@lumerahq/cli 0.31.0-dev.0 → 0.31.0

package/dist/{resources-I6JSKGOX.js → resources-FHL4IUQD.js}

@@ -1,9 +1,9 @@
 import {
   deploy
-} from "./chunk-2K4ZYGCE.js";
+} from "./chunk-IVII7OZZ.js";
 import {
   syncDeps
-} from "./chunk-ODANFLL7.js";
+} from "./chunk-HS63O4MH.js";
 import {
   loadEnv
 } from "./chunk-2CR762KB.js";
@@ -12,7 +12,7 @@ import {
   createApiClient,
   isApiErrorStatus,
   validateCollectionNameLength
-} from "./chunk-E7YZ6QS6.js";
+} from "./chunk-ZJ7M7JD3.js";
 import {
   findProjectRoot,
   getApiUrl,
@@ -31,8 +31,9 @@ import "./chunk-PNKVD2UK.js";
 import pc2 from "picocolors";
 import prompts from "prompts";
 import { execFileSync, execSync } from "child_process";
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, writeFileSync, mkdirSync } from "fs";
-import { join as join2, resolve } from "path";
+import { createHash } from "crypto";
+import { existsSync as existsSync2, lstatSync, mkdirSync, mkdtempSync, readdirSync as readdirSync2, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "fs";
+import { dirname as dirname2, join as join2, resolve } from "path";
 
 // src/lib/lint/index.ts
 import { existsSync, readFileSync, readdirSync } from "fs";
@@ -2496,6 +2497,7 @@ async function applyApp(args) {
   const accessLevel = getFlagValue(args, "access-level");
   const validAccessLevels = [
     "org_members_with_permission",
+    "specific_people",
     "org_members",
     "invited",
     "signed_in",
@@ -2642,6 +2644,133 @@ var SKILL_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var SKILL_NAME_MAX_LENGTH = 100;
 var SKILL_SLUG_MAX_LENGTH = 100;
 var SKILL_SUMMARY_MAX_LENGTH = 500;
+var SKILL_RESOURCE_MAX_COUNT = 20;
+var SKILL_RESOURCE_MAX_BYTES = 10 * 1024 * 1024;
+var SKILL_RESOURCES_MAX_TOTAL_BYTES = 100 * 1024 * 1024;
+var SKILL_RESOURCE_MAX_PATH_BYTES = 1024;
+var SKILL_RESOURCE_MAX_PATH_PART_BYTES = 255;
+var SKILL_RESOURCE_CONTENT_TYPES = {
+  bmp: "image/bmp",
+  gif: "image/gif",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  pdf: "application/pdf",
+  png: "image/png",
+  webp: "image/webp"
+};
+function skillResourceContentType(path) {
+  return SKILL_RESOURCE_CONTENT_TYPES[path.split(".").pop()?.toLowerCase() ?? ""] ?? "application/octet-stream";
+}
+function foldSkillResourcePathPart(value) {
+  return value.toUpperCase();
+}
+function skillResourcePathError(value) {
+  if (!value || Buffer.byteLength(value) > SKILL_RESOURCE_MAX_PATH_BYTES) {
+    return `path must be at most ${SKILL_RESOURCE_MAX_PATH_BYTES} bytes`;
+  }
+  if (value.startsWith("/") || value.endsWith("/") || value.includes("\\")) {
+    return "path must be relative and slash-separated";
+  }
+  if (/\p{Cc}/u.test(value)) return "path cannot contain control characters";
+  for (const part of value.split("/")) {
+    if (!part || part === "." || part === "..") return "path cannot contain empty, dot, or parent segments";
+    if (part !== part.trim()) return "path segments cannot start or end with whitespace";
+    if (Buffer.byteLength(part) > SKILL_RESOURCE_MAX_PATH_PART_BYTES) {
+      return `path segments must be at most ${SKILL_RESOURCE_MAX_PATH_PART_BYTES} bytes`;
+    }
+    if (foldSkillResourcePathPart(part) === "SKILL.MD") return "SKILL.md is reserved";
+  }
+  return null;
+}
+function skillResourcePathsCollide(left, right) {
+  const leftParts = left.split("/");
+  const rightParts = right.split("/");
+  const limit = Math.min(leftParts.length, rightParts.length);
+  for (let i = 0; i < limit; i++) {
+    if (leftParts[i] === rightParts[i]) continue;
+    return foldSkillResourcePathPart(leftParts[i] ?? "") === foldSkillResourcePathPart(rightParts[i] ?? "");
+  }
+  return true;
+}
+function localSkillResources(skillDir) {
+  const resources = [];
+  const errors = [];
+  let totalBytes = 0;
+  let fileCount = 0;
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const scan = (directory, parentParts) => {
+    const names = readdirSync2(directory, { encoding: "buffer" }).map((rawName) => {
+      try {
+        return decoder.decode(rawName);
+      } catch {
+        errors.push(`${parentParts.join("/") || "."}: file names must be valid UTF-8`);
+        return null;
+      }
+    }).filter((name) => name !== null).sort();
+    for (const name of names) {
+      if (parentParts.length === 0 && name === "SKILL.md") continue;
+      const parts = [...parentParts, name];
+      const resourcePath = parts.join("/");
+      const filePath = join2(directory, name);
+      const stat = lstatSync(filePath);
+      if (stat.isSymbolicLink()) {
+        errors.push(`${resourcePath}: symlinks are not supported`);
+        continue;
+      }
+      if (stat.isDirectory()) {
+        scan(filePath, parts);
+        continue;
+      }
+      if (!stat.isFile()) {
+        errors.push(`${resourcePath}: only regular files are supported`);
+        continue;
+      }
+      fileCount++;
+      totalBytes += stat.size;
+      const pathError = skillResourcePathError(resourcePath);
+      if (pathError) {
+        errors.push(`${resourcePath}: ${pathError}`);
+        continue;
+      }
+      if (stat.size > SKILL_RESOURCE_MAX_BYTES) {
+        errors.push(`${resourcePath}: file exceeds the 10 MiB limit`);
+        continue;
+      }
+      const conflict = resources.find((resource) => skillResourcePathsCollide(resource.path, resourcePath));
+      if (conflict) {
+        errors.push(`${resourcePath}: path conflicts ignoring letter case with ${conflict.path}`);
+        continue;
+      }
+      const sha256 = createHash("sha256").update(readFileSync2(filePath)).digest("hex");
+      resources.push({ path: resourcePath, filePath, size: stat.size, sha256 });
+    }
+  };
+  scan(skillDir, []);
+  if (fileCount > SKILL_RESOURCE_MAX_COUNT) errors.push(`resources: a skill can have at most ${SKILL_RESOURCE_MAX_COUNT} files`);
+  if (totalBytes > SKILL_RESOURCES_MAX_TOTAL_BYTES) errors.push("resources: files can total at most 100 MiB");
+  return { resources: resources.sort((a, b) => a.path.localeCompare(b.path)), errors };
+}
+function compareSkillResources(local, remote) {
+  const localByPath = new Map(local.map((resource) => [resource.path, resource]));
+  const remoteByPath = new Map(remote.map((resource) => [resource.path, resource]));
+  const added = [...localByPath.keys()].filter((path) => !remoteByPath.has(path)).sort();
+  const replaced = [...localByPath].filter(([path, resource]) => {
+    const current = remoteByPath.get(path);
+    return current && (current.size !== resource.size || current.sha256 !== resource.sha256);
+  }).map(([path]) => path).sort();
+  const deleted = [...remoteByPath.keys()].filter((path) => !localByPath.has(path)).sort();
+  return { added, replaced, deleted };
+}
+function skillResourceChangesEmpty(changes) {
+  return changes.added.length === 0 && changes.replaced.length === 0 && changes.deleted.length === 0;
+}
+function skillResourceChangesSummary(changes) {
+  return [
+    ...changes.added.map((path) => `+${path}`),
+    ...changes.replaced.map((path) => `~${path}`),
+    ...changes.deleted.map((path) => `-${path}`)
+  ].join(", ");
+}
 function loadLocalSkills(platformDir, filterName) {
   const skillsDir = join2(platformDir, "skills");
   if (!existsSync2(skillsDir)) return [];
@@ -2654,11 +2783,19 @@ function loadLocalSkills(platformDir, filterName) {
       errors.push(`${entry.name}: directory name must be a lowercase slug`);
       continue;
     }
-    const path = join2(skillsDir, entry.name, "SKILL.md");
+    const skillDir = join2(skillsDir, entry.name);
+    const path = join2(skillDir, "SKILL.md");
     if (!existsSync2(path)) {
       errors.push(`${entry.name}: missing SKILL.md`);
       continue;
     }
+    const skillMarkdownStat = lstatSync(path);
+    if (skillMarkdownStat.isSymbolicLink() || !skillMarkdownStat.isFile()) {
+      errors.push(`${entry.name}: SKILL.md must be a regular file`);
+      continue;
+    }
+    const { resources, errors: resourceErrors } = localSkillResources(skillDir);
+    errors.push(...resourceErrors.map((error3) => `${entry.name}: ${error3}`));
     const content = readFileSync2(path, "utf-8");
     const separator = /\r?\n---\r?\n/.exec(content);
     const parts = separator ? [content.slice(0, separator.index), content.slice(separator.index + separator[0].length)] : [content];
@@ -2684,7 +2821,7 @@ function loadLocalSkills(platformDir, filterName) {
     if (summary.length > SKILL_SUMMARY_MAX_LENGTH) errors.push(`${entry.name}: summary must be at most ${SKILL_SUMMARY_MAX_LENGTH} characters`);
     if (!instructions) errors.push(`${entry.name}: SKILL.md must include instructions after ---`);
     if (name && name.length <= SKILL_NAME_MAX_LENGTH && summary && summary.length <= SKILL_SUMMARY_MAX_LENGTH && instructions) {
-      skills.push({ slug: entry.name, name, summary, instructions });
+      skills.push({ slug: entry.name, name, summary, instructions, resources });
     }
   }
   if (errors.length > 0) {
@@ -2710,6 +2847,13 @@ ${skill.summary}
 ${skill.instructions}
 `;
 }
+function skillMetadataChanges(local, remote) {
+  const changes = [];
+  if (local.name !== remote.name) changes.push("name");
+  if (local.summary.trim() !== (remote.summary || "").trim()) changes.push("summary");
+  if (local.instructions.trim() !== (remote.instructions || "").trim()) changes.push("instructions");
+  return changes;
+}
 function scopedProjectSkillSlug(appName, localSlug) {
   return appName ? `${appName}:${localSlug}` : localSlug;
 }
@@ -2728,6 +2872,13 @@ function remoteSkillsByLocalSlug(remoteSkills, appName) {
   }
   return byLocalSlug;
 }
+function resolveProjectSkillLocalSlug(remoteSkills, selector) {
+  if (!selector) return void 0;
+  for (const [localSlug, skill] of remoteSkills) {
+    if (selector === localSlug || selector === skill.slug || selector === skill.name) return localSlug;
+  }
+  return selector;
+}
 function projectSkillRefCandidates(refs, appName) {
   return [...new Set(refs.flatMap((ref) => appName && SKILL_SLUG_RE.test(ref) ? [scopedProjectSkillSlug(appName, ref), ref] : [ref]))];
 }
@@ -2794,13 +2945,21 @@ async function planSkills(api, localSkills, projectId, appName) {
   for (const skill of localSkills) {
     const remote = remoteBySlug.get(skill.slug);
     if (!remote) {
-      changes.push({ type: "create", resource: "skill", id: skill.slug, name: skill.name });
+      const resourceSummary = skillResourceChangesSummary(compareSkillResources(skill.resources, []));
+      changes.push({
+        type: "create",
+        resource: "skill",
+        id: skill.slug,
+        name: skill.name,
+        details: resourceSummary ? `resources (${resourceSummary})` : void 0
+      });
       continue;
     }
-    const changed = [];
-    if (remote.name !== skill.name) changed.push("name");
-    if ((remote.summary || "").trim() !== skill.summary.trim()) changed.push("summary");
-    if ((remote.instructions || "").trim() !== skill.instructions.trim()) changed.push("instructions");
+    const changed = skillMetadataChanges(skill, remote);
+    const resourceChanges = compareSkillResources(skill.resources, remote.resources ?? []);
+    if (!skillResourceChangesEmpty(resourceChanges)) {
+      changed.push(`resources (${skillResourceChangesSummary(resourceChanges)})`);
+    }
     if (changed.length > 0) {
       changes.push({
         type: "update",
@@ -2808,12 +2967,64 @@ async function planSkills(api, localSkills, projectId, appName) {
         id: skill.slug,
         name: skill.name,
         details: `changed: ${changed.join(", ")}`,
-        textDiffs: changed.includes("instructions") || changed.includes("summary") ? [{ field: "SKILL.md", oldText: skillMarkdown({ slug: skill.slug, name: remote.name, summary: remote.summary || "", instructions: remote.instructions || "" }), newText: skillMarkdown(skill) }] : void 0
+        textDiffs: changed.includes("instructions") || changed.includes("summary") ? [{ field: "SKILL.md", oldText: skillMarkdown({ name: remote.name, summary: remote.summary || "", instructions: remote.instructions || "" }), newText: skillMarkdown(skill) }] : void 0
       });
     }
   }
   return changes;
 }
+async function uploadSkillResource(api, skillID, resource) {
+  const bytes = readFileSync2(resource.filePath);
+  const sha256 = createHash("sha256").update(bytes).digest("hex");
+  if (bytes.byteLength !== resource.size || sha256 !== resource.sha256) {
+    throw new Error(`${resource.path} changed while apply was running`);
+  }
+  const metadata = {
+    path: resource.path,
+    size: resource.size,
+    content_type: skillResourceContentType(resource.path),
+    sha256: resource.sha256
+  };
+  const upload = await api.startAgentSkillResourceUpload(skillID, metadata);
+  const headers = { ...upload.headers ?? {} };
+  if (!Object.keys(headers).some((name) => name.toLowerCase() === "content-type")) {
+    headers["Content-Type"] = metadata.content_type;
+  }
+  const response = await fetchWithRetry(upload.upload_url, {
+    method: "PUT",
+    headers,
+    body: bytes
+  }, { attempts: 3, retryMethods: ["PUT"] });
+  if (!response.ok) throw new Error(`${resource.path}: upload failed with HTTP ${response.status}`);
+  await api.completeAgentSkillResourceUpload(skillID, upload.upload_id, metadata);
+}
+async function reconcileSkillResources(api, skill, localResources) {
+  let remoteResources = skill.resources ?? [];
+  let changes = compareSkillResources(localResources, remoteResources);
+  if (changes.deleted.length > 0) {
+    const deletions = changes.deleted;
+    const expectedByPath = new Map(remoteResources.map((resource) => [resource.path, resource]));
+    remoteResources = (await api.getAgentSkill(skill.id)).resources ?? [];
+    for (const resourcePath of deletions) {
+      const expected = expectedByPath.get(resourcePath);
+      const current = remoteResources.find((resource) => resource.path === resourcePath);
+      if (!current) continue;
+      if (!expected || current.size !== expected.size || current.sha256 !== expected.sha256) {
+        throw new Error(`${resourcePath} changed while apply was running`);
+      }
+      const result = await api.deleteAgentSkillResource(skill.id, resourcePath);
+      remoteResources = result.resources;
+    }
+  }
+  changes = compareSkillResources(localResources, remoteResources);
+  if (changes.deleted.length > 0) throw new Error("remote resources changed while apply was running");
+  const uploadPaths = /* @__PURE__ */ new Set([...changes.added, ...changes.replaced]);
+  const remoteByPath = new Map(remoteResources.map((resource) => [resource.path, resource]));
+  const uploads = localResources.filter((resource) => uploadPaths.has(resource.path)).sort(
+    (a, b) => a.size - (remoteByPath.get(a.path)?.size ?? 0) - (b.size - (remoteByPath.get(b.path)?.size ?? 0))
+  );
+  for (const resource of uploads) await uploadSkillResource(api, skill.id, resource);
+}
 async function applySkills(api, localSkills, projectId, appName) {
   if (localSkills.length === 0) return 0;
   validateProjectSkillStorageSlugs(localSkills, appName);
@@ -2824,21 +3035,19 @@ async function applySkills(api, localSkills, projectId, appName) {
   for (const skill of localSkills) {
     const remote = remoteBySlug.get(skill.slug);
     try {
-      if (remote) {
-        await api.updateAgentSkill(remote.id, {
-          name: skill.name,
-          summary: skill.summary,
-          instructions: skill.instructions
-        });
-        console.log(pc2.green("  \u2713"), `${skill.name} (updated)`);
-      } else {
-        await api.createAgentSkill({
-          ...skill,
-          slug: scopedProjectSkillSlug(appName, skill.slug),
-          project_id: scopedProjectID
-        });
-        console.log(pc2.green("  \u2713"), `${skill.name} (created)`);
-      }
+      const saved = remote ? await api.updateAgentSkill(remote.id, {
+        name: skill.name,
+        summary: skill.summary,
+        instructions: skill.instructions
+      }) : await api.createAgentSkill({
+        name: skill.name,
+        summary: skill.summary,
+        instructions: skill.instructions,
+        slug: scopedProjectSkillSlug(appName, skill.slug),
+        project_id: scopedProjectID
+      });
+      await reconcileSkillResources(api, saved, skill.resources);
+      console.log(pc2.green("  \u2713"), `${skill.name} (${remote ? "updated" : "created"})`);
     } catch (error3) {
       console.log(pc2.red("  \u2717"), `${skill.name}: ${error3}`);
       errors++;
@@ -2846,7 +3055,57 @@ async function applySkills(api, localSkills, projectId, appName) {
   }
   return errors;
 }
-async function pullSkills(api, platformDir, filterName, projectId, appName) {
+function validateRemoteSkillResources(resources) {
+  if (resources.length > SKILL_RESOURCE_MAX_COUNT) throw new Error(`remote skill has more than ${SKILL_RESOURCE_MAX_COUNT} resources`);
+  const paths = [];
+  let totalBytes = 0;
+  for (const resource of resources) {
+    const pathError = skillResourcePathError(resource.path);
+    if (pathError) throw new Error(`remote resource ${resource.path}: ${pathError}`);
+    const conflict = paths.find((path) => skillResourcePathsCollide(path, resource.path));
+    if (conflict) throw new Error(`remote resource paths conflict: ${conflict} and ${resource.path}`);
+    if (!Number.isSafeInteger(resource.size) || resource.size < 0 || resource.size > SKILL_RESOURCE_MAX_BYTES) {
+      throw new Error(`remote resource ${resource.path} has an invalid size`);
+    }
+    if (!/^[a-f0-9]{64}$/.test(resource.sha256)) throw new Error(`remote resource ${resource.path} has an invalid checksum`);
+    paths.push(resource.path);
+    totalBytes += resource.size;
+  }
+  if (totalBytes > SKILL_RESOURCES_MAX_TOTAL_BYTES) throw new Error("remote skill resources exceed 100 MiB");
+}
+function writeVerifiedSkillResource(resource, bytes, skillDir, source) {
+  if (bytes.byteLength !== resource.size) throw new Error(`${resource.path}: ${source} size does not match`);
+  if (createHash("sha256").update(bytes).digest("hex") !== resource.sha256) {
+    throw new Error(`${resource.path}: ${source} checksum does not match`);
+  }
+  const destination = join2(skillDir, ...resource.path.split("/"));
+  mkdirSync(dirname2(destination), { recursive: true });
+  writeFileSync(destination, bytes);
+}
+async function downloadSkillResource(resource, skillDir) {
+  if (!resource.url) throw new Error(`${resource.path}: download URL is unavailable`);
+  let response;
+  try {
+    response = await fetchWithRetry(resource.url);
+  } catch {
+    throw new Error(`${resource.path}: download failed`);
+  }
+  if (!response.ok) throw new Error(`${resource.path}: download failed with HTTP ${response.status}`);
+  writeVerifiedSkillResource(resource, Buffer.from(await response.arrayBuffer()), skillDir, "downloaded");
+}
+function replaceSkillDirectory(stagingDir, skillDir) {
+  const backupDir = `${stagingDir}.previous`;
+  const hadExisting = existsSync2(skillDir);
+  if (hadExisting) renameSync(skillDir, backupDir);
+  try {
+    renameSync(stagingDir, skillDir);
+  } catch (error3) {
+    if (hadExisting && !existsSync2(skillDir)) renameSync(backupDir, skillDir);
+    throw error3;
+  }
+  if (hadExisting) rmSync(backupDir, { recursive: true, force: true });
+}
+async function pullSkills(api, platformDir, filterName, projectId, appName, checkedLocalSkills) {
   if (!projectId) {
     console.log(pc2.dim("  Skipped \u2014 project not registered (run `lumera register`)"));
     return;
@@ -2857,24 +3116,56 @@ async function pullSkills(api, platformDir, filterName, projectId, appName) {
     await api.listAgentSkills({ project_id: scopedProjectID }),
     appName
   );
-  for (const [localSlug, skill] of remoteSkills) {
+  const resolvedFilter = resolveProjectSkillLocalSlug(remoteSkills, filterName);
+  const checkedLocalSkillsBySlug = new Map(checkedLocalSkills?.map((skill) => [skill.slug, skill]) ?? []);
+  for (const [localSlug, listedSkill] of remoteSkills) {
     if (!SKILL_SLUG_RE.test(localSlug)) {
-      console.log(pc2.yellow(`  \u26A0 Skipping ${skill.name}: skill slug ${skill.slug} cannot be represented in platform/skills`));
+      console.log(pc2.yellow(`  \u26A0 Skipping ${listedSkill.name}: skill slug ${listedSkill.slug} cannot be represented in platform/skills`));
+      continue;
+    }
+    if (resolvedFilter && localSlug !== resolvedFilter) continue;
+    const listedResources = [...listedSkill.resources ?? []].sort((a, b) => a.path.localeCompare(b.path));
+    validateRemoteSkillResources(listedResources);
+    let local = checkedLocalSkillsBySlug.get(localSlug);
+    if (!checkedLocalSkills) {
+      try {
+        [local] = loadLocalSkills(platformDir, localSlug);
+      } catch {
+      }
+    }
+    if (local && skillMetadataChanges(local, listedSkill).length === 0 && skillResourceChangesEmpty(compareSkillResources(local.resources, listedResources))) {
+      console.log(pc2.green("  \u2713"), `${listedSkill.name} (unchanged)`);
       continue;
     }
-    if (filterName && localSlug !== filterName && skill.slug !== filterName && skill.name !== filterName) continue;
+    const skill = await api.getAgentSkill(listedSkill.id, { resource_urls: "attachment" });
     if (!(skill.summary || "").trim() || !(skill.instructions || "").trim()) {
       console.log(pc2.yellow(`  \u26A0 Skipping ${skill.name}: source-managed skills require both summary and instructions`));
       continue;
     }
+    const resources = [...skill.resources ?? []].sort((a, b) => a.path.localeCompare(b.path));
+    validateRemoteSkillResources(resources);
+    const localResources = new Map(local?.resources.map((resource) => [resource.path, resource]) ?? []);
     const skillDir = join2(skillsDir, localSlug);
-    mkdirSync(skillDir, { recursive: true });
-    writeFileSync(join2(skillDir, "SKILL.md"), skillMarkdown({
-      slug: localSlug,
-      name: skill.name,
-      summary: skill.summary || "",
-      instructions: skill.instructions || ""
-    }));
+    mkdirSync(skillsDir, { recursive: true });
+    const stagingDir = mkdtempSync(join2(platformDir, `.skill-${localSlug}-pull-`));
+    try {
+      writeFileSync(join2(stagingDir, "SKILL.md"), skillMarkdown({
+        name: skill.name,
+        summary: skill.summary || "",
+        instructions: skill.instructions || ""
+      }));
+      for (const resource of resources) {
+        const localResource = localResources.get(resource.path);
+        if (localResource?.size === resource.size && localResource.sha256 === resource.sha256) {
+          writeVerifiedSkillResource(resource, readFileSync2(localResource.filePath), stagingDir, "local");
+        } else {
+          await downloadSkillResource(resource, stagingDir);
+        }
+      }
+      replaceSkillDirectory(stagingDir, skillDir);
+    } finally {
+      rmSync(stagingDir, { recursive: true, force: true });
+    }
     console.log(pc2.green("  \u2713"), `${skill.name} \u2192 skills/${localSlug}/`);
   }
 }
@@ -2928,14 +3219,6 @@ function loadLocalAgents(platformDir, filterName, appName) {
           continue;
         }
       }
-      if (config.allowed_user_tags !== void 0) {
-        const tags = config.allowed_user_tags;
-        if (!Array.isArray(tags) || tags.length > 100 || tags.some((tag) => typeof tag !== "string" || !tag || Buffer.byteLength(tag) > 64 || tag !== tag.trim() || tag !== tag.toLowerCase())) {
-          errors.push(`${entry.name}: allowed_user_tags must be an array of at most 100 canonical tag keys (1\u201364 bytes each)`);
-          continue;
-        }
-        config.allowed_user_tags = [...new Set(tags)].sort();
-      }
       let systemPrompt = readFileSync2(promptPath, "utf-8");
       let policyScript = existsSync2(policyPath) ? readFileSync2(policyPath, "utf-8") : "";
       if (appName) {
@@ -2956,9 +3239,6 @@ function loadLocalAgents(platformDir, filterName, appName) {
   }
   return agents;
 }
-function allowedUserTagsChanged(local, remote) {
-  return local.allowed_user_tags !== void 0 && JSON.stringify([...new Set(local.allowed_user_tags)].sort()) !== JSON.stringify([...new Set(remote.allowed_user_tags ?? [])].sort());
-}
 async function planAgents(api, localAgents, projectId, localSourceSkillSlugs = /* @__PURE__ */ new Set(), pendingLocalSkillSlugs = /* @__PURE__ */ new Set(), appName) {
   const changes = [];
   let validationErrors = 0;
@@ -3011,7 +3291,6 @@ async function planAgents(api, localAgents, projectId, localSourceSkillSlugs = /
       if ((remote.system_prompt || "").trim() !== systemPrompt.trim()) diffs.push("system_prompt");
       if ((remote.model || "") !== (agent.model || "")) diffs.push("model");
       if (agent.thinking_level !== void 0 && (remote.thinking_level || "") !== agent.thinking_level) diffs.push("thinking_level");
-      if (allowedUserTagsChanged(agent, remote)) diffs.push("allowed_user_tags");
       if ((remote.idle_reap_timeout_seconds ?? 0) !== (agent.idle_reap_timeout_seconds ?? 0)) diffs.push("idle_reap_timeout_seconds");
       if ((remote.policy_script || "").trim() !== (policyScript || "").trim()) diffs.push("policy_script");
       if ((remote.policy_enabled || false) !== (agent.policy_enabled || false)) diffs.push("policy_enabled");
@@ -3115,7 +3394,6 @@ async function applyAgents(api, localAgents, projectId, localSourceSkillSlugs =
       system_prompt: systemPrompt,
       model: agent.model || "",
       ...agent.thinking_level !== void 0 ? { thinking_level: agent.thinking_level } : {},
-      ...agent.allowed_user_tags !== void 0 ? { allowed_user_tags: agent.allowed_user_tags } : {},
       idle_reap_timeout_seconds: agent.idle_reap_timeout_seconds ?? 0,
       skill_ids: skillIds,
       policy_script: policyScript || "",
@@ -3177,7 +3455,6 @@ async function pullAgents(api, platformDir, filterName, projectId, appName) {
     if (agent.description) config.description = agent.description;
     if (agent.model) config.model = agent.model;
     if (agent.thinking_level) config.thinking_level = agent.thinking_level;
-    if (agent.allowed_user_tags != null) config.allowed_user_tags = agent.allowed_user_tags;
     if (agent.idle_reap_timeout_seconds) config.idle_reap_timeout_seconds = agent.idle_reap_timeout_seconds;
     if (skillSlugs.length > 0) config.skills = skillSlugs;
     if (agent.policy_enabled) config.policy_enabled = true;
@@ -3314,16 +3591,21 @@ async function listResources(api, platformDir, filterType, appName, projectId) {
     for (const skill of localSkills) {
       const remote = remoteBySlug.get(skill.slug);
       if (!remote) {
-        results.push({ name: skill.name, type: "skills", status: "local-only" });
-      } else if (remote.name !== skill.name || (remote.summary || "").trim() !== skill.summary.trim() || (remote.instructions || "").trim() !== skill.instructions.trim()) {
-        results.push({ name: skill.name, type: "skills", status: "changed", details: "SKILL.md" });
+        const resourceChanges = skillResourceChangesSummary(compareSkillResources(skill.resources, []));
+        results.push(resourceChanges ? { name: skill.name, type: "skills", status: "local-only", details: `resources (${resourceChanges})` } : { name: skill.name, type: "skills", status: "local-only" });
       } else {
-        results.push({ name: skill.name, type: "skills", status: "synced" });
+        const resourceChanges = compareSkillResources(skill.resources, remote.resources ?? []);
+        const details = [
+          skillMetadataChanges(skill, remote).length > 0 ? "SKILL.md" : "",
+          skillResourceChangesEmpty(resourceChanges) ? "" : `resources (${skillResourceChangesSummary(resourceChanges)})`
+        ].filter(Boolean).join(", ");
+        results.push(details ? { name: skill.name, type: "skills", status: "changed", details } : { name: skill.name, type: "skills", status: "synced" });
       }
     }
     for (const remote of remoteSkills) {
       if (!localSlugs.has(localProjectSkillSlug(appName, remote.slug))) {
-        results.push({ name: remote.name, type: "skills", status: "remote-only" });
+        const resourceChanges = skillResourceChangesSummary(compareSkillResources([], remote.resources ?? []));
+        results.push(resourceChanges ? { name: remote.name, type: "skills", status: "remote-only", details: `resources (${resourceChanges})` } : { name: remote.name, type: "skills", status: "remote-only" });
       }
     }
   }
@@ -3825,8 +4107,12 @@ async function showResource(api, platformDir, resourceType, resourceName, appNam
     console.log(pc2.bold(`  Skill: ${local?.name || remote?.name}`));
     console.log();
     if (local && remote) {
-      const changed = local.name !== remote.name || local.summary.trim() !== (remote.summary || "").trim() || local.instructions.trim() !== (remote.instructions || "").trim();
+      const resourceChanges = compareSkillResources(local.resources, remote.resources ?? []);
+      const changed = skillMetadataChanges(local, remote).length > 0 || !skillResourceChangesEmpty(resourceChanges);
       console.log(`  Status: ${changed ? pc2.yellow("changed") : pc2.green("synced")}`);
+      if (!skillResourceChangesEmpty(resourceChanges)) {
+        console.log(`  Resources: ${skillResourceChangesSummary(resourceChanges)}`);
+      }
     } else if (local) {
       console.log(`  Status: ${pc2.yellow("local only")}`);
     } else {
@@ -3835,6 +4121,8 @@ async function showResource(api, platformDir, resourceType, resourceName, appNam
     console.log(`  Slug: ${local?.slug || (remote ? localProjectSkillSlug(appName, remote.slug) : "")}`);
     const summary = local?.summary || remote?.summary;
     if (summary) console.log(`  Summary: ${summary}`);
+    const resourcePaths = (local?.resources ?? remote?.resources ?? []).map((resource) => resource.path).sort();
+    if (resourcePaths.length > 0) console.log(`  Resource files: ${resourcePaths.join(", ")}`);
     console.log();
   } else if (resourceType === "mailboxes") {
     const localMailboxes = loadLocalMailboxes(platformDir, resourceName);
@@ -4268,6 +4556,7 @@ async function pull(args) {
   const api = createApiClient(void 0, void 0, appName);
   const projectId = getProjectId(projectRoot);
   const { type, name } = parseResource(filteredArgs[0]);
+  let checkedLocalSkills;
   if (!force) {
     const conflicts = [];
     let collections;
@@ -4278,11 +4567,22 @@ async function pull(args) {
       collections = /* @__PURE__ */ new Map();
     }
     if (projectId && (!type || type === "skills")) {
-      const localSkills = loadLocalSkills(platformDir, name || void 0);
-      if (localSkills.length > 0) {
-        const changes = await planSkills(api, localSkills, projectId, appName);
-        for (const change of changes) {
-          if (change.type === "update") conflicts.push(`skills/${change.id}`);
+      const remoteBySlug = remoteSkillsByLocalSlug(
+        await api.listAgentSkills({ project_id: projectId }),
+        appName
+      );
+      checkedLocalSkills = loadLocalSkills(
+        platformDir,
+        resolveProjectSkillLocalSlug(remoteBySlug, name || void 0)
+      );
+      if (checkedLocalSkills.length > 0) {
+        for (const skill of checkedLocalSkills) {
+          const remote = remoteBySlug.get(skill.slug);
+          if (!remote) continue;
+          const resourceChanges = compareSkillResources(skill.resources, remote.resources ?? []);
+          if (skillMetadataChanges(skill, remote).length > 0 || resourceChanges.added.length > 0 || resourceChanges.replaced.length > 0) {
+            conflicts.push(`skills/${skill.slug}`);
+          }
         }
       }
     }
@@ -4360,7 +4660,7 @@ async function pull(args) {
   }
   if (!type || type === "skills") {
     console.log(pc2.bold("  Skills:"));
-    await pullSkills(api, platformDir, name || void 0, projectId, appName);
+    await pullSkills(api, platformDir, name || void 0, projectId, appName, checkedLocalSkills);
     console.log();
   }
   if (!type || type === "agents") {
@@ -4517,7 +4817,7 @@ ${pc2.dim("Usage:")}
 
 ${pc2.dim("Resources:")}
   agents/<name>       Diff agent (system_prompt, policy_script)
-  skills/<slug>       Diff project skill instructions
+  skills/<slug>       Diff project SKILL.md and resource paths
   automations/<name>  Diff automation code
   hooks/<name>        Diff hook script
 
@@ -4597,11 +4897,7 @@ async function diff(args) {
     const promptChanged = (remote.system_prompt || "").trim() !== local.systemPrompt.trim();
     const policyChanged = (remote.policy_script || "").trim() !== (local.policyScript || "").trim();
     const thinkingLevelChanged = local.agent.thinking_level !== void 0 && (remote.thinking_level || "") !== local.agent.thinking_level;
-    const userTagsChanged = allowedUserTagsChanged(local.agent, remote);
-    if (userTagsChanged) {
-      console.log(`  allowed_user_tags: ${pc2.red(JSON.stringify(remote.allowed_user_tags ?? []))} \u2192 ${pc2.green(JSON.stringify(local.agent.allowed_user_tags))}`);
-    }
-    if (!promptChanged && !policyChanged && !thinkingLevelChanged && !userTagsChanged && remote.name === local.agent.name && (remote.description || "") === (local.agent.description || "") && (remote.model || "") === (local.agent.model || "") && (remote.idle_reap_timeout_seconds ?? 0) === (local.agent.idle_reap_timeout_seconds ?? 0) && (remote.policy_enabled || false) === (local.agent.policy_enabled || false)) {
+    if (!promptChanged && !policyChanged && !thinkingLevelChanged && remote.name === local.agent.name && (remote.description || "") === (local.agent.description || "") && (remote.model || "") === (local.agent.model || "") && (remote.idle_reap_timeout_seconds ?? 0) === (local.agent.idle_reap_timeout_seconds ?? 0) && (remote.policy_enabled || false) === (local.agent.policy_enabled || false)) {
       console.log(pc2.green(`  \u2713 No changes`));
     } else {
       if (promptChanged) renderFullDiff("system_prompt.md", remote.system_prompt || "", local.systemPrompt);
@@ -4697,16 +4993,22 @@ async function diff(args) {
       console.log(`  summary: ${pc2.red(remote.summary || "(empty)")} \u2192 ${pc2.green(local.summary)}`);
     }
     const remoteMarkdown = skillMarkdown({
-      slug: localProjectSkillSlug(appName, remote.slug),
       name: remote.name,
       summary: remote.summary || "",
       instructions: remote.instructions || ""
     });
     const localMarkdown = skillMarkdown(local);
-    if (remoteMarkdown === localMarkdown) {
+    const resourceChanges = compareSkillResources(local.resources, remote.resources ?? []);
+    if (remoteMarkdown === localMarkdown && skillResourceChangesEmpty(resourceChanges)) {
       console.log(pc2.green("  \u2713 No changes"));
     } else {
-      renderFullDiff("SKILL.md", remoteMarkdown, localMarkdown);
+      if (remoteMarkdown !== localMarkdown) renderFullDiff("SKILL.md", remoteMarkdown, localMarkdown);
+      if (!skillResourceChangesEmpty(resourceChanges)) {
+        console.log(pc2.bold("  Resources:"));
+        for (const path of resourceChanges.added) console.log(pc2.green(`  + ${path}`));
+        for (const path of resourceChanges.replaced) console.log(pc2.yellow(`  ~ ${path}`));
+        for (const path of resourceChanges.deleted) console.log(pc2.red(`  - ${path}`));
+      }
     }
   } else {
     console.log(pc2.red(`  Diff not supported for "${type}" \u2014 use agents, skills, automations, or hooks`));
@@ -4720,11 +5022,11 @@ export {
   applyAutomations,
   applyCollections,
   applySkills,
+  compareSkillResources,
   convertCollectionToApiFormat,
   destroy,
   diff,
   list,
-  loadLocalAgents,
   loadLocalCollections,
   loadLocalSkills,
   localProjectSkillSlug,
@@ -4734,10 +5036,10 @@ export {
   planSkills,
   projectSkillRefCandidates,
   pull,
-  pullAgents,
   pullCollections,
   pullSkills,
   resolveAgentSkillRefs,
+  resolveProjectSkillLocalSlug,
   scopedProjectSkillSlug,
   show
 };