@se-studio/skills 1.7.14 → 1.7.16

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @se-studio/skills
 
+## 1.7.16
+
+### Patch Changes
+
+- Hosted cms-edit can stage HTML/CSS/JS and from-json payloads via curl (kind=text|json), summarize long Text in diff, and reject inline MCP args over 8k.
+
+## 1.7.15
+
+### Patch Changes
+
+- Document HtmlComponent externalScripts in cms-edit playbooks and reject non-array JSON on Array-of-Symbol set.
+
 ## 1.7.14
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.7.14",
+  "version": "1.7.16",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/local-env.md

@@ -15,6 +15,8 @@ Gitignored `.env.local` files do **not** copy into a new worktree. Agents then i
 
 `localEnvRoot` is set on `projects.registry.json` (`~/source/local-env`).
 
+**Cloud agents** do not use this store. They pull Vercel **Development** (`docs/CLOUD_AGENTS.md`). Dedicated cloud CDA/CPA copies may exist under `~/source/local-env/cloud-agents/` for humans (Cursor secrets for example-empty); they are not git and must not be committed.
+
 Tracked files are whatever `.env.local` / `.env.*.local` exist on the **develop** checkout (`apps/*/.env.local` and `cms-edit/host/.env.local` included). Nested `experiments/` trees are ignored.
 
 The live Highlander repo (`highlander-health-website`, not the 2026 port) is `localEnvExtras` key `highlander-live` in the registry (not the `highlander` 2026 project). `pnpm local-env` catalogs it with the other sites.

package/references/contentful-cms-cms-guidelines/html-component-authoring.md

@@ -4,7 +4,7 @@ description: Guidelines for authoring HTML content in HtmlComponent CMS entries.
 license: Private
 metadata:
   author: se-core-product
-  version: "1.1.0"
+  version: "1.2.0"
 ---
 
 # HtmlComponent Authoring Guide
@@ -258,6 +258,12 @@ Put third-party libraries in **`externalScripts`**, not `createElement('script')
 
 The renderer waits until those scripts have loaded (`next/script` `onReady`) before running `customJs`. The same URL on two HtmlComponents shares one `next/script` id (`hc-ext-<hash>`). If the site has a Content-Security-Policy, allowlisted hosts must match `script-src`.
 
+In cms-edit, `externalScripts` is an Array of Symbol — set it with `--json`, never a scalar string:
+
+```
+cms_edit ["set", "@cN", "externalScripts", "--json", "[\"/html-components/feature/lib.js\"]"]
+```
+
 ---
 
 ## Common Patterns

package/skills/contentful-cms-core/SKILL.md

@@ -15,11 +15,11 @@ Use this skill when you need to read or edit content in Contentful using **hoste
 
 `cms-edit` lets you read and edit Contentful draft content without publishing.
 
-**New page/article:** `schema` for this space → `create from-json --dry-run --strict` → `create from-json` (`--json` or `--json-base64`). Nested tree key is `components`; discriminator is `type`.
+**New page/article:** `schema` for this space → if the payload is over 8k, staged `kind=json` then `create from-json --staged --dry-run --strict` → create. Tiny JSON may use `--json`. Nested tree key is `components`; discriminator is `type`.
 
-**Edit a tree:** `open` → `export from-json` → edit JSON → `apply from-json`. Tiny patches: `set` / `rtf` / `add` then `diff` → `save`.
+**Edit a tree:** `open` → `export from-json` → edit JSON → `apply from-json` (`--staged` when over 8k). Tiny patches: `set` / `rtf` / `add` then `diff` → `save`. Long HtmlComponent fields: `kind=text` then `set --staged`.
 
-**Never publish.** Hosted MCP cannot see your disk — send JSON in the tool call.
+**Never publish.** Hosted MCP cannot see your disk — send JSON in the tool call **only if under 8192 bytes**.
 
 ## Safety Rules
 
@@ -33,6 +33,7 @@ All `save` operations create **draft** versions. A human must review and publish
 **Assets:** Upload **is** supported (`asset upload`). Default workflow: **search and reuse** existing assets first (`index sync` → `asset search`). When uploading:
 - **Raster/video:** `cms_edit_request_staged_upload` → curl → `cms_edit_media` prepare (`stagedUploadIds`) → wait → catalog → import with real alt. Never `asset upload --staged/--url/--base64` for jpeg/png/webp/gif/mp4.
 - **SVG/PDF/Lottie:** `cms_edit_request_staged_upload` → curl → `asset upload --staged` (never `--base64`)
+- **HtmlComponent / large JSON:** `cms_edit_request_staged_upload` with `kind=text` or `kind=json` → curl → `set --staged`, `rtf --staged`, `create from-json --staged`, or `apply from-json --staged`. Hosted MCP rejects inline `--json`/`--content` over 8192 bytes.
 - Use a **sensible fileName** and **descriptive title** (and alt text where the site uses it)
 - Avoid oversized images — width over **2000px** is usually wasteful for web (exact limits vary by project; check `asset audit` / media review guidance)
 - Prefer `--if-exists-by-filename` to avoid duplicates

package/skills/contentful-cms-sync-schema/SKILL.md

@@ -88,6 +88,7 @@ Standard order when diff shows these gaps:
 | 6 | `17-add-article-authors.js` | `article.authors` array + backfill from `author` |
 | 7 | `21-add-article-bottom-content.js` | `article.bottomContent` array (idempotent; clones `content` link types) |
 | 8 | `25-add-meta-field.js` | Optional Long text `meta` JSON bag on template/page/article/tag/person and related types. Idempotent. Unused until filled. |
+| 9 | `28-add-html-component-external-scripts.js` | Optional `externalScripts` (array of URL strings) on existing `htmlComponent`. Idempotent. Greenfield spaces that run migration 12 after this change already get the field. |
 
 Site-specific (run only when diff shows missing field **and** app uses it):
 

package/skills/site-workflows-agent-session/SKILL.md

@@ -142,6 +142,8 @@ After the placement checklist, run the **refusal table** when the task involves
 
 **Cloud / remote agents:** they already have an isolated checkout. Open a **draft PR** to the integration branch so other machines can see the work. Do not require a yaml file in se-core-product. Do not implement on a registry `productionPath`.
 
+**Cloud env:** do not seed from `~/source/local-env`. Run the repo `scripts/cloud-env-pull.sh` (Vercel **Development**, Runtime Secret `VERCEL_TOKEN`). Do not invent a stub `.env.local`. Do not `vercel env pull` on a laptop develop checkout. Canonical: `docs/CLOUD_AGENTS.md` in se-core-product. CMS writes stay on hosted mcp. Grok Build should use the same pull later.
+
 Primary checkouts (`path` / develop / dev) stay on the integration branch for fetch, deps, and short integration-only maintenance.
 
 ### Create worktree (mandatory for local feature/*)