@standards/cli 1.0.0-alpha.408 → 1.0.0-alpha.410

package/README.md

@@ -3,35 +3,12 @@
 The Standards CLI connects a terminal to a Standards instance. See the public
 [CLI guide](../../content/docs/13-cli/index.mdx) for installation and the full command surface.
 
-## Run this computer as a paired device
+## Devices
 
-Remote device execution is an optional server capability. Once an operator has enabled it,
-create a named profile, pair the current computer, and keep the foreground worker running:
-
-```bash
-standards login --name production --url https://standards.example/v1 --key "$STANDARDS_API_KEY"
-standards device pair --name "Build Mac"
-standards device serve
-```
-
-The worker supports macOS and Linux and makes outbound HTTPS requests only. It executes each
-approved command in the foreground using the user's local account and permissions. There is no
-privilege escalation, background service installation, PTY, file transfer, or GUI control.
-
-Commands time out after 10 minutes by default and may not exceed 60 minutes. Standard output and
-standard error are each limited to 30,000 characters. Stop the worker with `Ctrl+C`; inspect it
-with `standards device status`; revoke its credential with `standards device revoke`.
-
-Interactive harnesses are outside the V0 contract. Invoke installed tools in their
-non-interactive mode, for example:
-
-```bash
-codex exec --json "Run the repository checks"
-claude -p "Summarize the failing tests"
-```
-
-Every agent command targeting a device requires explicit user approval. Calls to `exec_command`
-without a `deviceId` continue to use the agent sandbox.
+The CLI no longer runs a device worker. A machine your agents run commands on is enrolled with
+the `standards-device` worker and an enrollment token from Settings → Devices (**Enroll your
+computer** for your own machine, **Enroll machines** for a managed fleet): see the
+[device fleet guide](../../content/docs/10-agents/07-device-fleet.mdx).
 
 ## Move to the `@standards` scope
 

package/dist/bin.mjs

@@ -5,22 +5,20 @@ import { createRequire } from "node:module";
 import { styleText } from "node:util";
 import { BundleConflictError, StandardsRequestError, createTransport, syncBundle } from "@standards/client";
 import { Command } from "commander";
-import { BUNDLE_LOCALES, COUNT_MODES, DEVICE_CHANNEL_WORKER_CLOSE_PROTOCOL_VIOLATION, MEETING_RESPONSES, RECORDING_OVERRIDES, RECORD_ACCESS_ROLES, RESOURCE_VISIBILITIES, SchemaError, SchemaErrorCode, ValidationError, canonicalStringify, computeReconnectDelay, computeRetryDelay, deviceChannelUrl, diffSchemaState, formatByteSize, parseRecordAccessRole, parseSchemaState, parseServerFrame, schemaStateSourcePayload } from "@standards/schema";
+import { BUNDLE_LOCALES, COUNT_MODES, MEETING_RESPONSES, RECORDING_OVERRIDES, RECORD_ACCESS_ROLES, RESOURCE_VISIBILITIES, ValidationError, canonicalStringify, diffSchemaState, formatByteSize, parseRecordAccessRole, parseSchemaState, schemaStateSourcePayload } from "@standards/schema";
 import Table from "cli-table3";
 import { createAppClient } from "@standards/client/app";
-import { constants, createWriteStream } from "node:fs";
-import { access, chmod, mkdir, readFile, stat, unlink, writeFile } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join } from "node:path";
-import { homedir, hostname } from "node:os";
-import { createHash, randomUUID } from "node:crypto";
-import { WebSocket } from "ws";
-import { spawn } from "node:child_process";
-import { StringDecoder } from "node:string_decoder";
+import { createWriteStream } from "node:fs";
+import { chmod, mkdir, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { buildOperationPath, recordsOperations } from "@standards/schema/api";
 import { stdin, stdout } from "node:process";
 import { createInterface } from "node:readline/promises";
+import { homedir } from "node:os";
+import { isSafeSkillFilePath, skillFileText } from "@standards/constants";
 //#region src/output.ts
 const MAX_CELL_WIDTH = 50;
 function truncate(value, maxLength) {
@@ -366,968 +364,6 @@ function registerConnectorsCommand(program) {
 	});
 }
 //#endregion
-//#region src/config.ts
-const DEFAULT_API_URL = "http://localhost:4100/v1";
-const ENV_PROFILE_NAME = "sandbox";
-function getDefaultApiUrl() {
-	return DEFAULT_API_URL;
-}
-function getConfigPath() {
-	const configDir = process.env.STANDARDS_CONFIG_DIR ?? join(homedir(), ".standards");
-	return join(configDir, "config.json");
-}
-async function readConfig() {
-	try {
-		const raw = await readFile(getConfigPath(), "utf8");
-		const parsed = JSON.parse(raw);
-		return {
-			...parsed.installationId ? { installationId: parsed.installationId } : {},
-			currentProfile: parsed.currentProfile,
-			profiles: parsed.profiles ?? {}
-		};
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return { profiles: {} };
-		throw error;
-	}
-}
-async function writeConfig(config) {
-	const path = getConfigPath();
-	const directory = dirname(path);
-	await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	});
-	await chmod(directory, 448);
-	await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
-	await chmod(path, 384);
-}
-function normalizeApiOrigin(apiUrl) {
-	try {
-		return new URL(apiUrl).origin;
-	} catch {
-		return apiUrl.replace(/\/+$/, "");
-	}
-}
-async function upsertProfile(input) {
-	const config = await readConfig();
-	const existingProfile = config.profiles[input.name];
-	const device = existingProfile?.device && normalizeApiOrigin(existingProfile.apiUrl) === normalizeApiOrigin(input.apiUrl) ? existingProfile.device : void 0;
-	config.profiles[input.name] = {
-		apiUrl: input.apiUrl,
-		apiKey: input.apiKey,
-		...device ? { device } : {}
-	};
-	config.currentProfile = input.name;
-	await writeConfig(config);
-}
-async function getOrCreateInstallationId() {
-	const config = await readConfig();
-	if (config.installationId) return config.installationId;
-	const installationId = randomUUID();
-	config.installationId = installationId;
-	await writeConfig(config);
-	return installationId;
-}
-async function getStoredDeviceCredential(profileName) {
-	return (await readConfig()).profiles[profileName]?.device ?? null;
-}
-async function storeDeviceCredential(profileName, credential) {
-	const config = await readConfig();
-	const profile = config.profiles[profileName];
-	if (!profile) return false;
-	profile.device = credential;
-	await writeConfig(config);
-	return true;
-}
-async function removeDeviceCredential(profileName) {
-	const config = await readConfig();
-	const profile = config.profiles[profileName];
-	if (!profile?.device) return false;
-	profile.device = void 0;
-	await writeConfig(config);
-	return true;
-}
-async function setCurrentProfile(name) {
-	const config = await readConfig();
-	if (!config.profiles[name]) throw new Error(`Unknown Standards instance "${name}"`);
-	config.currentProfile = name;
-	await writeConfig(config);
-}
-async function removeProfile(name) {
-	const config = await readConfig();
-	const profileName = name ?? config.currentProfile;
-	if (!profileName) return;
-	delete config.profiles[profileName];
-	if (config.currentProfile === profileName) config.currentProfile = void 0;
-	await writeConfig(config);
-}
-async function listProfiles() {
-	const config = await readConfig();
-	const profiles = Object.entries(config.profiles).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({
-		name,
-		apiUrl: profile.apiUrl,
-		current: config.currentProfile === name
-	}));
-	const envProfile = getEnvProfile();
-	if (envProfile) profiles.push({
-		name: ENV_PROFILE_NAME,
-		apiUrl: envProfile.apiUrl,
-		current: !config.currentProfile,
-		source: "env"
-	});
-	return profiles;
-}
-async function getActiveProfile() {
-	const config = await readConfig();
-	if (!config.currentProfile) {
-		const envProfile = getEnvProfile();
-		return envProfile ? {
-			name: ENV_PROFILE_NAME,
-			...envProfile
-		} : null;
-	}
-	const profile = config.profiles[config.currentProfile];
-	if (!profile) return null;
-	return {
-		name: config.currentProfile,
-		...profile
-	};
-}
-function getEnvProfile() {
-	if (!process.env.STANDARDS_API_KEY) return null;
-	return {
-		apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
-		apiKey: process.env.STANDARDS_API_KEY
-	};
-}
-async function resolveCliConfig(options) {
-	if (options.apiUrl || options.apiKey) return {
-		apiUrl: options.apiUrl ?? process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
-		apiKey: options.apiKey ?? process.env.STANDARDS_API_KEY
-	};
-	const config = await readConfig();
-	const profileName = options.instance ?? config.currentProfile;
-	if (profileName) {
-		const profile = config.profiles[profileName];
-		if (!profile) throw new Error(`Unknown Standards instance "${profileName}"`);
-		return {
-			apiUrl: profile.apiUrl,
-			apiKey: profile.apiKey,
-			profileName
-		};
-	}
-	return {
-		apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
-		apiKey: process.env.STANDARDS_API_KEY
-	};
-}
-//#endregion
-//#region src/device/worker-client.ts
-/** How long a connection may wait for `ready` after sending `authenticate`. */
-const REQUEST_TIMEOUT_MS = 3e4;
-/** The code the SERVER closes an authenticated-but-not-ready socket with. */
-const SERVER_POLICY_VIOLATION_CLOSE_CODE = 1008;
-const NORMAL_CLOSE_CODE = 1e3;
-const EMPTY_SHELL_COMMAND_REFUSED = "Shell command frame carries no command";
-var DeviceWorkerRequestError = class extends SchemaError {
-	constructor(statusCode, message, code = SchemaErrorCode.REPOSITORY_QUERY_FAILED) {
-		super(message, code, { statusCode });
-		this.statusCode = statusCode;
-		this.name = "DeviceWorkerRequestError";
-	}
-};
-var DeviceCredentialRejectedError = class extends DeviceWorkerRequestError {
-	constructor() {
-		super(401, "Device credential rejected; run standards device pair again", SchemaErrorCode.ACCESS_DENIED);
-		this.name = "DeviceCredentialRejectedError";
-	}
-};
-/** The lease poll's own curve: 250 ms doubling up to 10 s, well under the channel's. */
-const LEASE_RETRY = {
-	initialMs: 250,
-	maxMs: 1e4
-};
-function computeRetryDelay$1(attempt, random = Math.random) {
-	return computeRetryDelay(attempt, random, LEASE_RETRY);
-}
-function abortError() {
-	return new DOMException("Aborted", "AbortError");
-}
-function isAbortError$1(error) {
-	return error instanceof DOMException && error.name === "AbortError";
-}
-function sleepWithAbort(milliseconds, signal) {
-	if (signal?.aborted) return Promise.reject(abortError());
-	return new Promise((resolve, reject) => {
-		function abort() {
-			clearTimeout(timer);
-			reject(abortError());
-		}
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", abort);
-			resolve();
-		}, milliseconds);
-		signal?.addEventListener("abort", abort, { once: true });
-	});
-}
-function withAbort(promise, signal) {
-	if (!signal) return promise;
-	if (signal.aborted) return Promise.reject(abortError());
-	return new Promise((resolve, reject) => {
-		const abort = () => reject(abortError());
-		signal.addEventListener("abort", abort, { once: true });
-		promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
-	});
-}
-function transmit(socket, frame) {
-	return new Promise((resolve, reject) => {
-		socket.send(JSON.stringify(frame), (error) => {
-			if (error) reject(new DeviceWorkerRequestError(0, "Device channel send failed"));
-			else resolve();
-		});
-	});
-}
-function leasedCommand(frame, command) {
-	return {
-		id: frame.id,
-		leaseToken: frame.leaseToken,
-		intent: frame.intent,
-		command,
-		timeoutMs: frame.timeoutMs,
-		...typeof frame.cwd === "string" ? { cwd: frame.cwd } : {}
-	};
-}
-/**
-* One WebSocket to the device channel. The first frame authenticates the
-* device; commands are queued as they arrive and handed to `lease()`.
-* A dropped connection reconnects with backoff; a credential rejection
-* (`revoked`, or close 1008 before `ready`) is terminal.
-*/
-var DeviceWorkerClient = class {
-	constructor(options) {
-		this.lifecycle = new AbortController();
-		this.queue = [];
-		this.waiters = /* @__PURE__ */ new Set();
-		this.cancellations = /* @__PURE__ */ new Map();
-		this.socket = null;
-		this.ready = false;
-		this.connection = null;
-		this.rejection = null;
-		this.closed = false;
-		this.url = deviceChannelUrl(options.apiUrl);
-		this.credential = `Device ${options.token}`;
-		this.sleep = options.sleep ?? sleepWithAbort;
-		this.random = options.random ?? Math.random;
-		this.now = options.now ?? Date.now;
-	}
-	/** Stops reconnecting and closes the socket; pending and later leases reject with an AbortError. */
-	close() {
-		this.closed = true;
-		this.lifecycle.abort();
-		this.socket?.close(NORMAL_CLOSE_CODE);
-		this.failWaiters(abortError());
-	}
-	lease(signal) {
-		if (this.rejection) return Promise.reject(this.rejection);
-		if (this.closed || signal?.aborted) return Promise.reject(abortError());
-		this.connection ??= this.maintainConnection().catch((error) => this.failWaiters(error));
-		const queued = this.queue.shift();
-		if (queued) return Promise.resolve(queued);
-		return new Promise((resolve, reject) => {
-			const settle = () => {
-				this.waiters.delete(waiter);
-				signal?.removeEventListener("abort", abort);
-			};
-			const waiter = {
-				resolve: (command) => {
-					settle();
-					resolve(command);
-				},
-				reject: (error) => {
-					settle();
-					reject(error);
-				}
-			};
-			const abort = () => waiter.reject(abortError());
-			signal?.addEventListener("abort", abort, { once: true });
-			this.waiters.add(waiter);
-		});
-	}
-	async markRunning(commandId, leaseToken) {
-		await this.send({
-			type: "running",
-			id: commandId,
-			leaseToken
-		});
-	}
-	async heartbeat(commandId, leaseToken, signal) {
-		const cancelled = this.cancellations.get(commandId);
-		if (cancelled) return {
-			cancel: true,
-			reason: cancelled
-		};
-		await withAbort(this.send({
-			type: "heartbeat",
-			id: commandId,
-			leaseToken
-		}), signal);
-		const reason = this.cancellations.get(commandId);
-		return reason ? {
-			cancel: true,
-			reason
-		} : { cancel: false };
-	}
-	async output(commandId, leaseToken, stdout, stderr) {
-		if (!(stdout || stderr)) return;
-		await this.send({
-			type: "output",
-			id: commandId,
-			leaseToken,
-			...stdout ? { stdout } : {},
-			...stderr ? { stderr } : {}
-		});
-	}
-	async complete(commandId, leaseToken, result) {
-		await this.send({
-			type: "complete",
-			id: commandId,
-			leaseToken,
-			result: {
-				stdout: result.stdout,
-				stderr: result.stderr,
-				exitCode: result.exitCode,
-				success: result.success,
-				...result.errorCode ? { errorCode: result.errorCode } : {}
-			}
-		});
-		this.cancellations.delete(commandId);
-	}
-	send(frame) {
-		const socket = this.socket;
-		if (!(socket && this.ready && socket.readyState === WebSocket.OPEN)) return Promise.reject(new DeviceWorkerRequestError(0, "Device channel is not connected"));
-		return transmit(socket, frame);
-	}
-	reject(error) {
-		this.rejection = error;
-		this.failWaiters(error);
-	}
-	failWaiters(error) {
-		for (const waiter of [...this.waiters]) waiter.reject(error);
-	}
-	deliver(command) {
-		const [waiter] = this.waiters;
-		if (waiter) waiter.resolve(command);
-		else this.queue.push(command);
-	}
-	async maintainConnection() {
-		const signal = this.lifecycle.signal;
-		let attempt = 0;
-		let lastDelay = 0;
-		while (!(signal.aborted || this.rejection)) {
-			const { ready, readyAt } = await this.connectOnce();
-			if (signal.aborted || this.rejection) return;
-			if (ready && readyAt !== null && this.now() - readyAt > lastDelay) attempt = 0;
-			lastDelay = computeReconnectDelay(attempt, this.random);
-			try {
-				await this.sleep(lastDelay, signal);
-			} catch (error) {
-				if (isAbortError$1(error)) return;
-				throw error;
-			}
-			attempt += 1;
-		}
-	}
-	/** Opens one socket and resolves once it has closed, telling whether and when `ready` was seen. */
-	connectOnce() {
-		return new Promise((resolve) => {
-			const signal = this.lifecycle.signal;
-			const socket = new WebSocket(this.url);
-			let authenticated = false;
-			let ready = false;
-			let readyAt = null;
-			const stop = () => socket.close(NORMAL_CLOSE_CODE);
-			const readyTimer = setTimeout(stop, REQUEST_TIMEOUT_MS);
-			signal.addEventListener("abort", stop, { once: true });
-			this.socket = socket;
-			socket.on("open", () => {
-				authenticated = true;
-				transmit(socket, {
-					type: "authenticate",
-					credential: this.credential
-				}).catch(stop);
-			});
-			socket.on("error", () => void 0);
-			socket.on("message", (data) => {
-				let frame;
-				try {
-					frame = parseServerFrame(data.toString());
-				} catch {
-					socket.close(DEVICE_CHANNEL_WORKER_CLOSE_PROTOCOL_VIOLATION, "DEVICE_CHANNEL_PROTOCOL");
-					return;
-				}
-				if (frame.type === "ready") {
-					clearTimeout(readyTimer);
-					ready = true;
-					readyAt = this.now();
-					this.ready = true;
-					return;
-				}
-				this.handleFrame(socket, frame);
-			});
-			socket.on("close", (code) => {
-				clearTimeout(readyTimer);
-				signal.removeEventListener("abort", stop);
-				this.socket = null;
-				this.ready = false;
-				if (code === SERVER_POLICY_VIOLATION_CLOSE_CODE && authenticated && !ready) this.reject(new DeviceCredentialRejectedError());
-				resolve({
-					ready,
-					readyAt
-				});
-			});
-		});
-	}
-	handleFrame(socket, frame) {
-		switch (frame.type) {
-			case "command":
-				this.receiveCommand(socket, frame);
-				return;
-			case "cancel":
-				this.cancellations.set(frame.id, frame.reason);
-				return;
-			case "reauthenticate":
-				transmit(socket, {
-					type: "authenticate",
-					credential: this.credential
-				}).catch(() => socket.close(NORMAL_CLOSE_CODE));
-				return;
-			case "revoked":
-				this.reject(new DeviceCredentialRejectedError());
-				socket.close(NORMAL_CLOSE_CODE);
-				return;
-			case "ping":
-				transmit(socket, { type: "pong" }).catch(() => socket.close(NORMAL_CLOSE_CODE));
-				return;
-		}
-	}
-	receiveCommand(socket, frame) {
-		if (frame.command === void 0) {
-			this.refuse(socket, frame, EMPTY_SHELL_COMMAND_REFUSED);
-			return;
-		}
-		this.deliver(leasedCommand(frame, frame.command));
-	}
-	/** Completes a command the shell worker cannot run, without handing it to the loop. */
-	refuse(socket, frame, stderr) {
-		const { id, leaseToken } = frame;
-		transmit(socket, {
-			type: "running",
-			id,
-			leaseToken
-		}).then(() => transmit(socket, {
-			type: "complete",
-			id,
-			leaseToken,
-			result: {
-				stdout: "",
-				stderr,
-				exitCode: 1,
-				success: false,
-				errorCode: "execution_failed"
-			}
-		})).catch(() => void 0);
-	}
-};
-//#endregion
-//#region src/device/process-runner.ts
-const OUTPUT_LIMIT = 3e4;
-const TERMINATION_GRACE_MS = 5e3;
-const TERMINATION_POLL_MS = 50;
-var BoundedTextBuffer = class {
-	constructor() {
-		this.decoder = new StringDecoder("utf8");
-		this.decoderFlushed = false;
-		this.value = "";
-		this.truncated = false;
-	}
-	append(chunk) {
-		if (this.truncated) return;
-		const text = typeof chunk === "string" ? chunk : this.decoder.write(Buffer.from(chunk));
-		this.appendText(text);
-	}
-	appendText(text) {
-		const remaining = OUTPUT_LIMIT - this.value.length;
-		if (text.length <= remaining) {
-			this.value += text;
-			return;
-		}
-		this.value += text.slice(0, Math.max(remaining, 0));
-		this.truncated = true;
-	}
-	toString() {
-		if (!this.decoderFlushed) {
-			this.decoderFlushed = true;
-			this.appendText(this.decoder.end());
-		}
-		return this.truncated ? `${this.value}\n... output truncated to ${OUTPUT_LIMIT} chars` : this.value;
-	}
-};
-function isMissingProcess(error) {
-	return error instanceof Error && "code" in error && error.code === "ESRCH";
-}
-function signalProcessGroup(pid, signal, kill) {
-	try {
-		kill(-pid, signal);
-		return true;
-	} catch (error) {
-		if (isMissingProcess(error)) return false;
-		throw error;
-	}
-}
-function beginProcessGroupTermination(pid, deps = {}) {
-	const kill = deps.kill ?? process.kill.bind(process);
-	const setTimer = deps.setTimer ?? setTimeout;
-	const clearTimer = deps.clearTimer ?? clearTimeout;
-	return new Promise((resolve, reject) => {
-		let settled = false;
-		let escalationTimer;
-		let pollTimer;
-		function clearTimers() {
-			if (escalationTimer) clearTimer(escalationTimer);
-			if (pollTimer) clearTimer(pollTimer);
-		}
-		function finish() {
-			if (settled) return;
-			settled = true;
-			clearTimers();
-			resolve();
-		}
-		function fail(error) {
-			if (settled) return;
-			settled = true;
-			clearTimers();
-			reject(error);
-		}
-		function poll() {
-			if (settled) return;
-			try {
-				if (!signalProcessGroup(pid, 0, kill)) {
-					finish();
-					return;
-				}
-				pollTimer = setTimer(poll, TERMINATION_POLL_MS);
-			} catch (error) {
-				fail(error);
-			}
-		}
-		try {
-			if (!signalProcessGroup(pid, "SIGTERM", kill)) {
-				finish();
-				return;
-			}
-			escalationTimer = setTimer(() => {
-				try {
-					if (!signalProcessGroup(pid, 0, kill)) {
-						finish();
-						return;
-					}
-					signalProcessGroup(pid, "SIGKILL", kill);
-				} catch (error) {
-					fail(error);
-				}
-			}, TERMINATION_GRACE_MS);
-			pollTimer = setTimer(poll, TERMINATION_POLL_MS);
-		} catch (error) {
-			fail(error);
-		}
-	});
-}
-async function resolveShell(shell = process.env.SHELL) {
-	if (!(shell && isAbsolute(shell))) return "/bin/sh";
-	try {
-		if (!(await stat(shell)).isFile()) return "/bin/sh";
-		await access(shell, constants.X_OK);
-		return shell;
-	} catch {
-		return "/bin/sh";
-	}
-}
-function terminalResult(reason, stdout, stderr) {
-	return {
-		stdout: stdout.toString(),
-		stderr: stderr.toString(),
-		exitCode: reason === "timed_out" ? 124 : 130,
-		success: false,
-		errorCode: reason
-	};
-}
-async function runDeviceProcess(input) {
-	if (input.signal?.aborted) return {
-		stdout: "",
-		stderr: "",
-		exitCode: 130,
-		success: false,
-		errorCode: "cancelled"
-	};
-	const shell = await resolveShell();
-	if (input.signal?.aborted) return {
-		stdout: "",
-		stderr: "",
-		exitCode: 130,
-		success: false,
-		errorCode: "cancelled"
-	};
-	const stdout = new BoundedTextBuffer();
-	const stderr = new BoundedTextBuffer();
-	return new Promise((resolve) => {
-		let settled = false;
-		let terminationReason;
-		let termination;
-		let child;
-		function finish(result) {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timeout);
-			input.signal?.removeEventListener("abort", cancel);
-			resolve(result);
-		}
-		function finishTerminationFailure(error) {
-			finish({
-				stdout: stdout.toString(),
-				stderr: error instanceof Error ? error.message : String(error),
-				exitCode: 1,
-				success: false,
-				errorCode: "execution_failed"
-			});
-		}
-		function terminate(reason) {
-			if (settled || terminationReason || !child?.pid) return;
-			terminationReason = reason;
-			termination = beginProcessGroupTermination(child.pid);
-			termination.catch(finishTerminationFailure);
-		}
-		function cancel() {
-			terminate("cancelled");
-		}
-		const timeout = setTimeout(() => terminate("timed_out"), input.timeoutMs);
-		try {
-			child = spawn(shell, ["-lc", input.command], {
-				cwd: input.cwd,
-				env: process.env,
-				detached: true,
-				stdio: [
-					"ignore",
-					"pipe",
-					"pipe"
-				]
-			});
-		} catch (error) {
-			finish({
-				stdout: "",
-				stderr: error instanceof Error ? error.message : String(error),
-				exitCode: 1,
-				success: false,
-				errorCode: "execution_failed"
-			});
-			return;
-		}
-		input.signal?.addEventListener("abort", cancel, { once: true });
-		if (input.signal?.aborted) cancel();
-		const spawned = child;
-		spawned.stdout.on("data", (chunk) => stdout.append(chunk));
-		spawned.stderr.on("data", (chunk) => stderr.append(chunk));
-		spawned.once("error", (error) => {
-			finish({
-				stdout: stdout.toString(),
-				stderr: error.message,
-				exitCode: 1,
-				success: false,
-				errorCode: "execution_failed"
-			});
-		});
-		spawned.once("close", (code) => {
-			if (terminationReason) {
-				const reason = terminationReason;
-				(termination ?? Promise.resolve()).then(() => finish(terminalResult(reason, stdout, stderr)), finishTerminationFailure);
-				return;
-			}
-			const exitCode = code ?? 1;
-			finish({
-				stdout: stdout.toString(),
-				stderr: stderr.toString(),
-				exitCode,
-				success: exitCode === 0,
-				...code === null ? { errorCode: "execution_failed" } : {}
-			});
-		});
-	});
-}
-//#endregion
-//#region src/device/worker-loop.ts
-const HEARTBEAT_INTERVAL_MS = 2e3;
-function isAbortError(error) {
-	return error instanceof DOMException && error.name === "AbortError";
-}
-/** The channel client reconnects on its own; only a transport failure (status 0) is retried here. */
-function isRetryableIdleError(error) {
-	return error instanceof DeviceWorkerRequestError && error.statusCode === 0;
-}
-function isLeaseConflict(error) {
-	return error instanceof DeviceWorkerRequestError && error.statusCode === 409;
-}
-async function executeLease(command, input, runProcess, sleep) {
-	try {
-		await input.client.markRunning(command.id, command.leaseToken);
-	} catch (error) {
-		if (error instanceof DeviceCredentialRejectedError) throw error;
-		return;
-	}
-	input.onEvent?.({
-		type: "running",
-		commandId: command.id,
-		intent: command.intent
-	});
-	const commandController = new AbortController();
-	const heartbeatController = new AbortController();
-	let completionAllowed = true;
-	let heartbeatFailure;
-	function abortCommand() {
-		commandController.abort();
-	}
-	input.signal.addEventListener("abort", abortCommand, { once: true });
-	const processPromise = runProcess({
-		command: command.command,
-		cwd: command.cwd,
-		timeoutMs: command.timeoutMs,
-		signal: commandController.signal
-	});
-	const heartbeatPromise = (async () => {
-		while (!heartbeatController.signal.aborted) try {
-			await sleep(HEARTBEAT_INTERVAL_MS, heartbeatController.signal);
-			const heartbeat = await input.client.heartbeat(command.id, command.leaseToken, heartbeatController.signal);
-			if (heartbeat.cancel) {
-				if (heartbeat.reason === "revoked") completionAllowed = false;
-				commandController.abort();
-				return;
-			}
-		} catch (error) {
-			if (heartbeatController.signal.aborted && isAbortError(error)) return;
-			heartbeatFailure = error;
-			completionAllowed = false;
-			commandController.abort();
-			return;
-		}
-	})();
-	let result;
-	try {
-		result = await processPromise;
-	} catch (error) {
-		result = {
-			stdout: "",
-			stderr: error instanceof Error ? error.message : String(error),
-			exitCode: 1,
-			success: false,
-			errorCode: "execution_failed"
-		};
-	} finally {
-		heartbeatController.abort();
-		await heartbeatPromise;
-		input.signal.removeEventListener("abort", abortCommand);
-	}
-	if (heartbeatFailure instanceof DeviceCredentialRejectedError) throw heartbeatFailure;
-	if (!completionAllowed || isLeaseConflict(heartbeatFailure)) return;
-	try {
-		await input.client.output(command.id, command.leaseToken, result.stdout, result.stderr);
-		await input.client.complete(command.id, command.leaseToken, result);
-	} catch (error) {
-		if (error instanceof DeviceCredentialRejectedError) throw error;
-		return;
-	}
-	input.onEvent?.({
-		type: "completed",
-		commandId: command.id,
-		exitCode: result.exitCode
-	});
-}
-async function runDeviceWorker(input) {
-	const runProcess = input.runProcess ?? runDeviceProcess;
-	const sleep = input.sleep ?? sleepWithAbort;
-	const random = input.random ?? Math.random;
-	let retryAttempt = 0;
-	while (!input.signal.aborted) {
-		let command;
-		try {
-			command = await input.client.lease(input.signal);
-			retryAttempt = 0;
-		} catch (error) {
-			if (input.signal.aborted) return;
-			if (error instanceof DeviceCredentialRejectedError) throw error;
-			if (!isRetryableIdleError(error)) throw error;
-			try {
-				await sleep(computeRetryDelay$1(retryAttempt, random), input.signal);
-			} catch (sleepError) {
-				if (input.signal.aborted && isAbortError(sleepError)) return;
-				throw sleepError;
-			}
-			retryAttempt += 1;
-			continue;
-		}
-		if (!command) continue;
-		await executeLease(command, input, runProcess, sleep);
-	}
-}
-//#endregion
-//#region src/commands/device.ts
-const NAMED_PROFILE_REQUIRED = "Device pairing requires a named Standards profile";
-const SUPPORTED_PLATFORMS_REQUIRED = "Device workers support macOS and Linux only";
-var DeviceCommandError = class extends SchemaError {
-	constructor(message) {
-		super(message, SchemaErrorCode.VALIDATION_FAILED);
-		this.name = "DeviceCommandError";
-	}
-};
-function requireSupportedPlatform(platform) {
-	if (platform === "darwin" || platform === "linux") return platform;
-	throw new DeviceCommandError(SUPPORTED_PLATFORMS_REQUIRED);
-}
-function requireNamedProfile(command) {
-	const options = getGlobalOptions(command);
-	if (!(options.profileName && options.apiUrl && options.apiKey)) throw new DeviceCommandError(NAMED_PROFILE_REQUIRED);
-	return {
-		apiUrl: options.apiUrl,
-		apiKey: options.apiKey,
-		profileName: options.profileName,
-		tenantId: options.tenant
-	};
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function parseDeviceView(value) {
-	if (!isRecord(value)) throw new DeviceCommandError("Invalid device response");
-	const { id, name, platform, arch, hostname: deviceHostname } = value;
-	const { status } = value;
-	if (typeof id !== "string" || typeof name !== "string" || platform !== "darwin" && platform !== "linux" || typeof arch !== "string" || typeof deviceHostname !== "string" || status !== "online" && status !== "offline" && status !== "revoked") throw new DeviceCommandError("Invalid device response");
-	return {
-		id,
-		name,
-		platform,
-		arch,
-		hostname: deviceHostname,
-		status
-	};
-}
-function parsePairDeviceResponse(value) {
-	if (!isRecord(value) || typeof value.token !== "string") throw new DeviceCommandError("Invalid device pairing response");
-	return {
-		device: parseDeviceView(value.device),
-		token: value.token
-	};
-}
-function parseDeviceList(value) {
-	if (!Array.isArray(value)) throw new DeviceCommandError("Invalid device list response");
-	return value.map(parseDeviceView);
-}
-async function pairDevice(name, command) {
-	const platform = requireSupportedPlatform(process.platform);
-	const profile = requireNamedProfile(command);
-	const installationId = await getOrCreateInstallationId();
-	const client = createClient({
-		apiUrl: profile.apiUrl,
-		apiKey: profile.apiKey,
-		tenantId: profile.tenantId
-	});
-	const response = parsePairDeviceResponse(await createAppClient(client).devices.pair({
-		installationId,
-		name,
-		platform,
-		arch: process.arch,
-		hostname: hostname()
-	}));
-	if (!await storeDeviceCredential(profile.profileName, {
-		id: response.device.id,
-		name: response.device.name,
-		token: response.token
-	})) throw new DeviceCommandError(NAMED_PROFILE_REQUIRED);
-	process.stdout.write(`Paired ${response.device.name} (${response.device.id})\n`);
-}
-async function showDeviceStatus(command) {
-	const profile = requireNamedProfile(command);
-	const credential = await getStoredDeviceCredential(profile.profileName);
-	if (!credential) throw new DeviceCommandError("No paired device; run standards device pair first");
-	const client = createClient({
-		apiUrl: profile.apiUrl,
-		apiKey: profile.apiKey,
-		tenantId: profile.tenantId
-	});
-	const pairedDevice = parseDeviceList(await createAppClient(client).devices.list({})).find((device) => device.id === credential.id);
-	formatOutput(pairedDevice ? [pairedDevice] : [{
-		id: credential.id,
-		name: credential.name,
-		status: "revoked"
-	}], getFormat(command));
-}
-async function revokeDevice(command) {
-	const profile = requireNamedProfile(command);
-	const credential = await getStoredDeviceCredential(profile.profileName);
-	if (!credential) throw new DeviceCommandError("No paired device; run standards device pair first");
-	const client = createClient({
-		apiUrl: profile.apiUrl,
-		apiKey: profile.apiKey,
-		tenantId: profile.tenantId
-	});
-	await createAppClient(client).devices.revoke({ id: credential.id });
-	await removeDeviceCredential(profile.profileName);
-}
-async function serveDevice(command) {
-	const platform = requireSupportedPlatform(process.platform);
-	const profile = requireNamedProfile(command);
-	const credential = await getStoredDeviceCredential(profile.profileName);
-	if (!credential) throw new DeviceCommandError("No paired device; run standards device pair first");
-	const userClient = createClient({
-		apiUrl: profile.apiUrl,
-		apiKey: profile.apiKey,
-		tenantId: profile.tenantId
-	});
-	const device = parseDeviceList(await createAppClient(userClient).devices.list({})).find((candidate) => candidate.id === credential.id);
-	if (!device) throw new DeviceCommandError("Device is unavailable");
-	if (device.platform !== platform) throw new DeviceCommandError("Device platform does not match paired device");
-	const controller = new AbortController();
-	const stop = () => controller.abort();
-	process.once("SIGINT", stop);
-	process.once("SIGTERM", stop);
-	process.stdout.write(`Connected as ${credential.name}\n`);
-	process.stdout.write("Waiting for commands — press Ctrl+C to disconnect\n");
-	const client = new DeviceWorkerClient({
-		apiUrl: profile.apiUrl,
-		token: credential.token
-	});
-	try {
-		await runDeviceWorker({
-			client,
-			signal: controller.signal,
-			onEvent: (event) => {
-				if (event.type === "running") {
-					process.stdout.write(`Running ${event.commandId}: ${event.intent}\n`);
-					return;
-				}
-				process.stdout.write(`Completed ${event.commandId} with exit code ${event.exitCode}\n`);
-			}
-		});
-	} finally {
-		client.close();
-		process.removeListener("SIGINT", stop);
-		process.removeListener("SIGTERM", stop);
-	}
-}
-function registerDeviceCommand(program) {
-	const device = program.command("device").description("Pair and run this computer as a device");
-	device.command("pair").description("Pair this computer with Standards").requiredOption("--name <name>", "device name").action(async (options, command) => pairDevice(options.name, command));
-	device.command("status").description("Show the paired device status").action(async (_options, command) => showDeviceStatus(command));
-	device.command("revoke").description("Revoke this computer's device credential").action(async (_options, command) => revokeDevice(command));
-	device.command("serve").description("Run the foreground device worker").action(async (_options, command) => serveDevice(command));
-}
-//#endregion
 //#region src/drift/shared-state.ts
 async function readSchemaState(client) {
 	const state = parseSchemaState(await client.schemaState.get({}));
@@ -1767,6 +803,11 @@ function buildQueryBody(opts) {
 	if (opts.count) body.countMode = parseCountFlag(opts.count);
 	return body;
 }
+/** The new parent of a move: exactly one of `--parent <id>` or `--top-level` (null). */
+function parseMoveTarget(opts) {
+	if (Boolean(opts.parent) === Boolean(opts.topLevel)) throw new ValidationError("Pass exactly one of --parent <id> or --top-level", []);
+	return opts.parent ?? null;
+}
 const COUNT_OPTION_DESCRIPTION = "total count mode (none, estimated, exact); omit for no total in page.total";
 function registerRecordsCommand(program) {
 	const records = program.command("records").description("Manage records (CRUD + search)");
@@ -1783,11 +824,12 @@ function registerRecordsCommand(program) {
 			id
 		}), getFormat(cmd));
 	});
-	records.command("create").description("Create a new record").argument("<object>", "object name").option("--data <json>", "record data as JSON string").action(async (objectName, opts, cmd) => {
+	records.command("create").description("Create a new record").argument("<object>", "object name").option("--data <json>", "record data as JSON string").option("--parent <id>", "parent record ID (hierarchical objects only)").action(async (objectName, opts, cmd) => {
 		const data = opts.data ? JSON.parse(opts.data) : {};
 		formatOutput(await getAppClientFromCommand(cmd).records.create({
 			objectName,
-			data
+			data,
+			...opts.parent ? { options: { parentId: opts.parent } } : {}
 		}), getFormat(cmd));
 	});
 	records.command("update").description("Update a record").argument("<object>", "object name").argument("<id>", "record ID").option("--data <json>", "fields to update as JSON string").action(async (objectName, id, opts, cmd) => {
@@ -1805,6 +847,26 @@ function registerRecordsCommand(program) {
 		});
 		process.stdout.write(`Record ${id} deleted.\n`);
 	});
+	records.command("deletion-count").description("Count what deleting records would take: broken links and descendants").argument("<object>", "object name").argument("<ids...>", "record IDs").action(async (objectName, ids, _opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).records.deletionCount({
+			objectName,
+			ids
+		}), getFormat(cmd));
+	});
+	records.command("move-impact").description("Show who would gain and lose access if a record moved").argument("<object>", "object name").argument("<id>", "record ID").option("--parent <id>", "new parent record ID").option("--top-level", "move to the top level").action(async (objectName, id, opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).records.moveImpact({
+			objectName,
+			recordId: id,
+			parentId: parseMoveTarget(opts)
+		}), getFormat(cmd));
+	});
+	records.command("move").description("Move a record and its descendants under a parent (preview with move-impact)").argument("<object>", "object name").argument("<id>", "record ID").option("--parent <id>", "new parent record ID").option("--top-level", "move to the top level").action(async (objectName, id, opts, cmd) => {
+		formatOutput(await getAppClientFromCommand(cmd).records.move({
+			objectName,
+			recordId: id,
+			parentId: parseMoveTarget(opts)
+		}), getFormat(cmd));
+	});
 	records.command("search").description("Full-text search records").argument("<object>", "object name").requiredOption("--query <q>", "search query string").option("--limit <n>", "max records to return").option("--offset <n>", "number of records to skip").option("--sort <sort>", "sort rule as \"attribute:direction\"").option("--filter <json>", "filter state as JSON string").option("--fields <names>", "comma-separated reference attributes to hydrate (empty for none, omit for all)").option("--count <mode>", COUNT_OPTION_DESCRIPTION).action(async (objectName, opts, cmd) => {
 		const body = {
 			q: opts.query,
@@ -1888,6 +950,124 @@ function registerRecordsCommand(program) {
 	});
 }
 //#endregion
+//#region src/config.ts
+const DEFAULT_API_URL = "http://localhost:4100/v1";
+const ENV_PROFILE_NAME = "sandbox";
+function getDefaultApiUrl() {
+	return DEFAULT_API_URL;
+}
+function getConfigPath() {
+	const configDir = process.env.STANDARDS_CONFIG_DIR ?? join(homedir(), ".standards");
+	return join(configDir, "config.json");
+}
+async function readConfig() {
+	try {
+		const raw = await readFile(getConfigPath(), "utf8");
+		const parsed = JSON.parse(raw);
+		return {
+			currentProfile: parsed.currentProfile,
+			profiles: parsed.profiles ?? {}
+		};
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return { profiles: {} };
+		throw error;
+	}
+}
+async function writeConfig(config) {
+	const path = getConfigPath();
+	const directory = dirname(path);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod(directory, 448);
+	await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+	await chmod(path, 384);
+}
+async function upsertProfile(input) {
+	const config = await readConfig();
+	config.profiles[input.name] = {
+		apiUrl: input.apiUrl,
+		apiKey: input.apiKey
+	};
+	config.currentProfile = input.name;
+	await writeConfig(config);
+}
+async function setCurrentProfile(name) {
+	const config = await readConfig();
+	if (!config.profiles[name]) throw new Error(`Unknown Standards instance "${name}"`);
+	config.currentProfile = name;
+	await writeConfig(config);
+}
+async function removeProfile(name) {
+	const config = await readConfig();
+	const profileName = name ?? config.currentProfile;
+	if (!profileName) return;
+	delete config.profiles[profileName];
+	if (config.currentProfile === profileName) config.currentProfile = void 0;
+	await writeConfig(config);
+}
+async function listProfiles() {
+	const config = await readConfig();
+	const profiles = Object.entries(config.profiles).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({
+		name,
+		apiUrl: profile.apiUrl,
+		current: config.currentProfile === name
+	}));
+	const envProfile = getEnvProfile();
+	if (envProfile) profiles.push({
+		name: ENV_PROFILE_NAME,
+		apiUrl: envProfile.apiUrl,
+		current: !config.currentProfile,
+		source: "env"
+	});
+	return profiles;
+}
+async function getActiveProfile() {
+	const config = await readConfig();
+	if (!config.currentProfile) {
+		const envProfile = getEnvProfile();
+		return envProfile ? {
+			name: ENV_PROFILE_NAME,
+			...envProfile
+		} : null;
+	}
+	const profile = config.profiles[config.currentProfile];
+	if (!profile) return null;
+	return {
+		name: config.currentProfile,
+		...profile
+	};
+}
+function getEnvProfile() {
+	if (!process.env.STANDARDS_API_KEY) return null;
+	return {
+		apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+		apiKey: process.env.STANDARDS_API_KEY
+	};
+}
+async function resolveCliConfig(options) {
+	if (options.apiUrl || options.apiKey) return {
+		apiUrl: options.apiUrl ?? process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+		apiKey: options.apiKey ?? process.env.STANDARDS_API_KEY
+	};
+	const config = await readConfig();
+	const profileName = options.instance ?? config.currentProfile;
+	if (profileName) {
+		const profile = config.profiles[profileName];
+		if (!profile) throw new Error(`Unknown Standards instance "${profileName}"`);
+		return {
+			apiUrl: profile.apiUrl,
+			apiKey: profile.apiKey,
+			profileName
+		};
+	}
+	return {
+		apiUrl: process.env.STANDARDS_API_URL ?? DEFAULT_API_URL,
+		apiKey: process.env.STANDARDS_API_KEY
+	};
+}
+//#endregion
 //#region src/commands/root.ts
 async function promptForMissingValue(label) {
 	const rl = createInterface({
@@ -1977,6 +1157,153 @@ function registerSearchCommand(program) {
 	});
 }
 //#endregion
+//#region src/commands/skills.ts
+const SKILL_FILE = "SKILL.md";
+/** A folder name: one path segment under the rule (`isSafeSkillFilePath`). */
+function isSafeSegment(segment) {
+	return !segment.includes("/") && isSafeSkillFilePath(segment);
+}
+/**
+* A path the server answered, before it lands on this disk: the skill path
+* rule, and no drive letter (`C:`), which Windows would read as absolute.
+*/
+function isSafeRelativePath(path) {
+	return !/^[A-Za-z]:/.test(path) && isSafeSkillFilePath(path);
+}
+/**
+* Hidden entries (`.git`, `.env`, `.DS_Store`…) and symbolic links are not
+* sent: a link could point anywhere on the machine. Each one is reported.
+*/
+function isSkipped(entry) {
+	return entry.name.startsWith(".") || entry.isSymbolicLink();
+}
+async function isDirectory(path) {
+	return (await stat(path)).isDirectory();
+}
+async function listFiles(dir, skipped) {
+	const files = [];
+	for (const entry of await readdir(dir, { withFileTypes: true })) {
+		const path = join(dir, entry.name);
+		if (isSkipped(entry)) skipped.push(path);
+		else if (entry.isDirectory()) files.push(...await listFiles(path, skipped));
+		else if (entry.isFile()) files.push(path);
+	}
+	return files.sort();
+}
+/** A directory holding `SKILL.md` is one folder; any other is a directory of folders. */
+async function foldersIn(dir, skipped) {
+	const entries = await readdir(dir, { withFileTypes: true });
+	if (entries.some((entry) => entry.isFile() && entry.name === SKILL_FILE)) return [dir];
+	const folders = [];
+	for (const entry of entries) if (isSkipped(entry)) skipped.push(join(dir, entry.name));
+	else if (entry.isDirectory()) folders.push(join(dir, entry.name));
+	return folders.sort();
+}
+/** One folder as read: text as `content`, any other bytes uploaded and sent by id. */
+async function readFolder(client, dir, skipped) {
+	const files = [];
+	for (const absolute of await listFiles(dir, skipped)) {
+		const path = relative(dir, absolute).split(sep).join("/");
+		const bytes = await readFile(absolute);
+		const content = skillFileText(bytes);
+		if (content !== void 0) {
+			files.push({
+				path,
+				content
+			});
+			continue;
+		}
+		const [stored] = await client.files.upload({ files: [new File([bytes], basename(absolute))] });
+		if (!stored) throw new Error(`The upload of ${absolute} answered no file`);
+		files.push({
+			path,
+			fileId: stored.id
+		});
+	}
+	return {
+		name: basename(resolve(dir)),
+		files
+	};
+}
+/**
+* `standards skills push`: every folder sent as read in one `skills.import`.
+* The CLI judges nothing: the server answers every problem, printed whole.
+*/
+async function runSkillsPush(client, dirs, options = {}) {
+	try {
+		const folders = [];
+		const skipped = [];
+		for (const dir of dirs) {
+			if (!await isDirectory(dir)) throw new Error(`${dir} is not a directory`);
+			for (const folder of await foldersIn(dir, skipped)) folders.push(await readFolder(client, folder, skipped));
+		}
+		return {
+			exitCode: 0,
+			result: await client.skills.import({
+				folders,
+				onConflict: options.replace === true ? "replace" : "fail"
+			}),
+			skipped
+		};
+	} catch (error) {
+		return {
+			exitCode: 1,
+			errorMessage: messageOf(error)
+		};
+	}
+}
+/** The bytes behind an exported file: its text, or its signed URL fetched. */
+async function exportedBytes(file) {
+	if ("content" in file) return new TextEncoder().encode(file.content);
+	const response = await fetch(file.url);
+	if (!response.ok) throw new Error(`Downloading ${file.url} answered ${response.status}`);
+	return new Uint8Array(await response.arrayBuffer());
+}
+/** `standards skills pull`: each skill written as `<dir>/<name>/`, its files at their paths. */
+async function runSkillsPull(client, dir, names) {
+	const { folders } = await client.skills.export(names && names.length > 0 ? { names: [...names] } : {});
+	const refused = folders.flatMap((folder) => isSafeSegment(folder.name) ? folder.files.filter((file) => !isSafeRelativePath(file.path)).map((file) => `skill ${JSON.stringify(folder.name)}: file path ${JSON.stringify(file.path)}`) : [`skill name ${JSON.stringify(folder.name)}`]);
+	if (refused.length > 0) throw new Error(`Pull refused, nothing was written: each name must be one folder name and each path relative, inside it:\n${refused.map((line) => `- ${line}`).join("\n")}`);
+	const target = resolve(dir);
+	const written = [];
+	for (const folder of folders) {
+		const root = resolve(target, folder.name);
+		for (const file of folder.files) {
+			const destination = resolve(root, file.path);
+			if (!(dirname(root) === target && destination.startsWith(`${root}${sep}`))) throw new Error(`Skill ${folder.name}: file path ${file.path} leaves ${target}`);
+			await mkdir(dirname(destination), { recursive: true });
+			await writeFile(destination, await exportedBytes(file));
+		}
+		written.push(root);
+	}
+	return written;
+}
+function collectName(value, names) {
+	return [...names, value];
+}
+/** Skills as Agent Skills folders: pull them to disk, push folders back. */
+function registerSkillsCommand(program) {
+	const skills = program.command("skills").description("Pull and push skills as Agent Skills folders (SKILL.md and its files)");
+	skills.command("pull").description("Write each skill as a folder <dir>/<name>/ (every skill you can open by default)").argument("[dir]", "directory to write the folders into", ".").option("--name <name>", "a skill to pull (repeat for several)", collectName, []).action(async (dir, opts, cmd) => {
+		try {
+			formatOutput({ written: await runSkillsPull(getAppClientFromCommand(cmd), dir, opts.name) }, getFormat(cmd));
+		} catch (error) {
+			console.error(styleText("red", `✗ ${messageOf(error)}`));
+			process.exit(1);
+		}
+	});
+	skills.command("push").description("Import skill folders: a folder holding SKILL.md, or a directory of such folders. All or nothing").argument("<dirs...>", "skill folders, or directories of skill folders").option("--replace", "rewrite the skill a name already reads instead of refusing it").action(async (dirs, opts, cmd) => {
+		const outcome = await runSkillsPush(getAppClientFromCommand(cmd), dirs, opts);
+		if (outcome.exitCode === 1) {
+			console.error(styleText("red", `✗ ${outcome.errorMessage}`));
+			process.exit(1);
+		}
+		for (const path of outcome.skipped) console.warn(styleText("yellow", `! skipped ${path} (hidden or a symbolic link)`));
+		for (const warning of outcome.result.warnings) console.warn(styleText("yellow", `! ${warning}`));
+		formatOutput(outcome.result, getFormat(cmd));
+	});
+}
+//#endregion
 //#region src/version.ts
 /**
 * The installed package's version, read from its own manifest: `src/` and the
@@ -2015,7 +1342,6 @@ function createProgram() {
 	registerPullCommand(program);
 	registerDiffCommand(program);
 	registerDocumentsCommand(program);
-	registerDeviceCommand(program);
 	registerFoldersCommand(program);
 	registerKeysCommand(program);
 	registerInvitationsCommand(program);
@@ -2026,6 +1352,7 @@ function createProgram() {
 	registerMeetingsCommand(program);
 	registerMemoryCommand(program);
 	registerSearchCommand(program);
+	registerSkillsCommand(program);
 	registerEmbeddingsCommand(program);
 	registerAiCommand(program);
 	registerQuotasCommand(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standards/cli",
-  "version": "1.0.0-alpha.408",
+  "version": "1.0.0-alpha.410",
   "description": "CLI tool to interact with Standards API",
   "type": "module",
   "bin": {
@@ -26,14 +26,12 @@
     "cli-table3": "^0.6.5",
     "commander": "^13.1.0",
     "jiti": "2.7.0",
-    "ws": "8.21.1",
-    "@standards/client": "1.0.0-alpha.408",
-    "@standards/constants": "1.0.0-alpha.408",
-    "@standards/schema": "1.0.0-alpha.408"
+    "@standards/client": "1.0.0-alpha.410",
+    "@standards/constants": "1.0.0-alpha.410",
+    "@standards/schema": "1.0.0-alpha.410"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",
-    "@types/ws": "8.18.1",
     "jsdom": "^25.0.1",
     "tsdown": "^0.23.0",
     "typescript": "^5.6.3",