agent-skills-standard 2.7.3 → 2.7.4

package/README.md

@@ -181,12 +181,12 @@ The CLI **distributes** skills as static files. The companion [`agent-skills-sta
 ags mcp status              # show current state + per-agent install
 ags mcp scope project       # project | user | snippets-only | disabled
 ags mcp via auto            # auto | npx | global launch mode (auto prefers a version-matched global ags-mcp)
-ags mcp enable --install-global   # npm i -g agent-skills-standard-mcp@<pin>, then verify the reported version
+ags mcp enable              # opt in; global launch mode installs agent-skills-standard-mcp@<pin> and verifies it
 ags mcp install             # apply changes
 ags mcp uninstall --from project   # remove our entry; siblings preserved
 ```
 
-Launch mode defaults to `auto`: the generated entry uses a globally installed `ags-mcp` only when its `--version` exactly matches the CLI pin, and otherwise falls back to `npx -y --prefer-offline agent-skills-standard-mcp@<pin>`. `ags mcp status` prints the resolved launch line, the pin, and the detected global version; `ags mcp install --via <mode>` overrides the mode for that run without persisting it. `ags upgrade` does not rewrite runtime configs — run `ags sync` (or `ags mcp install`) to move them to the new pin; `ags mcp status` and `ags doctor` flag configured-vs-expected drift.
+Launch mode defaults to `auto`: the generated entry uses a globally installed `ags-mcp` only when its `--version` exactly matches the CLI pin, and otherwise falls back to `npx -y --prefer-offline agent-skills-standard-mcp@<pin>`. With `via: global` (saved mode, or `ags mcp enable --via global`), `ags mcp enable` installs `agent-skills-standard-mcp@<pin>` globally via npm, verifies the reported version, then writes the runtime configs; a failed install or mismatched probe exits `1` and leaves `.skillsrc` and the configs untouched. `--install-global` remains available as an explicit trigger for the same install. `ags mcp status` prints the resolved launch line, the pin, and the detected global version; `ags mcp install --via <mode>` overrides the mode for that run without persisting it. `ags upgrade` does not rewrite runtime configs — run `ags sync` (or `ags mcp install`) to move them to the new pin; `ags mcp status` and `ags doctor` flag configured-vs-expected drift.
 
 The CLI **never** modifies user-home files (`~/.cursor/mcp.json`, `~/.gemini/settings.json`, etc.) unless you explicitly choose `scope: user` AND confirm each write. See [`mcp/README.md`](../mcp/README.md) for full details and [`mcp/ARCHITECTURE.md`](../mcp/ARCHITECTURE.md) for the threat model.
 

package/dist/index.js

@@ -53,7 +53,7 @@ let crypto = require("crypto");
 crypto = __toESM(crypto);
 var package_default = {
 	name: "agent-skills-standard",
-	version: "2.7.3",
+	version: "2.7.4",
 	description: "A CLI to manage and sync AI agent skills standard for Cursor, Claude, Copilot, Windsurf, and more.",
 	main: "dist/index.js",
 	bin: {
@@ -3638,7 +3638,7 @@ var LockfileService = class {
 * Bumped automatically by `scripts/release-mcp.ts` when the MCP package is
 * released and gated in CI, so this pin always matches `mcp/package.json`.
 */
-var MCP_COMPATIBLE_VERSION = "0.8.0";
+var MCP_COMPATIBLE_VERSION = "0.8.1";
 /**
 * Minimum `agent-skills-standard-mcp` version required for session retrospectives.
 */
@@ -3817,6 +3817,27 @@ var getTargets = (home = os.default.homedir(), platform = process.platform) => {
 	return out;
 };
 /**
+* Command used to run `ags-mcp --version`.
+*
+* On Windows npm exposes the binary as a `.cmd` shim, which `execFileSync`
+* cannot spawn directly (ENOENT), so the probe goes through `cmd /c` — the
+* same shape the generated global launch entry uses. POSIX keeps the bare
+* binary with no shell.
+*/
+function globalVersionProbeCommand(platform = process.platform) {
+	return platform === "win32" ? {
+		command: "cmd",
+		args: [
+			"/c",
+			"ags-mcp",
+			"--version"
+		]
+	} : {
+		command: "ags-mcp",
+		args: ["--version"]
+	};
+}
+/**
 * Owns all MCP-config writes. Pure logic — never prompts the user directly.
 * The caller (sync command, mcp subcommand) supplies a `userScopePrompt`
 * callback that is invoked ONLY when the user has chosen `scope: 'user'` AND
@@ -3835,7 +3856,7 @@ var McpConfigService = class {
 	* stale global must never be silently preferred over the pin.
 	*/
 	buildEntry(opts = {}) {
-		const version = opts.version || "0.8.0";
+		const version = opts.version || "0.8.1";
 		const via = opts.via ?? "auto";
 		const platform = this.testPlatform ?? process.platform;
 		if (via === "global" || via === "auto" && platform !== "win32" && this.detectGlobalVersion() === version) return platform === "win32" ? {
@@ -3863,19 +3884,46 @@ var McpConfigService = class {
 	*  2. the manifest under `npm root -g` — required for servers published
 	*     before `--version` existed, where probe 1 either prints nothing or
 	*     times out because the stdio server starts normally instead.
-	* A missing binary (ENOENT) never falls through: an installed manifest
-	* alone does not prove the command is on the client's PATH.
+	* A missing binary never falls through: an installed manifest alone does
+	* not prove the command is on the client's PATH. POSIX surfaces that as
+	* ENOENT; win32 (which probes through `cmd /c`) proves it with
+	* `where.exe ags-mcp` before allowing the legacy manifest fallback.
 	*/
 	detectGlobalVersion() {
 		const binaryVersion = this.probeGlobalBinaryVersion();
 		if (binaryVersion === GLOBAL_BINARY_MISSING) return null;
-		return binaryVersion ?? this.probeGlobalManifestVersion();
+		if (binaryVersion) return binaryVersion;
+		if (!this.probeGlobalBinaryOnPath()) return null;
+		return this.probeGlobalManifestVersion();
+	}
+	/**
+	* Whether `ags-mcp` resolves on PATH. POSIX misses already surface as
+	* ENOENT in the version probe, so only win32 needs the explicit check.
+	*/
+	probeGlobalBinaryOnPath() {
+		if ((this.testPlatform ?? process.platform) !== "win32") return true;
+		if (this.testGlobalPathProbe) return this.testGlobalPathProbe();
+		try {
+			const output = (0, child_process.execFileSync)("where.exe", ["ags-mcp"], {
+				encoding: "utf8",
+				timeout: 2e3,
+				stdio: [
+					"ignore",
+					"pipe",
+					"ignore"
+				]
+			});
+			return String(output).trim().length > 0;
+		} catch {
+			return false;
+		}
 	}
 	/** `ags-mcp --version`, or the sentinel when the command is not on PATH. */
 	probeGlobalBinaryVersion() {
 		try {
 			if (this.testGlobalVersionProbe) return this.testGlobalVersionProbe();
-			const output = (0, child_process.execFileSync)("ags-mcp", ["--version"], {
+			const { command, args } = globalVersionProbeCommand(this.testPlatform ?? process.platform);
+			const output = (0, child_process.execFileSync)(command, args, {
 				encoding: "utf8",
 				timeout: 2e3,
 				stdio: [
@@ -3934,6 +3982,11 @@ var McpConfigService = class {
 	setGlobalManifestProbeForTesting(fn) {
 		this.testGlobalManifestProbe = fn;
 	}
+	/** For testing: allows overriding the win32 PATH-resolution probe. */
+	testGlobalPathProbe = null;
+	setGlobalPathProbeForTesting(fn) {
+		this.testGlobalPathProbe = fn;
+	}
 	getTargets() {
 		return getTargets(this.testHome ?? void 0);
 	}
@@ -4424,7 +4477,7 @@ var DoctorService = class {
 			version: config.mcp.version,
 			via: config.mcp.via
 		});
-		const pin = config.mcp.version ?? "0.8.0";
+		const pin = config.mcp.version ?? "0.8.1";
 		const drifted = [];
 		for (const row of rows) {
 			if (scope === "project") {
@@ -10615,8 +10668,10 @@ function formatEntry(entry) {
 *   uninstall [--from=...] Remove our entry from configs (project | user | all)
 *   snippets [--via=...]   Generate fresh snippet files in ./mcp-config-snippets/
 *
-* `--install-global` (on enable) installs `agent-skills-standard-mcp@<pin>`
-* globally, then verifies the installed binary reports the pin.
+* `enable` also installs `agent-skills-standard-mcp@<pin>` globally and
+* verifies the reported version whenever the effective launch mode is
+* `global` (saved mode or `--via global`) — no extra flag required.
+* `--install-global` remains as an explicit trigger for the same install.
 */
 var McpCommand = class {
 	configService;
@@ -10630,6 +10685,32 @@ var McpCommand = class {
 	setGlobalInstallerForTesting(fn) {
 		this.globalInstaller = fn ?? defaultGlobalInstaller;
 	}
+	/**
+	* Install the pinned package globally and prove the installed binary
+	* reports that exact pin. Returns false (with exit code 1) when either
+	* step fails so callers can abort before persisting or writing configs.
+	*/
+	ensureGlobalPin(pin) {
+		const spec = `${PACKAGE}@${pin}`;
+		try {
+			this.globalInstaller(spec);
+		} catch {
+			console.log(picocolors.default.red(`❌ Global install failed. Run manually:`));
+			console.log(picocolors.default.gray(`   npm i -g ${spec}`));
+			process.exitCode = 1;
+			return false;
+		}
+		const detected = this.mcpService.detectGlobalVersion();
+		if (detected !== pin) {
+			console.log(picocolors.default.red(`❌ Global ags-mcp reports ${detected ?? "no version"} but the CLI pin is ${pin}.`));
+			if (!detected) console.log(picocolors.default.gray("   Probe found no usable version: check that npm's global bin directory is on PATH and that `ags-mcp --version` prints the expected pin."));
+			console.log(picocolors.default.gray(`   Run manually: npm i -g ${spec}`));
+			process.exitCode = 1;
+			return false;
+		}
+		console.log(picocolors.default.green(`✅ Global ags-mcp ${pin} installed and verified.`));
+		return true;
+	}
 	async run(action, options = {}) {
 		const config = await this.configService.loadConfig();
 		if (!config) {
@@ -10663,7 +10744,7 @@ var McpCommand = class {
 		console.log(`  via     : ${picocolors.default.cyan(mcp.via ?? "auto")}`);
 		console.log(`  prompted: ${mcp.prompted ? "yes" : "no"}`);
 		if (mcp.version) console.log(`  version : ${mcp.version}`);
-		const pin = mcp.version ?? "0.8.0";
+		const pin = mcp.version ?? "0.8.1";
 		const entry = this.mcpService.buildEntry({
 			version: mcp.version,
 			via: mcp.via
@@ -10714,6 +10795,19 @@ var McpCommand = class {
 			console.log(picocolors.default.gray("   Run `ags mcp install` to write the entries, or `ags mcp disable` to clear the consent flag."));
 		}
 	}
+	/**
+	* Per-file consent for user-home MCP configs. Shared by every install path
+	* so `enable` (including global mode) cannot drift from `actionInstall`.
+	*/
+	async promptUserScopeWrite(agent, file) {
+		const { ok } = await inquirer.default.prompt([{
+			type: "confirm",
+			name: "ok",
+			message: `Write user-scope MCP config for ${picocolors.default.cyan(agent)} at ${picocolors.default.gray(file)}?`,
+			default: false
+		}]);
+		return ok;
+	}
 	async actionEnable(config, agents, cwd, options) {
 		const mcp = config.mcp ?? defaultMcpConfig();
 		const viaOverrideRaw = options.via;
@@ -10726,25 +10820,10 @@ var McpCommand = class {
 			console.log(picocolors.default.yellow("⚠️  scope is currently \"disabled\". Set a real scope first: `ags mcp scope project`"));
 			return;
 		}
-		if (options.installGlobal) {
-			const pin = mcp.version ?? "0.8.0";
-			const spec = `${PACKAGE}@${pin}`;
-			try {
-				this.globalInstaller(spec);
-			} catch {
-				console.log(picocolors.default.red(`❌ Global install failed. Run manually:`));
-				console.log(picocolors.default.gray(`   npm i -g ${spec}`));
-				process.exitCode = 1;
-				return;
-			}
-			const detected = this.mcpService.detectGlobalVersion();
-			if (detected !== pin) {
-				console.log(picocolors.default.red(`❌ Global ags-mcp reports ${detected ?? "no version"} but the CLI pin is ${pin}.`));
-				console.log(picocolors.default.gray(`   Run manually: npm i -g ${spec}`));
-				process.exitCode = 1;
-				return;
-			}
-			console.log(picocolors.default.green(`✅ Global ags-mcp ${pin} installed and verified.`));
+		const effectiveVia = viaOverride ?? mcp.via ?? "auto";
+		if (Boolean(options.installGlobal) || effectiveVia === "global") {
+			const pin = mcp.version ?? "0.8.1";
+			if (!this.ensureGlobalPin(pin)) return;
 		}
 		config.mcp = {
 			...mcp,
@@ -10753,16 +10832,18 @@ var McpCommand = class {
 		};
 		await this.configService.saveConfig(config);
 		console.log(picocolors.default.green("✅ MCP enabled."));
-		if (viaOverride) {
+		if (viaOverride || effectiveVia === "global") {
+			const installVia = viaOverride ?? "global";
 			const report = await this.mcpService.install({
 				rootDir: cwd,
 				agents,
 				mcp: {
 					...config.mcp,
-					via: viaOverride
-				}
+					via: installVia
+				},
+				userScopePrompt: (agent, file) => this.promptUserScopeWrite(agent, file)
 			});
-			console.log(picocolors.default.gray(`   Installed configs using launch mode "${viaOverride}".`));
+			console.log(picocolors.default.gray(`   Installed configs using launch mode "${installVia}".`));
 			this.printReport(report, cwd);
 			return;
 		}
@@ -10781,7 +10862,7 @@ var McpCommand = class {
 		};
 		await this.configService.saveConfig(config);
 		console.log(picocolors.default.green(`✅ MCP launch mode set to "${via}".`));
-		if (via === "global") console.log(picocolors.default.yellow("⚠️  \"global\" requires a matching global install: `ags mcp enable --install-global`."));
+		if (via === "global") console.log(picocolors.default.yellow("⚠️  \"global\" requires a matching global install: `ags mcp enable` installs and verifies it automatically."));
 		else if (via === "auto") console.log(picocolors.default.gray("   \"auto\" uses a version-matched global ags-mcp when present, otherwise npx."));
 	}
 	async actionDisable(config) {
@@ -10827,15 +10908,6 @@ var McpCommand = class {
 			console.log(picocolors.default.yellow("Scope is \"disabled\" — nothing to install."));
 			return;
 		}
-		const userPrompt = async (agent, file) => {
-			const { ok } = await inquirer.default.prompt([{
-				type: "confirm",
-				name: "ok",
-				message: `Write user-scope MCP config for ${picocolors.default.cyan(agent)} at ${picocolors.default.gray(file)}?`,
-				default: false
-			}]);
-			return ok;
-		};
 		const report = await this.mcpService.install({
 			rootDir: cwd,
 			agents,
@@ -10845,7 +10917,7 @@ var McpCommand = class {
 				scope: effectiveScope,
 				...viaOverride ? { via: viaOverride } : {}
 			},
-			userScopePrompt: userPrompt
+			userScopePrompt: (agent, file) => this.promptUserScopeWrite(agent, file)
 		});
 		this.printReport(report, cwd);
 	}
@@ -10992,7 +11064,7 @@ var RetrospectiveCommand = class {
 		this.env = deps.env ?? process.env;
 		this.customExit = deps.exit;
 		this.log = deps.log ?? console.log;
-		this.mcpVersion = deps.mcpVersion ?? "0.8.0";
+		this.mcpVersion = deps.mcpVersion ?? "0.8.1";
 	}
 	exit(code) {
 		process.exitCode = code;
@@ -13804,7 +13876,7 @@ program.command("feedback").description("Report skill improvement opportunities
 program.command("upgrade").description("Upgrade the CLI to the latest version").option("--dry-run", "Check for updates without installing").action(async (options) => {
 	await new UpgradeCommand().run(options);
 });
-program.command("mcp <action> [scope]").description("Manage the optional MCP server integration. Actions: status | enable | disable | scope <project|user|snippets-only|disabled> | via <auto|npx|global> | install | uninstall | snippets").option("--scope <scope>", "Override scope for install (project|user|snippets-only|disabled)").option("--via <via>", "Override launch mode for this run (auto|npx|global)").option("--install-global", "On enable: install agent-skills-standard-mcp@<pin> globally, then verify its version").option("--from <from>", "For uninstall: project | user | all (default: project)").action(async (action, positional, opts) => {
+program.command("mcp <action> [scope]").description("Manage the optional MCP server integration. Actions: status | enable | disable | scope <project|user|snippets-only|disabled> | via <auto|npx|global> | install | uninstall | snippets").option("--scope <scope>", "Override scope for install (project|user|snippets-only|disabled)").option("--via <via>", "Override launch mode for this run (auto|npx|global)").option("--install-global", "On enable: install agent-skills-standard-mcp@<pin> globally, then verify its version (automatic when launch mode is global)").option("--from <from>", "For uninstall: project | user | all (default: project)").action(async (action, positional, opts) => {
 	const merged = { ...opts };
 	if (positional) {
 		if (action === "via") merged.via = opts.via ?? positional;