@se-studio/skills 1.7.15 → 1.7.16

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @se-studio/skills
 
+## 1.7.16
+
+### Patch Changes
+
+- Hosted cms-edit can stage HTML/CSS/JS and from-json payloads via curl (kind=text|json), summarize long Text in diff, and reject inline MCP args over 8k.
+
 ## 1.7.15
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/skills",
-  "version": "1.7.15",
+  "version": "1.7.16",
   "description": "SE Studio agent skills for marketing site development with Contentful CMS",
   "repository": {
     "type": "git",

package/references/agent-session/local-env.md

@@ -15,6 +15,8 @@ Gitignored `.env.local` files do **not** copy into a new worktree. Agents then i
 
 `localEnvRoot` is set on `projects.registry.json` (`~/source/local-env`).
 
+**Cloud agents** do not use this store. They pull Vercel **Development** (`docs/CLOUD_AGENTS.md`). Dedicated cloud CDA/CPA copies may exist under `~/source/local-env/cloud-agents/` for humans (Cursor secrets for example-empty); they are not git and must not be committed.
+
 Tracked files are whatever `.env.local` / `.env.*.local` exist on the **develop** checkout (`apps/*/.env.local` and `cms-edit/host/.env.local` included). Nested `experiments/` trees are ignored.
 
 The live Highlander repo (`highlander-health-website`, not the 2026 port) is `localEnvExtras` key `highlander-live` in the registry (not the `highlander` 2026 project). `pnpm local-env` catalogs it with the other sites.

package/skills/contentful-cms-core/SKILL.md

@@ -15,11 +15,11 @@ Use this skill when you need to read or edit content in Contentful using **hoste
 
 `cms-edit` lets you read and edit Contentful draft content without publishing.
 
-**New page/article:** `schema` for this space → `create from-json --dry-run --strict` → `create from-json` (`--json` or `--json-base64`). Nested tree key is `components`; discriminator is `type`.
+**New page/article:** `schema` for this space → if the payload is over 8k, staged `kind=json` then `create from-json --staged --dry-run --strict` → create. Tiny JSON may use `--json`. Nested tree key is `components`; discriminator is `type`.
 
-**Edit a tree:** `open` → `export from-json` → edit JSON → `apply from-json`. Tiny patches: `set` / `rtf` / `add` then `diff` → `save`.
+**Edit a tree:** `open` → `export from-json` → edit JSON → `apply from-json` (`--staged` when over 8k). Tiny patches: `set` / `rtf` / `add` then `diff` → `save`. Long HtmlComponent fields: `kind=text` then `set --staged`.
 
-**Never publish.** Hosted MCP cannot see your disk — send JSON in the tool call.
+**Never publish.** Hosted MCP cannot see your disk — send JSON in the tool call **only if under 8192 bytes**.
 
 ## Safety Rules
 
@@ -33,6 +33,7 @@ All `save` operations create **draft** versions. A human must review and publish
 **Assets:** Upload **is** supported (`asset upload`). Default workflow: **search and reuse** existing assets first (`index sync` → `asset search`). When uploading:
 - **Raster/video:** `cms_edit_request_staged_upload` → curl → `cms_edit_media` prepare (`stagedUploadIds`) → wait → catalog → import with real alt. Never `asset upload --staged/--url/--base64` for jpeg/png/webp/gif/mp4.
 - **SVG/PDF/Lottie:** `cms_edit_request_staged_upload` → curl → `asset upload --staged` (never `--base64`)
+- **HtmlComponent / large JSON:** `cms_edit_request_staged_upload` with `kind=text` or `kind=json` → curl → `set --staged`, `rtf --staged`, `create from-json --staged`, or `apply from-json --staged`. Hosted MCP rejects inline `--json`/`--content` over 8192 bytes.
 - Use a **sensible fileName** and **descriptive title** (and alt text where the site uses it)
 - Avoid oversized images — width over **2000px** is usually wasteful for web (exact limits vary by project; check `asset audit` / media review guidance)
 - Prefer `--if-exists-by-filename` to avoid duplicates

package/skills/site-workflows-agent-session/SKILL.md

@@ -142,6 +142,8 @@ After the placement checklist, run the **refusal table** when the task involves
 
 **Cloud / remote agents:** they already have an isolated checkout. Open a **draft PR** to the integration branch so other machines can see the work. Do not require a yaml file in se-core-product. Do not implement on a registry `productionPath`.
 
+**Cloud env:** do not seed from `~/source/local-env`. Run the repo `scripts/cloud-env-pull.sh` (Vercel **Development**, Runtime Secret `VERCEL_TOKEN`). Do not invent a stub `.env.local`. Do not `vercel env pull` on a laptop develop checkout. Canonical: `docs/CLOUD_AGENTS.md` in se-core-product. CMS writes stay on hosted mcp. Grok Build should use the same pull later.
+
 Primary checkouts (`path` / develop / dev) stay on the integration branch for fetch, deps, and short integration-only maintenance.
 
 ### Create worktree (mandatory for local feature/*)