alegra-data-agent 0.2.4 → 0.2.6

package/dist/api.js

@@ -1,5 +1,7 @@
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import { readAuth } from "./auth.js";
-import { COMMAND_NAME, GATEWAY_URL, getPackageVersion } from "./lib.js";
+import { COMMAND_NAME, GATEWAY_URL, getManifestCachePath, getPackageVersion } from "./lib.js";
 import { verifyManifestSignature } from "./signature.js";
 export class ManifestSignatureError extends Error {
     constructor(reason) {
@@ -29,7 +31,7 @@ function newRequestId() {
     return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 }
 function userAgent() {
-    return `${COMMAND_NAME}/${getPackageVersion()} (+https://github.com/alegradev/alegra-data-agent)`;
+    return `${COMMAND_NAME}/${getPackageVersion()} (+https://github.com/Alegra-Team/data-agent-selfservice)`;
 }
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
@@ -63,6 +65,7 @@ async function authedFetch(path, opts = {}) {
                     Accept: "application/json,application/octet-stream",
                     "User-Agent": userAgent(),
                     "X-Request-Id": reqId,
+                    ...opts.headers,
                 },
                 signal: ac.signal,
             });
@@ -109,6 +112,8 @@ async function authedFetch(path, opts = {}) {
             }
             throw new GatewayError(res.status, path, `Gateway con error ${res.status}. Reintenta en unos segundos. Si persiste, reporta a #data (request-id ${reqId}).`);
         }
+        if (res.status === 304 && opts.allowNotModified)
+            return res;
         if (!res.ok) {
             throw new GatewayError(res.status, path, `Gateway respondió ${res.status} en ${path}`);
         }
@@ -158,16 +163,76 @@ function mapNetworkError(err, path, timeoutMs) {
     }
     return new GatewayError(0, path, `Error de red al hablar con el gateway: ${err.message}`);
 }
+export function parseManifestCache(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null)
+            return null;
+        const { etag, manifest } = parsed;
+        if (typeof etag !== "string" || etag.length === 0)
+            return null;
+        if (typeof manifest !== "object" || manifest === null)
+            return null;
+        return { etag, manifest: manifest };
+    }
+    catch {
+        return null;
+    }
+}
+function readManifestCache() {
+    try {
+        return parseManifestCache(readFileSync(getManifestCachePath(), "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeManifestCache(etag, manifest) {
+    const path = getManifestCachePath();
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        const tmp = `${path}.${process.pid}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify({ etag, manifest })}\n`, { mode: 0o600 });
+        try {
+            renameSync(tmp, path);
+        }
+        catch (err) {
+            rmSync(tmp, { force: true });
+            throw err;
+        }
+    }
+    catch {
+    }
+}
+function verifiedOrThrow(manifest) {
+    const check = verifyManifestSignature(manifest, { softFail: false });
+    if (!check.ok) {
+        throw new ManifestSignatureError(check.reason);
+    }
+    return manifest;
+}
 export async function fetchManifest(opts = {}) {
     try {
-        const res = await authedFetch("/api/manifest", opts);
+        const cached = readManifestCache();
+        const res = await authedFetch("/api/manifest", {
+            ...opts,
+            allowNotModified: true,
+            headers: cached ? { ...opts.headers, "If-None-Match": cached.etag } : opts.headers,
+        });
+        if (res.status === 304) {
+            if (cached)
+                return verifiedOrThrow(cached.manifest);
+            const retry = await authedFetch("/api/manifest", { ...opts, allowNotModified: false });
+            if (!retry.ok)
+                return null;
+            return verifiedOrThrow((await retry.json()));
+        }
         if (!res.ok)
             return null;
-        const manifest = (await res.json());
-        const check = verifyManifestSignature(manifest, { softFail: false });
-        if (!check.ok) {
-            throw new ManifestSignatureError(check.reason);
-        }
+        const manifest = verifiedOrThrow((await res.json()));
+        const etag = res.headers.get("etag");
+        if (etag)
+            writeManifestCache(etag, manifest);
         return manifest;
     }
     catch (err) {
@@ -185,8 +250,3 @@ export async function fetchSkillFile(skillName, relPath) {
     const buffer = await res.arrayBuffer();
     return new Uint8Array(buffer);
 }
-export async function fetchMcps(opts = {}) {
-    const res = await authedFetch("/api/mcps", opts);
-    const body = (await res.json());
-    return body.mcps ?? {};
-}

package/dist/auth.js

@@ -25,19 +25,26 @@ function constantTimeStringEq(a, b) {
         return false;
     return timingSafeEqual(ab, bb);
 }
+let _authCache = null;
 export function readAuth() {
+    if (_authCache)
+        return _authCache.value;
     const path = getAuthFilePath();
-    if (!existsSync(path))
-        return null;
-    try {
-        return JSON.parse(readFileSync(path, "utf-8"));
-    }
-    catch {
-        return null;
+    let value = null;
+    if (existsSync(path)) {
+        try {
+            value = JSON.parse(readFileSync(path, "utf-8"));
+        }
+        catch {
+            value = null;
+        }
     }
+    _authCache = { value };
+    return value;
 }
 export function writeAuth(record) {
     const path = getAuthFilePath();
+    _authCache = { value: record };
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, `${JSON.stringify(record, null, 2)}\n`, "utf-8");
     try {
@@ -48,6 +55,7 @@ export function writeAuth(record) {
 }
 export function clearAuth() {
     const path = getAuthFilePath();
+    _authCache = { value: null };
     if (existsSync(path))
         rmSync(path, { force: true });
 }
@@ -278,6 +286,13 @@ function htmlPage(kind, subject) {
 </body>
 </html>`;
 }
+const HTML_ESCAPES = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;",
+};
 function escapeHtml(s) {
-    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+    return s.replace(/[&<>"']/g, (c) => HTML_ESCAPES[c] ?? c);
 }

package/dist/commands/hook.js

@@ -2,16 +2,21 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "
 import { dirname } from "node:path";
 import { logError, logOk, logWarn } from "../colors.js";
 import { COMMAND_NAME, PRODUCT_NAME, getClaudeSettingsPath, getPackageVersion } from "../lib.js";
+function versionRangeForHook(version) {
+    const [rawMajor] = version.split(".");
+    const major = Number.parseInt(rawMajor ?? "0", 10);
+    if (!Number.isFinite(major))
+        return "latest";
+    return major === 0 ? "0.x" : `^${major}.0.0`;
+}
 function hookCommandFor(mode) {
     const v = getPackageVersion();
-    const parts = v.split(".");
-    const major = parts[0] ?? "0";
-    const minor = parts[1] ?? "0";
-    const range = `~${major}.${minor}.0`;
-    const verb = mode === "auto" ? "update --yes" : "check";
+    const range = versionRangeForHook(v);
+    const verb = mode === "auto" ? "update --yes --background" : "check";
     return `pnpm dlx --config.minimumReleaseAge=0 ${COMMAND_NAME}@${range} ${verb} --no-bounce`;
 }
 const HOOK_SIGNATURE = COMMAND_NAME;
+const HOOK_TIMEOUT_SECONDS = 120;
 function readSettings() {
     const path = getClaudeSettingsPath();
     if (!existsSync(path))
@@ -44,7 +49,7 @@ function isOurMatcher(m) {
         h.command.includes(HOOK_SIGNATURE));
 }
 function buildOurMatcher(command) {
-    return { hooks: [{ type: "command", command }] };
+    return { hooks: [{ type: "command", command, timeout: HOOK_TIMEOUT_SECONDS }] };
 }
 export function runHookInstall(mode = "auto") {
     const settings = readSettings();
@@ -89,29 +94,6 @@ export function runHookInstall(mode = "auto") {
     }
     return 0;
 }
-export function refreshHookCommand() {
-    try {
-        const settings = readSettings();
-        if (!settings?.hooks)
-            return;
-        const existing = settings.hooks.SessionStart;
-        if (!Array.isArray(existing))
-            return;
-        const ours = existing.find(isOurMatcher);
-        if (!ours)
-            return;
-        const current = ours.hooks.find((h) => h.type === "command")?.command ?? "";
-        const fresh = hookCommandFor("auto");
-        if (current === fresh)
-            return;
-        const others = existing.filter((m) => !isOurMatcher(m));
-        others.push(buildOurMatcher(fresh));
-        settings.hooks.SessionStart = others;
-        writeSettings(settings);
-    }
-    catch {
-    }
-}
 export function runHookUninstall(opts = {}) {
     const say = opts.quiet ? () => { } : logWarn;
     const sayOk = opts.quiet ? () => { } : logOk;
@@ -155,4 +137,4 @@ export function runHookUninstall(opts = {}) {
     sayOk("Hook removido.");
     return 0;
 }
-export { hookCommandFor };
+export { hookCommandFor, versionRangeForHook };

package/dist/commands/install.js

@@ -141,7 +141,7 @@ function printNextSteps(noHook) {
         log(`     ${dim("$")} ${bold(`${COMMAND_NAME} hook uninstall`)}  ${gray("apagar aviso")}`);
     }
     log("");
-    log(`   ${dim("Docs · ")}${cyan("github.com/alegradev/alegra-data-agent")}`);
+    log(`   ${dim("Docs · ")}${cyan("github.com/Alegra-Team/data-agent-selfservice")}`);
     log("");
 }
 function isClaudeCode() {

package/dist/commands/login.js

@@ -19,7 +19,7 @@ export async function runLogin(opts = {}) {
     }
     log(`  Gateway: ${dim(GATEWAY_URL)}`);
     try {
-        const record = await performBrowserLogin();
+        const record = await performBrowserLogin(opts.timeoutMs);
         writeAuth(record);
         log("");
         log(`  ${green("✓")} Autenticado como ${bold(record.email)}.`);

package/dist/commands/status.js

@@ -2,8 +2,9 @@ import { existsSync, readFileSync } from "node:fs";
 import { AuthRequiredError, fetchManifest } from "../api.js";
 import { readAuth } from "../auth.js";
 import { bold, cyan, dim, gray, green, log, logError, logWarn, yellow } from "../colors.js";
-import { detectDrift } from "../installer.js";
+import { detectDrift, inspectMcpInTarget } from "../installer.js";
 import { COMMAND_NAME, GATEWAY_URL, getAutoUpdateLogPath, getClaudeSkillsDir, getLockFilePath, getPackageVersion, getTargetSkillsDir, readLockFile, } from "../lib.js";
+import { TARGETS } from "../targets.js";
 function reportAutoUpdateLog() {
     const logPath = getAutoUpdateLogPath();
     if (!existsSync(logPath))
@@ -18,6 +19,141 @@ function reportAutoUpdateLog() {
     catch {
     }
 }
+function reportMcps(manifest, lock) {
+    const mcps = manifest.mcps ?? {};
+    const names = Object.keys(mcps);
+    if (names.length === 0)
+        return;
+    log(bold("  MCPs:"));
+    for (const name of names) {
+        const entry = mcps[name];
+        const targets = (lock.mcps?.[name]?.targets ?? []);
+        if (targets.length === 0) {
+            log(`    ${cyan("+")} ${name} ${gray("(disponible, sin instalar)")}`);
+            continue;
+        }
+        const ok = [];
+        const missing = [];
+        const modified = [];
+        const broken = [];
+        const stale = [];
+        const prevHashes = lock.mcps?.[name]?.renderedHash;
+        for (const t of targets) {
+            const label = TARGETS[t].label;
+            const state = inspectMcpInTarget(entry, TARGETS[t], prevHashes?.[t]);
+            if (state === "ok")
+                ok.push(label);
+            else if (state === "missing")
+                missing.push(label);
+            else if (state === "stale")
+                stale.push(label);
+            else if (state === "broken")
+                broken.push(label);
+            else
+                modified.push(label);
+        }
+        const notes = [];
+        if (ok.length > 0)
+            notes.push(gray(`ok en ${ok.join(", ")}`));
+        if (modified.length > 0)
+            notes.push(dim(`editado a mano en ${modified.join(", ")}`));
+        if (broken.length > 0)
+            notes.push(yellow(`sin \`type\` — el cliente la descarta en ${broken.join(", ")}`));
+        if (stale.length > 0)
+            notes.push(dim(`formato viejo en ${stale.join(", ")} — se actualiza`));
+        if (missing.length > 0)
+            notes.push(yellow(`falta en ${missing.join(", ")}`));
+        const icon = missing.length > 0 || broken.length > 0
+            ? yellow("✗")
+            : stale.length > 0 || modified.length > 0
+                ? dim("~")
+                : green("✓");
+        log(`    ${icon} ${name} ${gray("·")} ${notes.join(gray(" · "))}`);
+    }
+    log("");
+}
+function reportAccountConnectorOverlap(manifest) {
+    const claudeCfg = TARGETS["claude-code"].mcpConfigPath;
+    if (!existsSync(claudeCfg))
+        return;
+    let connected = [];
+    try {
+        const cfg = JSON.parse(readFileSync(claudeCfg, "utf-8"));
+        if (!Array.isArray(cfg.claudeAiMcpEverConnected))
+            return;
+        connected = cfg.claudeAiMcpEverConnected.filter((x) => typeof x === "string");
+    }
+    catch {
+        return;
+    }
+    if (connected.length === 0)
+        return;
+    const norm = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, "");
+    const overlap = [];
+    for (const name of Object.keys(manifest.mcps ?? {})) {
+        const ours = norm(name);
+        const dup = connected.find((c) => {
+            const label = norm(c.replace(/^claude\.ai\s*/i, ""));
+            return label.includes(ours) || ours.includes(label);
+        });
+        if (dup)
+            overlap.push(`${name} ↔ "${dup}"`);
+    }
+    if (overlap.length === 0)
+        return;
+    logWarn(`Tenés ${overlap.length} connector(s) de tu cuenta que duplican un MCP del agente:`);
+    for (const o of overlap)
+        log(gray(`                  ${o}`));
+    log(gray("                  Son servidores distintos, cada uno con su propia autenticación."));
+    log(gray("                  Si el oficial no está autenticado, el agente puede responder por el"));
+    log(gray("                  tuyo — y un connector personalizado apunta a donde alguien escribió."));
+    log(gray(`                  Autenticá los del agente: /mcp → click en el servicio → Authenticate.`));
+    log("");
+}
+export function findRogueMetabase(manifest, specs = Object.values(TARGETS)) {
+    const official = manifest.mcps?.metabase?.url;
+    if (!official)
+        return [];
+    const norm = (u) => u.trim().replace(/\/+$/, "").toLowerCase();
+    const officialNorm = norm(official);
+    const found = [];
+    for (const spec of specs) {
+        if (!spec.mcpConfigPath.endsWith(".json"))
+            continue;
+        if (!existsSync(spec.mcpConfigPath))
+            continue;
+        try {
+            const cfg = JSON.parse(readFileSync(spec.mcpConfigPath, "utf-8"));
+            const servers = cfg[spec.mcpRootKey];
+            if (!servers || typeof servers !== "object")
+                continue;
+            for (const [name, def] of Object.entries(servers)) {
+                if (!/metabase/i.test(name))
+                    continue;
+                const url = def?.[spec.mcpUrlKey];
+                if (typeof url === "string" && norm(url) === officialNorm)
+                    continue;
+                found.push(`${spec.label} → ${name}${typeof url === "string" ? ` (${url})` : ""}`);
+            }
+        }
+        catch {
+        }
+    }
+    return found;
+}
+function reportRogueMetabase(manifest) {
+    const official = manifest.mcps?.metabase?.url;
+    if (!official)
+        return;
+    const found = findRogueMetabase(manifest);
+    if (found.length === 0)
+        return;
+    logWarn(`Hay ${found.length} MCP(s) de Metabase que NO son el oficial de Alegra: ${found.join(" · ")}`);
+    log(gray(`                  El oficial es ${official}. Los otros son otra fuente y dan otros números.`));
+    log(gray("                  Las skills tienen instrucción de no usarlos, pero eso no los bloquea:"));
+    log(gray("                  si no los necesitás, conviene quitarlos del cliente."));
+    log("");
+}
 export async function runStatus() {
     const auth = readAuth();
     const lockForTargets = readLockFile();
@@ -63,6 +199,12 @@ export async function runStatus() {
     }
     const lock = readLockFile();
     const drift = detectDrift(manifest);
+    const cliVersion = getPackageVersion();
+    if (manifest.productVersion && manifest.productVersion !== cliVersion) {
+        log(`  ${gray("Manifest:")}       generado por v${manifest.productVersion} ${gray(`· tu CLI corre v${cliVersion}`)}`);
+        log(gray("                  No es un error: el gateway y npm se despliegan por separado."));
+        log("");
+    }
     log(bold("  Skills:"));
     log(`    ${green("✓")} ${drift.unchanged.length} al día`);
     if (drift.toInstall.length > 0)
@@ -72,9 +214,15 @@ export async function runStatus() {
     if (drift.orphaned.length > 0)
         log(`    ${dim("·")} ${drift.orphaned.length} huérfanas: ${drift.orphaned.join(", ")}`);
     log("");
-    const total = drift.toInstall.length + drift.toUpdate.length;
+    reportMcps(manifest, lock);
+    reportRogueMetabase(manifest);
+    reportAccountConnectorOverlap(manifest);
+    const total = drift.toInstall.length +
+        drift.toUpdate.length +
+        drift.mcps.toInstall.length +
+        drift.mcps.toUpdate.length;
     if (total > 0) {
-        logWarn(`Hay ${total} skill(s) por actualizar. Agente: ejecutá vos mismo ${bold(`pnpm dlx ${COMMAND_NAME} update --yes`)} — el usuario no corre comandos.`);
+        logWarn(`Hay ${total} elemento(s) (skills + MCPs) por actualizar. Agente: ejecutá vos mismo ${bold(`pnpm dlx ${COMMAND_NAME} update --yes`)} — el usuario no corre comandos.`);
     }
     else if (Object.keys(lock.skills).length === 0) {
         logWarn(`Aún no hay skills instaladas. Agente: ejecutá vos mismo ${bold(`pnpm dlx ${COMMAND_NAME}`)} — el usuario no corre comandos.`);

package/dist/commands/update.js

@@ -1,18 +1,45 @@
-import { rmSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
 import { AuthRequiredError, fetchManifest } from "../api.js";
 import { hasValidAuth } from "../auth.js";
 import { refreshAutoUpdate } from "../autoupdate.js";
 import { cyan, dim, gray, green, log, logError, yellow } from "../colors.js";
 import { detectDrift, installAll, summarize } from "../installer.js";
-import { getAutoUpdateLogPath } from "../lib.js";
+import { getAutoUpdateLogPath, getLastCheckPath } from "../lib.js";
 import { banner } from "../ui.js";
 import { runLogin } from "./login.js";
+const BACKGROUND_COOLDOWN_MS = 15 * 60_000;
+const BACKGROUND_LOGIN_TIMEOUT_MS = 90_000;
+function checkedRecently() {
+    try {
+        const raw = readFileSync(getLastCheckPath(), "utf-8");
+        const at = Date.parse(JSON.parse(raw).checkedAt ?? "");
+        if (Number.isNaN(at))
+            return false;
+        const age = Date.now() - at;
+        return age >= 0 && age < BACKGROUND_COOLDOWN_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function markChecked() {
+    try {
+        const path = getLastCheckPath();
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${JSON.stringify({ checkedAt: new Date().toISOString() }, null, 2)}\n`);
+    }
+    catch {
+    }
+}
 export async function runUpdate(opts = {}) {
+    if (opts.background && !opts.dryRun && checkedRecently())
+        return 0;
     banner();
     if (!hasValidAuth()) {
-        const code = await runLogin({});
+        const code = await runLogin(opts.background ? { timeoutMs: BACKGROUND_LOGIN_TIMEOUT_MS } : {});
         if (code !== 0)
-            return code;
+            return opts.background ? 0 : code;
     }
     let reauthed = false;
     for (;;) {
@@ -52,6 +79,8 @@ async function runUpdateOnce(opts) {
     ];
     if (pending.length === 0) {
         log(green("  ✓ Todo al día (skills + MCPs).\n"));
+        if (!opts.dryRun)
+            markChecked();
         if (!opts.dryRun) {
             refreshAutoUpdate();
             clearAutoUpdateLog();
@@ -65,14 +94,18 @@ async function runUpdateOnce(opts) {
         log(`    ${yellow("↻")} ${name} ${gray("(skill nueva versión)")}`);
     for (const name of drift.mcps.toInstall)
         log(`    ${cyan("+")} ${name} ${gray("(MCP nuevo)")}`);
-    for (const name of drift.mcps.toUpdate)
-        log(`    ${yellow("↻")} ${name} ${gray("(MCP actualizado)")}`);
+    for (const name of drift.mcps.toUpdate) {
+        const motivo = drift.mcps.missing.includes(name)
+            ? "(MCP ausente o descartado por el cliente — se repone)"
+            : "(MCP actualizado)";
+        log(`    ${yellow("↻")} ${name} ${gray(motivo)}`);
+    }
     log("");
     if (opts.dryRun) {
         log(dim("  Modo dry-run: no se modificará nada.\n"));
         return 0;
     }
-    const result = await installAll({ only: pending, targets: opts.targets, force: true });
+    const result = await installAll({ only: pending, targets: opts.targets });
     if ("error" in result) {
         logError(result.error);
         return 1;
@@ -80,8 +113,10 @@ async function runUpdateOnce(opts) {
     summarize(result.results);
     refreshAutoUpdate();
     const failed = result.results.some((r) => r.status === "failed");
-    if (!failed)
+    if (!failed) {
         clearAutoUpdateLog();
+        markChecked();
+    }
     return failed ? 1 : 0;
 }
 function clearAutoUpdateLog() {

package/dist/installer.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve, sep } from "node:path";
+import { copyFileSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join, resolve, sep } from "node:path";
 import { AuthRequiredError, fetchManifest, fetchSkillFile } from "./api.js";
 import { dim, gray, green, logError, red, yellow } from "./colors.js";
 import { adaptStdioCommand, ensureDir, getAntigravityGeminiLegacyMcpConfigPath, getAntigravityGeminiLegacySkillsDir, getAntigravityLegacyMcpConfigPath, getAntigravityLegacySkillsDir, getClaudeSettingsPath, getCursorLegacyRulesDir, getLockFilePath, getOpenCodeLegacyPromptsDir, getPackageVersion, readLockFile, sha256File, writeLockFile, } from "./lib.js";
@@ -44,6 +44,17 @@ function mcpConfigHash(mcp) {
     });
     return createHash("sha256").update(salient).digest("hex");
 }
+function stableStringify(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(",")}]`;
+    const o = value;
+    return `{${Object.keys(o)
+        .sort()
+        .map((k) => `${JSON.stringify(k)}:${stableStringify(o[k])}`)
+        .join(",")}}`;
+}
 function safeJoinSkillFile(skillRoot, rel) {
     const candidate = resolve(skillRoot, rel);
     const root = resolve(skillRoot);
@@ -73,33 +84,51 @@ export function verifyInstalledFiles(dir, entry) {
 function sha256Buffer(buf) {
     return createHash("sha256").update(buf).digest("hex");
 }
+const DOWNLOAD_CONCURRENCY = 8;
+async function mapWithLimit(items, limit, fn) {
+    const out = new Array(items.length);
+    let next = 0;
+    const worker = async () => {
+        for (;;) {
+            const i = next++;
+            if (i >= items.length)
+                return;
+            out[i] = await fn(items[i]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    return out;
+}
 async function stageSkill(skillName, entry) {
     validateSkillName(skillName);
     for (const rel of entry.files)
         validateRelPath(rel);
-    const staged = [];
-    for (const rel of entry.files) {
+    return mapWithLimit(entry.files, DOWNLOAD_CONCURRENCY, async (rel) => {
         const data = await fetchSkillFile(skillName, rel);
         const actualHash = sha256Buffer(data);
         const expectedHash = entry.sha256[rel];
         if (actualHash !== expectedHash) {
             throw new Error(`hash inválido para ${skillName}/${rel}: esperaba ${expectedHash.slice(0, 12)}…, recibido ${actualHash.slice(0, 12)}…`);
         }
-        staged.push({ rel, data });
-    }
-    return staged;
+        return { rel, data };
+    });
+}
+function skillDirsFor(spec) {
+    return [spec.skillsDir, ...(spec.mirrorSkillsDirs ?? [])];
 }
 function writeSkillToTarget(skillName, staged, spec) {
     validateSkillName(skillName);
     if (spec.skillFormat === "folder") {
-        const dst = join(spec.skillsDir, skillName);
-        if (existsSync(dst))
-            withFsRetry(() => rmSync(dst, { recursive: true, force: true }));
-        ensureDir(dst);
-        for (const f of staged) {
-            const dstFile = safeJoinSkillFile(dst, f.rel);
-            ensureDir(dirname(dstFile));
-            withFsRetry(() => writeFileSync(dstFile, f.data));
+        for (const base of skillDirsFor(spec)) {
+            const dst = join(base, skillName);
+            if (existsSync(dst))
+                withFsRetry(() => rmSync(dst, { recursive: true, force: true }));
+            ensureDir(dst);
+            for (const f of staged) {
+                const dstFile = safeJoinSkillFile(dst, f.rel);
+                ensureDir(dirname(dstFile));
+                withFsRetry(() => writeFileSync(dstFile, f.data));
+            }
         }
         return;
     }
@@ -190,11 +219,30 @@ function atomicWriteFile(path, content) {
         }
     }
 }
+const MAX_BACKUPS = 3;
+const backedUpThisRun = new Set();
 function backupIfExists(path) {
     if (!existsSync(path))
         return;
-    const bak = `${path}.bak-${Date.now()}`;
-    copyFileSync(path, bak);
+    if (backedUpThisRun.has(path))
+        return;
+    copyFileSync(path, `${path}.bak-${Date.now()}`);
+    backedUpThisRun.add(path);
+    pruneBackups(path);
+}
+function pruneBackups(path) {
+    try {
+        const dir = dirname(path);
+        const prefix = `${basename(path)}.bak-`;
+        const stale = readdirSync(dir)
+            .filter((f) => f.startsWith(prefix))
+            .sort()
+            .slice(0, -MAX_BACKUPS);
+        for (const f of stale)
+            rmSync(join(dir, f), { force: true });
+    }
+    catch {
+    }
 }
 function readJsonOrEmpty(path) {
     if (!existsSync(path))
@@ -282,6 +330,19 @@ export function upsertTomlBlock(content, name, block) {
     const sep = content.endsWith("\n\n") ? "" : content.endsWith("\n") ? "\n" : "\n\n";
     return `${content}${sep}${fenced}\n`;
 }
+export function extractTomlBlock(content, name) {
+    const { begin, end } = tomlMarkers(name);
+    const bi = content.indexOf(begin);
+    if (bi === -1)
+        return null;
+    const ei = content.indexOf(end, bi);
+    if (ei === -1)
+        return null;
+    return content
+        .slice(bi + begin.length, ei)
+        .replace(/^\n/, "")
+        .replace(/\n$/, "");
+}
 export function removeTomlBlock(content, name) {
     const { begin, end } = tomlMarkers(name);
     const bi = content.indexOf(begin);
@@ -317,14 +378,77 @@ function unregisterMcpInTomlBlock(name, spec) {
     atomicWriteFile(spec.mcpConfigPath, next);
     return true;
 }
+export function renderedEntryHash(mcp, spec) {
+    const rendered = spec.mcpMechanism === "toml-block"
+        ? renderMcpToml(mcp).trim()
+        : stableStringify(renderMcpForTarget(mcp, spec));
+    return createHash("sha256").update(rendered).digest("hex");
+}
+function hashOf(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function isDiscardedByClient(current, spec) {
+    if (!spec.mcpHttpTypeValue)
+        return false;
+    if (!current || typeof current !== "object")
+        return false;
+    const entry = current;
+    if (typeof entry[spec.mcpUrlKey] !== "string")
+        return false;
+    return typeof entry.type !== "string";
+}
+export function inspectMcpInTarget(mcp, spec, prevHash) {
+    try {
+        if (!existsSync(spec.mcpConfigPath))
+            return "missing";
+        if (spec.mcpMechanism === "toml-block") {
+            const block = extractTomlBlock(readFileSync(spec.mcpConfigPath, "utf-8"), mcp.name);
+            if (block === null)
+                return "missing";
+            const current = block.trim();
+            if (current === renderMcpToml(mcp).trim())
+                return "ok";
+            return prevHash && hashOf(current) === prevHash ? "stale" : "modified";
+        }
+        const cfg = JSON.parse(readFileSync(spec.mcpConfigPath, "utf-8"));
+        const section = cfg[spec.mcpRootKey];
+        if (!section || typeof section !== "object")
+            return "missing";
+        const current = section[mcp.name];
+        if (current === undefined)
+            return "missing";
+        const currentStr = stableStringify(current);
+        if (currentStr === stableStringify(renderMcpForTarget(mcp, spec)))
+            return "ok";
+        if (prevHash && hashOf(currentStr) === prevHash)
+            return "stale";
+        if (isDiscardedByClient(current, spec))
+            return "broken";
+        return "modified";
+    }
+    catch {
+        return "missing";
+    }
+}
+function mcpNeedsRepairInTargets(mcp, targets, renderedHash) {
+    return targets.filter((id) => {
+        const state = inspectMcpInTarget(mcp, TARGETS[id], renderedHash?.[id]);
+        return state === "missing" || state === "stale" || state === "broken";
+    });
+}
+const cleanedTargets = new Set();
 function resolveTargets(opts) {
     const ids = opts.targets?.length ? opts.targets : detectInstalledTargets();
     if (ids.length === 0) {
         ids.push("claude-code");
     }
     const specs = ids.map((id) => TARGETS[id]);
-    for (const spec of specs)
+    for (const spec of specs) {
+        if (cleanedTargets.has(spec.id))
+            continue;
+        cleanedTargets.add(spec.id);
         cleanupLegacySkillArtifacts(spec);
+    }
     return specs;
 }
 const LEGACY_RENAMED_SKILLS = ["alanube", "alegra-producto", "alegra-ce-universe"];
@@ -360,10 +484,12 @@ function stripMcpEntries(path, names) {
 function cleanupLegacySkillArtifacts(spec) {
     try {
         if (spec.skillFormat === "folder") {
-            for (const old of LEGACY_RENAMED_SKILLS) {
-                const dir = join(spec.skillsDir, old);
-                if (existsSync(dir))
-                    rmSync(dir, { recursive: true, force: true });
+            for (const base of skillDirsFor(spec)) {
+                for (const old of LEGACY_RENAMED_SKILLS) {
+                    const dir = join(base, old);
+                    if (existsSync(dir))
+                        rmSync(dir, { recursive: true, force: true });
+                }
             }
         }
         const lock = readLockFile();
@@ -459,7 +585,13 @@ export async function installSkill(name, manifest, opts = {}) {
         }
     }
     if (okTargets.length === 0) {
-        return { name, kind: "skill", status: "failed", targets: targetIds, error: failures.join("; ") };
+        return {
+            name,
+            kind: "skill",
+            status: "failed",
+            targets: targetIds,
+            error: failures.join("; "),
+        };
     }
     lock.skills[name] = {
         name,
@@ -506,7 +638,17 @@ export function installMcp(mcp, opts = {}) {
     const targetsMatch = prev?.targets &&
         prev.targets.length === targetIds.length &&
         prev.targets.every((t) => targetIds.includes(t));
-    if (prev && targetsMatch && prev.configHash === mcpConfigHash(mcp) && !opts.force) {
+    const configChanged = !prev || prev.configHash !== mcpConfigHash(mcp);
+    const prevHashes = readLockFile().mcps?.[mcp.name]?.renderedHash;
+    const needsWrite = (t) => {
+        const state = inspectMcpInTarget(mcp, t, prevHashes?.[t.id]);
+        return state === "missing" || state === "stale" || state === "broken";
+    };
+    const writeTargets = opts.force || configChanged ? wantedTargets : wantedTargets.filter(needsWrite);
+    const alreadyThere = wantedTargets
+        .filter((t) => !writeTargets.includes(t) && !needsWrite(t))
+        .map((t) => t.id);
+    if (writeTargets.length === 0 && targetsMatch) {
         return { name: mcp.name, kind: "mcp", status: "unchanged", targets: targetIds };
     }
     if (opts.dryRun) {
@@ -514,20 +656,21 @@ export function installMcp(mcp, opts = {}) {
             name: mcp.name,
             kind: "mcp",
             status: prev ? "updated" : "installed",
-            targets: targetIds,
+            targets: writeTargets.map((t) => t.id),
         };
     }
-    const okTargets = [];
+    const written = [];
     const failures = [];
-    for (const t of wantedTargets) {
+    for (const t of writeTargets) {
         try {
             registerMcpInTarget(mcp, t);
-            okTargets.push(t.id);
+            written.push(t.id);
         }
         catch (err) {
             failures.push(`${t.id}: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    const okTargets = [...new Set([...alreadyThere, ...written])];
     if (okTargets.length === 0) {
         return {
             name: mcp.name,
@@ -537,12 +680,18 @@ export function installMcp(mcp, opts = {}) {
             error: failures.join("; "),
         };
     }
+    const renderedHash = { ...(prev?.renderedHash ?? {}) };
+    for (const t of writeTargets) {
+        if (okTargets.includes(t.id))
+            renderedHash[t.id] = renderedEntryHash(mcp, t);
+    }
     lock.mcps[mcp.name] = {
         name: mcp.name,
         installedFrom: getPackageVersion(),
         installedAt: new Date().toISOString(),
         configHash: mcpConfigHash(mcp),
         targets: okTargets,
+        renderedHash,
     };
     writeLockFile(lock);
     return {
@@ -604,9 +753,11 @@ export function uninstallSkill(name, opts = {}) {
         for (const tId of targetIds) {
             const spec = TARGETS[tId];
             if (spec.skillFormat === "folder") {
-                const dst = join(spec.skillsDir, name);
-                if (existsSync(dst))
-                    rmSync(dst, { recursive: true, force: true });
+                for (const base of skillDirsFor(spec)) {
+                    const dst = join(base, name);
+                    if (existsSync(dst))
+                        rmSync(dst, { recursive: true, force: true });
+                }
             }
             else {
                 const ext = spec.skillFormat === "cursor-mdc" ? ".mdc" : ".md";
@@ -703,16 +854,27 @@ export function detectDrift(manifest) {
         toUpdate: [],
         unchanged: [],
         orphaned: [],
+        missing: [],
     };
     const manifestMcps = manifest.mcps ?? {};
     for (const name of Object.keys(manifestMcps)) {
         const prevMcp = lock.mcps?.[name];
-        if (!prevMcp)
+        if (!prevMcp) {
             mcps.toInstall.push(name);
-        else if (prevMcp.configHash !== mcpConfigHash(manifestMcps[name]))
+            continue;
+        }
+        if (prevMcp.configHash !== mcpConfigHash(manifestMcps[name])) {
+            mcps.toUpdate.push(name);
+            continue;
+        }
+        const missing = mcpNeedsRepairInTargets(manifestMcps[name], (prevMcp.targets ?? []), prevMcp.renderedHash);
+        if (missing.length > 0) {
             mcps.toUpdate.push(name);
-        else
+            mcps.missing.push(name);
+        }
+        else {
             mcps.unchanged.push(name);
+        }
     }
     for (const name of Object.keys(lock.mcps ?? {})) {
         if (!manifestMcps[name])

package/dist/lib.js

@@ -5,7 +5,7 @@ import { dirname, join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 export const PRODUCT_NAME = "alegra-data-agent";
 export const COMMAND_NAME = "alegra-data-agent";
-export const REPO_SLUG = "alegradev/alegra-data-agent";
+export const REPO_SLUG = "Alegra-Team/data-agent-selfservice";
 export const REPO_DEFAULT_BRANCH = "main";
 export const GATEWAY_URL = process.env.ALEGRA_DATA_AGENT_GATEWAY_URL ?? "https://alegra-data-agent.vercel.app";
 export const ALL_TARGETS = [
@@ -19,12 +19,6 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 export function getPackageRoot() {
     return join(__dirname, "..");
 }
-export function getRegistryDir() {
-    return join(getPackageRoot(), "skills-registry");
-}
-export function getManifestPath() {
-    return join(getRegistryDir(), "index.json");
-}
 export function getClaudeSkillsDir() {
     return join(homedir(), ".claude", "skills");
 }
@@ -59,6 +53,9 @@ export function getOpenCodeConfigPath() {
     return join(base, "opencode", "opencode.json");
 }
 export function getAntigravitySkillsDir() {
+    return join(homedir(), ".gemini", "antigravity-cli", "skills");
+}
+export function getAntigravityGeminiSkillsDir() {
     return join(homedir(), ".gemini", "skills");
 }
 export function getAntigravityMcpConfigPath() {
@@ -142,6 +139,12 @@ export function getConfigDir() {
 export function getAuthFilePath() {
     return join(getConfigDir(), "auth.json");
 }
+export function getLastCheckPath() {
+    return join(getConfigDir(), "last-check.json");
+}
+export function getManifestCachePath() {
+    return join(getConfigDir(), "manifest-cache.json");
+}
 export function getAutoUpdateLogPath() {
     return join(getConfigDir(), "autoupdate.log");
 }
@@ -158,31 +161,29 @@ export function getPackageVersion() {
     }
     return _cachedVersion;
 }
-export function readManifest() {
-    const path = getManifestPath();
-    if (!existsSync(path))
-        return null;
-    try {
-        return JSON.parse(readFileSync(path, "utf-8"));
-    }
-    catch {
-        return null;
-    }
+let _lockCache = null;
+function emptyLock() {
+    return { schemaVersion: 1, productName: PRODUCT_NAME, skills: {} };
 }
 export function readLockFile() {
+    if (_lockCache)
+        return _lockCache;
     const path = getLockFilePath();
-    if (!existsSync(path)) {
-        return { schemaVersion: 1, productName: PRODUCT_NAME, skills: {} };
-    }
-    try {
-        return JSON.parse(readFileSync(path, "utf-8"));
-    }
-    catch {
-        return { schemaVersion: 1, productName: PRODUCT_NAME, skills: {} };
+    let lock = emptyLock();
+    if (existsSync(path)) {
+        try {
+            lock = JSON.parse(readFileSync(path, "utf-8"));
+        }
+        catch {
+            lock = emptyLock();
+        }
     }
+    _lockCache = lock;
+    return lock;
 }
 export function writeLockFile(lock) {
     const path = getLockFilePath();
+    _lockCache = lock;
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, `${JSON.stringify(lock, null, 2)}\n`, "utf-8");
 }

package/dist/main.js

@@ -37,6 +37,7 @@ function parseArgs(argv) {
         noHook: false,
         noBounce: false,
         autoUpdate: false,
+        background: false,
     };
     const positional = [];
     const only = [];
@@ -56,6 +57,8 @@ function parseArgs(argv) {
             flags.noBounce = true;
         else if (a === "--auto-update")
             flags.autoUpdate = true;
+        else if (a === "--background")
+            flags.background = true;
         else if (a === "-h" || a === "--help")
             flags.help = true;
         else if (a === "-v" || a === "--version")
@@ -128,6 +131,7 @@ async function main() {
             exitCode = await runUpdate({
                 yes: args.flags.yes,
                 dryRun: args.flags.dryRun,
+                background: args.flags.background,
                 targets: args.targets.length > 0 ? args.targets : undefined,
             });
             break;

package/dist/render.js

@@ -81,6 +81,9 @@ export function renderMcpForTarget(mcp, spec) {
         obj.type = "remote";
         obj.enabled = true;
     }
+    else if (spec.mcpHttpTypeValue) {
+        obj.type = spec.mcpHttpTypeValue;
+    }
     if (mcp.auth.type === "gateway") {
         if (!mcp.auth.tokenEnv) {
             throw new Error(`MCP '${mcp.name}' es type=gateway pero no trae tokenEnv`);

package/dist/signature.js

@@ -1,6 +1,16 @@
 import { createPublicKey, verify } from "node:crypto";
-export const SIGNING_KEY_ID = "alegra-data-agent-v1";
-export const PUBLIC_KEY_B64 = "MCowBQYDK2VwAyEApoojQPy6INQXl/xZ0gQumsI3tt9HvMrb0PaVlNn7TkE=";
+export const SIGNING_KEY_ID = "alegra-data-agent-v2";
+export const TRUSTED_KEYS = [
+    {
+        keyId: "alegra-data-agent-v2",
+        publicKeyB64: "MCowBQYDK2VwAyEA5nrWo7oWlhyad9rJjQHqgL0xaPZ83Yn5dJotGXxCo0c=",
+    },
+    {
+        keyId: "alegra-data-agent-v1",
+        publicKeyB64: "MCowBQYDK2VwAyEApoojQPy6INQXl/xZ0gQumsI3tt9HvMrb0PaVlNn7TkE=",
+    },
+];
+export const PUBLIC_KEY_B64 = TRUSTED_KEYS[0].publicKeyB64;
 export function canonicalize(obj) {
     if (obj === null || typeof obj !== "object")
         return JSON.stringify(obj);
@@ -25,10 +35,12 @@ export function verifyManifestSignature(manifest, options = {}) {
     if (sig.alg !== "Ed25519") {
         return { ok: false, reason: `algoritmo no soportado: ${sig.alg}` };
     }
-    if (sig.keyId !== SIGNING_KEY_ID) {
+    const keys = options.trustedKeys ?? TRUSTED_KEYS;
+    const trusted = keys.find((k) => k.keyId === sig.keyId);
+    if (!trusted) {
         return {
             ok: false,
-            reason: `keyId no reconocido: ${sig.keyId} (CLI espera ${SIGNING_KEY_ID})`,
+            reason: `keyId no reconocido: ${sig.keyId} (este CLI acepta ${keys.map((k) => k.keyId).join(", ")})`,
         };
     }
     if (typeof manifest.generatedAt === "string") {
@@ -49,7 +61,7 @@ export function verifyManifestSignature(manifest, options = {}) {
     }
     const canonical = canonicalize(manifest);
     const publicKey = createPublicKey({
-        key: Buffer.from(PUBLIC_KEY_B64, "base64"),
+        key: Buffer.from(trusted.publicKeyB64, "base64"),
         format: "der",
         type: "spki",
     });

package/dist/targets.js

@@ -1,11 +1,12 @@
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { getAntigravityMcpConfigPath, getAntigravitySkillsDir, getClaudeJsonPath, getClaudeSkillsDir, getCodexConfigPath, getCodexSkillsDir, getCursorMcpPath, getCursorSkillsDir, getOpenCodeConfigPath, getOpenCodeSkillsDir, } from "./lib.js";
+import { getAntigravityGeminiSkillsDir, getAntigravityMcpConfigPath, getAntigravitySkillsDir, getClaudeJsonPath, getClaudeSkillsDir, getCodexConfigPath, getCodexSkillsDir, getCursorMcpPath, getCursorSkillsDir, getOpenCodeConfigPath, getOpenCodeSkillsDir, } from "./lib.js";
 export const TARGETS = {
     "claude-code": {
         id: "claude-code",
         label: "Claude Code",
+        mcpHttpTypeValue: "http",
         skillsDir: getClaudeSkillsDir(),
         skillFormat: "folder",
         mcpConfigPath: getClaudeJsonPath(),
@@ -14,6 +15,7 @@ export const TARGETS = {
     },
     cursor: {
         id: "cursor",
+        mcpHttpTypeValue: "http",
         label: "Cursor",
         skillsDir: getCursorSkillsDir(),
         skillFormat: "folder",
@@ -35,6 +37,7 @@ export const TARGETS = {
         id: "antigravity",
         label: "Antigravity",
         skillsDir: getAntigravitySkillsDir(),
+        mirrorSkillsDirs: [getAntigravityGeminiSkillsDir()],
         skillFormat: "folder",
         mcpConfigPath: getAntigravityMcpConfigPath(),
         mcpRootKey: "mcpServers",
@@ -60,15 +63,15 @@ export function detectInstalledTargets() {
         ? process.env.CODEX_HOME
         : join(home, ".codex");
     const sentinels = {
-        "claude-code": join(home, ".claude"),
-        cursor: join(home, ".cursor"),
-        opencode: join(xdgConfig, "opencode"),
-        antigravity: join(home, ".gemini", "antigravity"),
-        codex: codexHome,
+        "claude-code": [join(home, ".claude")],
+        cursor: [join(home, ".cursor")],
+        opencode: [join(xdgConfig, "opencode")],
+        antigravity: [join(home, ".gemini", "antigravity-cli"), join(home, ".gemini", "antigravity")],
+        codex: [codexHome],
     };
     const out = [];
     for (const id of Object.keys(sentinels)) {
-        if (existsSync(sentinels[id]))
+        if (sentinels[id].some((p) => existsSync(p)))
             out.push(id);
     }
     return out;

package/dist/ui.js

@@ -67,6 +67,6 @@ ${bold("Opciones:")}
   -v, --version        Mostrar versión
 
 ${bold("Documentación:")}
-  https://github.com/alegradev/alegra-data-agent
+  https://github.com/Alegra-Team/data-agent-selfservice
 `;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alegra-data-agent",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "private": false,
   "description": "Agente de Data interno de Alegra. Instala skills + MCPs en tu cliente de IA con un comando.",
   "license": "UNLICENSED",
@@ -19,31 +19,34 @@
     "README.md"
   ],
   "devDependencies": {
-    "@types/node": "25.8.0",
-    "typescript": "6.0.3"
+    "@types/node": "26.1.2",
+    "typescript": "7.0.2"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/alegradev/alegra-data-agent.git"
+    "url": "git+https://github.com/Alegra-Team/data-agent-selfservice.git"
   },
-  "homepage": "https://github.com/alegradev/alegra-data-agent#readme",
+  "homepage": "https://github.com/Alegra-Team/data-agent-selfservice#readme",
   "bugs": {
-    "url": "https://github.com/alegradev/alegra-data-agent/issues"
+    "url": "https://github.com/Alegra-Team/data-agent-selfservice/issues"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",
     "build": "tsc -p tsconfig.build.json",
     "clean": "rm -rf dist",
     "manifest:generate": "node --experimental-strip-types --disable-warning=ExperimentalWarning scripts/generate-manifest.mjs",
-    "manifest:sign": "node scripts/sign-manifest.mjs",
+    "manifest:sign": "node --experimental-strip-types --disable-warning=ExperimentalWarning scripts/sign-manifest.mjs",
+    "signing-key:generate": "node scripts/generate-signing-key.mjs",
     "manifest:scan": "node scripts/scan-skills.mjs",
     "manifest:validate": "node scripts/validate-skills.mjs --legacy-ok",
     "manifest:validate:strict": "node scripts/validate-skills.mjs",
     "manifest": "pnpm run manifest:validate && pnpm run manifest:scan && pnpm run manifest:generate && pnpm run manifest:sign",
     "test": "node tests/runner.mjs",
     "test:report": "node tests/runner.mjs --report markdown",
-    "test:security": "node tests/security/runner.mjs",
-    "test:all": "node tests/runner.mjs && node tests/security/runner.mjs",
+    "test:security": "node --experimental-strip-types --disable-warning=ExperimentalWarning tests/security/runner.mjs",
+    "test:all": "pnpm run test && pnpm run test:security",
+    "eval:run": "node tests/evals/run-phase2.mjs",
+    "verify:clients": "node scripts/verify-clients.mjs",
     "lint": "pnpm dlx @biomejs/biome@1.9.4 check .",
     "lint:fix": "pnpm dlx @biomejs/biome@1.9.4 check --write .",
     "format": "pnpm dlx @biomejs/biome@1.9.4 format --write ."