@prave/cli 1.4.14 → 1.5.1

package/README.md

@@ -63,7 +63,7 @@ Syncing 12 Skills — this takes about 15 seconds.
 Synced 12 · failed 0
 ```
 
-The `last_sync_at` watermark persists at `~/.prave/state.json`. Pass `--yes` to skip the prompt in CI scripts.
+The `last_sync_at` watermark persists at `~/.prave/state.json`.
 
 ## Commands
 

package/dist/commands/sync.js

@@ -1,74 +1,76 @@
-import { readdir, stat } from 'node:fs/promises';
+import { mkdir, readdir, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import chalk from 'chalk';
 import ora from 'ora';
+import { resolveAgentTargets } from '../lib/agent-paths.js';
 import { track } from '../lib/analytics.js';
-import { CONFIG } from '../lib/config.js';
+import { api, ApiError } from '../lib/api.js';
 import { requireAuth } from '../lib/credentials.js';
 import { fetchMyPlan, formatUpgradeHint } from '../lib/plan.js';
 import { readState, writeState } from '../lib/state.js';
 import { formatRelative, msSince } from '../lib/time.js';
 import { log } from '../utils/logger.js';
-import { installCommand } from './install.js';
 /**
- * Empirical per-skill timing — `installCommand` does ~1 registry GET +
- * ~1 file write + ~1 best-effort POST analyze, which clocks in around
- * 0.4s on a warm connection. With concurrency=4 we approximate effective
- * ~0.4s per skill / 4 ≈ 0.1s, but include a safety multiplier so the
- * estimate doesn't oversell. End result: estimate ~ 0.15s/skill, rounded
- * to nearest 5s with a 5s floor.
+ * Bulk-fetch chunk size. The API caps `slugs` at 250 per request
+ * (see bulkSyncInputSchema). We chunk well below that so one slow
+ * skill in a chunk doesn't stall everything, and so total response
+ * size stays predictable on slow connections.
+ */
+const SYNC_CHUNK_SIZE = 80;
+/**
+ * Per-skill local-write concurrency. Disk-only, no network — but
+ * spawning 200 concurrent fs.writeFile calls makes the OS unhappy on
+ * older Macs. Eight is a sweet spot that's basically instant for any
+ * library size we've seen.
+ */
+const WRITE_CONCURRENCY = 8;
+/**
+ * Empirical sync time per skill is now ~0.02s (single bulk fetch
+ * amortized + parallel local writes). Multiplied by skill count and
+ * rounded to nearest 5s with a 2s floor.
  */
-const SECONDS_PER_SKILL = 0.15;
-const SYNC_CONCURRENCY = 4;
 function estimateSeconds(count) {
-    const raw = count * SECONDS_PER_SKILL;
+    const raw = count * 0.02;
     const rounded = Math.round(raw / 5) * 5;
-    return Math.max(5, rounded);
+    return Math.max(2, rounded);
 }
 /**
- * Inline concurrency limiter — runs `fn(item)` for each item, never letting
- * more than `limit` promises be in-flight at once. Returns when all settle.
- *
- * We deliberately avoid `Promise.all` over the full list to keep the agent
- * gentle on the API and on the user's disk; ~3-4x throughput vs sequential
- * is the goal, not "fire 200 requests at once".
+ * Inline concurrency limiter for the local disk writes. Avoids the
+ * `Promise.all` pattern over hundreds of file writes.
  */
 async function runWithConcurrency(items, limit, fn) {
-    const results = new Array(items.length);
     let cursor = 0;
     const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
         while (true) {
             const i = cursor++;
             if (i >= items.length)
                 return;
-            results[i] = await fn(items[i], i);
+            await fn(items[i]);
         }
     });
     await Promise.all(workers);
-    return results;
 }
 /**
  * `prave sync` — re-pulls every locally installed Skill from the
- * registry. Picks up SKILL.md edits without the user having to remember
- * each slug.
+ * registry.
+ *
+ * v2 implementation (Jun 2026) — earlier per-skill loop ran 3 separate
+ * authenticated requests per Skill (GET content, POST install, POST
+ * analyze), which for an 85-Skill library produced ~255 requests and
+ * burned through the 240/min/user default rate limit mid-way. The
+ * rewrite below makes ONE bulk request per chunk of up to 80 Skills.
+ * For a typical library that's 1 chunk = 1 request, and even the
+ * largest power-user library we've seen (200 Skills) needs only 3.
  *
- * Behaviours layered on top of the basic loop:
- *   • Last-sync timestamp persisted to ~/.prave/state.json — used to nudge
- *     against accidental rapid re-syncs (<30 min) and to skip the prompt
- *     entirely on the first ever run.
- *   • Concurrency-limited parallel pulls (4 in flight) — ~3-4x faster than
- *     the previous sequential loop.
- *   • Per-skill progress: spinner text ticks "Installed N / M — slug" so
- *     the user can see actual liveness on slow connections.
- *   • The deploy-to-all-agents question is asked ONCE up-front for the
- *     entire queue and threaded into every `installCommand` invocation
- *     via `skipDeployPrompt: true`. A single batched deploy runs at the
- *     end.
+ * The per-skill `intelligence/analyze` POST is intentionally dropped
+ * from sync — the dashboard surfaces a "re-index your library" action
+ * the user can hit once, in bulk, when they want fresh intelligence.
+ * Running an LLM per Skill on every sync was wasteful regardless of
+ * the rate limit.
  */
 export async function syncCommand() {
     track('cli_sync');
-    // Auth gate — sync mutates the install ledger and intelligence cache.
     const session = await requireAuth('prave sync');
     if (!session)
         return;
@@ -88,8 +90,6 @@ export async function syncCommand() {
         const rl = createInterface({ input: process.stdin, output: process.stdout });
         let proceed = true;
         try {
-            // Stronger nudge when the user just synced (<30 min). Default flips
-            // to "no" — they almost certainly hit the wrong command.
             if (since !== null && since < 30 * 60 * 1000) {
                 const ans = (await rl.question(`Last sync: ${pretty}. Sync again? [y/N] `))
                     .trim()
@@ -111,64 +111,147 @@ export async function syncCommand() {
             return;
         }
     }
+    // Resolve every on-disk target the user has enabled in web settings.
+    // Pre-2026-06-05 sync was hard-pinned to ~/.claude/skills/ — users
+    // with Codex / Cline / Amp enabled saw nothing land in those dirs.
+    // Now we read the server-side agent settings and write to every
+    // enabled (non-conversion) path. Cursor is excluded for now because
+    // it needs format conversion.
+    const targets = await resolveAgentTargets();
+    const targetSummary = targets.map((t) => t.agent).join(', ');
     const spinner = ora('Scanning local Skills…').start();
-    let entries = [];
-    try {
-        entries = await readdir(CONFIG.skillsDir);
+    // Union of slugs across all enabled targets — a skill that only
+    // exists in ~/.claude/skills is still "installed", and one we
+    // pulled into ~/.codex/skills the last sync should re-sync too.
+    const slugSet = new Set();
+    let scannedAny = false;
+    for (const target of targets) {
+        let entries = [];
+        try {
+            entries = await readdir(target.dir);
+            scannedAny = true;
+        }
+        catch {
+            // Missing dir → user enabled the agent in settings but never
+            // installed a skill there. Sync will create it on first write.
+            continue;
+        }
+        for (const name of entries) {
+            const dir = join(target.dir, name);
+            if ((await stat(dir).catch(() => null))?.isDirectory())
+                slugSet.add(name);
+        }
     }
-    catch {
-        spinner.warn(`No Skills directory at ${CONFIG.skillsDir}`);
+    if (!scannedAny && slugSet.size === 0) {
+        spinner.warn(`No Skills directory found across ${targetSummary || 'claude'}.`);
         return;
     }
-    const slugs = [];
-    for (const name of entries) {
-        const dir = join(CONFIG.skillsDir, name);
-        if ((await stat(dir).catch(() => null))?.isDirectory())
-            slugs.push(name);
-    }
+    const slugs = Array.from(slugSet);
     if (!slugs.length) {
         spinner.warn('No installed Skills to sync.');
         return;
     }
-    spinner.succeed(`Found ${slugs.length} installed Skill${slugs.length === 1 ? '' : 's'}.`);
-    // Pre-flight time estimate — sets expectations before the user hits Y.
+    spinner.succeed(`Found ${slugs.length} installed Skill${slugs.length === 1 ? '' : 's'} across ${targetSummary || 'claude'}.`);
     const estSeconds = estimateSeconds(slugs.length);
-    console.log(chalk.dim(`Syncing ${slugs.length} Skill${slugs.length === 1 ? '' : 's'} — this takes about ${estSeconds} seconds.`));
-    // Parallel install with live progress counter. The legacy post-sync
-    // "deploy to all agents?" prompt is gone — `prave deploy` has been
-    // retired and `installCommand` already fans out to the user's
-    // configured agent targets directly.
-    const progress = ora(`Installed 0 / ${slugs.length}`).start();
-    let done = 0;
+    console.log(chalk.dim(`Syncing ${slugs.length} Skill${slugs.length === 1 ? '' : 's'} → ${targets.length} agent dir${targets.length === 1 ? '' : 's'} — this takes about ${estSeconds} seconds.`));
+    const progress = ora(`Synced 0 / ${slugs.length}`).start();
     let updated = 0;
-    let failed = 0;
-    await runWithConcurrency(slugs, SYNC_CONCURRENCY, async (slug) => {
+    let paywalled = 0;
+    let noContent = 0;
+    let missing = 0;
+    const missingSlugs = [];
+    const paywalledSlugs = [];
+    // Chunk + sequential bulk-fetch. Sequential between chunks is fine —
+    // one chunk covers ~80 skills in one round-trip, the wall-clock saving
+    // vs the old N-roundtrip loop is already 10–30x even without
+    // chunk-level parallelism. Going parallel adds complexity (and a
+    // bigger burst against the API) for negligible gain.
+    for (let i = 0; i < slugs.length; i += SYNC_CHUNK_SIZE) {
+        const chunk = slugs.slice(i, i + SYNC_CHUNK_SIZE);
+        let response;
         try {
-            await installCommand(slug, { noDeps: true, skipDeployPrompt: true });
-            updated++;
-        }
-        catch {
-            failed++;
+            const { data } = await api.post('/api/v1/skills/bulk/sync', { slugs: chunk }, true);
+            response = data;
         }
-        finally {
-            done++;
-            progress.text = `Installed ${done} / ${slugs.length} — ${slug}`;
+        catch (err) {
+            // Fatal-ish: if a whole chunk request fails, we still tried — log
+            // and skip the chunk so the user gets a partial sync rather than
+            // a 100% failure.
+            if (err instanceof ApiError) {
+                log.warn(`Chunk failed (${err.message}) — skipping ${chunk.length} Skill${chunk.length === 1 ? '' : 's'}.`);
+            }
+            else {
+                log.warn(`Chunk failed — skipping ${chunk.length} Skill${chunk.length === 1 ? '' : 's'}.`);
+            }
+            missing += chunk.length;
+            missingSlugs.push(...chunk);
+            progress.text = `Synced ${updated} / ${slugs.length}`;
+            continue;
         }
-    });
-    if (failed === 0) {
-        progress.succeed(`Synced ${updated} / ${slugs.length}`);
+        // Track per-slug verdicts for the final summary line.
+        missing += response.missing.length;
+        missingSlugs.push(...response.missing);
+        // Write files in parallel, bounded. Each successful item gets
+        // written to EVERY target dir (claude + codex + …) — failures on
+        // a single target don't abort the others; we just count a skill
+        // as updated when at least one write succeeded.
+        await runWithConcurrency(response.items, WRITE_CONCURRENCY, async (item) => {
+            if (item.error === 'paid_unpurchased') {
+                paywalled += 1;
+                paywalledSlugs.push(item.slug);
+                return;
+            }
+            if (item.error === 'no_content' || item.content === null) {
+                noContent += 1;
+                return;
+            }
+            let anyWritten = false;
+            for (const target of targets) {
+                const dir = join(target.dir, item.slug);
+                try {
+                    await mkdir(dir, { recursive: true });
+                    await writeFile(join(dir, 'SKILL.md'), item.content, 'utf8');
+                    anyWritten = true;
+                }
+                catch {
+                    /* per-target write failure — continue with other targets */
+                }
+            }
+            if (anyWritten) {
+                updated += 1;
+                progress.text = `Synced ${updated} / ${slugs.length} — ${item.slug}`;
+            }
+            else {
+                noContent += 1;
+            }
+        });
+    }
+    // Final status line. Distinguishes the four outcomes so the user can
+    // act on each (re-buy paywalled, re-import missing, file an issue on
+    // no-content).
+    const total = slugs.length;
+    if (updated === total) {
+        progress.succeed(`Synced ${updated} / ${total}`);
     }
     else {
-        progress.warn(`Synced ${updated} · failed ${failed}`);
+        progress.warn(`Synced ${updated} / ${total}` +
+            (paywalled ? ` · paywalled ${paywalled}` : '') +
+            (noContent ? ` · no content ${noContent}` : '') +
+            (missing ? ` · missing ${missing}` : ''));
+    }
+    if (paywalledSlugs.length) {
+        log.dim(`   paywalled: ${paywalledSlugs.slice(0, 5).join(', ')}${paywalledSlugs.length > 5 ? `, +${paywalledSlugs.length - 5} more` : ''} — buy on prave.app to sync.`);
+    }
+    if (missingSlugs.length) {
+        log.dim(`   not found: ${missingSlugs.slice(0, 5).join(', ')}${missingSlugs.length > 5 ? `, +${missingSlugs.length - 5} more` : ''}`);
     }
     // Persist last-sync timestamp regardless of partial failures — the user
     // *did* attempt a sync, and we want the cooldown to apply to retries
     // just as much as to the happy path.
     await writeState({ last_sync_at: new Date().toISOString() }).catch(() => { });
     // Tail end of sync: fire a quiet usage scan so the optimiser stays warm
-    // without the user having to remember an extra command. Quiet mode means
-    // we only log a one-liner ("Usage: 12 new, 88 known.") instead of taking
-    // over the spinner. Failures are non-fatal — sync's primary job is done.
+    // without the user having to remember an extra command. Failures are
+    // non-fatal — sync's primary job is done.
     try {
         const { usageScanCommand } = await import('./usage.js');
         await usageScanCommand({ quiet: true });

package/dist/lib/agent-paths.js

@@ -0,0 +1,56 @@
+import { homedir } from 'node:os';
+import { AGENT_REGISTRY } from '@prave/shared';
+import { api, ApiError } from './api.js';
+import { CONFIG } from './config.js';
+const isWindows = process.platform === 'win32';
+function expandTilde(p) {
+    if (!p)
+        return p;
+    if (p === '~')
+        return homedir();
+    if (p.startsWith('~/') || p.startsWith('~\\')) {
+        return homedir() + p.slice(1);
+    }
+    return p;
+}
+function pickOsPath(paths) {
+    return isWindows ? paths.windows : paths.mac;
+}
+export async function resolveAgentTargets() {
+    try {
+        const { data: settings } = await api.get('/api/v1/settings/agents', true);
+        const enabled = settings.enabled_agents ?? [];
+        if (enabled.length === 0) {
+            return [{ agent: 'claude', dir: CONFIG.skillsDir }];
+        }
+        const seen = new Set();
+        const targets = [];
+        for (const agent of enabled) {
+            const meta = AGENT_REGISTRY[agent];
+            if (!meta)
+                continue;
+            if (meta.conversionRequired)
+                continue;
+            const stored = settings.skill_paths?.[agent];
+            const raw = stored
+                ? pickOsPath(stored)
+                : pickOsPath(meta.defaultPath);
+            const dir = expandTilde(raw).replace(/[\\/]+$/, '');
+            if (!dir || seen.has(dir))
+                continue;
+            seen.add(dir);
+            targets.push({ agent, dir });
+        }
+        if (targets.length === 0) {
+            return [{ agent: 'claude', dir: CONFIG.skillsDir }];
+        }
+        return targets;
+    }
+    catch (err) {
+        // Fail-safe path: legacy single-claude behaviour. A 401 here just
+        // means the user isn't authed and the caller will surface that
+        // through requireAuth() anyway.
+        void (err instanceof ApiError);
+        return [{ agent: 'claude', dir: CONFIG.skillsDir }];
+    }
+}

package/dist/lib/flush-telemetry.js

@@ -26,8 +26,15 @@ export async function flushBufferedTelemetry(opts = {}) {
         if (pending === 0)
             return; // even with force, no spinner for 0
         log.info(`${chalk.cyan('●')} You have telemetry updates from offline sessions. Syncing ${chalk.bold(pending)} event${pending === 1 ? '' : 's'} to your dashboard…`);
-        const result = await flushBuffered(async (body) => {
-            await api.post('/api/v1/intelligence/usage/by-slug', body, true);
+        const result = await flushBuffered(async (chunk) => {
+            // Map to the API shape — server tolerates a missing source.
+            const events = chunk.map((e) => ({
+                slug: e.slug,
+                agent_type: e.agent_type,
+                triggered_at: e.triggered_at,
+                meta: e.meta,
+            }));
+            await api.post('/api/v1/intelligence/usage/by-slug/batch', { events }, true);
         });
         if (result.failed === 0) {
             log.success(`Synced ${chalk.bold(result.sent)} telemetry event${result.sent === 1 ? '' : 's'}. Dashboard is up to date.`);

package/dist/lib/telemetry-buffer.js

@@ -76,33 +76,37 @@ async function readQueue() {
     return out;
 }
 /**
- * Replay the queue against the by-slug endpoint and delete the file on
- * full success. Caller passes the already-authenticated POST helper so
- * we don't introduce a circular dep on api.ts.
+ * Replay the queue in chunked batch calls and delete the file on full
+ * success. Caller passes the already-authenticated batch POST helper
+ * so we don't introduce a circular dep on api.ts.
+ *
+ * Pre-2026-06-05 this loop fired ONE POST per event. With ~300 events
+ * buffered after a week offline that meant 300 sequential calls that
+ * blew through the per-user 240/min limit mid-replay. The chunked
+ * batch path collapses N events into Math.ceil(N / 250) requests.
  *
  * On partial failure (network blip mid-flush), the remaining events
  * are rewritten so a later attempt picks up where we left off. Order
  * is preserved across rewrites.
  */
-export async function flushBuffered(postBySlug) {
+const FLUSH_CHUNK_SIZE = 250; // matches the server's recordSkillUsageBySlugBatchSchema cap (500), with headroom
+export async function flushBuffered(postBatch) {
     const events = await readQueue();
     if (!events.length)
         return { sent: 0, failed: 0, total: 0 };
     let sent = 0;
-    const remaining = [];
-    for (let i = 0; i < events.length; i++) {
-        const ev = events[i];
-        if (!ev)
-            continue;
+    let remaining = events.slice();
+    for (let i = 0; i < events.length; i += FLUSH_CHUNK_SIZE) {
+        const chunk = events.slice(i, i + FLUSH_CHUNK_SIZE);
         try {
-            await postBySlug({ ...ev, source: 'buffered' });
-            sent += 1;
+            await postBatch(chunk);
+            sent += chunk.length;
+            remaining = events.slice(i + chunk.length);
         }
         catch {
-            // Keep this one and every event after it for the next attempt.
-            // We don't push-and-continue because a network blip likely means
-            // every subsequent POST will fail too — better to stop fast.
-            remaining.push(...events.slice(i));
+            // Stop on first failed chunk — keep the failed chunk and
+            // everything after it for the next attempt.
+            remaining = events.slice(i);
             break;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prave/cli",
-  "version": "1.4.14",
+  "version": "1.5.1",
   "description": "Prave CLI — discover, install, version, test, and ship Claude Skills. The developer platform for the complete Skill lifecycle.",
   "type": "module",
   "keywords": [
@@ -54,7 +54,7 @@
     "ora": "^8.0.1",
     "tar": "^7.4.3",
     "undici": "^6.18.0",
-    "@prave/shared": "1.4.14"
+    "@prave/shared": "1.4.16"
   },
   "devDependencies": {
     "@types/node": "^20.12.7",