@lore-co/cli 0.2.14 → 0.2.16

package/dist/cli.js

@@ -4,6 +4,8 @@ import { reportCommand, runTelemetryCommand, telemetryEnabled, trackedCommand, T
 import { secureWindowsDirectory, windowsPermissionsArePrivate } from "./windows-permissions.js";
 import { COMMAND_GUIDES, ROOT_HELP, helpTopic } from "./command-help.js";
 import { runShareCommand } from "./share.js";
+import { resolveConnectProject, validateConnectProjectOptions } from "./connect-project.js";
+import { captureDirectories } from "./capture-scope.js";
 import { prepareConnection, persistConnection, listConnections } from "./connections.js";
 import { connectionReferences, resolveLocalConnection } from "./directory-policy.js";
 import { withDirectoryLock } from "./reliability-store.js";
@@ -23,7 +25,9 @@ import { runHook, } from "./runtime.js";
 import { readInvocationHealthWriteInput, runInvocationHealthWrite, } from "./invocation-health-writer.js";
 import { runAskCommand } from "./ask.js";
 import { runRememberCommand } from "./remember.js";
+import { installLoreSkill, removeLoreSkill } from "./skills.js";
 import { runApproachCommand } from "./approach.js";
+import { runSkillCommand } from "./skill-command.js";
 import { runGuardCommand } from "./guard.js";
 import { runContinueCommand, runResumeCommand } from "./handoff.js";
 import { disableRecovery, prepareAutomaticRecovery, prepareRecoveryInstallation, runRecoveryCommand, runRecoveryHook, runWrappedAgent } from "./recovery.js";
@@ -97,6 +101,11 @@ Usage:
 
 Options:
   --name <name>           Name this account/workspace connection (e.g. work)
+  --current-project    Confirm and record the current Git project
+  --choose-folder      Open a folder picker on this machine
+  --repository <repo>  Verify the selected folder matches this GitHub repository
+  --folder <path>        Record only in this folder and subfolders (repeatable)
+  --all-projects         Record in all projects allowed by your workspace
   --url <url>           Lore API base URL (default: https://api.uselore.co)
   --dashboard-url <url> Lore dashboard URL (default: https://uselore.co for hosted Lore)
   --login               Approve access securely in the Lore dashboard
@@ -109,8 +118,12 @@ Options:
   --json                Print machine-readable output
   --help                Show this command's help
 
+New connections stay paused until you choose a project, a folder, or --all-projects.
+Reconnecting without a capture option keeps your saved folder rules.
+Folder choices control capture; learning scope controls where knowledge applies.
+
 Examples:
-  lore connect --login --agent claude
+  lore connect --login --agent claude --folder .
   lore connect --login --agent cowork
   lore connect --token "$LORE_WORKSPACE_TOKEN" --agent claude
   lore connect --url http://localhost:3004 --token dev-token --agent codex
@@ -1418,10 +1431,15 @@ async function installRuntime(paths) {
             rm(paths.runtimeSignedSnapshot, { force: true }),
             rm(paths.runtimeCanonicalJson, { force: true }),
             rm(resolve(dirname(paths.runtime), "guard-evaluation.js"), { force: true }),
+            rm(resolve(dirname(paths.runtime), "capture-conflict.js"), { force: true }),
             rm(resolve(dirname(paths.runtime), "image-bytes.js"), { force: true }),
             rm(resolve(dirname(paths.runtime), "image-capture.js"), { force: true }),
             rm(resolve(dirname(paths.runtime), "retained-context.js"), { force: true }),
+            rm(resolve(dirname(paths.runtime), "retrieval-task.js"), { force: true }),
+            rm(resolve(dirname(paths.runtime), "runtime-redaction.js"), { force: true }),
+            rm(resolve(dirname(paths.runtime), "user-message.js"), { force: true }),
             rm(resolve(dirname(paths.runtime), "approach-guidance.js"), { force: true }),
+            rm(resolve(dirname(paths.runtime), "skill-guidance.js"), { force: true }),
             rm(paths.runtimeContextFallback, { force: true }),
             rm(paths.runtimeInvocationHealthWriter, { force: true }),
             rm(paths.runtimeVersion, { force: true }),
@@ -1449,12 +1467,17 @@ async function installRuntime(paths) {
     }
     const runtimeVersion = `export const RUNTIME_VERSION = ${JSON.stringify(LORE_VERSION)};\n`;
     const runtimeFiles = {
-        "lore-hook.mjs": runtime.replaceAll("@lore-co/core/guard-evaluation", "./guard-evaluation.js"),
+        "lore-hook.mjs": runtime.replaceAll("@lore-co/core/guard-evaluation", "./guard-evaluation.js").replaceAll("@lore-co/core/capture-conflict", "./capture-conflict.js"),
         "guard-evaluation.js": guardEvaluation,
+        "capture-conflict.js": await readFile(fileURLToPath(import.meta.resolve("@lore-co/core/capture-conflict")), "utf8"),
         "image-bytes.js": imageBytes,
         "image-capture.js": imageCapture,
         "retained-context.js": await readFile(resolve(sourceDirectory, "retained-context.js"), "utf8"),
+        "retrieval-task.js": (await readFile(resolve(sourceDirectory, "retrieval-task.js"), "utf8")).replaceAll("@lore-co/core/user-message", "./user-message.js"),
+        "runtime-redaction.js": await readFile(resolve(sourceDirectory, "runtime-redaction.js"), "utf8"),
+        "user-message.js": await readFile(fileURLToPath(import.meta.resolve("@lore-co/core/user-message")), "utf8"),
         "approach-guidance.js": await readFile(resolve(sourceDirectory, "approach-guidance.js"), "utf8"),
+        "skill-guidance.js": await readFile(resolve(sourceDirectory, "skill-guidance.js"), "utf8"),
         "repository.js": repository,
         "repository-address.js": await readFile(resolve(dirname(fileURLToPath(import.meta.resolve("@lore-co/core/repository-location"))), "repository-address.js"), "utf8"),
         "directory-policy.js": (await readFile(fileURLToPath(import.meta.resolve("@lore-co/core/local-scope")), "utf8")).replaceAll("./repository-location.js", "./repository.js"),
@@ -1478,10 +1501,15 @@ async function installRuntime(paths) {
     };
     await Promise.all([
         atomicWrite(resolve(dirname(paths.runtime), "guard-evaluation.js"), guardEvaluation, 0o600),
+        atomicWrite(resolve(dirname(paths.runtime), "capture-conflict.js"), runtimeFiles["capture-conflict.js"], 0o600),
         atomicWrite(resolve(dirname(paths.runtime), "image-bytes.js"), imageBytes, 0o600),
         atomicWrite(resolve(dirname(paths.runtime), "image-capture.js"), imageCapture, 0o600),
         atomicWrite(resolve(dirname(paths.runtime), "retained-context.js"), runtimeFiles["retained-context.js"], 0o600),
+        atomicWrite(resolve(dirname(paths.runtime), "retrieval-task.js"), runtimeFiles["retrieval-task.js"], 0o600),
+        atomicWrite(resolve(dirname(paths.runtime), "runtime-redaction.js"), runtimeFiles["runtime-redaction.js"], 0o600),
+        atomicWrite(resolve(dirname(paths.runtime), "user-message.js"), runtimeFiles["user-message.js"], 0o600),
         atomicWrite(resolve(dirname(paths.runtime), "approach-guidance.js"), runtimeFiles["approach-guidance.js"], 0o600),
+        atomicWrite(resolve(dirname(paths.runtime), "skill-guidance.js"), runtimeFiles["skill-guidance.js"], 0o600),
         atomicWrite(paths.runtimeRepository, repository, 0o600),
         atomicWrite(resolve(dirname(paths.runtime), "repository-address.js"), runtimeFiles["repository-address.js"], 0o600),
         atomicWrite(resolve(dirname(paths.runtime), "directory-policy.js"), runtimeFiles["directory-policy.js"], 0o600),
@@ -1555,7 +1583,21 @@ function parseConnectArguments(args) {
             parsed.recovery = false;
             continue;
         }
-        if (argument !== "--name" &&
+        if (argument === "--current-project") {
+            parsed.currentProject = true;
+            continue;
+        }
+        if (argument === "--choose-folder") {
+            parsed.chooseFolder = true;
+            continue;
+        }
+        if (argument === "--all-projects") {
+            parsed.allProjects = true;
+            continue;
+        }
+        if (argument !== "--repository" &&
+            argument !== "--folder" &&
+            argument !== "--name" &&
             argument !== "--url" &&
             argument !== "--dashboard-url" &&
             argument !== "--token" &&
@@ -1566,7 +1608,13 @@ function parseConnectArguments(args) {
         }
         const [value, valueIndex] = valueAfter(args, index, argument);
         index = valueIndex;
-        if (argument === "--name") {
+        if (argument === "--repository") {
+            parsed.repository = value;
+        }
+        else if (argument === "--folder") {
+            (parsed.folders ??= []).push(value);
+        }
+        else if (argument === "--name") {
             parsed.connectionName = value;
         }
         else if (argument === "--fallback") {
@@ -1597,6 +1645,7 @@ function parseConnectArguments(args) {
             throw new Error("--agent must be claude, codex, copilot, copilot-cli, copilot-vscode, cowork, cursor, opencode, polytoken, or t3code");
         }
     }
+    validateConnectProjectOptions(parsed);
     if (parsed.login && parsed.token !== undefined) {
         throw new Error("--login and --token cannot be used together");
     }
@@ -1661,7 +1710,8 @@ async function connectWithCredentialLocked(options, identity) {
         ? existing.apiUrl === apiUrl && existing.token === token ? identity
             : await authenticatedIdentity(existing.apiUrl, existing.token, timeoutMs).catch(() => undefined)
         : undefined;
-    const connection = await prepareConnection(paths, identity, { apiUrl, token, ...(options.connectionName ? { connectionName: options.connectionName } : {}) }, previousIdentity);
+    const directories = await captureDirectories(options, paths.home, options.cwd);
+    const connection = await prepareConnection(paths, identity, { apiUrl, token, ...(directories === undefined ? {} : { directories }), ...(options.connectionName ? { connectionName: options.connectionName } : {}) }, previousIdentity);
     await secureWindowsDirectory(paths.loreDirectory);
     const recoveryEnv = options.home === undefined ? process.env : { ...process.env, ZDOTDIR: paths.home };
     let recoveryWarning;
@@ -1708,6 +1758,31 @@ async function connectWithCredentialLocked(options, identity) {
             cursorMcpDocuments.set(mcpPath, { document: mcp, merged: mergeLoreCursorMcp(mcp.exists ? mcp.value : {}, paths) });
         }
     }
+    const agentConfigPaths = {};
+    for (const agent of agents) {
+        agentConfigPaths[agent] = installations
+            .filter((installation) => installation.agent === agent)
+            .map((installation) => installation.configPath);
+    }
+    const config = {
+        ...connection.fields,
+        version: 2,
+        apiUrl,
+        ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
+        workspaceId: identity.workspaceId,
+        token: token.trim(),
+        agents,
+        agentConfigPaths,
+        connectedAt: connection.profiles.find(value => value.connectionId === connection.fields.connectionId)?.connectedAt ?? now.toISOString(),
+        timeoutMs,
+    };
+    const reliabilityStore = new ReliabilityStore(identity.workspaceId, {
+        home: paths.home,
+        connectionId: config.connectionId,
+    });
+    await reliabilityStore.initialize();
+    // Folder restrictions must be durable before any new hook can run.
+    await persistConnection(paths, config, connection.profiles);
     if (installations.some((installation) => targetFor(installation.agent).runtimeRequired)) {
         await installRuntime(paths);
     }
@@ -1735,30 +1810,6 @@ async function connectWithCredentialLocked(options, identity) {
             backups.push(result.backup);
         }
     }
-    const agentConfigPaths = {};
-    for (const agent of agents) {
-        agentConfigPaths[agent] = installations
-            .filter((installation) => installation.agent === agent)
-            .map((installation) => installation.configPath);
-    }
-    const config = {
-        ...connection.fields,
-        version: 2,
-        apiUrl,
-        ...(dashboardUrl === undefined ? {} : { dashboardUrl }),
-        workspaceId: identity.workspaceId,
-        token: token.trim(),
-        agents,
-        agentConfigPaths,
-        connectedAt: connection.profiles.find(value => value.connectionId === connection.fields.connectionId)?.connectedAt ?? now.toISOString(),
-        timeoutMs,
-    };
-    const reliabilityStore = new ReliabilityStore(identity.workspaceId, {
-        home: paths.home,
-        connectionId: config.connectionId,
-    });
-    await reliabilityStore.initialize();
-    await persistConnection(paths, config, connection.profiles);
     if (existing && !existing.connectionId && existing.apiUrl === apiUrl && existing.token === token) {
         await new ReliabilityStore(identity.workspaceId, { home: paths.home }).transferPendingTo(reliabilityStore);
         await reliabilityStore.migrateLegacyQueue(paths.queue);
@@ -1778,7 +1829,10 @@ async function connectWithCredentialLocked(options, identity) {
             .catch((error) => [`Host recovery setup: ${error.message}`]) : [];
     if (options.recovery === false)
         await disableRecovery(paths.home);
+    const skills = await installLoreSkill(paths, installations);
     return {
+        capture: { folders: config.directories?.include ?? null, excludedFolders: config.directories?.exclude ?? [] },
+        skillFiles: skills.files,
         connected: true,
         apiUrl: config.apiUrl,
         identity,
@@ -1786,7 +1840,7 @@ async function connectWithCredentialLocked(options, identity) {
         config: paths.config,
         changedHookFiles,
         backups,
-        warnings: [...(connection.needsFolders ? [`Lore is off for ${config.connectionName} until you add folder rules. Run lore config open --connection ${config.connectionName}.`] : []), ...requestedExpansion.warnings, ...hostRecoveryWarnings, ...(agents.includes("codex")
+        warnings: [...skills.warnings, ...(connection.needsFolders ? [`Lore is off for ${config.connectionName} until you choose where to record. Reconnect with --folder <path> or --all-projects, or run lore config open --connection ${config.connectionName}.`] : []), ...requestedExpansion.warnings, ...hostRecoveryWarnings, ...(agents.includes("codex")
                 ? ["Codex requires hook approval. Open /hooks in Codex and review any new or changed Lore hooks, then start a fresh session. Run lore doctor to verify approval and the first invocation."]
                 : [])],
         ...(recoveryNotice ? { recoveryNotice } : {}),
@@ -1940,6 +1994,7 @@ async function connectCommand(args) {
     if (parsed.login && hasProvidedToken) {
         throw new Error("--login cannot be combined with an explicit or environment workspace token. Unset it or use the token directly.");
     }
+    const capture = await resolveConnectProject(parsed, paths.home);
     const authorization = parsed.login
         ? await requestDeviceAuthorization({
             apiUrl,
@@ -1953,6 +2008,7 @@ async function connectCommand(args) {
         throw new Error("Workspace token is required. Use --login, --token <token>, LORE_WORKSPACE_TOKEN, or LORE_TOKEN.");
     }
     const result = await connectWithCredential({
+        ...capture,
         ...(parsed.connectionName === undefined ? {} : { connectionName: parsed.connectionName }),
         ...(parsed.fallback === undefined ? {} : { fallback: parsed.fallback }),
         recovery: parsed.recovery ?? true,
@@ -1964,7 +2020,9 @@ async function connectCommand(args) {
     });
     if (authorization)
         await acknowledgeDeviceAuthorization(apiUrl, authorization);
-    writeResult(result, parsed.json, `access authorized; integrations installed: ${result.agents.join(", ")}\napi_url: ${result.apiUrl}\nconfig: ${result.config}\nRestart your agent and complete a turn, then run lore doctor to verify recording.\n${result.recoveryNotice ? `${result.recoveryNotice}\n` : ""}${result.warnings.map((warning) => `warning: ${warning}\n`).join("")}`);
+    const captureSummary = result.capture.folders === null ? "all projects allowed by the workspace"
+        : result.capture.folders.length ? result.capture.folders.join(", ") : "paused — choose folders with --folder <path>";
+    writeResult(result, parsed.json, `access authorized; integrations installed: ${result.agents.join(", ")}\napi_url: ${result.apiUrl}\nconfig: ${result.config}\ncapture: ${captureSummary}${result.capture.excludedFolders.length ? `; excluded: ${result.capture.excludedFolders.join(", ")}` : ""}\nRestart your agent and complete a turn, then run lore doctor to verify recording.\n${result.skillFiles.length ? 'Choose lore in your agent’s skills to find knowledge or remember this session.\n' : ''}${result.recoveryNotice ? `${result.recoveryNotice}\n` : ""}${result.warnings.map((warning) => `warning: ${warning}\n`).join("")}`);
 }
 async function queueCount(paths) {
     try {
@@ -2049,10 +2107,15 @@ async function inspectRuntimeInstallation(required, paths) {
     const runtimeFiles = {
         "lore-hook.mjs": paths.runtime,
         "guard-evaluation.js": resolve(dirname(paths.runtime), "guard-evaluation.js"),
+        "capture-conflict.js": resolve(dirname(paths.runtime), "capture-conflict.js"),
         "image-bytes.js": resolve(dirname(paths.runtime), "image-bytes.js"),
         "image-capture.js": resolve(dirname(paths.runtime), "image-capture.js"),
         "retained-context.js": resolve(dirname(paths.runtime), "retained-context.js"),
+        "retrieval-task.js": resolve(dirname(paths.runtime), "retrieval-task.js"),
+        "runtime-redaction.js": resolve(dirname(paths.runtime), "runtime-redaction.js"),
+        "user-message.js": resolve(dirname(paths.runtime), "user-message.js"),
         "approach-guidance.js": resolve(dirname(paths.runtime), "approach-guidance.js"),
+        "skill-guidance.js": resolve(dirname(paths.runtime), "skill-guidance.js"),
         "repository.js": paths.runtimeRepository,
         "repository-address.js": resolve(dirname(paths.runtime), "repository-address.js"),
         "directory-policy.js": resolve(dirname(paths.runtime), "directory-policy.js"),
@@ -2238,8 +2301,18 @@ async function getAgentStatus(agent, config, paths, runtime) {
         invocationError: invocation.error,
     };
 }
+// Diagnostics remain available when the current folder has capture disabled.
+// A fallback reads only the last saved connection; it never enables capture.
+async function diagnosticConfig(paths, cwd) {
+    try {
+        return await readConnectorConfig(paths, cwd);
+    }
+    catch {
+        return readConnectorConfig(paths);
+    }
+}
 async function statusData(paths, cwd) {
-    const config = await readConnectorConfig(paths, cwd);
+    const config = await diagnosticConfig(paths, cwd);
     let configMode = null;
     try {
         const metadata = await stat(paths.config);
@@ -2256,6 +2329,7 @@ async function statusData(paths, cwd) {
         Promise.all(CONFIGURED_AGENT_NAMES.map(async (agent) => getAgentStatus(agent, config, paths, runtime))),
     ]);
     return {
+        folderAccess: await checkDirectory(cwd, paths.home, config ?? undefined),
         schemaVersion: "lore-cli-status-v1",
         integrationContractVersion: RELIABILITY_INTEGRATION_CONTRACT_VERSION,
         connected: config !== null,
@@ -2290,7 +2364,7 @@ async function statusCommand(args) {
     const metricRate = (value) => value === null || value === undefined
         ? "-"
         : `${(value * 100).toFixed(1)}%`;
-    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? `installed (${data.runtimeVersion})` : data.runtimeVersion === null ? "missing" : `stale (${data.runtimeVersion})`) : "not required"}\ndurable_outbox: ${data.reliability?.outbox.total ?? 0} ready=${data.reliability?.outbox.ready ?? 0} auth_blocked=${data.reliability?.outbox.authBlocked ?? 0} dead=${data.reliability?.outbox.dead ?? 0}\noldest_capture: ${data.reliability?.outbox.oldestEnqueuedAt ?? "-"}\ncontext_snapshots: ${data.reliability?.cache.context ?? 0}\noldest_context_snapshot: ${data.reliability?.cache.oldestContextWrittenAt ?? "-"}\npolicy_snapshots: ${data.reliability?.cache.policy ?? 0}\nlocal_context_fallback_rate: ${metricRate(data.reliability?.operational.retrieval.fallbackRate)}\nlocal_guard_coverage: ${metricRate(data.reliability?.operational.guard.coverageRate)}\nlocal_guard_failures: ${data.reliability?.operational.guard.failures ?? 0}\nlocal_retrieval_failures: ${data.reliability?.operational.retrieval.failed ?? 0}\n${data.reliabilityError === null ? "" : `reliability_error: ${data.reliabilityError}\n`}${agentLines}\n${externalSurfaceLines}\n`);
+    writeResult(data, parsed.json, `connected: ${data.connected ? "yes" : "no"}\ncurrent_folder: ${data.folderAccess.allowed ? "allowed" : "off"} (${data.folderAccess.reason})\napi_url: ${data.apiUrl ?? "-"}\nconfig_mode: ${data.configMode ?? "-"}\nruntime: ${data.runtimeRequired ? (data.runtimeInstalled ? `installed (${data.runtimeVersion})` : data.runtimeVersion === null ? "missing" : `stale (${data.runtimeVersion})`) : "not required"}\ndurable_outbox: ${data.reliability?.outbox.total ?? 0} ready=${data.reliability?.outbox.ready ?? 0} auth_blocked=${data.reliability?.outbox.authBlocked ?? 0} dead=${data.reliability?.outbox.dead ?? 0}\noldest_capture: ${data.reliability?.outbox.oldestEnqueuedAt ?? "-"}\ncontext_snapshots: ${data.reliability?.cache.context ?? 0}\noldest_context_snapshot: ${data.reliability?.cache.oldestContextWrittenAt ?? "-"}\npolicy_snapshots: ${data.reliability?.cache.policy ?? 0}\nlocal_context_fallback_rate: ${metricRate(data.reliability?.operational.retrieval.fallbackRate)}\nlocal_guard_coverage: ${metricRate(data.reliability?.operational.guard.coverageRate)}\nlocal_guard_failures: ${data.reliability?.operational.guard.failures ?? 0}\nlocal_retrieval_failures: ${data.reliability?.operational.retrieval.failed ?? 0}\n${data.reliabilityError === null ? "" : `reliability_error: ${data.reliabilityError}\n`}${agentLines}\n${externalSurfaceLines}\n`);
 }
 async function disconnectCommand(args) {
     const parsed = parseOutputArguments(args, DISCONNECT_HELP, "disconnect");
@@ -2336,6 +2410,7 @@ export async function disconnectInstallation(paths = getLorePaths(), preservePen
             backups.push(result.backup);
         }
     }
+    await removeLoreSkill(paths, installations);
     await Promise.all([
         rm(paths.config, { force: true }),
         rm(resolve(paths.loreDirectory, "connections"), { recursive: true, force: true }),
@@ -2348,9 +2423,14 @@ export async function disconnectInstallation(paths = getLorePaths(), preservePen
         rm(paths.runtimeCanonicalJson, { force: true }),
         rm(paths.runtimeContextFallback, { force: true }),
         rm(resolve(dirname(paths.runtime), "guard-evaluation.js"), { force: true }),
+        rm(resolve(dirname(paths.runtime), "capture-conflict.js"), { force: true }),
         rm(resolve(dirname(paths.runtime), "image-bytes.js"), { force: true }),
         rm(resolve(dirname(paths.runtime), "image-capture.js"), { force: true }),
         rm(resolve(dirname(paths.runtime), "retained-context.js"), { force: true }),
+        rm(resolve(dirname(paths.runtime), "retrieval-task.js"), { force: true }),
+        rm(resolve(dirname(paths.runtime), "runtime-redaction.js"), { force: true }),
+        rm(resolve(dirname(paths.runtime), "user-message.js"), { force: true }),
+        rm(resolve(dirname(paths.runtime), "skill-guidance.js"), { force: true }),
         rm(paths.runtimeInvocationHealthWriter, { force: true }),
         rm(paths.runtimeVersion, { force: true }),
         rm(paths.runtimePackage, { force: true }),
@@ -2475,9 +2555,9 @@ async function doctorCommand(args) {
         return;
     }
     const paths = getLorePaths();
-    const config = await readConnectorConfig(paths, process.cwd());
+    const config = await diagnosticConfig(paths, process.cwd());
     const status = await statusData(paths, process.cwd());
-    const checks = [];
+    const checks = [{ name: "capture-folder", status: status.folderAccess.allowed ? "ok" : "warning", detail: status.folderAccess.allowed ? status.folderAccess.reason : `Recording is off here: ${status.folderAccess.reason}. Run lore scope check <folder> to verify a selected folder.` }];
     checks.push({
         name: "platform",
         status: platform() === "darwin" || platform() === "linux" || isWindows() ? "ok" : "error",
@@ -2587,7 +2667,8 @@ async function doctorCommand(args) {
                     status.reliability.outbox.inFlight > 0
                     ? "warning"
                     : "ok",
-            detail: `${status.reliability.outbox.total} total; ${status.reliability.outbox.ready} ready, ${status.reliability.outbox.authBlocked} authentication-blocked, ${status.reliability.outbox.dead} dead-letter`,
+            detail: `${status.reliability.outbox.total} total; ${status.reliability.outbox.ready} ready, ${status.reliability.outbox.authBlocked} authentication-blocked, ${status.reliability.outbox.dead} dead-letter` +
+                (status.reliability.outbox.oldestFailure ? `; oldest failure (${status.reliability.outbox.oldestFailure.attempts} attempts): ${status.reliability.outbox.oldestFailure.message}` : ""),
         });
         checks.push({
             name: "verified-snapshot-cache",
@@ -2664,6 +2745,9 @@ async function printCommandHelp(path) {
         case "approach":
             await runApproachCommand(args, null);
             return;
+        case "skill":
+            await runSkillCommand(args, null);
+            return;
         case "guard":
             await runGuardCommand(args, null);
             return;
@@ -2752,8 +2836,8 @@ async function executeCli(args = process.argv.slice(2)) {
         return;
     }
     const commandArgs = args.slice(1);
-    if (["ask", "remember", "share", "resume", "continue", "approach"].includes(command)) {
-        const decision = await checkDirectory(process.cwd(), getLorePaths(command === "approach" ? process.env.LORE_HOME : undefined).home);
+    if (["ask", "remember", "share", "resume", "continue", "approach", "skill"].includes(command) && !(command === "skill" && commandArgs[0] === "discover")) {
+        const decision = await checkDirectory(process.cwd(), getLorePaths(["approach", "skill"].includes(command) ? process.env.LORE_HOME : undefined).home);
         if (!decision.allowed)
             throw new Error(`Lore is off in this folder. ${decision.reason}`);
     }
@@ -2798,6 +2882,9 @@ async function executeCli(args = process.argv.slice(2)) {
         case "approach":
             await runApproachCommand(commandArgs, await readConnectorConfig(getLorePaths(process.env.LORE_HOME), process.cwd()));
             return;
+        case "skill":
+            await runSkillCommand(commandArgs, commandArgs[0] === "discover" ? null : await readConnectorConfig(getLorePaths(process.env.LORE_HOME), process.cwd()));
+            return;
         case "guard":
             await runGuardCommand(commandArgs, await readConnectorConfig(getLorePaths(), process.cwd()));
             return;
@@ -2863,6 +2950,7 @@ async function executeCli(args = process.argv.slice(2)) {
                     });
                     return {
                         agents: connected.agents,
+                        warnings: connected.warnings,
                         verified: await verifyConnectedInstallation(),
                     };
                 },