed in.", "Run `npx -y @floomhq/floom login` first.");
     const apiUrl = resolveApiUrl(cfg);
     await postJson(`${apiUrl}/api/v1/me/subscriptions`, "subscribe to library", cfg.accessToken, { library_slug: slug });
-    process.stdout.write(`\n${symbols.ok}  Following ${c.cyan(slug)}\n`);
-    process.stdout.write(`   ${c.dim("Library saved to your Floom account.")}\n`);
-    process.stdout.write(`   ${c.dim(`Run \`npx -y @floomhq/floom sync\` to write skills under ${resolveSkillsDir("claude")}/${slug}/ by default.`)}\n`);
-    process.stdout.write(`   ${c.dim("Run `npx -y @floomhq/floom mcp` to keep followed libraries updated while your agent is connected.")}\n\n`);
+    process.stdout.write(`\n${symbols.ok}  Subscribed to ${c.cyan(slug)}\n`);
+    process.stdout.write(`   ${c.dim("Run `floom sync --target claude` or `floom sync --target codex` to pull this library locally.")}\n\n`);
 }
 export async function libraryUnsubscribe(slug) {
     const cfg = await readConfig();
@@ -90,7 +86,7 @@ export async function libraryUnsubscribe(slug) {
         throw new FloomError("Not signed in.", "Run `npx -y @floomhq/floom login` first.");
     const apiUrl = resolveApiUrl(cfg);
     await deleteRequest(`${apiUrl}/api/v1/me/subscriptions/${encodeURIComponent(slug)}`, "unsubscribe from library", cfg.accessToken);
-    process.stdout.write(`\n${symbols.ok}  Unfollowed ${c.cyan(slug)}\n\n`);
+    process.stdout.write(`\n${symbols.ok}  Unsubscribed from ${c.cyan(slug)}\n\n`);
 }
 export async function moveSkill(opts) {
     const cfg = await readConfig();

package/dist/list.js

@@ -40,25 +40,24 @@ export async function list(opts) {
     }
     const apiUrl = resolveApiUrl(cfg);
     const spinner = opts.json ? null : ora({ text: c.dim("Loading skills..."), color: "yellow" }).start();
-    let skills = [];
+    let published = [];
     try {
         const mine = await getJson(`${apiUrl}/api/v1/me/skills`, "load your skills", cfg.accessToken);
-        skills = mine.skills ?? [];
+        published = mine.skills ?? [];
     }
     finally {
         spinner?.stop();
     }
     if (opts.json) {
-        process.stdout.write(`${JSON.stringify({ skills }, null, 2)}\n`);
+        process.stdout.write(`${JSON.stringify({ published }, null, 2)}\n`);
         return;
     }
-    process.stdout.write(`\n${symbols.dot}  ${c.bold("Synced library")} ${c.dim(`(${skills.length})`)}\n`);
-    process.stdout.write(`   ${c.dim("Includes your published, saved, and followed library skills.")}\n\n`);
-    if (skills.length === 0) {
-        process.stdout.write(`   ${c.dim("Nothing in your library yet. Add a shared link, save a skill on floom.dev, or publish `npx -y @floomhq/floom publish skill.md`.")}\n`);
+    process.stdout.write(`\n${symbols.dot}  ${c.bold("Published")} ${c.dim(`(${published.length})`)}\n\n`);
+    if (published.length === 0) {
+        process.stdout.write(`   ${c.dim("Nothing published yet. Try `npx -y @floomhq/floom publish my-skill`.")}\n`);
     }
     else {
-        for (const s of skills)
+        for (const s of published)
             process.stdout.write(`${formatRow(s)}\n`);
     }
     process.stdout.write("\n");

package/dist/login.js

@@ -1,5 +1,5 @@
 import { createServer } from "node:http";
-import { randomBytes } from "node:crypto";
+import { createServer as createNetServer } from "node:net";
 import open from "open";
 import ora from "ora";
 import { getApiUrl, writeConfig } from "./config.js";
@@ -9,6 +9,7 @@ const DEFAULT_PORT = 7456;
 const TIMEOUT_MS = 5 * 60 * 1000;
 export async function login() {
     const apiUrl = getApiUrl();
+    const port = await pickPort();
     process.stdout.write(header());
     process.stdout.write(`${symbols.arrow}  Opening browser to sign in with Google...\n\n`);
     const spinner = ora({
@@ -17,12 +18,12 @@ export async function login() {
     }).start();
     let tokens;
     try {
-        tokens = await waitForCallback();
+        tokens = await waitForCallback(port);
     }
     catch (err) {
         spinner.stop();
         if (err instanceof Error && /timed out/i.test(err.message)) {
-            throw new FloomError("No worries — try `npx -y @floomhq/floom login` again when ready.");
+            throw new FloomError("No worries - try `npx -y @floomhq/floom login` again when ready.");
         }
         throw err;
     }
@@ -56,26 +57,48 @@ export async function login() {
     spinner.stop();
     process.stdout.write(`${symbols.ok}  Signed in as ${c.bold(me.email ?? me.id)}\n`);
     process.stdout.write(`   ${c.dim("Your token is saved at ~/.floom/config.json")}\n\n`);
-    process.stdout.write(`   ${c.bold("Account mode is on")}\n`);
-    process.stdout.write(`   ${c.dim("Publish skills, save skills on floom.dev, follow libraries, and sync your account library locally.")}\n\n`);
-    process.stdout.write(`   ${c.dim("Publish:")} ${c.cyan("npx -y @floomhq/floom publish <file.md>")}\n`);
-    process.stdout.write(`   ${c.dim("Sync:")}    ${c.cyan("npx -y @floomhq/floom sync")}\n`);
-    process.stdout.write(`   ${c.dim("MCP:")}     ${c.cyan("npx -y @floomhq/floom mcp")}\n\n`);
 }
-function waitForCallback() {
+/** Reserve a free port. Prefers 7456 for existing Supabase CLI auth setups. */
+async function pickPort() {
+    if (await canListen(DEFAULT_PORT))
+        return DEFAULT_PORT;
+    return reserveEphemeralPort();
+}
+function canListen(port) {
+    return new Promise((resolve) => {
+        const server = createNetServer();
+        server.once("error", () => resolve(false));
+        server.listen(port, "127.0.0.1", () => {
+            server.close(() => resolve(true));
+        });
+    });
+}
+function reserveEphemeralPort() {
+    return new Promise((resolve, reject) => {
+        const server = createNetServer();
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            if (!address || typeof address === "string") {
+                server.close();
+                reject(new FloomError("Could not reserve a local sign-in port."));
+                return;
+            }
+            const port = address.port;
+            server.close(() => resolve(port));
+        });
+    });
+}
+function waitForCallback(port) {
     return new Promise((resolve, reject) => {
         const apiUrl = getApiUrl();
-        const allowedOrigin = new URL(apiUrl).origin;
-        const state = randomBytes(24).toString("base64url");
         let settled = false;
-        let retriedEphemeralPort = false;
         const server = createServer((req, res) => {
             // CORS preflight from the browser bridge page.
-            const origin = req.headers.origin;
-            const corsOrigin = origin === allowedOrigin ? origin : "null";
+            const origin = req.headers.origin ?? "*";
             if (req.method === "OPTIONS") {
                 res.writeHead(204, {
-                    "access-control-allow-origin": corsOrigin,
+                    "access-control-allow-origin": origin,
                     "access-control-allow-methods": "POST, OPTIONS",
                     "access-control-allow-headers": "content-type",
                     "access-control-allow-private-network": "true",
@@ -92,24 +115,15 @@ function waitForCallback() {
                         const data = parseCallbackBody(body, req.headers["content-type"]);
                         if (!data.access_token || !data.refresh_token) {
                             res.writeHead(400, {
-                                "access-control-allow-origin": corsOrigin,
+                                "access-control-allow-origin": origin,
                                 "access-control-allow-private-network": "true",
                                 "content-type": "text/html; charset=utf-8",
                             });
                             res.end(localCallbackPage("Missing tokens from OAuth response."));
                             return;
                         }
-                        if (data.state !== state) {
-                            res.writeHead(400, {
-                                "access-control-allow-origin": corsOrigin,
-                                "access-control-allow-private-network": "true",
-                                "content-type": "text/html; charset=utf-8",
-                            });
-                            res.end(localCallbackPage("Invalid OAuth state."));
-                            return;
-                        }
                         res.writeHead(200, {
-                            "access-control-allow-origin": corsOrigin,
+                            "access-control-allow-origin": origin,
                             "access-control-allow-private-network": "true",
                             "content-type": "text/html; charset=utf-8",
                         });
@@ -119,7 +133,7 @@ function waitForCallback() {
                         resolve(data);
                     }
                     catch {
-                        res.writeHead(400, { "content-type": "text/html; charset=utf-8", "access-control-allow-origin": corsOrigin });
+                        res.writeHead(400, { "content-type": "text/html; charset=utf-8", "access-control-allow-origin": origin });
                         res.end(localCallbackPage("Invalid OAuth response."));
                     }
                 });
@@ -140,28 +154,14 @@ function waitForCallback() {
             server.close();
         }
         server.on("error", (err) => {
-            const code = err.code;
-            if (!settled && !retriedEphemeralPort && code === "EADDRINUSE") {
-                retriedEphemeralPort = true;
-                server.listen(0, "127.0.0.1");
-                return;
-            }
             if (settled)
                 return;
             settled = true;
             clearTimeout(timer);
-            reject(new FloomError("Local auth server failed.", err.message));
+            reject(new FloomError(`Local auth server failed on port ${port}.`, `Is port ${port} already in use? (${err.message})`));
         });
-        server.listen(DEFAULT_PORT, "127.0.0.1", () => {
-            const address = server.address();
-            if (!address || typeof address === "string") {
-                settled = true;
-                cleanup();
-                reject(new FloomError("Could not reserve a local sign-in port."));
-                return;
-            }
-            const port = address.port;
-            const target = `${apiUrl}/auth/cli?port=${port}&state=${encodeURIComponent(state)}`;
+        server.listen(port, "127.0.0.1", () => {
+            const target = `${apiUrl}/auth/cli?port=${port}`;
             open(target).catch((e) => {
                 const msg = e instanceof Error ? e.message : String(e);
                 process.stdout.write(c.yellow(`Could not auto-open browser (${msg}).\n`) +
@@ -175,7 +175,7 @@ function parseCallbackBody(body, contentType) {
     if (type.includes("application/x-www-form-urlencoded")) {
         const params = new URLSearchParams(body);
         const parsed = {};
-        for (const key of ["access_token", "refresh_token", "expires_in", "token_type", "state"]) {
+        for (const key of ["access_token", "refresh_token", "expires_in", "token_type"]) {
             const value = params.get(key);
             if (value)
                 parsed[key] = value;
@@ -185,5 +185,40 @@ function parseCallbackBody(body, contentType) {
     return JSON.parse(body);
 }
 function localCallbackPage(message) {
-    return `<!doctype html><html><head><meta charset="utf-8"><title>Floom CLI sign-in</title></head><body style="font-family:system-ui,sans-serif;margin:48px"><h1>${message}</h1><p>Return to your terminal to continue.</p></body></html>`;
+    const safeMessage = escapeHtml(message);
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Floom CLI sign-in</title>
+  <style>
+    :root { color-scheme: light; --ink: #111827; --muted: #4b5563; --line: #e5e7eb; --accent: #0f766e; --bg: #f8fafc; }
+    * { box-sizing: border-box; }
+    body { margin: 0; min-height: 100vh; display: grid; place-items: center; background: var(--bg); color: var(--ink); font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+    main { width: min(560px, calc(100vw - 40px)); padding: 40px; background: #fff; border: 1px solid var(--line); border-radius: 16px; box-shadow: 0 24px 80px rgba(15, 23, 42, 0.08); }
+    .mark { display: inline-flex; align-items: center; gap: 10px; margin-bottom: 28px; font-weight: 700; letter-spacing: 0.02em; }
+    .dot { width: 10px; height: 10px; border-radius: 999px; background: var(--accent); display: inline-block; }
+    h1 { margin: 0; font-size: clamp(32px, 7vw, 56px); line-height: 0.95; letter-spacing: 0; }
+    p { margin: 20px 0 0; font-size: 18px; line-height: 1.55; color: var(--muted); }
+    code { display: inline-block; margin-top: 24px; padding: 10px 12px; border: 1px solid var(--line); border-radius: 8px; background: #f9fafb; color: var(--ink); font-size: 14px; }
+  </style>
+</head>
+<body>
+  <main>
+    <div class="mark"><span class="dot"></span><span>floom</span></div>
+    <h1>${safeMessage}</h1>
+    <p>Return to your terminal to continue. Your Floom CLI now has the token it needs.</p>
+    <code>floom doctor</code>
+  </main>
+</body>
+</html>`;
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
 }

package/dist/mcp.js

@@ -1,19 +1,16 @@
 import { c } from "./ui.js";
 export function printMcpSetup() {
     const snippet = `## Floom
-- Before recreating behavior from scratch, search the local Floom skills folder for matching skills.
+- Use Floom skills from the local Floom skills folder when they match the task.
 - To install a shared skill, run \`npx -y @floomhq/floom add <slug-or-url> --target claude\` or \`npx -y @floomhq/floom add <slug-or-url> --target codex\`.
-- If MCP tools are available, use \`floom_search_skills\`, \`floom_install_skill\`, \`floom_list_libraries\`, and \`floom_subscribe_library\`.
-- If MCP tools are not available, run \`npx -y @floomhq/floom search <query>\`.
-- Shared-link installs work with \`add\` and no account for public or unlisted links.
-- MCP sync requires \`npx -y @floomhq/floom login\` and keeps saved, published, and followed library skills updated locally.`;
+- To find reusable behavior, run \`npx -y @floomhq/floom search <query>\`.
+- MCP sync is optional preview behavior; use it only while the Floom MCP server is configured and running.`;
     process.stdout.write(`\n${c.bold("Floom MCP setup")}\n\n`);
     process.stdout.write(`${c.dim("Pick your tool:")}\n\n`);
-    process.stdout.write(`${c.dim("Shared links work with `npx -y @floomhq/floom add` and no account. MCP is for account-backed saved, published, and followed library sync.")}\n\n`);
     process.stdout.write(`  ${c.bold("Claude Code")}\n`);
     process.stdout.write(`  ${c.cyan("claude mcp add floom -- npx -y @floomhq/floom-mcp-sync")}\n\n`);
     process.stdout.write(`  ${c.bold("Codex CLI")}\n`);
-    process.stdout.write(`  ${c.cyan("codex mcp add floom -- env FLOOM_TARGET=codex npx -y @floomhq/floom-mcp-sync")}\n\n`);
+    process.stdout.write(`  ${c.cyan("codex mcp add floom -- npx -y @floomhq/floom-mcp-sync")}\n\n`);
     process.stdout.write(`${c.dim("Full guide:")} ${c.cyan("https://floom.dev/docs/mcp")}\n\n`);
     process.stdout.write(`${c.dim("Recommended agent instruction snippet:")}\n\n`);
     process.stdout.write(`${snippet}\n\n`);