@hogsend/cli 0.1.0 → 0.2.0

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/bin.ts
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 
 // src/commands/contacts.ts
 import { parseArgs } from "util";
@@ -110,10 +110,10 @@ function renderTable(rows, columns) {
   );
   const pad = (text, width) => text + " ".repeat(width - text.length);
   const header = cols.map((c, i) => color.bold(pad(c, widths[i] ?? 0))).join("  ");
-  const sep3 = cols.map((_, i) => "-".repeat(widths[i] ?? 0)).join("  ");
+  const sep4 = cols.map((_, i) => "-".repeat(widths[i] ?? 0)).join("  ");
   const body = rows.map((r) => cols.map((c, i) => pad(cell(r[c]), widths[i] ?? 0)).join("  ")).join("\n");
   return `${header}
-${color.dim(sep3)}
+${color.dim(sep4)}
 ${body}`;
 }
 function renderKv(obj) {
@@ -430,6 +430,137 @@ var contactsCommand = {
 
 // src/commands/doctor.ts
 import { parseArgs as parseArgs2 } from "util";
+
+// src/lib/skills.ts
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { createRequire } from "module";
+import { join } from "path";
+import { fileURLToPath } from "url";
+function bundledSkillsDir() {
+  return fileURLToPath(new URL("../skills", import.meta.url));
+}
+function installDir(cwd) {
+  return join(cwd, ".claude", "skills");
+}
+function stampPath(cwd) {
+  return join(cwd, ".claude", ".hogsend-skills.json");
+}
+function cliVersion() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    const pkg = require2("../package.json");
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function readFileSyncSafe(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return "";
+  }
+}
+function readFrontmatterField(skillDir, field) {
+  const skillFile = join(skillDir, "SKILL.md");
+  if (!existsSync(skillFile)) return "";
+  const raw = readFileSyncSafe(skillFile);
+  const fmMatch = raw.match(/^---\n([\s\S]*?)\n---/);
+  if (!fmMatch) return "";
+  const block = fmMatch[1] ?? "";
+  for (const line of block.split("\n")) {
+    const m = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+    if (m && m[1] === field) {
+      return (m[2] ?? "").replace(/^["']|["']$/g, "").trim();
+    }
+  }
+  return "";
+}
+function listBundledSkills(cwd) {
+  const dir = bundledSkillsDir();
+  if (!existsSync(dir)) return [];
+  const target = installDir(cwd);
+  const entries = readdirSync(dir).filter((name) => {
+    const full = join(dir, name);
+    return statSync(full).isDirectory() && existsSync(join(full, "SKILL.md"));
+  });
+  return entries.sort().map((name) => ({
+    name,
+    description: readFrontmatterField(join(dir, name), "description"),
+    installed: existsSync(join(target, name))
+  }));
+}
+function copySkill(name, cwd, force) {
+  const src = join(bundledSkillsDir(), name);
+  const dest = join(installDir(cwd), name);
+  const exists = existsSync(dest);
+  if (exists && !force) {
+    return { name, installed: false, skipped: true, path: dest };
+  }
+  mkdirSync(installDir(cwd), { recursive: true });
+  cpSync(src, dest, { recursive: true, force: true });
+  return { name, installed: true, skipped: false, path: dest };
+}
+function writeSkillsStamp(cwd, skills) {
+  const stamp = {
+    cliVersion: cliVersion(),
+    skills: [...skills].sort(),
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  mkdirSync(join(cwd, ".claude"), { recursive: true });
+  writeFileSync(stampPath(cwd), `${JSON.stringify(stamp, null, 2)}
+`);
+}
+function readSkillsStamp(cwd) {
+  try {
+    const parsed = JSON.parse(readFileSync(stampPath(cwd), "utf8"));
+    return parsed && typeof parsed.cliVersion === "string" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function compareVersions(a, b) {
+  const parse = (v) => (v.split("-")[0] ?? "").split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const pa = parse(a);
+  const pb = parse(b);
+  for (let i = 0; i < 3; i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+function skillsStaleness(cwd) {
+  const stamp = readSkillsStamp(cwd);
+  if (!stamp) return null;
+  const current = cliVersion();
+  return {
+    stale: compareVersions(stamp.cliVersion, current) < 0,
+    installed: stamp.cliVersion,
+    current
+  };
+}
+
+// src/commands/doctor.ts
+function skillsNudge(ctx) {
+  const verdict = skillsStaleness(process.cwd());
+  if (!verdict?.stale || ctx.json) return;
+  ctx.out.note(
+    [
+      `Vendored Claude skills are from v${verdict.installed}; this CLI is v${verdict.current}.`,
+      "",
+      `Refresh: ${color.cyan("hogsend upgrade")} ${color.dim("(deps + skills)")} or ${color.cyan("hogsend skills add --all --force")}.`
+    ].join("\n"),
+    "Skills out of date"
+  );
+}
 var usage2 = `hogsend doctor [--url <baseUrl>] [--admin-key <key>] [--json]
 
 Probe a running Hogsend instance via GET /v1/health and report its health:
@@ -538,7 +669,8 @@ async function run2(ctx) {
       uptime: health.uptime,
       timestamp: health.timestamp,
       components: health.components,
-      schema: health.schema
+      schema: health.schema,
+      skills: skillsStaleness(process.cwd()) ?? void 0
     });
     if (!ok) process.exit(1);
     return;
@@ -561,6 +693,7 @@ async function run2(ctx) {
     `  ${trackLine("client", health.schema.client)}`
   ];
   ctx.out.note(lines.join("\n"), "Doctor");
+  skillsNudge(ctx);
   if (ok) {
     ctx.out.outro(color.green("doctor: ok"));
     return;
@@ -576,15 +709,15 @@ var doctorCommand = {
 };
 
 // src/commands/eject.ts
-import { existsSync as existsSync2, realpathSync } from "fs";
-import { createRequire } from "module";
-import { dirname, join as join2, sep as sep2 } from "path";
+import { existsSync as existsSync3, realpathSync } from "fs";
+import { createRequire as createRequire2 } from "module";
+import { dirname, join as join3, sep as sep2 } from "path";
 import { parseArgs as parseArgs3 } from "util";
 
 // src/eject.ts
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
 import { cp, readFile, rm, stat, writeFile } from "fs/promises";
-import { basename, join, relative, sep } from "path";
+import { basename, join as join2, relative, sep } from "path";
 var EjectError = class extends Error {
   constructor(message) {
     super(message);
@@ -609,8 +742,8 @@ async function writePackageJson(file, value) {
 async function eject(opts) {
   const { pkg, consumerRoot, sourceDir, force = false } = opts;
   const vendorName = basename(pkg);
-  const vendorPath = join(consumerRoot, "vendor", vendorName);
-  const consumerPkgPath = join(consumerRoot, "package.json");
+  const vendorPath = join2(consumerRoot, "vendor", vendorName);
+  const consumerPkgPath = join2(consumerRoot, "package.json");
   const consumerPkg = await readPackageJson(consumerPkgPath);
   let depMap;
   let depSpecBefore;
@@ -626,7 +759,7 @@ async function eject(opts) {
       `${pkg} is not a dependency of the consumer package.json`
     );
   }
-  if (existsSync(vendorPath)) {
+  if (existsSync2(vendorPath)) {
     if (!force) {
       throw new EjectError(
         `vendor/${vendorName} already exists; pass --force to overwrite`
@@ -654,7 +787,7 @@ async function eject(opts) {
     }
   });
   copiedFiles = await countFiles(vendorPath);
-  const vendoredPkgPath = join(vendorPath, "package.json");
+  const vendoredPkgPath = join2(vendorPath, "package.json");
   const vendoredPkg = await readPackageJson(vendoredPkgPath);
   if (vendoredPkg.private === true) {
     delete vendoredPkg.private;
@@ -677,7 +810,7 @@ async function countFiles(dir) {
   let count = 0;
   const entries = await readdir(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const full = join(dir, entry.name);
+    const full = join2(dir, entry.name);
     if (entry.isDirectory()) {
       count += await countFiles(full);
     } else if (entry.isFile()) {
@@ -705,16 +838,16 @@ Options:
 
 After ejecting, run: pnpm install`;
 function resolveSourceDir(pkg, consumerRoot) {
-  const direct = join2(consumerRoot, "node_modules", pkg, "package.json");
-  if (existsSync2(direct)) {
+  const direct = join3(consumerRoot, "node_modules", pkg, "package.json");
+  if (existsSync3(direct)) {
     return dirname(realpathSync(direct));
   }
-  const require2 = createRequire(`${consumerRoot}${sep2}`);
+  const require2 = createRequire2(`${consumerRoot}${sep2}`);
   try {
     const entry = require2.resolve(pkg);
     let dir = dirname(entry);
     while (dir !== dirname(dir)) {
-      if (existsSync2(join2(dir, "package.json"))) return dir;
+      if (existsSync3(join3(dir, "package.json"))) return dir;
       dir = dirname(dir);
     }
   } catch {
@@ -1213,8 +1346,8 @@ var patchCommand = {
 // src/commands/setup.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { randomBytes } from "crypto";
-import { copyFileSync, existsSync as existsSync3, readFileSync, writeFileSync } from "fs";
-import { join as join3 } from "path";
+import { copyFileSync, existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join4 } from "path";
 import { parseArgs as parseArgs7 } from "util";
 import { confirm } from "@clack/prompts";
 
@@ -1252,16 +1385,16 @@ function generateSecret() {
 var SECRET_KEY = "BETTER_AUTH_SECRET";
 var PLACEHOLDER_PREFIX = "change-me";
 function ensureEnv(cwd) {
-  const envPath = join3(cwd, ".env");
-  const examplePath = join3(cwd, ".env.example");
+  const envPath = join4(cwd, ".env");
+  const examplePath = join4(cwd, ".env.example");
   let copied;
-  if (existsSync3(envPath)) {
+  if (existsSync4(envPath)) {
     copied = {
       step: "env",
       status: "skipped",
       detail: ".env already exists"
     };
-  } else if (existsSync3(examplePath)) {
+  } else if (existsSync4(examplePath)) {
     copyFileSync(examplePath, envPath);
     copied = {
       step: "env",
@@ -1285,7 +1418,7 @@ function ensureEnv(cwd) {
   }
   let raw;
   try {
-    raw = readFileSync(envPath, "utf8");
+    raw = readFileSync2(envPath, "utf8");
   } catch (err) {
     return {
       copied,
@@ -1321,7 +1454,7 @@ function ensureEnv(cwd) {
   } else {
     lines[idx] = newLine;
   }
-  writeFileSync(envPath, lines.join("\n"));
+  writeFileSync2(envPath, lines.join("\n"));
   return {
     copied,
     secret: {
@@ -1355,12 +1488,12 @@ async function run7(ctx) {
     return;
   }
   const cwd = values.cwd ?? process.cwd();
-  if (!existsSync3(join3(cwd, "package.json"))) {
+  if (!existsSync4(join4(cwd, "package.json"))) {
     ctx.out.fail(
       `no package.json in ${cwd} \u2014 run setup from a scaffolded Hogsend app (or pass --cwd).`
     );
   }
-  const hasCompose = existsSync3(join3(cwd, "docker-compose.yml")) || existsSync3(join3(cwd, "docker-compose.yaml")) || existsSync3(join3(cwd, "compose.yml")) || existsSync3(join3(cwd, "compose.yaml"));
+  const hasCompose = existsSync4(join4(cwd, "docker-compose.yml")) || existsSync4(join4(cwd, "docker-compose.yaml")) || existsSync4(join4(cwd, "compose.yml")) || existsSync4(join4(cwd, "compose.yaml"));
   const skipConfirm = ctx.json || values.yes;
   if (!ctx.json) {
     ctx.out.intro(
@@ -1467,16 +1600,8 @@ var setupCommand = {
 };
 
 // src/commands/skills.ts
-import {
-  cpSync,
-  existsSync as existsSync4,
-  mkdirSync,
-  readdirSync,
-  readFileSync as readFileSync2,
-  statSync
-} from "fs";
-import { join as join4 } from "path";
-import { fileURLToPath } from "url";
+import { existsSync as existsSync5 } from "fs";
+import { join as join5 } from "path";
 import { parseArgs as parseArgs8 } from "util";
 import { multiselect } from "@clack/prompts";
 var usage8 = `hogsend skills <subcommand> [options]
@@ -1489,10 +1614,13 @@ Subcommands:
   list                      List bundled skills + whether each is installed.
   add [name] [--force]      Copy a bundled skill into ./.claude/skills/<name>/.
                             Omit name for an interactive multiselect (human),
-                            or copy all bundled skills (--json / non-interactive).
+                            or copy all bundled skills (--all / --json /
+                            non-interactive).
 
 Options:
-  --force        Overwrite an already-installed skill.
+  --all          Install every bundled skill (skips the interactive picker).
+  --force        Overwrite an already-installed skill. Use after upgrading the
+                 engine to refresh vendored skills to the latest guidance.
   --json         Emit machine-readable JSON only (implies non-interactive).
   -h, --help     Show this help.
 
@@ -1500,49 +1628,11 @@ Examples:
   hogsend skills list
   hogsend skills list --json
   hogsend skills add
-  hogsend skills add hogsend-cli --force`;
-function bundledSkillsDir() {
-  return fileURLToPath(new URL("../skills", import.meta.url));
-}
-function installDir(cwd) {
-  return join4(cwd, ".claude", "skills");
-}
-function readFrontmatterField(skillDir, field) {
-  const skillFile = join4(skillDir, "SKILL.md");
-  if (!existsSync4(skillFile)) return "";
-  const raw = readFileSyncSafe(skillFile);
-  const fmMatch = raw.match(/^---\n([\s\S]*?)\n---/);
-  if (!fmMatch) return "";
-  const block = fmMatch[1] ?? "";
-  for (const line of block.split("\n")) {
-    const m = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (m && m[1] === field) {
-      return (m[2] ?? "").replace(/^["']|["']$/g, "").trim();
-    }
-  }
-  return "";
-}
-function readFileSyncSafe(path) {
-  try {
-    return readFileSync2(path, "utf8");
-  } catch {
-    return "";
-  }
-}
-function listBundledSkills(cwd) {
-  const dir = bundledSkillsDir();
-  if (!existsSync4(dir)) return [];
-  const target = installDir(cwd);
-  const entries = readdirSync(dir).filter((name) => {
-    const full = join4(dir, name);
-    return statSync(full).isDirectory() && existsSync4(join4(full, "SKILL.md"));
-  });
-  return entries.sort().map((name) => ({
-    name,
-    description: readFrontmatterField(join4(dir, name), "description"),
-    installed: existsSync4(join4(target, name))
-  }));
-}
+  hogsend skills add --all
+  hogsend skills add hogsend-cli --force
+  hogsend skills add --all --force         # refresh everything after an upgrade
+
+Tip: \`hogsend upgrade\` bumps the engine AND refreshes these skills in one step.`;
 function runList3(ctx) {
   const skills = listBundledSkills(process.cwd());
   if (ctx.json) {
@@ -1571,25 +1661,15 @@ function runList3(ctx) {
     ["name", "installed", "description"]
   );
   ctx.out.outro(
-    `Install with ${color.cyan("hogsend skills add <name>")} (or just ${color.cyan("hogsend skills add")}).`
+    `Install with ${color.cyan("hogsend skills add <name>")} (or ${color.cyan("hogsend skills add --all")}). Refresh after an engine upgrade with ${color.cyan("--force")}.`
   );
 }
-function copySkill(name, cwd, force) {
-  const src = join4(bundledSkillsDir(), name);
-  const dest = join4(installDir(cwd), name);
-  const exists = existsSync4(dest);
-  if (exists && !force) {
-    return { name, installed: false, skipped: true, path: dest };
-  }
-  mkdirSync(installDir(cwd), { recursive: true });
-  cpSync(src, dest, { recursive: true, force: true });
-  return { name, installed: true, skipped: false, path: dest };
-}
 async function runAdd(ctx, argv) {
   const { values, positionals } = parseArgs8({
     args: argv,
     allowPositionals: true,
     options: {
+      all: { type: "boolean", default: false },
       force: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false }
     }
@@ -1614,6 +1694,8 @@ async function runAdd(ctx, argv) {
       );
     }
     names = [requested];
+  } else if (values.all) {
+    names = bundled.map((s) => s.name);
   } else if (ctx.out.interactive) {
     const picked = bail(
       await multiselect({
@@ -1630,7 +1712,13 @@ async function runAdd(ctx, argv) {
   } else {
     names = bundled.map((s) => s.name);
   }
-  const results = names.map((name) => copySkill(name, cwd, force));
+  const results = names.map(
+    (name) => copySkill(name, cwd, force)
+  );
+  if (results.some((r) => r.installed)) {
+    const installedNames = listBundledSkills(cwd).filter((s) => existsSync5(join5(installDir(cwd), s.name))).map((s) => s.name);
+    writeSkillsStamp(cwd, installedNames);
+  }
   if (ctx.json) {
     ctx.out.json({
       installDir: installDir(cwd),
@@ -1748,6 +1836,387 @@ var statsCommand = {
   run: run9
 };
 
+// src/commands/studio.ts
+import { spawn } from "child_process";
+import { createReadStream, existsSync as existsSync6, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { createServer } from "http";
+import { extname, join as join6, normalize, resolve, sep as sep3 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { parseArgs as parseArgs10 } from "util";
+var usage10 = `hogsend studio [options]
+
+Serve the bundled Hogsend Studio (the admin SPA) locally and open it in a
+browser. The Studio is a static single-page app; this command starts a tiny
+local web server for it on a port of your choosing.
+
+By default the Studio talks to the API at the same origin it is served from,
+which won't be a running API here \u2014 so point it at your instance with
+--base-url (the SPA uses cookie auth, so the instance must allow CORS from the
+Studio origin, or you can simply open the Studio that the engine mounts at
+\`<instance>/studio\` instead).
+
+Options:
+  --port <n>          Local port to serve on (default 3333).
+  --base-url <url>    API instance the Studio should call (injected at runtime).
+                      Omit to use same-origin (the local server, for static
+                      preview only).
+  --open              Open the Studio in your default browser after starting.
+  --dist <path>       Override the Studio dist directory (advanced).
+  -h, --help          Show this help.
+
+Examples:
+  hogsend studio --open
+  hogsend studio --base-url https://api.example.com --open
+  hogsend studio --port 4000`;
+function resolveStudioDist(distFlag) {
+  const candidates = [];
+  if (distFlag && distFlag.length > 0) {
+    candidates.push(resolve(process.cwd(), distFlag));
+  }
+  candidates.push(fileURLToPath2(new URL("../studio", import.meta.url)));
+  candidates.push(
+    fileURLToPath2(new URL("../../studio/dist", import.meta.url)),
+    fileURLToPath2(new URL("../../../studio/dist", import.meta.url))
+  );
+  candidates.push(resolve(process.cwd(), "packages/studio/dist"));
+  for (const dir of candidates) {
+    if (existsSync6(join6(dir, "index.html"))) {
+      return dir;
+    }
+  }
+  return null;
+}
+var MIME = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".map": "application/json; charset=utf-8"
+};
+function mimeFor(path) {
+  return MIME[extname(path).toLowerCase()] ?? "application/octet-stream";
+}
+function indexHtml(distPath, baseUrl) {
+  const raw = readFileSync3(join6(distPath, "index.html"), "utf8");
+  if (!baseUrl) return raw;
+  const inject = `<script>window.__HOGSEND_STUDIO__=${JSON.stringify({
+    baseUrl
+  })};</script>`;
+  if (raw.includes("</head>")) {
+    return raw.replace("</head>", `${inject}</head>`);
+  }
+  return `${inject}${raw}`;
+}
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+async function run10(ctx) {
+  const { values, positionals } = parseArgs10({
+    args: ctx.argv,
+    allowPositionals: true,
+    strict: false,
+    options: {
+      port: { type: "string" },
+      "base-url": { type: "string" },
+      open: { type: "boolean", default: false },
+      dist: { type: "string" },
+      help: { type: "boolean", short: "h", default: false }
+    }
+  });
+  if (values.help) {
+    ctx.out.log(usage10);
+    return;
+  }
+  const port = Number(values.port ?? "3333");
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    ctx.out.fail(`invalid --port "${values.port}" (expected 1-65535)`);
+  }
+  const baseUrl = typeof values["base-url"] === "string" ? values["base-url"] : void 0;
+  const distPath = resolveStudioDist(
+    typeof values.dist === "string" ? values.dist : positionals[0]
+  );
+  if (!distPath) {
+    ctx.out.fail(
+      "could not find a built Studio (dist/). Build it with `pnpm --filter @hogsend/studio build`, or pass --dist <path>."
+    );
+  }
+  const cleanBase = baseUrl ? baseUrl.replace(/\/+$/, "") : void 0;
+  const index = indexHtml(distPath, cleanBase);
+  const server = createServer((req, res) => {
+    const urlPath = decodeURIComponent((req.url ?? "/").split("?")[0] ?? "/");
+    const rel = urlPath.replace(/^\/studio/, "");
+    if (rel === "" || rel === "/") {
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(index);
+      return;
+    }
+    const target = normalize(join6(distPath, rel));
+    if (target !== distPath && !target.startsWith(distPath + sep3)) {
+      res.writeHead(403);
+      res.end("Forbidden");
+      return;
+    }
+    if (existsSync6(target) && statSync2(target).isFile()) {
+      res.writeHead(200, { "content-type": mimeFor(target) });
+      createReadStream(target).pipe(res);
+      return;
+    }
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    res.end(index);
+  });
+  await new Promise((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(port, () => resolveListen());
+  }).catch((err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    ctx.out.fail(`could not start server on port ${port}: ${msg}`);
+  });
+  const localUrl = `http://localhost:${port}/studio/`;
+  if (ctx.json) {
+    ctx.out.json({
+      url: localUrl,
+      port,
+      baseUrl: cleanBase ?? null,
+      dist: distPath
+    });
+  } else {
+    ctx.out.intro(`${color.bgMagenta(color.black(" hogsend "))} studio`);
+    ctx.out.note(
+      [
+        `${color.green("\u25CF")} Studio serving at ${color.cyan(localUrl)}`,
+        cleanBase ? color.dim(`API instance: ${cleanBase}`) : color.dim(
+          "No --base-url set (same-origin / static preview). The API calls will hit this local server and fail \u2014 pass --base-url <instance>, or open <instance>/studio directly."
+        ),
+        "",
+        color.dim("First load shows a create-admin screen if no admin exists."),
+        color.dim("Press Ctrl+C to stop.")
+      ].join("\n"),
+      "Studio"
+    );
+  }
+  if (values.open) {
+    openBrowser(localUrl);
+  }
+  await new Promise((resolveForever) => {
+    const stop = () => {
+      server.close(() => resolveForever());
+    };
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+  });
+}
+var studioCommand = {
+  name: "studio",
+  summary: "Serve the bundled Hogsend Studio admin SPA locally",
+  usage: usage10,
+  run: run10
+};
+
+// src/commands/upgrade.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
+import { join as join7 } from "path";
+import { parseArgs as parseArgs11 } from "util";
+import { confirm as confirm2 } from "@clack/prompts";
+var usage11 = `hogsend upgrade [--cwd <dir>] [--pm <pnpm|npm|yarn|bun>] [options]
+
+Upgrade a scaffolded Hogsend app in one step:
+  1. bump every @hogsend/* dependency to latest (or --to <version>), then
+  2. refresh the vendored Claude Code skills in ./.claude/skills to match.
+
+Run this after a new engine release so your app AND the agent guidance move
+together. Skills are version-stamped so \`hogsend doctor\` can warn when they
+fall behind.
+
+Options:
+  --cwd <dir>        Project root to upgrade (defaults to the current directory).
+  --pm <manager>     Package manager (default: detected from the lockfile, else pnpm).
+  --to <version>     Target version for @hogsend/* deps (default: latest).
+  --deps-only        Bump dependencies only; don't touch skills.
+  --skills-only      Refresh skills only; don't touch dependencies.
+  --yes, -y          Skip the confirmation prompt. Implied by --json.
+  --json             Run non-interactively and emit a single JSON result.
+  -h, --help         Show this help.`;
+var VALID_PMS = ["pnpm", "npm", "yarn", "bun"];
+function detectPm(cwd) {
+  if (existsSync7(join7(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync7(join7(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync7(join7(cwd, "bun.lockb")) || existsSync7(join7(cwd, "bun.lock")))
+    return "bun";
+  if (existsSync7(join7(cwd, "package-lock.json"))) return "npm";
+  return "pnpm";
+}
+function hogsendDeps(cwd) {
+  const pkg = JSON.parse(readFileSync4(join7(cwd, "package.json"), "utf8"));
+  const all = { ...pkg.dependencies, ...pkg.devDependencies };
+  return Object.keys(all).filter((n) => n.startsWith("@hogsend/")).sort();
+}
+function addArgs(pm, specs) {
+  return [pm === "npm" ? "install" : "add", ...specs];
+}
+async function run11(ctx) {
+  const { values } = parseArgs11({
+    args: ctx.argv,
+    allowPositionals: true,
+    options: {
+      cwd: { type: "string" },
+      pm: { type: "string" },
+      to: { type: "string" },
+      "deps-only": { type: "boolean", default: false },
+      "skills-only": { type: "boolean", default: false },
+      yes: { type: "boolean", short: "y", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    }
+  });
+  if (values.help) {
+    ctx.out.log(usage11);
+    return;
+  }
+  if (values["deps-only"] && values["skills-only"]) {
+    ctx.out.fail("--deps-only and --skills-only are mutually exclusive.");
+  }
+  const cwd = values.cwd ?? process.cwd();
+  if (!existsSync7(join7(cwd, "package.json"))) {
+    ctx.out.fail(
+      `no package.json in ${cwd} \u2014 run upgrade from a scaffolded Hogsend app (or pass --cwd).`
+    );
+  }
+  let pm;
+  if (values.pm !== void 0) {
+    if (!VALID_PMS.includes(values.pm)) {
+      ctx.out.fail(
+        `invalid --pm "${values.pm}". Expected one of: ${VALID_PMS.join(", ")}.`
+      );
+    }
+    pm = values.pm;
+  } else {
+    pm = detectPm(cwd);
+  }
+  const target = values.to ?? "latest";
+  const doDeps = !values["skills-only"];
+  const doSkills = !values["deps-only"];
+  const deps = doDeps ? hogsendDeps(cwd) : [];
+  if (doDeps && deps.length === 0) {
+    ctx.out.fail(
+      `no @hogsend/* dependencies found in ${join7(cwd, "package.json")}.`
+    );
+  }
+  const skipConfirm = ctx.json || values.yes;
+  if (!ctx.json) {
+    ctx.out.intro(
+      `${color.bgMagenta(color.black(" hogsend "))} ${color.dim("upgrade")}`
+    );
+  }
+  if (ctx.out.interactive && !skipConfirm) {
+    const plan = [
+      doDeps ? `bump ${deps.length} @hogsend/* dep(s) to ${target} (${pm})` : null,
+      doSkills ? "refresh .claude/skills" : null
+    ].filter(Boolean).join(" + ");
+    const proceed = bail(
+      await confirm2({ message: `Upgrade ${color.cyan(cwd)}: ${plan}?` })
+    );
+    if (!proceed) {
+      ctx.out.outro(color.dim("Nothing changed."));
+      return;
+    }
+  }
+  const results = [];
+  if (doDeps) {
+    const specs = deps.map((n) => `${n}@${target}`);
+    const dep = await ctx.out.step(
+      `Bumping @hogsend/* -> ${target} (${pm})`,
+      async () => spawnSync3(pm, addArgs(pm, specs), {
+        cwd,
+        stdio: ctx.json ? "ignore" : "inherit",
+        shell: process.platform === "win32"
+      })
+    );
+    results.push({
+      step: "deps",
+      status: dep.status === 0 ? "ok" : "failed",
+      detail: dep.status === 0 ? `${deps.join(", ")} -> ${target}` : `${pm} exited with code ${dep.status ?? "?"}`
+    });
+  } else {
+    results.push({ step: "deps", status: "skipped", detail: "--skills-only" });
+  }
+  const depsFailed = results.some(
+    (r) => r.step === "deps" && r.status === "failed"
+  );
+  if (!doSkills) {
+    results.push({
+      step: "skills",
+      status: "skipped",
+      detail: "--deps-only"
+    });
+  } else if (depsFailed) {
+    results.push({
+      step: "skills",
+      status: "skipped",
+      detail: "skipped \u2014 dependency bump failed; fix it then re-run"
+    });
+  } else {
+    const bundled = listBundledSkills(cwd);
+    const copied = bundled.map((s) => copySkill(s.name, cwd, true));
+    writeSkillsStamp(
+      cwd,
+      bundled.map((s) => s.name)
+    );
+    results.push({
+      step: "skills",
+      status: "ok",
+      detail: `refreshed ${copied.length} skill(s) -> ${installDir(cwd)}`
+    });
+  }
+  const failed = results.filter((r) => r.status === "failed");
+  const ok = failed.length === 0;
+  if (ctx.json) {
+    ctx.out.json({ ok, cwd, pm, target, steps: results });
+    if (!ok) process.exit(1);
+    return;
+  }
+  ctx.out.table(
+    results.map((r) => ({
+      step: r.step,
+      status: r.status === "ok" ? color.green("ok") : r.status === "skipped" ? color.dim("skipped") : color.red("failed"),
+      detail: r.detail
+    })),
+    ["step", "status", "detail"]
+  );
+  if (!ok) {
+    ctx.out.fail(
+      `${failed.length} step(s) failed \u2014 see the table above. Fix and re-run hogsend upgrade.`
+    );
+  }
+  ctx.out.outro(
+    `${color.green("Upgraded.")} ${color.dim("Engine + agent skills are on the latest line.")}`
+  );
+}
+var upgradeCommand = {
+  name: "upgrade",
+  summary: "Bump @hogsend/* deps to latest + refresh vendored skills",
+  usage: usage11,
+  run: run11
+};
+
 // src/commands/index.ts
 var commands = [
   doctorCommand,
@@ -1755,19 +2224,21 @@ var commands = [
   contactsCommand,
   statsCommand,
   eventsCommand,
+  studioCommand,
   setupCommand,
   skillsCommand,
+  upgradeCommand,
   ejectCommand,
   patchCommand
 ];
 
 // src/lib/config.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
-import { join as join5 } from "path";
-import { parseArgs as parseArgs10 } from "util";
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
+import { join as join8 } from "path";
+import { parseArgs as parseArgs12 } from "util";
 var DEFAULT_BASE_URL = "http://localhost:3002";
 function parseGlobalFlags(argv) {
-  const { values, tokens } = parseArgs10({
+  const { values, tokens } = parseArgs12({
     args: argv,
     allowPositionals: true,
     strict: false,
@@ -1804,11 +2275,11 @@ function parseGlobalFlags(argv) {
 }
 function loadDotEnv(cwd = process.cwd()) {
   const out = {};
-  const file = join5(cwd, ".env");
-  if (!existsSync5(file)) return out;
+  const file = join8(cwd, ".env");
+  if (!existsSync8(file)) return out;
   let raw;
   try {
-    raw = readFileSync3(file, "utf8");
+    raw = readFileSync5(file, "utf8");
   } catch {
     return out;
   }
@@ -1841,7 +2312,7 @@ function resolveConfig(flags, cwd = process.cwd()) {
 // src/bin.ts
 function version() {
   try {
-    const require2 = createRequire2(import.meta.url);
+    const require2 = createRequire3(import.meta.url);
     const pkg = require2("../package.json");
     return pkg.version ?? "0.0.0";
   } catch {