@hogsend/cli 0.1.0 → 0.2.0

package/src/commands/skills.ts

@@ -1,17 +1,17 @@
-import {
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  statSync,
-} from "node:fs";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { multiselect } from "@clack/prompts";
 import { color } from "../lib/output.js";
 import { bail } from "../lib/prompt.js";
+import {
+  bundledSkillsDir,
+  type CopyResult,
+  copySkill,
+  installDir,
+  listBundledSkills,
+  writeSkillsStamp,
+} from "../lib/skills.js";
 import type { Command, CommandContext } from "./types.js";
 
 const usage = `hogsend skills <subcommand> [options]
@@ -24,10 +24,13 @@ Subcommands:
   list                      List bundled skills + whether each is installed.
   add [name] [--force]      Copy a bundled skill into ./.claude/skills/<name>/.
                             Omit name for an interactive multiselect (human),
-                            or copy all bundled skills (--json / non-interactive).
+                            or copy all bundled skills (--all / --json /
+                            non-interactive).
 
 Options:
-  --force        Overwrite an already-installed skill.
+  --all          Install every bundled skill (skips the interactive picker).
+  --force        Overwrite an already-installed skill. Use after upgrading the
+                 engine to refresh vendored skills to the latest guidance.
   --json         Emit machine-readable JSON only (implies non-interactive).
   -h, --help     Show this help.
 
@@ -35,70 +38,11 @@ Examples:
   hogsend skills list
   hogsend skills list --json
   hogsend skills add
-  hogsend skills add hogsend-cli --force`;
-
-/**
- * Resolve the directory holding the bundled skills shipped in the tarball.
- * At runtime bin.js lives at <pkg>/dist/bin.js, so the skills dir (shipped via
- * package.json files[]) is one level up at <pkg>/skills.
- */
-function bundledSkillsDir(): string {
-  return fileURLToPath(new URL("../skills", import.meta.url));
-}
-
-/** Target directory for installed skills in the consumer project. */
-function installDir(cwd: string): string {
-  return join(cwd, ".claude", "skills");
-}
-
-interface BundledSkill {
-  name: string;
-  description: string;
-  installed: boolean;
-}
-
-/** A single line `key: value` reader for SKILL.md YAML frontmatter. */
-function readFrontmatterField(skillDir: string, field: string): string {
-  const skillFile = join(skillDir, "SKILL.md");
-  if (!existsSync(skillFile)) return "";
-  // Tiny frontmatter scan — avoids a YAML dep. Reads only the top block.
-  const raw = readFileSyncSafe(skillFile);
-  const fmMatch = raw.match(/^---\n([\s\S]*?)\n---/);
-  if (!fmMatch) return "";
-  const block = fmMatch[1] ?? "";
-  for (const line of block.split("\n")) {
-    const m = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (m && m[1] === field) {
-      return (m[2] ?? "").replace(/^["']|["']$/g, "").trim();
-    }
-  }
-  return "";
-}
-
-/** Read a file as utf8, returning "" on any error (never throws). */
-function readFileSyncSafe(path: string): string {
-  try {
-    return readFileSync(path, "utf8");
-  } catch {
-    return "";
-  }
-}
+  hogsend skills add --all
+  hogsend skills add hogsend-cli --force
+  hogsend skills add --all --force         # refresh everything after an upgrade
 
-/** Enumerate bundled skills (each is a subdir with a SKILL.md). */
-function listBundledSkills(cwd: string): BundledSkill[] {
-  const dir = bundledSkillsDir();
-  if (!existsSync(dir)) return [];
-  const target = installDir(cwd);
-  const entries = readdirSync(dir).filter((name) => {
-    const full = join(dir, name);
-    return statSync(full).isDirectory() && existsSync(join(full, "SKILL.md"));
-  });
-  return entries.sort().map((name) => ({
-    name,
-    description: readFrontmatterField(join(dir, name), "description"),
-    installed: existsSync(join(target, name)),
-  }));
-}
+Tip: \`hogsend upgrade\` bumps the engine AND refreshes these skills in one step.`;
 
 function runList(ctx: CommandContext): void {
   const skills = listBundledSkills(process.cwd());
@@ -133,35 +77,17 @@ function runList(ctx: CommandContext): void {
     ["name", "installed", "description"],
   );
   ctx.out.outro(
-    `Install with ${color.cyan("hogsend skills add <name>")} (or just ${color.cyan("hogsend skills add")}).`,
+    `Install with ${color.cyan("hogsend skills add <name>")} (or ${color.cyan("hogsend skills add --all")}). ` +
+      `Refresh after an engine upgrade with ${color.cyan("--force")}.`,
   );
 }
 
-interface CopyResult {
-  name: string;
-  installed: boolean;
-  skipped: boolean;
-  path: string;
-}
-
-/** Copy one bundled skill into the project, honouring --force. */
-function copySkill(name: string, cwd: string, force: boolean): CopyResult {
-  const src = join(bundledSkillsDir(), name);
-  const dest = join(installDir(cwd), name);
-  const exists = existsSync(dest);
-  if (exists && !force) {
-    return { name, installed: false, skipped: true, path: dest };
-  }
-  mkdirSync(installDir(cwd), { recursive: true });
-  cpSync(src, dest, { recursive: true, force: true });
-  return { name, installed: true, skipped: false, path: dest };
-}
-
 async function runAdd(ctx: CommandContext, argv: string[]): Promise<void> {
   const { values, positionals } = parseArgs({
     args: argv,
     allowPositionals: true,
     options: {
+      all: { type: "boolean", default: false },
       force: { type: "boolean", default: false },
       help: { type: "boolean", short: "h", default: false },
     },
@@ -191,6 +117,9 @@ async function runAdd(ctx: CommandContext, argv: string[]): Promise<void> {
       );
     }
     names = [requested];
+  } else if (values.all) {
+    // Explicit install-all — skip the picker even in a TTY.
+    names = bundled.map((s) => s.name);
   } else if (ctx.out.interactive) {
     const picked = bail(
       await multiselect({
@@ -209,7 +138,18 @@ async function runAdd(ctx: CommandContext, argv: string[]): Promise<void> {
     names = bundled.map((s) => s.name);
   }
 
-  const results = names.map((name) => copySkill(name, cwd, force));
+  const results: CopyResult[] = names.map((name) =>
+    copySkill(name, cwd, force),
+  );
+
+  // Stamp the now-installed set with this CLI's version, so `hogsend doctor`
+  // can later tell whether the vendored skills have fallen behind the engine.
+  if (results.some((r) => r.installed)) {
+    const installedNames = listBundledSkills(cwd)
+      .filter((s) => existsSync(join(installDir(cwd), s.name)))
+      .map((s) => s.name);
+    writeSkillsStamp(cwd, installedNames);
+  }
 
   if (ctx.json) {
     ctx.out.json({

package/src/commands/studio.ts

@@ -0,0 +1,261 @@
+import { spawn } from "node:child_process";
+import { createReadStream, existsSync, readFileSync, statSync } from "node:fs";
+import { createServer } from "node:http";
+import { extname, join, normalize, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+import { color } from "../lib/output.js";
+import type { Command, CommandContext } from "./types.js";
+
+const usage = `hogsend studio [options]
+
+Serve the bundled Hogsend Studio (the admin SPA) locally and open it in a
+browser. The Studio is a static single-page app; this command starts a tiny
+local web server for it on a port of your choosing.
+
+By default the Studio talks to the API at the same origin it is served from,
+which won't be a running API here — so point it at your instance with
+--base-url (the SPA uses cookie auth, so the instance must allow CORS from the
+Studio origin, or you can simply open the Studio that the engine mounts at
+\`<instance>/studio\` instead).
+
+Options:
+  --port <n>          Local port to serve on (default 3333).
+  --base-url <url>    API instance the Studio should call (injected at runtime).
+                      Omit to use same-origin (the local server, for static
+                      preview only).
+  --open              Open the Studio in your default browser after starting.
+  --dist <path>       Override the Studio dist directory (advanced).
+  -h, --help          Show this help.
+
+Examples:
+  hogsend studio --open
+  hogsend studio --base-url https://api.example.com --open
+  hogsend studio --port 4000`;
+
+/**
+ * Resolve the built Studio `dist/` directory.
+ *
+ * Resolution order:
+ *  1. Explicit --dist override (positional path; absolute or cwd-relative).
+ *  2. The dist bundled inside this CLI package (shipped via package.json files[];
+ *     at runtime bin.js is <pkg>/dist/bin.js, so the bundled studio is one level
+ *     up at <pkg>/studio).
+ *  3. Monorepo source layout: packages/studio/dist relative to this file.
+ *  4. cwd-relative packages/studio/dist (running from repo root).
+ */
+function resolveStudioDist(distFlag: string | undefined): string | null {
+  const candidates: string[] = [];
+
+  if (distFlag && distFlag.length > 0) {
+    candidates.push(resolve(process.cwd(), distFlag));
+  }
+
+  // Bundled in the published CLI tarball at <pkg>/studio.
+  candidates.push(fileURLToPath(new URL("../studio", import.meta.url)));
+
+  // Monorepo: this file is packages/cli/src/commands/studio.ts (or built into
+  // dist/), so the studio dist sits at ../../studio/dist relative to dist/.
+  candidates.push(
+    fileURLToPath(new URL("../../studio/dist", import.meta.url)),
+    fileURLToPath(new URL("../../../studio/dist", import.meta.url)),
+  );
+
+  candidates.push(resolve(process.cwd(), "packages/studio/dist"));
+
+  for (const dir of candidates) {
+    if (existsSync(join(dir, "index.html"))) {
+      return dir;
+    }
+  }
+  return null;
+}
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".map": "application/json; charset=utf-8",
+};
+
+function mimeFor(path: string): string {
+  return MIME[extname(path).toLowerCase()] ?? "application/octet-stream";
+}
+
+/**
+ * Read index.html and, when a base URL is provided, inject a runtime global the
+ * Studio reads (`window.__HOGSEND_STUDIO__ = { baseUrl }`) so the static bundle
+ * can be pointed at a remote instance without a rebuild.
+ */
+function indexHtml(distPath: string, baseUrl: string | undefined): string {
+  const raw = readFileSync(join(distPath, "index.html"), "utf8");
+  if (!baseUrl) return raw;
+  const inject = `<script>window.__HOGSEND_STUDIO__=${JSON.stringify({
+    baseUrl,
+  })};</script>`;
+  if (raw.includes("</head>")) {
+    return raw.replace("</head>", `${inject}</head>`);
+  }
+  return `${inject}${raw}`;
+}
+
+/** Open a URL in the OS default browser (best-effort, never throws). */
+function openBrowser(url: string): void {
+  const platform = process.platform;
+  const cmd =
+    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {
+    // best-effort
+  }
+}
+
+async function run(ctx: CommandContext): Promise<void> {
+  const { values, positionals } = parseArgs({
+    args: ctx.argv,
+    allowPositionals: true,
+    strict: false,
+    options: {
+      port: { type: "string" },
+      "base-url": { type: "string" },
+      open: { type: "boolean", default: false },
+      dist: { type: "string" },
+      help: { type: "boolean", short: "h", default: false },
+    },
+  });
+
+  if (values.help) {
+    ctx.out.log(usage);
+    return;
+  }
+
+  const port = Number(values.port ?? "3333");
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    ctx.out.fail(`invalid --port "${values.port}" (expected 1-65535)`);
+  }
+
+  // --base-url flag, else the resolved CLI config base URL (so it "just works"
+  // against the same instance the other commands target), unless that's the
+  // local default placeholder. Keep undefined for pure static preview.
+  const baseUrl =
+    typeof values["base-url"] === "string" ? values["base-url"] : undefined;
+
+  const distPath = resolveStudioDist(
+    typeof values.dist === "string" ? values.dist : positionals[0],
+  );
+
+  if (!distPath) {
+    ctx.out.fail(
+      "could not find a built Studio (dist/). Build it with " +
+        "`pnpm --filter @hogsend/studio build`, or pass --dist <path>.",
+    );
+  }
+
+  const cleanBase = baseUrl ? baseUrl.replace(/\/+$/, "") : undefined;
+  const index = indexHtml(distPath, cleanBase);
+
+  const server = createServer((req, res) => {
+    const urlPath = decodeURIComponent((req.url ?? "/").split("?")[0] ?? "/");
+
+    // The Studio bundle is built under base "/studio/", so all asset URLs are
+    // prefixed with /studio. Strip that prefix to map onto the dist root.
+    const rel = urlPath.replace(/^\/studio/, "");
+    if (rel === "" || rel === "/") {
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(index);
+      return;
+    }
+
+    // Resolve safely inside distPath (defend against path traversal).
+    const target = normalize(join(distPath, rel));
+    if (target !== distPath && !target.startsWith(distPath + sep)) {
+      res.writeHead(403);
+      res.end("Forbidden");
+      return;
+    }
+
+    if (existsSync(target) && statSync(target).isFile()) {
+      res.writeHead(200, { "content-type": mimeFor(target) });
+      createReadStream(target).pipe(res);
+      return;
+    }
+
+    // SPA fallback: unknown paths serve index.html so client-side routes work.
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    res.end(index);
+  });
+
+  await new Promise<void>((resolveListen, reject) => {
+    server.once("error", reject);
+    server.listen(port, () => resolveListen());
+  }).catch((err: unknown) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    ctx.out.fail(`could not start server on port ${port}: ${msg}`);
+  });
+
+  const localUrl = `http://localhost:${port}/studio/`;
+
+  if (ctx.json) {
+    ctx.out.json({
+      url: localUrl,
+      port,
+      baseUrl: cleanBase ?? null,
+      dist: distPath,
+    });
+    // In json mode we still keep the server running (foreground). Agents that
+    // don't want a long-running process should not pass --json to `studio`.
+  } else {
+    ctx.out.intro(`${color.bgMagenta(color.black(" hogsend "))} studio`);
+    ctx.out.note(
+      [
+        `${color.green("●")} Studio serving at ${color.cyan(localUrl)}`,
+        cleanBase
+          ? color.dim(`API instance: ${cleanBase}`)
+          : color.dim(
+              "No --base-url set (same-origin / static preview). The API " +
+                "calls will hit this local server and fail — pass --base-url " +
+                "<instance>, or open <instance>/studio directly.",
+            ),
+        "",
+        color.dim("First load shows a create-admin screen if no admin exists."),
+        color.dim("Press Ctrl+C to stop."),
+      ].join("\n"),
+      "Studio",
+    );
+  }
+
+  if (values.open) {
+    openBrowser(localUrl);
+  }
+
+  // Keep the process alive until interrupted.
+  await new Promise<void>((resolveForever) => {
+    const stop = () => {
+      server.close(() => resolveForever());
+    };
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+  });
+}
+
+export const studioCommand: Command = {
+  name: "studio",
+  summary: "Serve the bundled Hogsend Studio admin SPA locally",
+  usage,
+  run,
+};

package/src/commands/upgrade.ts

@@ -0,0 +1,245 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { confirm } from "@clack/prompts";
+import { color } from "../lib/output.js";
+import { bail } from "../lib/prompt.js";
+import {
+  copySkill,
+  installDir,
+  listBundledSkills,
+  writeSkillsStamp,
+} from "../lib/skills.js";
+import type { Command, CommandContext } from "./types.js";
+
+const usage = `hogsend upgrade [--cwd <dir>] [--pm <pnpm|npm|yarn|bun>] [options]
+
+Upgrade a scaffolded Hogsend app in one step:
+  1. bump every @hogsend/* dependency to latest (or --to <version>), then
+  2. refresh the vendored Claude Code skills in ./.claude/skills to match.
+
+Run this after a new engine release so your app AND the agent guidance move
+together. Skills are version-stamped so \`hogsend doctor\` can warn when they
+fall behind.
+
+Options:
+  --cwd <dir>        Project root to upgrade (defaults to the current directory).
+  --pm <manager>     Package manager (default: detected from the lockfile, else pnpm).
+  --to <version>     Target version for @hogsend/* deps (default: latest).
+  --deps-only        Bump dependencies only; don't touch skills.
+  --skills-only      Refresh skills only; don't touch dependencies.
+  --yes, -y          Skip the confirmation prompt. Implied by --json.
+  --json             Run non-interactively and emit a single JSON result.
+  -h, --help         Show this help.`;
+
+type Pm = "pnpm" | "npm" | "yarn" | "bun";
+const VALID_PMS: Pm[] = ["pnpm", "npm", "yarn", "bun"];
+
+/** Detect the package manager from a lockfile, defaulting to pnpm. */
+function detectPm(cwd: string): Pm {
+  if (existsSync(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync(join(cwd, "bun.lockb")) || existsSync(join(cwd, "bun.lock")))
+    return "bun";
+  if (existsSync(join(cwd, "package-lock.json"))) return "npm";
+  return "pnpm";
+}
+
+/** The @hogsend/* deps declared in the app's package.json. */
+function hogsendDeps(cwd: string): string[] {
+  const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8")) as {
+    dependencies?: Record<string, string>;
+    devDependencies?: Record<string, string>;
+  };
+  const all = { ...pkg.dependencies, ...pkg.devDependencies };
+  return Object.keys(all)
+    .filter((n) => n.startsWith("@hogsend/"))
+    .sort();
+}
+
+/** Build the install verb + args for the given pm (all but npm use `add`). */
+function addArgs(pm: Pm, specs: string[]): string[] {
+  return [pm === "npm" ? "install" : "add", ...specs];
+}
+
+interface StepResult {
+  step: string;
+  status: "ok" | "skipped" | "failed";
+  detail: string;
+}
+
+async function run(ctx: CommandContext): Promise<void> {
+  const { values } = parseArgs({
+    args: ctx.argv,
+    allowPositionals: true,
+    options: {
+      cwd: { type: "string" },
+      pm: { type: "string" },
+      to: { type: "string" },
+      "deps-only": { type: "boolean", default: false },
+      "skills-only": { type: "boolean", default: false },
+      yes: { type: "boolean", short: "y", default: false },
+      help: { type: "boolean", short: "h", default: false },
+    },
+  });
+
+  if (values.help) {
+    ctx.out.log(usage);
+    return;
+  }
+
+  if (values["deps-only"] && values["skills-only"]) {
+    ctx.out.fail("--deps-only and --skills-only are mutually exclusive.");
+  }
+
+  const cwd = values.cwd ?? process.cwd();
+  if (!existsSync(join(cwd, "package.json"))) {
+    ctx.out.fail(
+      `no package.json in ${cwd} — run upgrade from a scaffolded Hogsend app (or pass --cwd).`,
+    );
+  }
+
+  let pm: Pm;
+  if (values.pm !== undefined) {
+    if (!(VALID_PMS as string[]).includes(values.pm)) {
+      ctx.out.fail(
+        `invalid --pm "${values.pm}". Expected one of: ${VALID_PMS.join(", ")}.`,
+      );
+    }
+    pm = values.pm as Pm;
+  } else {
+    pm = detectPm(cwd);
+  }
+
+  const target = values.to ?? "latest";
+  const doDeps = !values["skills-only"];
+  const doSkills = !values["deps-only"];
+  const deps = doDeps ? hogsendDeps(cwd) : [];
+
+  if (doDeps && deps.length === 0) {
+    ctx.out.fail(
+      `no @hogsend/* dependencies found in ${join(cwd, "package.json")}.`,
+    );
+  }
+
+  const skipConfirm = ctx.json || values.yes;
+  if (!ctx.json) {
+    ctx.out.intro(
+      `${color.bgMagenta(color.black(" hogsend "))} ${color.dim("upgrade")}`,
+    );
+  }
+  if (ctx.out.interactive && !skipConfirm) {
+    const plan = [
+      doDeps
+        ? `bump ${deps.length} @hogsend/* dep(s) to ${target} (${pm})`
+        : null,
+      doSkills ? "refresh .claude/skills" : null,
+    ]
+      .filter(Boolean)
+      .join(" + ");
+    const proceed = bail(
+      await confirm({ message: `Upgrade ${color.cyan(cwd)}: ${plan}?` }),
+    );
+    if (!proceed) {
+      ctx.out.outro(color.dim("Nothing changed."));
+      return;
+    }
+  }
+
+  const results: StepResult[] = [];
+
+  // 1. bump @hogsend/* deps via the package manager.
+  if (doDeps) {
+    const specs = deps.map((n) => `${n}@${target}`);
+    const dep = await ctx.out.step(
+      `Bumping @hogsend/* -> ${target} (${pm})`,
+      async () =>
+        spawnSync(pm, addArgs(pm, specs), {
+          cwd,
+          stdio: ctx.json ? "ignore" : "inherit",
+          shell: process.platform === "win32",
+        }),
+    );
+    results.push({
+      step: "deps",
+      status: dep.status === 0 ? "ok" : "failed",
+      detail:
+        dep.status === 0
+          ? `${deps.join(", ")} -> ${target}`
+          : `${pm} exited with code ${dep.status ?? "?"}`,
+    });
+  } else {
+    results.push({ step: "deps", status: "skipped", detail: "--skills-only" });
+  }
+
+  // 2. refresh vendored skills + re-stamp (only if deps didn't hard-fail).
+  const depsFailed = results.some(
+    (r) => r.step === "deps" && r.status === "failed",
+  );
+  if (!doSkills) {
+    results.push({
+      step: "skills",
+      status: "skipped",
+      detail: "--deps-only",
+    });
+  } else if (depsFailed) {
+    results.push({
+      step: "skills",
+      status: "skipped",
+      detail: "skipped — dependency bump failed; fix it then re-run",
+    });
+  } else {
+    const bundled = listBundledSkills(cwd);
+    const copied = bundled.map((s) => copySkill(s.name, cwd, true));
+    writeSkillsStamp(
+      cwd,
+      bundled.map((s) => s.name),
+    );
+    results.push({
+      step: "skills",
+      status: "ok",
+      detail: `refreshed ${copied.length} skill(s) -> ${installDir(cwd)}`,
+    });
+  }
+
+  const failed = results.filter((r) => r.status === "failed");
+  const ok = failed.length === 0;
+
+  if (ctx.json) {
+    ctx.out.json({ ok, cwd, pm, target, steps: results });
+    if (!ok) process.exit(1);
+    return;
+  }
+
+  ctx.out.table(
+    results.map((r) => ({
+      step: r.step,
+      status:
+        r.status === "ok"
+          ? color.green("ok")
+          : r.status === "skipped"
+            ? color.dim("skipped")
+            : color.red("failed"),
+      detail: r.detail,
+    })),
+    ["step", "status", "detail"],
+  );
+
+  if (!ok) {
+    ctx.out.fail(
+      `${failed.length} step(s) failed — see the table above. Fix and re-run hogsend upgrade.`,
+    );
+  }
+
+  ctx.out.outro(
+    `${color.green("Upgraded.")} ${color.dim("Engine + agent skills are on the latest line.")}`,
+  );
+}
+
+export const upgradeCommand: Command = {
+  name: "upgrade",
+  summary: "Bump @hogsend/* deps to latest + refresh vendored skills",
+  usage,
+  run,
+};