@moda-ai/cli 1.36.0 → 1.38.0

package/dist/cli-c5c6f0yw.js

@@ -0,0 +1,128 @@
+import {
+  SKILL_SOURCE_INTEGRATION_BUNDLED,
+  claudeSkillToCursorRule,
+  detectAgents,
+  packageAssetPath,
+  readSkillsManifest,
+  upsertSkillManifestRecord
+} from "./cli-ssfq84k5.js";
+
+// src/skills-bundled.ts
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+var BUNDLED_SKILLS_DIR = packageAssetPath("skills", "integration");
+function bundledSkillsDir() {
+  return process.env.MODA_BUNDLED_SKILLS_DIR || BUNDLED_SKILLS_DIR;
+}
+function readBundledIndex() {
+  const indexPath = join(bundledSkillsDir(), "index.json");
+  if (!existsSync(indexPath))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(indexPath, "utf8"));
+    if (!Array.isArray(parsed.skills))
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function readBundledSkillMd(skillId) {
+  const path = join(bundledSkillsDir(), skillId, "SKILL.md");
+  if (!existsSync(path))
+    return null;
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function installIntegrationSkill(skillId, cwd = process.cwd()) {
+  if (!/^[a-z0-9-]+$/.test(skillId)) {
+    throw new Error(`Invalid integration skill id: ${JSON.stringify(skillId).slice(0, 80)}`);
+  }
+  const sourceDir = join(bundledSkillsDir(), skillId);
+  if (!existsSync(join(sourceDir, "SKILL.md"))) {
+    const bundled = readBundledIndex()?.skills.map((skill) => skill.id) ?? [];
+    throw new Error(`Integration skill '${skillId}' is not bundled with this CLI.${bundled.length > 0 ? ` Bundled skills: ${bundled.join(", ")}` : ""}`);
+  }
+  const files = listFilesRecursive(sourceDir).sort();
+  const plannedWrites = [];
+  for (const file of files) {
+    const relPath = relative(sourceDir, file).replace(/\\/g, "/");
+    plannedWrites.push({
+      targetRelPath: `.claude/skills/${skillId}/${relPath}`,
+      targetPath: join(cwd, ".claude", "skills", skillId, relPath),
+      content: readFileSync(file, "utf8")
+    });
+  }
+  const writeCursor = detectAgents().includes("Cursor") || existsSync(join(cwd, ".cursor"));
+  if (writeCursor) {
+    const skillMd = readFileSync(join(sourceDir, "SKILL.md"), "utf8");
+    plannedWrites.push({
+      targetRelPath: `.cursor/rules/${skillId}.mdc`,
+      targetPath: join(cwd, ".cursor", "rules", `${skillId}.mdc`),
+      content: claudeSkillToCursorRule(skillMd)
+    });
+  }
+  const ownedPaths = new Set((readSkillsManifest(cwd)?.records ?? []).flatMap((record) => record.paths));
+  const collisions = plannedWrites.filter((write) => existsSync(write.targetPath) && !ownedPaths.has(write.targetRelPath));
+  if (collisions.length > 0) {
+    throw new Error(`Refusing to overwrite ${collisions.length} existing file(s) not managed by Moda: ` + `${collisions.map((write) => write.targetRelPath).join(", ")}. ` + "Move or remove them, then re-run to install the bundled integration skill.");
+  }
+  const paths = [];
+  let wroteAny = false;
+  for (const write of plannedWrites) {
+    if (writeIfChanged(write.targetPath, write.content))
+      wroteAny = true;
+    paths.push(write.targetRelPath);
+  }
+  upsertSkillManifestRecord(cwd, {
+    skillId,
+    contentHash: hashSkillDir(sourceDir, files),
+    source: SKILL_SOURCE_INTEGRATION_BUNDLED,
+    paths
+  });
+  return { skillId, status: wroteAny ? "installed" : "unchanged", paths };
+}
+function writeIfChanged(path, content) {
+  if (existsSync(path)) {
+    try {
+      if (readFileSync(path, "utf8") === content)
+        return false;
+    } catch {}
+  }
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, content);
+  return true;
+}
+function listFilesRecursive(dir) {
+  const files = [];
+  const stack = [dir];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (!current)
+      continue;
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const path = join(current, entry.name);
+      if (entry.isDirectory())
+        stack.push(path);
+      else if (entry.isFile())
+        files.push(path);
+    }
+  }
+  return files;
+}
+function hashSkillDir(sourceDir, files) {
+  const hash = createHash("sha256");
+  for (const file of files) {
+    hash.update(relative(sourceDir, file).replace(/\\/g, "/"));
+    hash.update("\x00");
+    hash.update(readFileSync(file));
+    hash.update("\x00");
+  }
+  return hash.digest("hex");
+}
+
+export { bundledSkillsDir, readBundledIndex, readBundledSkillMd, installIntegrationSkill };

package/dist/{cli-scjxgaba.js → cli-k38j2fpq.js}

@@ -1,7 +1,7 @@
 import {
   authFetch,
   getCachedLoginContext
-} from "./cli-yz99t7n8.js";
+} from "./cli-kegd748v.js";
 import {
   CliAccessError,
   CliInputError,
@@ -15,7 +15,7 @@ import {
   resolveTenantIdFromActiveProfile,
   saveCliConfig,
   writeSecretJsonFile
-} from "./cli-drabjmaj.js";
+} from "./cli-q79sq80a.js";
 
 // src/init/tenant.ts
 import { randomUUID } from "node:crypto";

package/dist/{cli-yz99t7n8.js → cli-kegd748v.js}

@@ -1,14 +1,16 @@
 import {
   CliAuthError,
   CliInputError,
-  __require,
   getModaPaths,
   loadProfileConfig,
   resolveModaBaseUrl,
   saveProfileConfig,
   secretFilePathFromRef,
   writeSecretJsonFile
-} from "./cli-drabjmaj.js";
+} from "./cli-q79sq80a.js";
+import {
+  __require
+} from "./cli-0v6na3yp.js";
 
 // src/auth-storage.ts
 import { existsSync, readFileSync, rmSync } from "node:fs";
@@ -326,6 +328,71 @@ function getCachedLoginContext(options = {}) {
     return null;
   return cachedLoginContext.context;
 }
+var MISMATCH_MESSAGE = "The sign-in code is for a different workspace than --tenant-id.";
+var CONNECT_CODE_RE = /^mcc_[A-Za-z0-9_-]{43}$/;
+
+class ConnectCodeError extends Error {
+  reason;
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "ConnectCodeError";
+  }
+}
+async function connectWithCode(code, options = {}) {
+  if (!CONNECT_CODE_RE.test(code)) {
+    throw new ConnectCodeError("That is not a Moda sign-in code. Copy the command from the Moda onboarding page again.", "rejected");
+  }
+  let response;
+  try {
+    response = await fetch(`${resolveModaBaseUrl(options)}/api/cli/auth/connect`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code, label: hostname(), ...options.tenantId ? { tenant_id: options.tenantId } : {} }),
+      redirect: "manual",
+      signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS)
+    });
+  } catch {
+    throw new ConnectCodeError("Could not reach Moda to use the sign-in code.", "unreachable");
+  }
+  if (response.status === 400) {
+    const body = await response.json().catch(() => ({}));
+    if (body.error === "tenant_mismatch") {
+      throw new ConnectCodeError(MISMATCH_MESSAGE, "workspace_mismatch");
+    }
+  }
+  if (response.status === 401 || response.status === 400) {
+    throw new ConnectCodeError("The sign-in code was rejected: it expired (10 minutes) or was already used.", "rejected");
+  }
+  if (!response.ok || response.status >= 300 && response.status < 400) {
+    throw new ConnectCodeError(`Moda could not use the sign-in code (HTTP ${response.status}).`, "failed");
+  }
+  const payload = await response.json().catch(() => ({}));
+  const cliToken = typeof payload.cli_token === "string" ? payload.cli_token : undefined;
+  const expiresAtMs = typeof payload.expires_at === "string" ? Date.parse(payload.expires_at) : NaN;
+  const tenantId = typeof payload.tenant_id === "string" ? payload.tenant_id : undefined;
+  if (!cliToken || !Number.isFinite(expiresAtMs) || !tenantId) {
+    throw new ConnectCodeError("Moda returned an incomplete response for the sign-in code.", "failed");
+  }
+  if (options.tenantId && tenantId !== options.tenantId) {
+    throw new ConnectCodeError(MISMATCH_MESSAGE, "workspace_mismatch");
+  }
+  const userEmail = typeof payload.user?.email === "string" ? payload.user.email : undefined;
+  persistAuthSession({
+    access_token: cliToken,
+    expires_at: Math.floor(expiresAtMs / 1000),
+    profile: resolveStorageProfile(options),
+    token_type: "bearer",
+    token_kind: "moda_ct",
+    ...userEmail ? { user_email: userEmail } : {}
+  }, options);
+  const context = {
+    user: { email: userEmail ?? "", name: typeof payload.user?.name === "string" ? payload.user.name : null },
+    tenants: Array.isArray(payload.tenants) ? payload.tenants : []
+  };
+  cachedLoginContext = { profile: resolveStorageProfile(options), context };
+  return { ...context, tenantId };
+}
 var SUCCESS_HTML = `<!DOCTYPE html>
 <html><body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#fafafa">
 <div style="text-align:center">
@@ -759,4 +826,4 @@ function safeResolveUrl(location, base) {
   }
 }
 
-export { isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, login, authFetch };
+export { isAuthSessionValid, loadToken, loadAuthSession, clearAuthSession, revokeCliSessionToken, getCachedLoginContext, ConnectCodeError, connectWithCode, login, authFetch };

package/dist/{cli-drabjmaj.js → cli-q79sq80a.js}

@@ -1,37 +1,3 @@
-import { createRequire } from "node:module";
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
-var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
-  if (canCache)
-    cache.set(mod, to);
-  return to;
-};
-var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-
 // src/profiles.ts
 import {
   chmodSync,
@@ -1600,4 +1566,4 @@ function createCommandContext(input, options = {}) {
   };
 }
 
-export { __toESM, __commonJS, __require, PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, resolveOutputMode, createCliOutput, stringOption, createCommandContext };
+export { PROD_BASE_URL, DEFAULT_INGEST_URL, getModaPaths, getModaDir, isLoopbackBaseUrl, assertValidProfileName, loadProfileConfig, saveProfileConfig, getActiveProfile, setActiveProfile, upsertProfile, clearStoredApiKeyCredentials, secretFilePathFromRef, resolveSecretReference, resolveApiKeyFromActiveProfile, resolveTenantIdFromActiveProfile, ensureSecretFilePermissions, writeSecretJsonFile, CliInputError, CliAccessError, CliInputRequiredError, CliAuthError, CliCancellationError, isNetworkLikeError, isApiLikeError, VERSION, MODA_BASE_URL, loadCliConfig, saveCliConfig, resolveApiKey, embeddedTenantIdFromApiKey, resolveIngestUrl2 as resolveIngestUrl, resolveTenantId, resolveModaBaseUrl, validateConfig, MAX_SCANNED_FILE_BYTES, DEFAULT_MAX_INVENTORY_FILES, DEFAULT_MAX_INVENTORY_TEXT_BYTES, MAX_RECORDED_SKIPS, SKIPPED_DIRS, isSkippedDir, isSkippedPathPrefix, isEvalLikePath, shouldInventoryFile, isTextFile, isSecretishPath, SECRET_KEYS, redactDeep, redactString, packSnapshot, EXIT_OK, EXIT_ERROR, EXIT_DEGRADED, EXIT_AUTH_REQUIRED, EXIT_INPUT_REQUIRED, EXIT_CANCELLED, AGENT_ERROR_CODES, wasOutputCancelled, safeWriteStdout, safeWriteStderr, resolveOutputMode, createCliOutput, stringOption, createCommandContext };

package/dist/cli-ssfq84k5.js

@@ -0,0 +1,393 @@
+// src/package-assets.ts
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+function packageAssetPath(...parts) {
+  return join(dirname(fileURLToPath(import.meta.url)), "..", ...parts);
+}
+
+// src/init/rules.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { confirm } from "@inquirer/prompts";
+var SKILLS_SOURCE_DIR = packageAssetPath("skills");
+var SKILLS = [
+  {
+    id: "moda-cli",
+    label: "moda-cli — let coding agents query Moda analytics via the CLI"
+  }
+];
+var ADAPTERS = {
+  "Claude Code": {
+    name: "Claude Code",
+    targetFor: (skillId) => ({
+      dir: join2(".claude", "skills", skillId),
+      filename: "SKILL.md"
+    }),
+    transform: (content) => content
+  },
+  Cursor: {
+    name: "Cursor",
+    targetFor: (skillId) => ({
+      dir: join2(".cursor", "rules"),
+      filename: `${skillId}.mdc`
+    }),
+    transform: claudeSkillToCursorRule
+  }
+};
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n([\s\S]*)$/;
+var DESCRIPTION_RE = /^description:\s*(.+?)\s*$/m;
+function claudeSkillToCursorRule(skillContent) {
+  const match = FRONTMATTER_RE.exec(skillContent);
+  if (!match) {
+    return skillContent;
+  }
+  const [, frontmatter, body] = match;
+  const descMatch = DESCRIPTION_RE.exec(frontmatter);
+  const description = descMatch?.[1].trim() ?? "";
+  const cursorFrontmatter = `---
+` + `description: ${JSON.stringify(description)}
+` + `alwaysApply: false
+` + `---
+`;
+  return `${cursorFrontmatter}
+${body.replace(/^\s+/, "")}`;
+}
+function loadSkillSource(skillId) {
+  const path = join2(SKILLS_SOURCE_DIR, skillId, "SKILL.md");
+  if (!existsSync(path)) {
+    throw new Error(`Skill source missing: ${path}`);
+  }
+  return readFileSync(path, "utf8");
+}
+function installSkillForAgent(skill, adapter, content) {
+  const { dir, filename } = adapter.targetFor(skill.id);
+  const dirPath = join2(process.cwd(), dir);
+  const filePath = join2(dirPath, filename);
+  const relativePath = join2(dir, filename);
+  try {
+    mkdirSync(dirPath, { recursive: true });
+    if (existsSync(filePath)) {
+      return { agent: adapter.name, relativePath, status: "exists" };
+    }
+    writeFileSync(filePath, adapter.transform(content));
+    return { agent: adapter.name, relativePath, status: "wrote" };
+  } catch (err) {
+    return {
+      agent: adapter.name,
+      relativePath,
+      status: "failed",
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function installRules(detectedAgents, options = {}) {
+  const adapters = detectedAgents.map((a) => ADAPTERS[a]).filter((a) => a !== undefined);
+  if (adapters.length === 0) {
+    if (!options.silent)
+      console.log("  No supported coding agents detected");
+    return;
+  }
+  const agentList = adapters.map((a) => a.name).join(", ");
+  const skillList = SKILLS.map((s) => `
+    • ${s.label}`).join("");
+  const shouldInstall = options.yes ? true : await confirm({
+    message: `Install Moda skills for ${agentList}?${skillList}
+  Continue?`,
+    default: true
+  });
+  if (!shouldInstall) {
+    if (!options.silent)
+      console.log("  Skipped");
+    return;
+  }
+  let wrote = 0;
+  let skipped = 0;
+  let failed = 0;
+  for (const skill of SKILLS) {
+    let content;
+    try {
+      content = loadSkillSource(skill.id);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(`  Warning: ${message}`);
+      failed += adapters.length;
+      continue;
+    }
+    for (const adapter of adapters) {
+      const outcome = installSkillForAgent(skill, adapter, content);
+      switch (outcome.status) {
+        case "wrote":
+          if (!options.silent)
+            console.log(`  ${outcome.agent}: wrote ${outcome.relativePath}`);
+          wrote++;
+          break;
+        case "exists":
+          if (!options.silent) {
+            console.log(`  ${outcome.agent}: ${outcome.relativePath} already exists — skipping`);
+          }
+          skipped++;
+          break;
+        case "failed":
+          if (!options.silent) {
+            console.error(`  ${outcome.agent}: failed to write ${outcome.relativePath} — ${outcome.error}`);
+          }
+          failed++;
+          break;
+      }
+    }
+  }
+  const summary = [
+    wrote && `${wrote} written`,
+    skipped && `${skipped} already present`,
+    failed && `${failed} failed`
+  ].filter(Boolean).join(", ");
+  if (summary) {
+    if (!options.silent)
+      console.log(`  Done — ${summary}`);
+  }
+}
+
+// src/init/mcp.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import { execSync } from "node:child_process";
+function isOnPath(cmd) {
+  try {
+    execSync(`which ${cmd}`, { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function detectAgents() {
+  const cwd = process.cwd();
+  const agents = [];
+  if (existsSync2(join3(cwd, ".claude")) || isOnPath("claude")) {
+    agents.push("Claude Code");
+  }
+  if (existsSync2(join3(cwd, ".cursor"))) {
+    agents.push("Cursor");
+  }
+  return agents;
+}
+
+// src/skills-manifest.ts
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readdirSync,
+  readFileSync as readFileSync2,
+  rmdirSync,
+  unlinkSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join4, normalize, relative, resolve } from "node:path";
+var SKILLS_MANIFEST_PATH = join4(".moda", "skills.yml");
+var SKILL_SOURCE_HARNESS = "moda";
+var SKILL_SOURCE_INTEGRATION_BUNDLED = "integration-bundled";
+function readSkillsManifest(cwd) {
+  const manifestPath = join4(cwd, SKILLS_MANIFEST_PATH);
+  if (!existsSync3(manifestPath))
+    return null;
+  let text = "";
+  try {
+    text = readFileSync2(manifestPath, "utf8");
+  } catch {
+    return null;
+  }
+  return {
+    tenantId: readYamlScalar(text, "tenant_id"),
+    generationRunId: readYamlScalar(text, "generation_run_id"),
+    generationVersion: Number(readYamlScalar(text, "generation_version") || 0),
+    releaseKey: readYamlScalar(text, "release_key"),
+    statusFilter: readYamlScalar(text, "status_filter"),
+    releasedAt: readYamlScalar(text, "released_at"),
+    managedPaths: readManagedPaths(text),
+    records: readSkillRecords(text)
+  };
+}
+function manifestHeaderFrom(manifest) {
+  return {
+    tenantId: manifest?.tenantId ?? "",
+    releaseKey: manifest?.releaseKey ?? "",
+    statusFilter: manifest?.statusFilter ?? "",
+    generationRunId: manifest?.generationRunId ?? "",
+    generationVersion: manifest?.generationVersion ?? 0,
+    releasedAt: manifest?.releasedAt ?? ""
+  };
+}
+function writeSkillsManifest(cwd, header, records) {
+  const manifestPath = join4(cwd, SKILLS_MANIFEST_PATH);
+  const managedPaths = [...new Set(records.flatMap((record) => record.paths))].sort();
+  const lines = [
+    "version: 1",
+    "source: moda",
+    `tenant_id: ${yamlQuote(header.tenantId)}`,
+    `release_key: ${yamlQuote(header.releaseKey)}`,
+    `status_filter: ${yamlQuote(header.statusFilter)}`,
+    `generation_run_id: ${yamlQuote(header.generationRunId)}`,
+    `generation_version: ${header.generationVersion}`,
+    `released_at: ${yamlQuote(header.releasedAt)}`,
+    `installed_at: ${yamlQuote(new Date().toISOString())}`,
+    "managed_paths:",
+    ...managedPaths.map((path) => `  - ${yamlQuote(path)}`),
+    "skills:",
+    ...records.flatMap((record) => [
+      `  - skill_id: ${yamlQuote(record.skillId)}`,
+      `    content_hash: ${yamlQuote(record.contentHash)}`,
+      `    source: ${yamlQuote(record.source)}`,
+      "    paths:",
+      ...record.paths.map((path) => `      - ${yamlQuote(path)}`)
+    ]),
+    ""
+  ];
+  mkdirSync2(dirname2(manifestPath), { recursive: true });
+  writeFileSync2(manifestPath, lines.join(`
+`));
+}
+function upsertSkillManifestRecord(cwd, record) {
+  const manifest = readSkillsManifest(cwd);
+  const records = (manifest?.records ?? []).filter((existing) => !(existing.skillId === record.skillId && existing.source === record.source));
+  records.push(record);
+  writeSkillsManifest(cwd, manifestHeaderFrom(manifest), records);
+}
+function pruneManagedSkillPaths(cwd, managedPaths, log) {
+  let pruned = 0;
+  for (const rawPath of [...new Set(managedPaths)]) {
+    const safePath = safeManagedRelativePath(rawPath);
+    if (!safePath)
+      continue;
+    const absolutePath = absoluteManagedPath(cwd, safePath);
+    if (!absolutePath || !existsSync3(absolutePath))
+      continue;
+    try {
+      unlinkSync(absolutePath);
+      pruned++;
+      log(`  pruned ${safePath}`);
+      pruneEmptyClaudeSkillDir(cwd, safePath);
+    } catch {}
+  }
+  return pruned;
+}
+function pruneEmptyClaudeSkillDir(cwd, relativePath) {
+  if (!relativePath.startsWith(".claude/skills/") || !relativePath.endsWith("/SKILL.md"))
+    return;
+  const dir = dirname2(join4(cwd, relativePath));
+  try {
+    if (existsSync3(dir) && readdirSync(dir).length === 0) {
+      rmdirSync(dir);
+    }
+  } catch {}
+}
+function absoluteManagedPath(cwd, relativePath) {
+  const abs = resolve(cwd, relativePath);
+  const root = resolve(cwd);
+  const rel = relative(root, abs);
+  if (rel.startsWith("..") || isAbsolute(rel))
+    return null;
+  return abs;
+}
+function safeManagedRelativePath(rawPath) {
+  if (!rawPath || rawPath.includes("\x00") || isAbsolute(rawPath))
+    return null;
+  const normalized = normalize(rawPath).replace(/\\/g, "/");
+  if (normalized.startsWith("../") || normalized === ".." || normalized.includes("/../"))
+    return null;
+  const isClaudeSkill = normalized.startsWith(".claude/skills/") && normalized.endsWith("/SKILL.md");
+  const isCursorRule = normalized.startsWith(".cursor/rules/") && normalized.endsWith(".mdc");
+  return isClaudeSkill || isCursorRule ? normalized : null;
+}
+function readYamlScalar(text, key) {
+  const match = text.match(new RegExp(`^${key}:\\s*(.*?)\\s*$`, "m"));
+  return match ? parseYamlScalar(match[1]) : "";
+}
+function readSkillRecords(text) {
+  const records = [];
+  let inSkills = false;
+  let current = null;
+  let inPaths = false;
+  for (const line of text.split(/\r?\n/)) {
+    if (line.trim() === "skills:") {
+      inSkills = true;
+      continue;
+    }
+    if (!inSkills)
+      continue;
+    if (line.length > 0 && !line.startsWith(" "))
+      break;
+    const skillIdMatch = line.match(/^ {2}- skill_id:\s*(.*?)\s*$/);
+    if (skillIdMatch) {
+      if (current)
+        records.push(current);
+      current = {
+        skillId: parseYamlScalar(skillIdMatch[1]),
+        contentHash: "",
+        source: SKILL_SOURCE_HARNESS,
+        paths: []
+      };
+      inPaths = false;
+      continue;
+    }
+    if (!current)
+      continue;
+    const hashMatch = line.match(/^ {4}content_hash:\s*(.*?)\s*$/);
+    if (hashMatch) {
+      current.contentHash = parseYamlScalar(hashMatch[1]);
+      continue;
+    }
+    const sourceMatch = line.match(/^ {4}source:\s*(.*?)\s*$/);
+    if (sourceMatch) {
+      current.source = parseYamlScalar(sourceMatch[1]) || SKILL_SOURCE_HARNESS;
+      continue;
+    }
+    if (/^ {4}paths:\s*$/.test(line)) {
+      inPaths = true;
+      continue;
+    }
+    const pathMatch = inPaths ? line.match(/^ {6}-\s*(.*?)\s*$/) : null;
+    if (pathMatch) {
+      const value = parseYamlScalar(pathMatch[1]);
+      if (value)
+        current.paths.push(value);
+    }
+  }
+  if (current)
+    records.push(current);
+  return records;
+}
+function readManagedPaths(text) {
+  const paths = [];
+  let inManagedPaths = false;
+  for (const line of text.split(/\r?\n/)) {
+    if (line.trim() === "managed_paths:") {
+      inManagedPaths = true;
+      continue;
+    }
+    if (inManagedPaths && line.length > 0 && !line.startsWith(" "))
+      break;
+    if (!inManagedPaths)
+      continue;
+    const match = line.match(/^\s*-\s*(.*?)\s*$/);
+    if (match)
+      paths.push(parseYamlScalar(match[1]));
+  }
+  return paths.filter(Boolean);
+}
+function parseYamlScalar(raw) {
+  const value = raw.trim();
+  if (!value)
+    return "";
+  if (value.startsWith('"')) {
+    try {
+      return String(JSON.parse(value));
+    } catch {
+      return value.replace(/^"|"$/g, "");
+    }
+  }
+  return value.replace(/^'|'$/g, "");
+}
+function yamlQuote(value) {
+  return JSON.stringify(value);
+}
+
+export { packageAssetPath, claudeSkillToCursorRule, installRules, detectAgents, SKILL_SOURCE_HARNESS, SKILL_SOURCE_INTEGRATION_BUNDLED, readSkillsManifest, writeSkillsManifest, upsertSkillManifestRecord, pruneManagedSkillPaths };