@postplus/cli 0.1.37 → 0.1.39

package/build/hosted-domain-commands.js

@@ -17,10 +17,7 @@ const HOSTED_DOMAIN_CAPABILITIES = {
     media: new Set(['media-file', 'media-generation', 'video-analysis']),
     mobile: new Set(['mobile-automation']),
     publish: new Set(['social-publishing']),
-    research: new Set([
-        'public-content-collection',
-        'public-content-discovery',
-    ]),
+    research: new Set(['public-content-collection', 'public-content-discovery']),
 };
 export async function runHostedDomainCommand(domain, args) {
     const [subcommand, ...rest] = args;
@@ -69,6 +66,16 @@ async function runResearchCollect(args) {
         `postplus-cli:research:${collectionKey}:${randomUUID()}`;
     const quoteConfirmationToken = flags.values.get('quote-confirmation-token') ??
         normalizeString(envelope.quoteConfirmationToken);
+    // Optional per-request cost ceiling (USD) overriding the hosted default.
+    const maxChargeFlag = flags.values.get('max-charge-usd');
+    let maxTotalChargeUsd;
+    if (maxChargeFlag !== undefined) {
+        const parsed = Number(maxChargeFlag);
+        if (!Number.isFinite(parsed) || parsed <= 0) {
+            throw new Error('--max-charge-usd must be a positive number of USD.');
+        }
+        maxTotalChargeUsd = parsed;
+    }
     const payload = await postHostedJson({
         body: {
             collectionKey,
@@ -76,6 +83,7 @@ async function runResearchCollect(args) {
             operationId,
             quoteConfirmationToken: quoteConfirmationToken ?? undefined,
             skillName,
+            maxTotalChargeUsd,
         },
         pathName: '/api/postplus-cli/hosted/collection',
         skillName,
@@ -348,7 +356,7 @@ function printResearchHelp() {
 
 Usage:
   postplus research schema [--collection-key <key>] [--json]
-  postplus research collect --skill <skill-id> --collection-key <key> --input <hosted-envelope.json> [--output <result.json>]
+  postplus research collect --skill <skill-id> --collection-key <key> --input <hosted-envelope.json> [--max-charge-usd <usd>] [--output <result.json>]
   postplus research collect --run-handle <runHandle> [--output <result.json>]
   postplus research capability --request <hosted-capability-request.json> [--output <result.json>]
 `);

package/build/hosted-schema-catalog.js

@@ -1,87 +1,72 @@
 // Generated from the PostPlus Cloud hosted catalog release gate.
 // Keep keys in sync with apps/web hosted capability and collection catalogs.
+//
+// The result-count field in each hint is a fetch-volume example using the actor's
+// REAL input field (it shapes how much the actor fetches, not the cost ceiling).
+// Total spend is bounded server-side by a per-request USD budget — pay-per-event
+// actors via Apify maxTotalChargeUsd, Bright Data Facebook via
+// limit_multiple_results — so these values are starting points, not the cap.
+// Field names matter: clockworks TikTok actors fetch per resultsPerPage /
+// maxProfilesPerQuery / commentsPerPost (maxItems is a run option they ignore as
+// input) and apidojo youtube-comments uses maxItems (not maxComments).
 export const RESEARCH_COLLECTION_HINTS = {
-    'amazon-asins': {
-        asins: ['B0C1234567'],
-        country: 'US',
-    },
-    'amazon-bestsellers': {
-        categoryUrl: 'https://www.amazon.com/Best-Sellers/zgbs',
-        maxItems: 5,
-    },
-    'amazon-free-products': {
-        keyword: 'portable blender',
-        maxItems: 5,
-    },
-    'amazon-products': {
-        country: 'US',
-        keyword: 'portable blender',
-        maxItems: 5,
-    },
-    'amazon-reviews': {
-        asin: 'B0C1234567',
-        country: 'US',
-        maxReviews: 10,
-    },
-    'amazon-reviews-v2': {
-        asin: 'B0C1234567',
-        domainCode: 'com',
-        maxReviews: 10,
-    },
     'google-trends-fast': {
-        queries: ['portable blender'],
+        enableTrendingSearches: false,
+        geo: 'US',
+        keyword: 'portable blender',
+        timeframe: 'today 12-m',
     },
     'instagram-comments': {
         directUrls: ['https://www.instagram.com/p/example/'],
-        resultsLimit: 5,
+        resultsLimit: 20,
     },
     'instagram-email-search': {
         Country: 'www',
         Email_Type: '0',
         Keyword: 'skincare creator',
-        Limit: '10',
+        Limit: '25',
         social_network: 'instagram.com/',
     },
     'instagram-hashtags': {
         hashtags: ['desksetup'],
-        resultsLimit: 3,
+        resultsLimit: 10,
     },
     'instagram-posts': {
-        resultsLimit: 3,
+        resultsLimit: 12,
         username: ['openai'],
     },
     'instagram-profiles': {
-        resultsLimit: 3,
         usernames: ['instagram'],
     },
     'instagram-search': {
-        searchLimit: 3,
+        searchLimit: 10,
         searchTerms: ['skincare routine'],
         searchType: 'user',
     },
     'tiktok-ads-top': {
         include_analytics: true,
-        limit: 1,
+        limit: 20,
     },
     'tiktok-comments': {
+        commentsPerPost: 20,
         postURLs: ['https://www.tiktok.com/@example/video/1234567890'],
-        resultsPerPage: 5,
     },
     'tiktok-profiles': {
+        resultsPerPage: 12,
         usernames: ['tiktok'],
     },
     'tiktok-related-videos': {
-        maxItems: 3,
         postURLs: ['https://www.tiktok.com/@example/video/1234567890'],
+        resultsPerPage: 10,
     },
     'tiktok-users': {
-        maxItems: 5,
+        maxProfilesPerQuery: 10,
         searchQueries: ['skincare creator'],
     },
     'tiktok-videos': {
-        maxItems: 3,
         proxyCountryCode: 'US',
         queries: ['portable blender'],
+        resultsPerPage: 10,
         searchSection: '/video',
     },
     'youtube-channel-summary': {
@@ -91,23 +76,17 @@ export const RESEARCH_COLLECTION_HINTS = {
         maxVideosPerChannel: 0,
     },
     'youtube-comments': {
-        maxComments: 10,
+        maxItems: 50,
         startUrls: ['https://www.youtube.com/watch?v=dQw4w9WgXcQ'],
     },
     'youtube-video-download': {
         urls: ['https://www.youtube.com/watch?v=dQw4w9WgXcQ'],
     },
-    'x-posts': {
-        maxItems: 5,
-        searchTerms: ['product launch'],
-    },
-    'x-profiles': {
-        handles: ['OpenAI'],
-    },
 };
 export const PUBLIC_CONTENT_SOURCE_HINTS = {
     'facebook-group-posts': [
         {
+            num_of_posts: 25,
             url: 'https://www.facebook.com/groups/example',
         },
     ],
@@ -118,6 +97,7 @@ export const PUBLIC_CONTENT_SOURCE_HINTS = {
     ],
     'facebook-profile-posts': [
         {
+            num_of_posts: 25,
             url: 'https://www.facebook.com/openai',
         },
     ],

package/build/index.js

@@ -9,7 +9,7 @@ import { readCurrentCliVersion } from './client-compatibility.js';
 import { formatDoctorReport, generateDoctorReport } from './doctor.js';
 import { runHostedDomainCommand } from './hosted-domain-commands.js';
 import { assertConfigFilePermissions } from './local-state.js';
-import { readLargeCreditQuoteConfirmationChallenge, resolveLargeCreditQuoteConfirmation, } from './quote-confirmation.js';
+import { QUOTE_AUTO_CONFIRM_UNDER_ENV, QuoteAutoConfirmCeilingExceededError, QuoteConfirmationNonInteractiveError, confirmLargeCreditQuote, readLargeCreditQuoteConfirmationChallenge, resolveLargeCreditQuoteConfirmation, } from './quote-confirmation.js';
 import { POSTPLUS_SKILLS_CURRENT_DIRECTORY_INSTALL_COMMAND, POSTPLUS_SKILLS_INSTALL_COMMAND, formatPostPlusSkillsInstallCommand, loadPublicSkillCatalog, } from './skill-catalog.js';
 import { formatSkillBaselineVerifyReport, runPostPlusSkillUninstall, runPostPlusSkillUpdate, runPostPlusSkillVerify, } from './skill-management.js';
 import { formatStatusReport, generateStatusReport } from './status.js';
@@ -51,7 +51,7 @@ Usage:
   postplus publish capability --request <hosted-capability-request.json> [--output <result.json>]
   postplus mobile schema [--json]
   postplus mobile capability --request <hosted-capability-request.json> [--output <result.json>]
-  postplus quote confirm --json --challenge-file <path>
+  postplus quote confirm --json --challenge-file <path> [--auto-confirm-under <millicredits>]
   postplus skills verify [--json]
   postplus studio init|open|status   Open bundled Local Studio
   postplus update [--current-directory]
@@ -208,11 +208,46 @@ async function runQuoteCommand(rest) {
         process.stderr.write('Invalid large credit quote confirmation challenge.\n');
         return 1;
     }
-    writeJson(await resolveLargeCreditQuoteConfirmation(challenge));
+    const ceilingMillicredits = resolveQuoteAutoConfirmCeiling(parsed.autoConfirmUnder);
+    try {
+        writeJson(await resolveLargeCreditQuoteConfirmation(challenge, {
+            confirm: confirmLargeCreditQuote,
+            ceilingMillicredits,
+        }));
+    }
+    catch (error) {
+        if (error instanceof QuoteAutoConfirmCeilingExceededError ||
+            error instanceof QuoteConfirmationNonInteractiveError) {
+            process.stderr.write(`${error.message}\n`);
+            return 1;
+        }
+        throw error;
+    }
     return 0;
 }
+/**
+ * Resolves the bounded auto-confirm ceiling in millicredits. Precedence:
+ * explicit --auto-confirm-under flag, then the
+ * POSTPLUS_QUOTE_AUTO_CONFIRM_UNDER_MILLICREDITS env var. Returns null when
+ * neither is set, leaving today's interactive behavior unchanged.
+ */
+function resolveQuoteAutoConfirmCeiling(flagValue) {
+    if (flagValue !== null) {
+        return flagValue;
+    }
+    const envValue = process.env[QUOTE_AUTO_CONFIRM_UNDER_ENV];
+    if (envValue === undefined || envValue.trim() === '') {
+        return null;
+    }
+    const parsed = Number(envValue);
+    if (!Number.isFinite(parsed) || parsed < 0) {
+        throw new Error(`Invalid ${QUOTE_AUTO_CONFIRM_UNDER_ENV}: expected a non-negative number of millicredits.`);
+    }
+    return parsed;
+}
 function parseQuoteConfirmOptions(args) {
     const options = {
+        autoConfirmUnder: null,
         challengeFile: null,
         json: false,
     };
@@ -231,6 +266,19 @@ function parseQuoteConfirmOptions(args) {
             index += 1;
             continue;
         }
+        if (arg === '--auto-confirm-under') {
+            const rawValue = args[index + 1];
+            if (!rawValue || rawValue.startsWith('--')) {
+                throw new Error('Missing value for --auto-confirm-under.');
+            }
+            const value = Number(rawValue);
+            if (!Number.isFinite(value) || value < 0) {
+                throw new Error('Invalid value for --auto-confirm-under: expected a non-negative number of millicredits.');
+            }
+            options.autoConfirmUnder = value;
+            index += 1;
+            continue;
+        }
         throw new Error(`Unknown option for quote confirm: ${arg}`);
     }
     return options;

package/build/quote-confirmation.js

@@ -1,6 +1,50 @@
 import readline from 'node:readline/promises';
 import { readLocalConfig, updateLocalConfig } from './local-state.js';
 const PRODUCT_ERROR_CODE = 'postplus_cli_quote_confirmation_required';
+export const QUOTE_AUTO_CONFIRM_CEILING_EXCEEDED_CODE = 'postplus_cli_quote_auto_confirm_ceiling_exceeded';
+export const QUOTE_AUTO_CONFIRM_UNDER_ENV = 'POSTPLUS_QUOTE_AUTO_CONFIRM_UNDER_MILLICREDITS';
+/**
+ * Thrown when a bounded auto-confirm ceiling is configured but the challenge
+ * cost exceeds it. Carries the original challenge so an orchestrator or human
+ * can confirm explicitly instead of the CLI hanging on a readline prompt.
+ */
+export class QuoteAutoConfirmCeilingExceededError extends Error {
+    code = QUOTE_AUTO_CONFIRM_CEILING_EXCEEDED_CODE;
+    challenge;
+    ceilingMillicredits;
+    costMillicredits;
+    constructor(input) {
+        super(`Quote cost ${input.costMillicredits} millicredits exceeds the ` +
+            `auto-confirm ceiling of ${input.ceilingMillicredits} millicredits. ` +
+            'Confirm explicitly or raise --auto-confirm-under / ' +
+            `${QUOTE_AUTO_CONFIRM_UNDER_ENV}.`);
+        this.name = 'QuoteAutoConfirmCeilingExceededError';
+        this.challenge = input.challenge;
+        this.ceilingMillicredits = input.ceilingMillicredits;
+        this.costMillicredits = input.costMillicredits;
+    }
+}
+/**
+ * Thrown when no auto-confirm ceiling is configured and stdin is not a TTY, so
+ * the interactive readline prompt would hang. Fails fast with an actionable
+ * message instead.
+ */
+export class QuoteConfirmationNonInteractiveError extends Error {
+    code = 'postplus_cli_quote_confirmation_non_interactive';
+    challenge;
+    constructor(challenge) {
+        super('Quote confirmation required but stdin is not a TTY and no auto-confirm ' +
+            'ceiling is configured. Pass --auto-confirm-under <millicredits>, set ' +
+            `${QUOTE_AUTO_CONFIRM_UNDER_ENV}, or run interactively.`);
+        this.name = 'QuoteConfirmationNonInteractiveError';
+        this.challenge = challenge;
+    }
+}
+function resolveChallengeCostMillicredits(challenge) {
+    return typeof challenge.estimatedMillicredits === 'number'
+        ? challenge.estimatedMillicredits
+        : challenge.requiredTierMillicredits;
+}
 export function readLargeCreditQuoteConfirmationChallenge(value) {
     if (!value || typeof value !== 'object') {
         return null;
@@ -55,7 +99,7 @@ export async function resolveLargeCreditQuoteConfirmation(challenge, dependencie
 }) {
     const acknowledgedTierMillicredits = await readAcknowledgedTierMillicredits(challenge);
     if (acknowledgedTierMillicredits < challenge.requiredTierMillicredits) {
-        await dependencies.confirm(challenge);
+        await runQuoteConfirmation(challenge, dependencies);
         await writeAcknowledgedTierMillicredits(challenge);
     }
     return {
@@ -63,6 +107,39 @@ export async function resolveLargeCreditQuoteConfirmation(challenge, dependencie
         token: challenge.token,
     };
 }
+async function runQuoteConfirmation(challenge, dependencies) {
+    const ceiling = dependencies.ceilingMillicredits;
+    if (typeof ceiling === 'number' && Number.isFinite(ceiling)) {
+        const cost = resolveChallengeCostMillicredits(challenge);
+        if (cost > ceiling) {
+            throw new QuoteAutoConfirmCeilingExceededError({
+                challenge,
+                ceilingMillicredits: ceiling,
+                costMillicredits: cost,
+            });
+        }
+        const log = dependencies.logNotice ?? defaultLogNotice;
+        const now = (dependencies.now ?? (() => new Date()))();
+        log(JSON.stringify({
+            event: 'quote_auto_confirm',
+            timestamp: now.toISOString(),
+            accountId: challenge.accountId,
+            operationId: challenge.operationId,
+            costMillicredits: cost,
+            ceilingMillicredits: ceiling,
+            requiredTierMillicredits: challenge.requiredTierMillicredits,
+        }));
+        return;
+    }
+    const isTty = dependencies.isTty ?? (() => Boolean(process.stdin.isTTY));
+    if (!isTty()) {
+        throw new QuoteConfirmationNonInteractiveError(challenge);
+    }
+    await dependencies.confirm(challenge);
+}
+function defaultLogNotice(line) {
+    process.stderr.write(`${line}\n`);
+}
 export async function confirmLargeCreditQuote(challenge) {
     const terminal = readline.createInterface({
         input: process.stdin,

package/build/skill-management.js

@@ -1,9 +1,15 @@
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import { writeCurrentCliVersionToLocalConfig } from './client-compatibility.js';
 import { runCommand, runInteractiveCommand } from './command-runner.js';
 import { clearManagedSkillBaseline, readManagedSkillBaseline, writeManagedSkillBaseline, } from './local-state.js';
 import { POSTPLUS_SKILLS_AGENT_TARGETS, formatPostPlusSkillsInstallCommand, resolvePostPlusSkillsSource, loadPublicSkillCatalog, } from './skill-catalog.js';
 import { clearUpdateCheckCache } from './update-check.js';
 const NPX_SKILLS = ['-y', 'skills'];
+const SKILLS_INSTALLER_GLOBAL_LOCK_PATH = ['.agents', '.skill-lock.json'];
+const SKILLS_INSTALLER_PROJECT_LOCK_PATH = 'skills-lock.json';
+const SKILLS_INSTALLER_POSTPLUS_SOURCE = 'postplusai/postplus-skills';
 const DEFAULT_SKILL_MUTATION_OPTIONS = {
     scope: 'global',
 };
@@ -12,8 +18,10 @@ export async function runPostPlusSkillUpdate(dependencies = {
 }, options = DEFAULT_SKILL_MUTATION_OPTIONS) {
     const catalog = await loadPublicSkillCatalog();
     const skillNames = catalog.skills.map((skill) => skill.skillId);
+    const releasedSkills = new Set(skillNames);
     const baseline = await readManagedSkillBaseline();
-    const retiredSkillNames = baseline.skillNames.filter((skillName) => !skillNames.includes(skillName));
+    const lockedSkillNames = await readPostPlusInstallerLockedSkillEntries(options.scope).then((entries) => entries.map((entry) => entry.name));
+    const retiredSkillNames = mergeSkillNames(baseline.skillNames, lockedSkillNames).filter((skillName) => !releasedSkills.has(skillName));
     if (skillNames.length === 0) {
         throw new Error('PostPlus public skill catalog has no released skills.');
     }
@@ -45,7 +53,8 @@ export async function runPostPlusSkillUninstall(dependencies = {
     const catalog = await loadPublicSkillCatalog();
     const skillNames = catalog.skills.map((skill) => skill.skillId);
     const baseline = await readManagedSkillBaseline();
-    const allKnownSkillNames = mergeSkillNames(skillNames, baseline.skillNames);
+    const lockedSkillNames = await readPostPlusInstallerLockedSkillEntries(options.scope).then((entries) => entries.map((entry) => entry.name));
+    const allKnownSkillNames = mergeSkillNames(mergeSkillNames(skillNames, baseline.skillNames), lockedSkillNames);
     if (allKnownSkillNames.length === 0) {
         throw new Error('PostPlus public skill catalog has no released skills.');
     }
@@ -96,9 +105,20 @@ async function inspectPostPlusSkillInstall(dependencies, options = {}) {
     const requiredSkillNames = catalog.skills.map((skill) => skill.skillId);
     const requiredSkills = new Set(requiredSkillNames);
     const baseline = await readManagedSkillBaseline();
-    const retiredManagedSkills = baseline.skillNames.filter((skillName) => !requiredSkills.has(skillName));
+    const baselineRetiredManagedSkills = baseline.skillNames.filter((skillName) => !requiredSkills.has(skillName));
     try {
         const installed = await listInstalledSkills(dependencies);
+        const baselineRetiredSkills = new Set(baselineRetiredManagedSkills);
+        const lockedSkills = new Set((await readPostPlusInstallerLockedSkillEntries()).map((entry) => `${entry.scope}:${entry.name}`));
+        const installedRetiredManagedSkills = [
+            ...new Set(installed
+                .filter((skill) => baselineRetiredSkills.has(skill.name) ||
+                lockedSkills.has(`${skill.scope}:${skill.name}`))
+                .map((skill) => skill.name)),
+        ]
+            .filter((skillName) => !requiredSkills.has(skillName))
+            .sort((a, b) => a.localeCompare(b));
+        const retiredManagedSkills = mergeSkillNames(baselineRetiredManagedSkills, installedRetiredManagedSkills);
         const postPlusInstalled = installed.filter((skill) => requiredSkills.has(skill.name));
         const installedNames = new Set(postPlusInstalled.map((skill) => skill.name));
         const missingSkills = [...requiredSkills].filter((skill) => !installedNames.has(skill));
@@ -110,7 +130,8 @@ async function inspectPostPlusSkillInstall(dependencies, options = {}) {
                 baseline,
                 releaseId: catalog.releaseId,
                 skillNames: requiredSkillNames,
-            })) {
+            }) &&
+            installedRetiredManagedSkills.length === 0) {
             await writeManagedSkillBaseline({
                 releaseId: catalog.releaseId,
                 skillNames: requiredSkillNames,
@@ -128,7 +149,8 @@ async function inspectPostPlusSkillInstall(dependencies, options = {}) {
         return {
             catalog,
             report: {
-                ok: missingSkills.length === 0,
+                ok: missingSkills.length === 0 &&
+                    installedRetiredManagedSkills.length === 0,
                 error: null,
                 installCommand: formatPostPlusSkillsInstallCommand(catalog.source),
                 installedCount: installedNames.size,
@@ -157,7 +179,7 @@ async function inspectPostPlusSkillInstall(dependencies, options = {}) {
                 managedSkillsReleaseId: baseline.releaseId,
                 missingSkills: [...requiredSkills],
                 requiredCount: requiredSkills.size,
-                retiredManagedSkills,
+                retiredManagedSkills: baselineRetiredManagedSkills,
                 scopes: [],
                 source: catalog.source,
                 updateCommand: formatPostPlusSkillUpdateCommand(),
@@ -212,6 +234,9 @@ export function formatSkillBaselineVerifyReport(report) {
     else {
         lines.push('  Verified baseline: unchanged');
     }
+    if (report.retiredManagedSkills.length > 0) {
+        lines.push(`  Retired managed skills: ${formatSkillList(report.retiredManagedSkills, 8)}`, `  Cleanup (global): ${report.updateCommand}`, `  Cleanup (current directory): ${formatPostPlusSkillUpdateCommand('current-directory')}`);
+    }
     if (report.missingSkills.length > 0) {
         lines.push(`  Missing: ${formatSkillList(report.missingSkills, 8)}`, `  Fix (global): ${report.installCommand}`, `  Fix (current directory): ${formatPostPlusSkillsInstallCommand(report.source, 'current-directory')}`);
     }
@@ -274,6 +299,106 @@ function haveSameSkillNames(left, right) {
     return (normalizedLeft.length === normalizedRight.length &&
         normalizedLeft.every((value, index) => value === normalizedRight[index]));
 }
+async function readPostPlusInstallerLockedSkillEntries(scope) {
+    const lockPaths = scope === 'global'
+        ? [{ path: getSkillsInstallerGlobalLockPath(), scope: 'global' }]
+        : scope === 'current-directory'
+            ? [
+                {
+                    path: getSkillsInstallerProjectLockPath(),
+                    scope: 'project',
+                },
+            ]
+            : [
+                {
+                    path: getSkillsInstallerProjectLockPath(),
+                    scope: 'project',
+                },
+                {
+                    path: getSkillsInstallerGlobalLockPath(),
+                    scope: 'global',
+                },
+            ];
+    const entries = await Promise.all(lockPaths.map((lock) => readPostPlusInstallerLockedSkillNamesFromPath(lock.path).then((skillNames) => skillNames.map((name) => ({
+        name,
+        scope: lock.scope,
+    })))));
+    return entries
+        .flat()
+        .sort((left, right) => left.scope.localeCompare(right.scope) ||
+        left.name.localeCompare(right.name));
+}
+async function readPostPlusInstallerLockedSkillNamesFromPath(lockPath) {
+    try {
+        const raw = await readFile(lockPath, 'utf8');
+        const payload = JSON.parse(raw);
+        if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+            return [];
+        }
+        const record = payload;
+        if (typeof record.version !== 'number') {
+            return [];
+        }
+        if (!record.skills || typeof record.skills !== 'object') {
+            return [];
+        }
+        return Object.entries(record.skills)
+            .filter(([, entry]) => isPostPlusSkillsInstallerLockEntry(entry))
+            .map(([skillName]) => skillName.trim())
+            .filter(Boolean)
+            .sort((a, b) => a.localeCompare(b));
+    }
+    catch (error) {
+        const nodeError = error;
+        if (nodeError.code === 'ENOENT') {
+            return [];
+        }
+        throw error;
+    }
+}
+function isPostPlusSkillsInstallerLockEntry(entry) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+        return false;
+    }
+    const record = entry;
+    const source = typeof record.source === 'string' ? record.source.trim() : '';
+    const sourceUrl = typeof record.sourceUrl === 'string' ? record.sourceUrl.trim() : '';
+    return (normalizeSkillsInstallerSource(source) ===
+        SKILLS_INSTALLER_POSTPLUS_SOURCE ||
+        normalizeSkillsInstallerSource(sourceUrl) ===
+            SKILLS_INSTALLER_POSTPLUS_SOURCE);
+}
+function normalizeSkillsInstallerSource(value) {
+    let normalized = value.trim().replace(/\\/g, '/');
+    if (normalized.length === 0) {
+        return '';
+    }
+    const sshMatch = normalized.match(/^git@[^:]+:(.+)$/);
+    if (sshMatch) {
+        normalized = sshMatch[1] ?? '';
+    }
+    else if (/^https?:\/\//i.test(normalized) || /^ssh:\/\//i.test(normalized)) {
+        try {
+            normalized = new URL(normalized).pathname.replace(/^\/+/, '');
+        }
+        catch {
+            return normalized.toLowerCase();
+        }
+    }
+    return normalized
+        .replace(/\.git$/i, '')
+        .replace(/\/+$/, '')
+        .toLowerCase();
+}
+function getSkillsInstallerGlobalLockPath() {
+    const xdgStateHome = process.env.XDG_STATE_HOME?.trim();
+    return xdgStateHome
+        ? join(xdgStateHome, 'skills', '.skill-lock.json')
+        : join(homedir(), ...SKILLS_INSTALLER_GLOBAL_LOCK_PATH);
+}
+function getSkillsInstallerProjectLockPath() {
+    return join(process.cwd(), SKILLS_INSTALLER_PROJECT_LOCK_PATH);
+}
 async function listInstalledSkills(dependencies) {
     const project = await listInstalledSkillsForScope(dependencies, []);
     const global = await listInstalledSkillsForScope(dependencies, ['--global']);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postplus/cli",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "packageManager": "pnpm@10.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017",
   "type": "module",
   "description": "PostPlus CLI for PostPlus Cloud auth, status, and diagnostics.",