@kindgi/cli 0.1.11-rc.0 → 0.2.0-rc.1

package/dist/commands/dev.js

@@ -32,13 +32,15 @@
  */
 import { randomBytes, randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { chmod, readFile, unlink, writeFile } from 'node:fs/promises';
+import { readFile, unlink } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, isAbsolute, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
-import { discoveryRoots, findKindgiConfig, packLanguage, resolveDiscovery, } from '@kindgi/handler-runtime';
+import { blocksFolder, codePatterns, createGlobMatcher, discoveryRoots, findKindgiConfig, packLanguage, readPackBlocks, resolveDiscovery, } from '@kindgi/handler-runtime';
 import { LOCAL_ENV_NAME, describeUnreadable, displayEnvPath, namesInAppFiles, packValues, readPackEnv, runtimeValues, } from '@kindgi/secrets-dotenv';
 import { CORS_ORIGINS_VAR, EXPORT_SIGNING_KEY_PATH_VAR, PUBLIC_TOKEN_KEY_PATH_VAR, parseCorsOrigins, } from '@kindgi/env-schema';
+import { scrubText } from '@kindgi/log';
+import { indexerPredatesBlocks, packIndexerName } from '../build/pack-blocks.js';
 import { ALREADY_RUNNING_EXIT_CODE, alreadyRunning } from '../dev/already-running.js';
 import { LocalPortsRefused, localPortsRefused, refusedHere, } from '../dev/blocked.js';
 import { DEV_LOCK_FILE, osProcesses, ownerIsLive, takeDevLock, } from '../dev/dev-lock.js';
@@ -47,7 +49,7 @@ import { DEV_GOOGLE_CREDENTIALS_VAR, VERTEX_PROVIDER_ID, isVertexRegistration, r
 import { DEFAULT_DEV_LOG_VIEW, parseDevLogFlags, resolveDevLogView, runtimeLogLevels, showIndexerLine, showLine, showText, sourceLogEnv, } from '../dev/log-view.js';
 import { isJvmPackCode, resolvePackCode } from '../dev/pack-code.js';
 import { devPackEnv, devPackEnvFiles } from '../dev/pack-env.js';
-import { createPackRefresher, showPackEvent } from '../dev/pack-service.js';
+import { createPackRefresher, showBlockWritten, showPackEvent } from '../dev/pack-service.js';
 import { PORT_SEARCH_SPAN, firstFreePort } from '../dev/port.js';
 import { devRuntimeSource, previewExpiryWarning, previewRefusalHint, readLicenseStatus, } from '../dev/preview-expiry.js';
 import { resolveDevProject } from '../dev/project.js';
@@ -63,12 +65,13 @@ import { PYPI_NO_BUNDLER } from '../esbuild-loader.js';
 import { openUrlInBrowser } from '../open-url.js';
 import { renderJson } from '../output.js';
 import { binDisplay, cliInstall, detectBinRunner } from '../package-manager.js';
+import { writePrivateFile } from '../private-file.js';
 import { MODELS_GUIDE } from '../providers/models-guide.js';
 import { loadProviderPresets } from '../providers/preset-loader.js';
 import { CLI_VERSION } from '../version-info.js';
 import { consoleUrlOf, couldNotOpen } from './console.js';
 import { defaultSdkSkillsRoot } from './init.js';
-import { describeSkillDrift, detectSkillDrift } from './skills.js';
+import { describeDevSkillsRefresh, refreshSkillsForDev } from './skills.js';
 export const devCommand = {
     kind: 'leaf',
     name: 'dev',
@@ -141,10 +144,10 @@ export const devCommand = {
             description: 'Let `docker compose` recreate the bundled Postgres if its definition changed (needs compose). By default an existing container is reused.',
         },
         // The runtime's and the pack service's records: what's shown, and how.
-        // `--quiet` (a global flag) keeps errors only.
+        // `--quiet` (a global flag) keeps errors and warnings only.
         'log-level': {
             type: 'string',
-            description: "The lowest level of the log records shown: error, warn, info, debug or trace. Default: `KINDGI_LOG_LEVEL` (the shell's, then the env files'), else info; with `--quiet`, error.",
+            description: "The lowest level of the log records shown: error, warn, info, debug or trace. Default: `KINDGI_LOG_LEVEL` (the shell's, then the env files'), else info; with `--quiet`, warn.",
         },
         log: {
             type: 'string',
@@ -182,11 +185,18 @@ function emitProgress(msg) {
         return;
     emitProblem(msg);
 }
-/** A progress line that's an error: shown under `--quiet` too. */
+/** A progress line that's an error or a warning: shown under `--quiet` too. */
 function emitProblem(msg) {
     process.stderr.write(`${stoppingLineOpen ? '\n' : ''}  ${msg}\n`);
     stoppingLineOpen = false;
 }
+/** The dev sandbox's lines, then its warnings: those are said under `--quiet` too. */
+function emitSandboxLines(outcome) {
+    for (const line of outcome.lines)
+        emitProgress(line);
+    for (const line of outcome.warnings)
+        emitProblem(line);
+}
 /**
  * How logs show this session (`dev/log-view.ts`): set from the flags as
  * `runDev` starts, and again once the env files are read.
@@ -366,7 +376,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
         emitProgress(`✓ Google credentials: ${google.credentials.path} (${google.credentials.who}), mounted read-only for Vertex AI`);
     }
     else if (declaredVertex.length > 0) {
-        emitProgress(`⚠ ${vertexCredentialsHint(declaredVertex, ctx.env)}`);
+        emitProblem(`⚠ ${vertexCredentialsHint(declaredVertex, ctx.env)}`);
     }
     // The pack service runs sandboxed where this machine can: the code a
     // coding agent writes can't read your keys or reach Docker. Where it
@@ -382,8 +392,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
     if (devSandbox.kind === 'error') {
         return { kind: 'error', stderr: `kindgi dev: ${devSandbox.message}\n`, exitCode: 1 };
     }
-    for (const line of devSandbox.lines)
-        emitProgress(line);
+    emitSandboxLines(devSandbox);
     const sandboxNotices = new Set();
     // The runtime's port, before anything starts. Taken without `--port`
     // (another `kindgi dev`, say): the next free one, which `.kindgirc.json`
@@ -417,7 +426,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
             };
         }
         if (args.recreateServices) {
-            emitProgress('⚠ --recreate-services: the shared Postgres may be recreated; every kindgi dev on this machine using it reconnects');
+            emitProblem('⚠ --recreate-services: the shared Postgres may be recreated; every kindgi dev on this machine using it reconnects');
         }
         emitProgress('Starting Postgres...');
         emitProgress('  first-run image pull can take 30-90s; cached boots are ~5-10s');
@@ -442,7 +451,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
             ? "✓ Postgres: started with docker (docker compose isn't available)"
             : '✓ Postgres: started with docker compose');
         for (const note of outcome.handle.notes ?? [])
-            emitProgress(`⚠ ${note}`);
+            emitProblem(`⚠ ${note}`);
     }
     const kindgircPath = join(args.packDir, '.kindgirc.json');
     const persisted = await readPersistedRc(kindgircPath);
@@ -498,7 +507,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
         }
         catch (err) {
             if (err.code !== 'ENOENT') {
-                emitProgress(`  --reset: could not remove .kindgirc.json: ${err.message}`);
+                emitProblem(`⚠ --reset: could not remove .kindgirc.json: ${err.message}`);
             }
         }
         if (projectDatabases === undefined) {
@@ -569,13 +578,17 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
             if (sandboxNotices.has(line))
                 return;
             sandboxNotices.add(line);
-            emitProgress(`⚠ ${line}`);
+            emitProblem(`⚠ ${line}`);
         },
         onLog: (line, stream) => emitOutput(showText('pack', line, logView, stream)),
         onEvent: (event) => {
             for (const output of showPackEvent(event, logView))
                 emitOutput(output);
         },
+        blocks: {
+            pattern: projectEnv.blocksPattern,
+            onWritten: (write, written) => emitProgress(`  ${showBlockWritten(write, written)}`),
+        },
     };
     // The front listens for the whole session; children come and go behind
     // it. It keeps the previous session's port, so a runtime started with
@@ -597,7 +610,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
         }
         if (previous.packServicePort === undefined)
             throw err;
-        emitProgress(`  the pack service's port ${previous.packServicePort} is taken: using another one${args.runtimeUrl !== undefined ? ' (restart your runtime with the new runtime.env)' : ''}`);
+        emitProblem(`⚠ the pack service's port ${previous.packServicePort} is taken: using another one${args.runtimeUrl !== undefined ? ' (restart your runtime with the new runtime.env)' : ''}`);
         await pack.close().catch(() => undefined);
         pack = dev.createPackService(packOptions);
         packFront = await pack.listen();
@@ -625,7 +638,10 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
             onBuild: async (build) => {
                 if (build.externals === undefined)
                     return;
-                for (const line of await devOnly.check(build.externals))
+                const checked = await devOnly.check(build.externals);
+                for (const line of checked.warnings)
+                    emitProblem(`  ${line}`);
+                for (const line of checked.lines)
                     emitProgress(`  ${line}`);
             },
         }),
@@ -716,6 +732,17 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
         })
         : emptyReport();
     emitBootIndex(bootIndex, bootReport, discoveryRoots(projectEnv.discoveryPatterns));
+    if (bootIndex.kind === 'ok') {
+        const predates = await indexerPredatesBlocks({
+            packDir: args.packDir,
+            pattern: projectEnv.blocksPattern,
+            blocksCounted: bootIndex.counts.blocks !== undefined,
+            indexer: packIndexerName(code.value.language),
+            release: CLI_VERSION,
+        });
+        if (predates !== undefined)
+            emitProblem(`  ⚠ ${predates}`);
+    }
     // Hints run the project's own kindgi through its package manager — or,
     // for a Python pack (no npm project), the kindgi on PATH.
     const runner = await detectBinRunner(args.packDir, code.value.language, undefined, ctx.env);
@@ -729,7 +756,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
             : { kind: 'database', url: databaseUrl };
     if (providersTarget.kind === 'bundled') {
         await adoptLegacyBundledEntries(devProvidersRecordPath(args.packDir), providersTarget.database, server.tenantId).catch((err) => {
-            emitProgress(`  ⚠ could not update ${join('.kindgi', 'dev', 'providers.json')}: ${err.message}. Providers this pack registered before 0.1.4 may read as not its own.`);
+            emitProblem(`  ⚠ could not update ${join('.kindgi', 'dev', 'providers.json')}: ${err.message}. Providers this pack registered before 0.1.4 may read as not its own.`);
         });
     }
     await applyDeclaredProviders({
@@ -761,27 +788,13 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
             .map((p) => p.id)
             .filter((id) => id === VERTEX_PROVIDER_ID && !declaredVertex.includes(id));
         if (byHand.length > 0)
-            emitProgress(`⚠ ${vertexCredentialsHint(byHand, ctx.env)}`);
+            emitProblem(`⚠ ${vertexCredentialsHint(byHand, ctx.env)}`);
     }
     // A preview runtime near the end of its life (90 days after its
-    // release, until 1.0): from 30 days before, the way to a newer one.
+    // release): from 30 days before, the way to a newer one.
     const previewWarning = previewExpiryWarning(await readLicenseStatus(client), devRuntimeSource(args));
     if (previewWarning !== undefined)
-        emitProgress(previewWarning);
-    const bannerLines = renderDevBanner({
-        baseUrl: server.baseUrl,
-        consoleMounted: server.consoleMounted === true,
-        tenantId: server.tenantId,
-        token: server.token,
-        providers,
-        packDir: args.packDir,
-        bootIndex,
-        bootReport,
-        discoveryRoots: discoveryRoots(projectEnv.discoveryPatterns),
-        ...(servicesHandle !== undefined && { autoStartedServices: servicesHandle.services }),
-        corsOrigins: publicRunTokens.corsOrigins,
-        ...(google.credentials !== undefined && { googleCredentials: google.credentials }),
-    });
+        emitProblem(previewWarning);
     // Write `.kindgirc.json` to the pack root so a SECOND terminal in
     // the same directory (`cd <pack>; kindgi runs start ...`) picks up
     // the api URL + bearer token automatically. Same file the config
@@ -799,25 +812,31 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
     // tenant row and orphans the pack's registered primitives under old
     // tenant UUIDs. Persisting keeps the "run this pack" identity
     // stable across restarts.
-    let kindgircWritten = false;
-    try {
-        await writeFile(kindgircPath, `${JSON.stringify({
-            apiUrl: server.baseUrl,
-            token: server.token,
-            tenantId: server.tenantId,
-            userId: server.userId,
-            packServicePort: packFront.port,
-            packServiceToken: pack.token,
-        }, null, 2)}\n`, 
-        // It holds the dev token and the pack service's token.
-        { encoding: 'utf8', mode: 0o600 });
-        await chmod(kindgircPath, 0o600);
-        kindgircWritten = true;
-    }
-    catch {
-        // Best effort — if the pack dir is read-only or something goes wrong,
-        // don't fail boot. The user can still pass --url/--token flags.
-    }
+    const kindgircWritten = await writeKindgirc(kindgircPath, {
+        apiUrl: server.baseUrl,
+        token: server.token,
+        tenantId: server.tenantId,
+        userId: server.userId,
+        packServicePort: packFront.port,
+        packServiceToken: pack.token,
+    });
+    // Where the token is in full: the banners show only its ends.
+    const tokenFile = kindgircWritten ? '.kindgirc.json' : join('.kindgi', 'dev', 'runtime.env');
+    const bannerLines = renderDevBanner({
+        baseUrl: server.baseUrl,
+        consoleMounted: server.consoleMounted === true,
+        tenantId: server.tenantId,
+        token: server.token,
+        tokenFile,
+        providers,
+        packDir: args.packDir,
+        bootIndex,
+        bootReport,
+        discoveryRoots: discoveryRoots(projectEnv.discoveryPatterns),
+        ...(servicesHandle !== undefined && { autoStartedServices: servicesHandle.services }),
+        corsOrigins: publicRunTokens.corsOrigins,
+        ...(google.credentials !== undefined && { googleCredentials: google.credentials }),
+    });
     // Where it serves, for a second kindgi dev to say (`dev.lock`).
     await lock
         .update({
@@ -842,7 +861,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
         emitProgress(`  Project    ${project.name} · database ${project.database}`);
     }
     emitProgress(`  Tenant     ${server.tenantId}`);
-    emitProgress(`  Token      ${server.token}`);
+    emitProgress(`  Token      ${describeDevToken(server.token, tokenFile)}`);
     if (providers !== undefined) {
         emitProgress(`  Models     ${describeModels(providers)}`);
     }
@@ -871,7 +890,10 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
     emitProgress('  Hit a framework rough edge?');
     emitProgress(`    echo "…" | ${kindgi('feedback', 'write', '--kind=bug', '--title="…"', '--body-stdin')}  (appends to FEEDBACK.md)`);
     emitProgress('');
-    await emitSkillDriftHint(args.packDir, code.value.language, kindgi('skills', 'sync'));
+    await emitSkillsRefresh(args.packDir, code.value.language, {
+        sync: kindgi('skills', 'sync'),
+        force: kindgi('skills', 'sync', '--force'),
+    });
     if (args.watch) {
         emitProgress(`  Watching ${args.packDir}`);
         emitProgress('  Ctrl+C to stop.');
@@ -880,10 +902,13 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
     if (args.open) {
         if (server.consoleMounted === true) {
             const opened = await (ctx.openUrl ?? openUrlInBrowser)(consoleUrlOf(server.baseUrl));
-            emitProgress(opened.ok ? '  Opened the console in your browser.' : `  ${couldNotOpen(opened.reason)}`);
+            if (opened.ok)
+                emitProgress('  Opened the console in your browser.');
+            else
+                emitProblem(`⚠ ${couldNotOpen(opened.reason)}`);
         }
         else {
-            emitProgress('  --open: this runtime serves no console, so there is nothing to open.');
+            emitProblem('⚠ --open: this runtime serves no console, so there is nothing to open.');
         }
         emitProgress('');
     }
@@ -961,6 +986,12 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
             patterns: projectEnv.discoveryPatterns,
             onWatchFailed,
         }));
+        // The pack's blocks: their files and their templates, read into the index again.
+        watchHandles.push(await dev.watchPack(args.packDir, untilStopped(ctx.stopSignal, () => onRefresh()), {
+            debounceMs: DEFAULT_WATCH_DEBOUNCE_MS,
+            ...(await blocksWatch(args.packDir, projectEnv.blocksPattern)),
+            onWatchFailed,
+        }));
         // The env files: the same code, restarted with the new environment.
         watchHandles.push(await dev.watchPack(args.packDir, untilStopped(ctx.stopSignal, () => onRefresh()), {
             debounceMs: DEFAULT_WATCH_DEBOUNCE_MS,
@@ -1014,7 +1045,7 @@ async function runDevForPack(ctx, args, dev, configFile, stderrIsTTY, lock) {
     const stdout = ctx.globals.formatRequested ? renderJson(summary, ctx.globals.format).stdout : '';
     return {
         kind: 'ok',
-        // --quiet: errors only, so no summary.
+        // --quiet: errors and warnings only, so no summary.
         rendered: {
             stdout,
             stderr: args.watch || logView.quiet ? '' : `${bannerLines.join('\n')}\n`,
@@ -1090,16 +1121,18 @@ async function loadDevProjectEnv(ctx, packDir) {
         ? `env files: none yet (reads ${label(env.files.read)})`
         : `✓ env files: ${label(env.present)} — ${Object.keys(packValues(env.values)).length} name(s) for the pack`);
     for (const line of describeEnvDiagnostics(packDir, env.diagnostics))
-        emitProgress(`  ! ${line}`);
+        emitProblem(`  ! ${line}`);
     const discovery = settings.config?.discovery;
     const language = settings.config !== undefined ? packLanguage(settings.config) : 'node';
+    const resolved = resolveDiscovery(typeof discovery === 'object' && discovery !== null
+        ? discovery
+        : undefined, language);
     return {
         kind: 'ok',
         localEnvFiles: settings.localEnvFiles,
         runtime: runtimeValues(env.values),
-        discoveryPatterns: Object.values(resolveDiscovery(typeof discovery === 'object' && discovery !== null
-            ? discovery
-            : undefined, language)),
+        discoveryPatterns: codePatterns(resolved),
+        blocksPattern: resolved.blocks,
         language,
         config: settings.config,
         secretNames: new Set(Object.keys(packValues(env.values))),
@@ -1153,7 +1186,7 @@ async function walkRuntimePorts(args, inUse) {
             exitCode: 1,
         };
     }
-    emitProgress(`⚠ port ${args.port} is in use (another kindgi dev?): using ${free}`);
+    emitProblem(`⚠ port ${args.port} is in use (another kindgi dev?): using ${free}`);
     return { kind: 'ok', port: free };
 }
 function resolveDevArgs(ctx) {
@@ -1330,6 +1363,24 @@ function pickRunners(ctx) {
         exitCode: 1,
     };
 }
+/**
+ * Write `.kindgirc.json`, readable by its owner only, since it holds the dev
+ * token and the pack service's token: a new `0600` file that replaces the old
+ * one (`writePrivateFile`), so a program that opened an older, looser one
+ * can't read the new tokens through it. Whether it was written. Best effort:
+ * what goes wrong is a warning, and boot goes on. Without the file, the CLI
+ * in the folder can still pass --url and --token.
+ */
+async function writeKindgirc(path, rc) {
+    try {
+        await writePrivateFile(path, `${JSON.stringify(rc, null, 2)}\n`);
+    }
+    catch (err) {
+        emitProblem(`⚠ couldn't write .kindgirc.json (${err.message}): the CLI in this folder needs --url and --token to reach this runtime`);
+        return false;
+    }
+    return true;
+}
 /**
  * Read the persisted `.kindgirc.json` if present. Returns `undefined`
  * for any missing field — all missing cases fall back to
@@ -1377,7 +1428,7 @@ function emitBootIndex(bootIndex, bootReport, roots) {
         return;
     }
     const c = bootIndex.counts;
-    emitProgress(`✓ loaded: ${c.tools} tools, ${c.guardrails} guardrails, ${c.agents} agents, ${c.flows} flows`);
+    emitProgress(`✓ loaded: ${c.tools} tools, ${c.guardrails} guardrails, ${c.agents} agents, ${c.flows} flows${blocksTotal(c)}`);
     for (const e of bootIndex.fileErrors) {
         emitProblem(`  ⚠ indexer: ${e.filePath ?? '?'} [${e.code}] ${e.message}`);
     }
@@ -1410,7 +1461,7 @@ function reportWatchFailureOnce() {
             return;
         said = true;
         const why = error instanceof Error ? error.message : String(error);
-        emitProgress(`  ⚠ file watch failed (${why}): changes are picked up by the once-a-second scan`);
+        emitProblem(`  ⚠ file watch failed (${why}): changes are picked up by the once-a-second scan`);
     };
 }
 /** `fn` until the stop begins: a change seen while stopping starts nothing. */
@@ -1479,7 +1530,7 @@ async function runEach(steps) {
  */
 function emitWatchTick(input) {
     const { counts, fileErrors, failed, elapsedMs, registered, warnings } = input;
-    const totals = `${counts.tools} tools, ${counts.guardrails} guardrails, ${counts.agents} agents, ${counts.flows} flows`;
+    const totals = `${counts.tools} tools, ${counts.guardrails} guardrails, ${counts.agents} agents, ${counts.flows} flows${blocksTotal(counts)}`;
     if (fileErrors.length === 0 && failed.length === 0) {
         emitProgress(`  ✓ loaded ${registered} primitives (${totals}) in ${elapsedMs}ms`);
         emitWarningsSince(warnings);
@@ -1494,6 +1545,24 @@ function emitWatchTick(input) {
     }
     emitWarningsSince(warnings);
 }
+/** `, 2 blocks` after the other counts, when the pack has any. */
+function blocksTotal(counts) {
+    return counts.blocks !== undefined && counts.blocks > 0 ? `, ${counts.blocks} blocks` : '';
+}
+/**
+ * What the blocks watcher follows: the blocks folder, templates and all.
+ * A pattern at the pack root has no folder of its own, so it follows the
+ * block files and, by name, the templates they name now.
+ */
+async function blocksWatch(packDir, pattern) {
+    const folder = blocksFolder(pattern);
+    if (folder !== '')
+        return { patterns: [`${folder}/**`] };
+    const matches = createGlobMatcher([pattern]);
+    const read = await readPackBlocks(packDir, pattern);
+    const templates = read.files.filter((rel) => !matches(rel)).map((rel) => join(packDir, rel));
+    return { patterns: [pattern], ...(templates.length > 0 && { files: templates }) };
+}
 /** A load's warnings, by message (an indexer that reports none, or a failed load, has none). */
 function warningsOf(result) {
     return new Set(result.kind === 'ok' ? (result.warnings ?? []).map((w) => w.message) : []);
@@ -1512,27 +1581,33 @@ function emitWarningsSince({ fresh, standing }) {
         emitProblem(`    ⚠ ${standing} warnings from the last load still apply`);
 }
 /**
- * Compare the pack's installed framework skills against the bundled
- * SDK versions; print a one-liner if drift is detected. Silent when
- * everything is up to date. Never fails boot — a drift-check crash
- * (missing skills root, unreadable manifest) is swallowed because
- * the drift check is advisory, not load-bearing.
+ * Bring the pack's framework skills up to this CLI's (`refreshSkillsForDev`),
+ * and say what changed and what's still behind. Silent when nothing is. A
+ * refresh that fails is said, never fails boot: the skills help the coding
+ * agent, not the pack. What's behind, and a refresh that fails, are
+ * warnings: shown under `--quiet` too.
  */
-async function emitSkillDriftHint(packDir, language, syncCommand) {
+async function emitSkillsRefresh(packDir, language, commands) {
     const skillsRoot = defaultSdkSkillsRoot();
     if (skillsRoot === undefined)
         return;
+    let lines;
     try {
-        const drift = describeSkillDrift(await detectSkillDrift({ skillsRoot, targetDir: packDir, language }));
-        if (drift === undefined)
-            return;
-        emitProgress(`  ⚠ Framework skills: ${drift}.`);
-        emitProgress(`    Run \`${syncCommand}\` to pull the latest.`);
-        emitProgress('');
+        const refresh = await refreshSkillsForDev({ skillsRoot, targetDir: packDir, language });
+        lines = describeDevSkillsRefresh(refresh, commands);
     }
-    catch {
-        // Advisory; never block boot on a drift-check failure.
+    catch (error) {
+        const why = error instanceof Error ? error.message : String(error);
+        lines = [
+            { text: `  ⚠ Framework skills: couldn't refresh them: ${why}`, problem: true },
+            { text: `    Run \`${commands.sync}\` to pull the latest.`, problem: true },
+        ];
     }
+    if (lines.length === 0)
+        return;
+    for (const line of lines)
+        (line.problem ? emitProblem : emitProgress)(line.text);
+    (lines.some((line) => line.problem) ? emitProblem : emitProgress)('');
 }
 /**
  * How this pack's code runs (`dev/pack-code.ts`). For a Python pack, the
@@ -1607,7 +1682,7 @@ async function settleProviderKeys(inputs) {
         if (h.inKindgiFile)
             continue;
         const where = h.files.map((f) => displayEnvPath(inputs.packDir, f)).join(' and ');
-        emitProgress(`  ⚠ ${h.name} is in ${where}, which your app loads too. To give Kindgi its own copy: ${inputs.kindgi('secrets', 'copy')} (it never edits your app's files).`);
+        emitProblem(`  ⚠ ${h.name} is in ${where}, which your app loads too. To give Kindgi its own copy: ${inputs.kindgi('secrets', 'copy')} (it never edits your app's files).`);
     }
     return all;
 }
@@ -1648,18 +1723,33 @@ async function applyDeclaredProviders(inputs) {
         });
     }
     catch (err) {
-        emitProgress(`⚠ Providers from ${inputs.file}: not applied; the runtime's providers could not be listed: ${err.message}`);
+        emitProblem(`⚠ Providers from ${inputs.file}: not applied; the runtime's providers could not be listed: ${err.message}`);
         return;
     }
-    for (const line of describeReconcile(result.outcomes, inputs))
-        emitProgress(line);
+    for (const line of describeReconcile(result.outcomes, inputs)) {
+        (line.problem ? emitProblem : emitProgress)(line.text);
+    }
     try {
         await writeOwnedProviders(recordPath, inputs.key, result.owned);
     }
     catch (err) {
-        emitProgress(`  ⚠ could not write ${join('.kindgi', 'dev', 'providers.json')}: ${err.message}. The next boot leaves the providers registered now as they are.`);
+        emitProblem(`  ⚠ could not write ${join('.kindgi', 'dev', 'providers.json')}: ${err.message}. The next boot leaves the providers registered now as they are.`);
     }
 }
+/**
+ * The dev token as the banners show it: as the runtime's own startup line
+ * does, `kgi_bt_…` and its last four characters, so a dev log someone
+ * pastes doesn't give the token away. A token pinned with `--dev-token` in
+ * another shape shows only its last four, and none under 16 characters.
+ * `tokenFile`, in the pack, has it in full.
+ */
+export function describeDevToken(token, tokenFile) {
+    const scrubbed = scrubText(token);
+    const shown = /^kgi_[a-z]{2,3}_…[^…]{0,4}$/u.test(scrubbed)
+        ? scrubbed
+        : `…${token.length >= 16 ? token.slice(-4) : ''}`;
+    return `${shown}   (in full in the pack's ${tokenFile})`;
+}
 /** The browser origins line: who may follow runs with public run tokens (`KINDGI_CORS_ORIGINS`). */
 function describeBrowserOrigins(origins) {
     return origins.length > 0
@@ -1700,7 +1790,7 @@ export function renderDevBanner(inputs) {
     }
     lines.push(`    API server         ${inputs.baseUrl}`);
     lines.push(`    Tenant             ${inputs.tenantId}`);
-    lines.push(`    Bearer token       ${inputs.token}`);
+    lines.push(`    Bearer token       ${describeDevToken(inputs.token, inputs.tokenFile)}`);
     lines.push(`    Pack dir           ${inputs.packDir}`);
     if (inputs.providers !== undefined) {
         lines.push(`    Models             ${describeModels(inputs.providers)}`);
@@ -1727,7 +1817,7 @@ function renderIndexSection(inputs) {
         const c = index.counts;
         const lines = [
             `  Discovering pack (${index.packId}@${index.packVersion})`,
-            `    ✓ ${c.tools} tools    ✓ ${c.guardrails} guardrails    ✓ ${c.agents} agents    ✓ ${c.flows} flows`,
+            `    ✓ ${c.tools} tools    ✓ ${c.guardrails} guardrails    ✓ ${c.agents} agents    ✓ ${c.flows} flows${c.blocks !== undefined && c.blocks > 0 ? `    ✓ ${c.blocks} blocks` : ''}`,
         ];
         if (inputs.bootReport.failed.length > 0) {
             lines.push('', '  Registration failures:');