@zenera/cli 1.1.42 → 1.1.44

package/README.md

@@ -115,7 +115,7 @@ in line with it, validate the setup, and run it:
 ```sh
 zen meta run my-project /spec-sync-project
 zen check my-project
-zen run my-project "Summarize this repository and write NOTES.md"
+zen run my-project --here "Summarize this repository and write NOTES.md"
 zen inspect
 ```
 
@@ -127,13 +127,15 @@ than silently guessing. After you answer, apply that feedback with
 ## Run it your way
 
 With no prompt, `zen run` opens the terminal UI. Provide a prompt for a
-one-shot run, or use JSON and batch mode to integrate with other tools:
+one-shot run, or use JSON and batch mode to integrate with other tools. A
+one-shot run works in a fresh directory inside its session; `--here` points it
+at the directory you are in instead:
 
 ```sh
 zen run my-project                         # interactive terminal UI
-zen run my-project "Review the latest changes"
+zen run my-project --here "Review the latest changes"
 git diff | zen run my-project
-zen run my-project "Summarize the changes" --read-only
+zen run my-project --here "Summarize the changes" --read-only
 zen run my-project "Triage these alerts" --json | jq
 zen run batch --input cases.json           # run a set of requests
 ```

package/dist/commands/check.js

@@ -6,7 +6,7 @@ import { duration } from "../narrate.js";
 import { project as resolveProject } from "../resolve.js";
 import { refreshShared } from "../scaffold.js";
 import { bold, count, cyan, dim, green, invalidError, json, progress, red, table, usageError, write, writeAll, yellow, } from "../term.js";
-import { validateProject, } from "../validate.js";
+import { repinDockerfile, validateProject, } from "../validate.js";
 const USAGE = 'zen check [name|dir] [--project <name|dir>] [--fix] [--no-sandbox] [--no-models] [--strict] [--quiet]';
 // ---------------------------------------------------------------------------
 // zen check
@@ -57,8 +57,10 @@ export const check = {
         '(.vscode/ and .github/). They restate how this version of zen behaves,',
         'so a copy left behind by an upgrade is worse than none — they are',
         'replaced whether or not they were edited, and the report that follows is',
-        'of the project as repaired. Nothing else is touched: agents.yaml, the',
-        'prompts, the specification and agents/instructions.md are yours.',
+        'of the project as repaired. It also pins the @zenera/* installs in the',
+        'sandbox Dockerfile to this zen\u2019s version, changing nothing else in it.',
+        'Nothing else is touched: agents.yaml, the prompts, the specification and',
+        'agents/instructions.md are yours.',
         '',
         'The argument is a directory if one is there and a registered project',
         'name otherwise; with neither, the project you are standing in.',
@@ -87,7 +89,7 @@ export const check = {
         // the files that are there now and the exit code answers the repaired
         // project. A fix that left an error behind in the output would be read
         // as a fix that failed.
-        const fixed = values.fix ? refreshShared(dir) : [];
+        const fixed = values.fix ? [...refreshShared(dir), ...repinDockerfile(dir)] : [];
         // Materialised first, so the credential verdicts are the ones a run
         // would reach: a key in the environment and a key in the keyring are
         // the same key by the time the library asks. The project's own `.env`
@@ -329,7 +331,7 @@ function fixedLines(fixed) {
         return [];
     }
     return [
-        `${bold('Replaced')} ${dim(`${count(fixed.length, 'file')} \u2014 ours, not the project's`)}`,
+        `${bold('Fixed')} ${dim(count(fixed.length, 'file'))}`,
         ...fixed.map((f) => `  ${green('wrote')} ${f}`),
         '',
     ];

package/dist/commands/completion.d.ts

@@ -2,7 +2,7 @@ import type { Command } from '../command.ts';
 export { install, installed, loader, rcFile } from '../completion-install.ts';
 /**
  * Prints the shell's side of tab completion. The script is a few lines that
- * call back into `zen __complete`, so the project names and stored prompts it
+ * call back into `zen __complete`, so the project names and commands it
  * offers are always read from the machine it runs on, never baked in.
  */
 export declare const completion: Command;

package/dist/commands/completion.js

@@ -8,7 +8,7 @@ export { install, installed, loader, rcFile } from "../completion-install.js";
 const USAGE = 'zen completion [<zsh|bash|fish>] [--install [--yes]]';
 /**
  * Prints the shell's side of tab completion. The script is a few lines that
- * call back into `zen __complete`, so the project names and stored prompts it
+ * call back into `zen __complete`, so the project names and commands it
  * offers are always read from the machine it runs on, never baked in.
  */
 export const completion = {
@@ -29,12 +29,12 @@ export const completion = {
         '  zen completion zsh --install --yes       without asking',
         '',
         'Then, in a new shell:',
-        '  zen meta run my-project /<Tab>           the project’s stored prompts',
+        '  zen meta run my-project /<Tab>           the project’s commands',
         '  zen meta <Tab>                           run, prompts, resume, model …',
         '  zen run <Tab>                            your projects',
         '',
-        'The prompts are the files in .github/prompts/ — the same ones an editor',
-        'offers as slash commands. Where there is nothing to offer, file names are.',
+        'The commands are the skills in .github/skills/ an editor offers as slash',
+        'commands - not the zen-* ones, which are the model’s. Where there is nothing to offer, file names are.',
     ],
     run: async (ctx) => {
         const { values, positionals } = parse(ctx.args, { install: { type: 'boolean' }, yes: { type: 'boolean' } }, USAGE);

package/dist/commands/meta.js

@@ -10,7 +10,7 @@ import { parse } from "../args.js";
 import { matching, projectNames } from "../candidates.js";
 import { copilotEventLog } from "../eventlog.js";
 import { probeChat, probeModel } from "../liveness.js";
-import { answerBox, chooseModel, DATASET_DETAILS, DATASET_SUMMARY, DATASET_USAGE, datasetProjectFlag, DEFAULT_RESUMES, editorFiles, fallbackRef, FINETUNE_DETAILS, FINETUNE_SUMMARY, FINETUNE_USAGE, finetuneProjectFlag, lastSession, launch, listPrompts, loadPrompt, locate, masked, metaCompatible, misspelledProvider, MODEL_ENV, openLog, ORDER, PROMPT_DIR, providersWarning, readMeta, recordSession, RESUME_PROMPT, resumeDelayMs, runDataset, runFinetune, sameModel, sessionModel, sessionTotals, SOURCE_LABELS, startVertexRelay, tailSpans, Tally, terminalSink, transient, wire, wireGateway, writeMeta, } from "../meta/index.js";
+import { answerBox, chooseModel, DATASET_DETAILS, DATASET_SUMMARY, DATASET_USAGE, datasetProjectFlag, DEFAULT_RESUMES, editorFiles, fallbackRef, FINETUNE_DETAILS, FINETUNE_SUMMARY, FINETUNE_USAGE, finetuneProjectFlag, lastSession, launch, listPrompts, loadPrompt, locate, masked, metaCompatible, misspelledProvider, MODEL_ENV, openLog, ORDER, SKILL_DIR, providersWarning, readMeta, recordSession, RESUME_PROMPT, resumeDelayMs, runDataset, runFinetune, sameModel, sessionModel, sessionTotals, SOURCE_LABELS, startVertexRelay, tailSpans, Tally, terminalSink, transient, wire, wireGateway, writeMeta, } from "../meta/index.js";
 import { splitRef } from "../modelref.js";
 import { duration } from "../narrate.js";
 import { project as resolveProject } from "../resolve.js";
@@ -84,16 +84,16 @@ const OPTIONS = {
 };
 const RUN_FORMS = [
     '  zen meta run [project] "<question>"      ask it something',
-    '  zen meta run [project] /<name> [words]   run a stored prompt',
-    '  zen meta run [project]                   pick one of its stored prompts',
+    '  zen meta run [project] /<name> [words]   run one of its commands',
+    '  zen meta run [project]                   pick one of its commands',
 ];
 const RUN_ARGUMENTS = [
     'Arguments:',
     '  [project]   Name of a project. Default: the one you are in.',
     '  [prompt]    Your question, in quotes. Or --prompt, or piped in when neither',
     '              it nor --prompt-file is given.',
-    '  /<name>     A prompt file in .github/prompts/<name>.prompt.md.',
-    '  [words]     Appended to that prompt as a final line.',
+    '  /<name>     A command: the skill in .github/skills/<name>/SKILL.md.',
+    '  [words]     Given to that command, after its text.',
 ];
 const RUN_OPTIONS = [
     'Options:',
@@ -126,7 +126,7 @@ export const meta = {
     details: [
         'Forms:',
         ...RUN_FORMS,
-        '  zen meta prompts [project]               list the stored prompts',
+        '  zen meta prompts [project]               list its commands',
         '  zen meta resume [project] [session]      carry on a run that stopped',
         '  zen meta model [ref]                     show or set the model it uses',
         '  zen meta dataset <verb>                  the cases it tunes against',
@@ -134,7 +134,7 @@ export const meta = {
         '',
         'The project may come before the verb instead: `zen meta acme run`.',
         '`zen meta dataset --help`, `zen meta finetune --help` and `zen meta run --help`',
-        'have their own pages; the last lists the stored prompts.',
+        'have their own pages; the last lists the commands.',
         '',
         ...RUN_ARGUMENTS,
         '',
@@ -281,7 +281,7 @@ async function runHelp(ctx, words) {
     lines.push('', ...RUN_ARGUMENTS, '', ...RUN_OPTIONS, '', 'Examples:', '  zen meta run "what does this project do?"', '  zen meta run acme /project-review', '  zen meta run acme /spec-sync-project agents/triage.md', '  zen meta run acme /analyze --json');
     page({
         usage: 'zen meta run [project] [/<name> [words] | "<question>"] [options]',
-        summary: 'Ask the meta agent a question, or run one of the stored prompts.',
+        summary: 'Ask the meta agent a question, or run one of the commands.',
         details: lines,
     });
 }
@@ -359,7 +359,7 @@ async function stored(ctx, values, args) {
     if (question) {
         return await go(ctx, values, project, question);
     }
-    // Nothing said and nothing piped: the stored prompts are what is left to offer.
+    // Nothing said and nothing piped: the commands are what is left to offer.
     return await runPrompt(ctx, values, project, await pickPrompt(ctx, project), []);
 }
 async function runPrompt(ctx, values, project, name, extra) {
@@ -508,7 +508,7 @@ async function prompts(ctx, values, args) {
         return json(found.map(({ name, description, path }) => ({ name, description, path })));
     }
     if (found.length === 0) {
-        note(dim(`no prompts in ${project.name}/${PROMPT_DIR}`));
+        note(dim(`no commands in ${project.name}/${SKILL_DIR}`));
         return;
     }
     writeAll(table(found.map((p) => [`/${p.name}`, p.description ? dim(p.description) : ''])));

package/dist/commands/run.js

@@ -33,6 +33,8 @@ export const run = {
         '  --new                  Start a new session without asking which one.',
         '  --input <file>         Read the whole request from JSON. `-` is stdin.',
         '  --workspace <dir>      Directory the agent can read and write.',
+        '                         Default: a fresh one inside the new session.',
+        '  --here                 Same as --workspace with the directory you are in.',
         '  --memory <dir>         Directory the agents remember into.',
         '  --memory-read-only     Recall from it, write nothing back.',
         '  --model <ref>          Use this model instead of the default.',
@@ -59,7 +61,9 @@ export const run = {
         'the answer alone and `2>/dev/null` hides the progress.',
         '',
         'A prompt always starts a new session, so --new is for the TUI, where the',
-        'alternative is being asked which session to continue.',
+        'alternative is being asked which session to continue. Its workspace is a',
+        'fresh, empty directory inside that session; to ask about the files where',
+        'you are, say --here.',
         '',
         '--input names a file holding the whole request - project, input, workspace,',
         'memory - and what it says wins over the same flag on the line. Its paths are',
@@ -98,6 +102,7 @@ export const run = {
         '  zen run                               open the TUI in this project',
         '  zen run acme                          open the TUI in the acme project',
         '  zen run "what changed?"               ask that, print the answer, exit',
+        '  zen run --here "what changed?"        ... about the files in this directory',
         '  git diff | zen run                    take the prompt from stdin',
         '  zen run "what changed?" > out.md      redirect the answer into a file',
         '  zen run --out out.md "what changed?"  write the answer to out.md only',
@@ -118,6 +123,7 @@ export const run = {
             new: { type: 'boolean' },
             input: { type: 'string' },
             workspace: { type: 'string' },
+            here: { type: 'boolean' },
             memory: { type: 'string' },
             'memory-read-only': { type: 'boolean' },
             model: { type: 'string' },
@@ -155,16 +161,20 @@ export const run = {
         if (values.theme !== undefined && !parseChoice(values.theme)) {
             throw usageError(`unknown theme: ${values.theme}`, 'dark, light or auto');
         }
+        if (values.here && values.workspace !== undefined) {
+            throw usageError('--here and --workspace both name the workspace', 'keep one');
+        }
         // With `--input -` the pipe carries the request, not the prompt, so it
         // is read here and never looked at again below.
         const request = values.input ? await readRequest(values.input, ctx.cwd, piped) : undefined;
         const prompt = typed || (request ? '' : (piped ?? ''));
         // A prompt on the command line is a request for an answer, not a
         // conversation to pick up. So it answers the three questions itself:
-        // a fresh session, the directory it was typed in as the workspace,
-        // and no confirmation for it — `zen run acme "what changed?"` should
-        // read the code that is right there. Every flag still wins, and the
-        // TUI, where there is someone to ask, still asks.
+        // a fresh session, a fresh directory inside it as the workspace, and
+        // no confirmation for any of it. Reading the files where it was typed
+        // takes --here: an agent that can write should not land in whatever
+        // directory the shell happened to be in. Every flag still wins, and
+        // the TUI, where there is someone to ask, still asks.
         const input = request ? request.input : prompt;
         const shot = Boolean(prompt) || Boolean(request);
         if (values.events && !shot) {
@@ -175,7 +185,8 @@ export const run = {
             project: request?.project ?? values.project ?? (named ? head : undefined),
             session: values.session,
             fresh: values.new || (shot && !values.session),
-            workspace: request?.workspace ?? values.workspace ?? (shot ? ctx.cwd : undefined),
+            workspace: request?.workspace ?? values.workspace ?? (values.here ? ctx.cwd : undefined),
+            ask: !shot,
             yes: values.yes || shot,
         });
         const engine = await Engine.open({
@@ -234,6 +245,7 @@ const NOT_IN_A_BATCH = [
     ['session', 'every item is a new session of its own'],
     ['new', 'every item is new already'],
     ['workspace', 'they cannot share one; each item gets its own, or names one in the file'],
+    ['here', 'they cannot share one; each item gets its own, or names one in the file'],
     ['plain', 'a batch never draws the TUI'],
     ['theme', 'a batch never draws the TUI'],
     ['events', 'each item already has its own output.json'],

package/dist/completion.js

@@ -14,7 +14,7 @@ import { completeMeta } from "./commands/meta.js";
 // One candidate per line, `value<TAB>description`. Nothing at all means "no
 // opinion", and the shell falls back to completing file names — which is the
 // right answer for `-C <dir>`, for `--events <file>`, and for the files that
-// follow a stored prompt.
+// follow a stored command.
 // ---------------------------------------------------------------------------
 /** Flags the frame owns, offered where a command name would be. */
 const GLOBAL_FLAGS = [

package/dist/meta/editor.js

@@ -1,3 +1,4 @@
+import { existsSync, readdirSync, rmdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { copyTree, TEMPLATES } from "./host.js";
 // ---------------------------------------------------------------------------
@@ -27,8 +28,8 @@ import { copyTree, TEMPLATES } from "./host.js";
 // assistant still needs a brief of its own, and what it needs to know is how
 // this kind of project is put together — the file formats, how a prompt is
 // written, when to add a skill rather than an agent. That is what the
-// `.github/` tree is: the standing brief, plus the prompt files and skills the
-// editor picks up from the same place.
+// `.github/` tree is: the standing brief, plus the skills the editor picks up
+// from the same place - `zen-*` for the model to load, the rest as `/commands`.
 // ---------------------------------------------------------------------------
 /**
  * Writes the editor's files under `dir`, replacing what is there. They are
@@ -38,6 +39,45 @@ import { copyTree, TEMPLATES } from "./host.js";
  * none. Returns the relative paths that actually changed.
  */
 export function editorFiles(dir) {
-    return copyTree(join(TEMPLATES, 'editor'), dir, '', {});
+    return [...copyTree(join(TEMPLATES, 'editor'), dir, '', {}), ...retirePrompts(dir)];
+}
+// Every `.github/prompts/*.prompt.md` `zen` has ever shipped. Copilot dropped
+// prompt files for skills, and these are now `.github/skills/<name>/` - so the
+// old copy would only offer a second, stale `/name`. A prompt file the project
+// wrote itself is not on this list, and stays.
+const RETIRED_PROMPTS = [
+    'analyze',
+    'dataset',
+    'finetune',
+    'finetune-apply',
+    'finetune-consolidate',
+    'inspect',
+    'new-agent',
+    'new-skill',
+    'project-review',
+    'review-project',
+    'spec-apply-feedback',
+    'spec-edit',
+    'spec-sync-project',
+    'sync-with-spec',
+    'update-spec-from-feedback',
+];
+function retirePrompts(dir) {
+    const folder = join(dir, '.github', 'prompts');
+    if (!existsSync(folder)) {
+        return [];
+    }
+    const removed = [];
+    for (const name of RETIRED_PROMPTS) {
+        const file = join(folder, `${name}.prompt.md`);
+        if (existsSync(file)) {
+            rmSync(file);
+            removed.push(join('.github', 'prompts', `${name}.prompt.md`));
+        }
+    }
+    if (readdirSync(folder).length === 0) {
+        rmdirSync(folder);
+    }
+    return removed;
 }
 //# sourceMappingURL=editor.js.map

package/dist/meta/finetune/command.js

@@ -89,7 +89,7 @@ export const FINETUNE_DETAILS = [
     'has its own private memory; passing memories are merged into finetune/memories/.',
     '',
     'A parked case gives its worker back; woken cases take a worker before new ones.',
-    '/finetune-apply fixes the parked cases together: when -M wait, or once nothing',
+    '/zen-finetune-apply fixes the parked cases together: when -M wait, or once nothing',
     'else can run. No run starts during an apply. What it may do:',
     '  - Every call reads the house rules, the prompt, preloaded skills and one line per',
     '    skill, so that is what --budget counts. A skill body is paid only once loaded:',
@@ -461,7 +461,7 @@ async function gate(ctx, project, rest, options) {
     const dir = resolve(ctx.cwd, at);
     const g = readJson(join(dir, 'gate.json'));
     if (!g || existsSync(join(dir, 'applied.json'))) {
-        throw invalidError(`${at} is not an apply in progress`, 'pass the apply directory named on the line after /finetune-apply');
+        throw invalidError(`${at} is not an apply in progress`, 'pass the apply directory named after /zen-finetune-apply');
     }
     const after = await measure(project.dir);
     const over = overLimits(g.before, after, g.limits);

package/dist/meta/finetune/improvements.js

@@ -401,7 +401,7 @@ export class Improvements {
                 join(dir, 'apply.events.jsonl'),
                 '--prompt-file',
                 brief,
-                '/finetune-apply',
+                '/zen-finetune-apply',
                 dir,
             ], applyLog);
             writeFileSync(join(dir, attempt === 1 ? 'apply.json' : `apply-${attempt}.json`), res.stdout);

package/dist/meta/prompts.d.ts

@@ -1,3 +1,4 @@
+export declare const SKILL_DIR = ".github/skills";
 export declare const PROMPT_DIR = ".github/prompts";
 /** `/project-review`, `project-review`, `project-review.prompt.md` or a path. */
 export declare function promptPath(dir: string, name: string): string;
@@ -5,14 +6,18 @@ export interface StoredPrompt {
     name: string;
     path: string;
     description?: string;
+    /** False for a skill marked `user-invocable: false` - the model's, not a command. */
+    invocable: boolean;
     body: string;
 }
 /**
- * Frontmatter is the editor's business — `mode`, `tools`, `description` — and
- * none of it means anything to copilot, so only the body is sent. `description`
- * is kept for the one line of narration that says which prompt is running.
+ * Frontmatter is the editor's business — `name`, `argument-hint`, the
+ * invocation switches — and none of it means anything once the body is the
+ * prompt, so only the body is sent. `description` is kept for the one line of
+ * narration that says which command is running.
  */
 export declare function readPrompt(path: string, name: string, text: string): StoredPrompt;
 export declare function loadPrompt(dir: string, name: string): Promise<StoredPrompt>;
+/** The commands a person may type: every skill not marked for the model only, and any legacy prompt file. */
 export declare function listPrompts(dir: string): Promise<string[]>;
 //# sourceMappingURL=prompts.d.ts.map

package/dist/meta/prompts.js

@@ -1,14 +1,21 @@
-import { existsSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { usageError } from "./host.js";
 // ---------------------------------------------------------------------------
-// Stored prompts
+// Stored commands
 //
-// Copilot reads `AGENTS.md`, `.github/skills/` and `.github/agents/`, but it
-// has no notion of `.github/prompts/*.prompt.md` — the files an editor offers
-// as slash commands. Reading one and handing over its body is the whole of
-// `zen meta run`, and it is why that subcommand exists.
+// The editor offers `.github/skills/<name>/SKILL.md` as `/name`. The `zen-*`
+// skills are reference the model loads on its own (`user-invocable: false`);
+// the rest are commands somebody types (`disable-model-invocation: true`), and
+// those are what `zen meta run /<name>` runs. Copilot would expand `/name`
+// itself, but reading the file and handing over its body works the same with
+// every model and leaves room for `--prompt-file` after it.
+//
+// `.github/prompts/*.prompt.md` is the format these used to be in. Copilot has
+// dropped it, but a project may still have prompt files of its own, so one
+// whose name no skill takes is still run.
 // ---------------------------------------------------------------------------
+export const SKILL_DIR = '.github/skills';
 export const PROMPT_DIR = '.github/prompts';
 const PROMPT_SUFFIX = '.prompt.md';
 /** `/project-review`, `project-review`, `project-review.prompt.md` or a path. */
@@ -17,42 +24,58 @@ export function promptPath(dir, name) {
     if (bare.includes('/') || bare.endsWith('.md')) {
         return `${dir}/${bare}`;
     }
-    return `${dir}/${PROMPT_DIR}/${bare}${PROMPT_SUFFIX}`;
+    const skill = `${dir}/${SKILL_DIR}/${bare}/SKILL.md`;
+    const legacy = `${dir}/${PROMPT_DIR}/${bare}${PROMPT_SUFFIX}`;
+    return !existsSync(skill) && existsSync(legacy) ? legacy : skill;
 }
 /**
- * Frontmatter is the editor's business — `mode`, `tools`, `description` — and
- * none of it means anything to copilot, so only the body is sent. `description`
- * is kept for the one line of narration that says which prompt is running.
+ * Frontmatter is the editor's business — `name`, `argument-hint`, the
+ * invocation switches — and none of it means anything once the body is the
+ * prompt, so only the body is sent. `description` is kept for the one line of
+ * narration that says which command is running.
  */
 export function readPrompt(path, name, text) {
     let body = text;
     let description;
+    let invocable = true;
     const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
     if (match) {
         body = text.slice(match[0].length);
         const found = /^description:\s*(.+)$/m.exec(match[1]);
         description = found?.[1].trim().replace(/^['"]|['"]$/g, '');
+        invocable = !/^user-invocable:\s*['"]?false['"]?\s*$/m.test(match[1]);
     }
-    return { name, path, description, body: body.trim() };
+    return { name, path, description, invocable, body: body.trim() };
 }
 export async function loadPrompt(dir, name) {
     const path = promptPath(dir, name);
     if (!existsSync(path)) {
         const known = await listPrompts(dir);
-        throw usageError(`no prompt named ${name.replace(/^\//, '')}`, known.length > 0
+        throw usageError(`no command named ${name.replace(/^\//, '')}`, known.length > 0
             ? `try: ${known.map((p) => `/${p}`).join(', ')}`
-            : `put one in ${PROMPT_DIR}/`);
+            : `put one in ${SKILL_DIR}/<name>/SKILL.md`);
     }
     return readPrompt(path, name.replace(/^\//, ''), await readFile(path, 'utf8'));
 }
+/** The commands a person may type: every skill not marked for the model only, and any legacy prompt file. */
 export async function listPrompts(dir) {
-    const { readdir } = await import('node:fs/promises');
+    const names = new Set();
+    for (const entry of entries(`${dir}/${SKILL_DIR}`)) {
+        const path = `${dir}/${SKILL_DIR}/${entry}/SKILL.md`;
+        if (existsSync(path) && readPrompt(path, entry, readFileSync(path, 'utf8')).invocable) {
+            names.add(entry);
+        }
+    }
+    for (const entry of entries(`${dir}/${PROMPT_DIR}`)) {
+        if (entry.endsWith(PROMPT_SUFFIX)) {
+            names.add(entry.slice(0, -PROMPT_SUFFIX.length));
+        }
+    }
+    return [...names].sort();
+}
+function entries(path) {
     try {
-        const names = await readdir(`${dir}/${PROMPT_DIR}`);
-        return names
-            .filter((n) => n.endsWith(PROMPT_SUFFIX))
-            .map((n) => n.slice(0, -PROMPT_SUFFIX.length))
-            .sort();
+        return readdirSync(path);
     }
     catch {
         return [];

package/dist/resolve.d.ts

@@ -5,6 +5,8 @@ export interface Wanted {
     session?: string;
     fresh?: boolean;
     workspace?: string;
+    /** false to take the session's own workspace without offering a choice */
+    ask?: boolean;
     yes?: boolean;
     cwd: string;
 }

package/dist/resolve.js

@@ -137,7 +137,7 @@ export async function chooseWorkspace(session, want) {
         await approve(at, session, want);
         return at;
     }
-    if (!term.isInteractive()) {
+    if (want.ask === false || !term.isInteractive()) {
         return own;
     }
     const chosen = await term.choose('Workspace — what the agent can read and write', [

package/dist/usage.d.ts

@@ -3,7 +3,7 @@ import type { ModelUsage, TokenUsage } from '@zenera/neo';
 export declare const LEDGER_ENV = "ZENERA_USAGE_LEDGER";
 /** The meta session whose agent started this process, if one did. */
 export declare const META_SESSION_ENV = "ZENERA_META_SESSION";
-/** The stored prompt that meta session was started with, if any. */
+/** The stored command that meta session was started with, if any. */
 export declare const META_PROMPT_ENV = "ZENERA_META_PROMPT";
 /**
  * Where this project's usage goes: the variable when set, else the fine-tuning's

package/dist/usage.js

@@ -13,7 +13,7 @@ import { warn } from "./term.js";
 export const LEDGER_ENV = 'ZENERA_USAGE_LEDGER';
 /** The meta session whose agent started this process, if one did. */
 export const META_SESSION_ENV = 'ZENERA_META_SESSION';
-/** The stored prompt that meta session was started with, if any. */
+/** The stored command that meta session was started with, if any. */
 export const META_PROMPT_ENV = 'ZENERA_META_PROMPT';
 /**
  * Where this project's usage goes: the variable when set, else the fine-tuning's

package/dist/validate.d.ts

@@ -176,4 +176,15 @@ export interface ValidateOptions {
 }
 export declare function validateProject(opts: ValidateOptions): Promise<Report>;
 export declare function availableTools(root: string, config: ProjectConfig): AnyTool<unknown>[];
+/**
+ * Pins every `@zenera/*` install in the project's Dockerfile to this `zen`,
+ * which is what `zen check --fix` does about `sandbox.pin.stale` and
+ * `sandbox.pin.absent`. Only the version after each name is touched, and only
+ * on lines `checkPin` reads, so whatever else the file holds is left alone.
+ *
+ * Returns the project-relative path when the file was rewritten, and nothing
+ * when there is no Dockerfile, it resolves outside the project, or it already
+ * pins this version — a project that does not load is the report's to explain.
+ */
+export declare function repinDockerfile(root: string): string[];
 //# sourceMappingURL=validate.d.ts.map

package/dist/validate.js

@@ -1,8 +1,8 @@
 import { SHAPES, auditModels, credentialFor, envNames, form, resolveBuild, } from '@zenera/engine';
 import { EXA_GROUP, FileSkillProvider, SANDBOX_MOUNT, Sandbox, exaTools, fileTools, frontmatter, projectRegistry, readProjectConfig, sandboxTools, selectTools, toList, } from '@zenera/neo';
-import { existsSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { probeModels } from "./liveness.js";
 import { BuildError, ensurePodmanReady } from "./podman.js";
 import { ownVersion, staleShared } from "./scaffold.js";
@@ -1315,7 +1315,7 @@ function checkPin(path, rel, add) {
             }
         }
     }
-    const fix = `pin them to ${mine}, the version \`zen --version\` reports`;
+    const fix = `pin them to ${mine}, the version \`zen --version\` reports — \`zen check --fix\` does it`;
     if (stale.size > 0) {
         add({
             severity: 'warning',
@@ -1337,6 +1337,49 @@ function checkPin(path, rel, add) {
         });
     }
 }
+/**
+ * Pins every `@zenera/*` install in the project's Dockerfile to this `zen`,
+ * which is what `zen check --fix` does about `sandbox.pin.stale` and
+ * `sandbox.pin.absent`. Only the version after each name is touched, and only
+ * on lines `checkPin` reads, so whatever else the file holds is left alone.
+ *
+ * Returns the project-relative path when the file was rewritten, and nothing
+ * when there is no Dockerfile, it resolves outside the project, or it already
+ * pins this version — a project that does not load is the report's to explain.
+ */
+export function repinDockerfile(root) {
+    let rel;
+    try {
+        const ref = readProjectConfig(root).config.sandbox?.build?.dockerfile;
+        rel = ref === undefined ? undefined : normalise(root, ref);
+    }
+    catch {
+        return [];
+    }
+    if (rel === undefined) {
+        return [];
+    }
+    const path = join(root, rel);
+    let text;
+    try {
+        text = readFileSync(path, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const mine = ownVersion();
+    const next = text
+        .split('\n')
+        .map((line) => /^\s*#/.test(line)
+        ? line
+        : line.replace(ZENERA_INSTALL, (_, name) => `@zenera/${name}@${mine}`))
+        .join('\n');
+    if (next === text) {
+        return [];
+    }
+    writeFileSync(path, next);
+    return [rel.split(sep).join('/')];
+}
 /** Written by the smoke test and read back, to prove the mount is real. */
 const SMOKE = 'zen-check';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/cli",
-    "version": "1.1.42",
+    "version": "1.1.44",
     "description": "Command-line front end for @zenera/neo: agentic projects you can run, share and commit.",
     "keywords": [
         "agents",
@@ -54,9 +54,9 @@
         "@google/genai": "^2.30.0",
         "@inkjs/ui": "^2.0.0",
         "@openrouter/sdk": "^1.4.25",
-        "@zenera/engine": "^1.1.42",
-        "@zenera/neo": "^1.1.42",
-        "@zenera/view": "^1.1.42",
+        "@zenera/engine": "^1.1.44",
+        "@zenera/neo": "^1.1.44",
+        "@zenera/view": "^1.1.44",
         "google-auth-library": "^10.0.0",
         "ink": "^7.1.1",
         "openai": "^6.0.0",