alegra-data-agent 0.4.4 → 0.5.0

package/README.md

@@ -14,8 +14,8 @@ Solo accesible para cuentas `@alegra.com` (OAuth Google). El CLI te abre el nave
 
 - Node ≥ 22.6.0
 - pnpm ≥ 11.1.2
-- Uno de: Claude Code, Cursor, OpenCode, Antigravity, Codex
+- Uno de: Claude Code, Cursor, OpenCode, Antigravity, Codex, Hermes Agent
 
 ## Soporte
 
-Documentación y soporte para el equipo de Alegra: canal interno de BI Data.
+Guía de uso, documentación y soporte para el equipo de Alegra: entra a https://alegra-data-agent.vercel.app con tu cuenta `@alegra.com`.

package/dist/api.js

@@ -1,8 +1,8 @@
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { readAuth } from "./auth.js";
-import { COMMAND_NAME, GATEWAY_URL, getManifestCachePath, getPackageVersion } from "./lib.js";
-import { verifyManifestSignature } from "./signature.js";
+import { COMMAND_NAME, GATEWAY_URL, getManifestCachePath, getPackageVersion, readLockFile, writeLockFile, } from "./lib.js";
+import { manifestTimestamp, verifyManifestSignature } from "./signature.js";
 export class ManifestSignatureError extends Error {
     constructor(reason) {
         super(`Firma del manifest inválida: ${reason}. Posible compromiso del gateway.`);
@@ -204,8 +204,49 @@ function writeManifestCache(etag, manifest) {
     catch {
     }
 }
-function verifiedOrThrow(manifest) {
-    const check = verifyManifestSignature(manifest, { softFail: false });
+export const LOCK_MANIFEST_FLOOR_KEY = "manifestGeneratedAt";
+function lockFloor() {
+    try {
+        const raw = readLockFile()[LOCK_MANIFEST_FLOOR_KEY];
+        return manifestTimestamp({ generatedAt: raw });
+    }
+    catch {
+        return null;
+    }
+}
+export function recordManifestFloor(manifest) {
+    try {
+        const ts = manifestTimestamp(manifest);
+        if (ts === null)
+            return;
+        const current = lockFloor();
+        if (current !== null && current >= ts)
+            return;
+        const lock = readLockFile();
+        lock[LOCK_MANIFEST_FLOOR_KEY] = manifest.generatedAt;
+        writeLockFile(lock);
+    }
+    catch {
+    }
+}
+function trustedCacheFloor(cached) {
+    if (!cached)
+        return null;
+    try {
+        if (!verifyManifestSignature(cached.manifest, { softFail: false }).ok)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return manifestTimestamp(cached.manifest);
+}
+function maxFloor(...floors) {
+    const valid = floors.filter((f) => typeof f === "number");
+    return valid.length > 0 ? Math.max(...valid) : null;
+}
+function verifiedOrThrow(manifest, notOlderThan) {
+    const check = verifyManifestSignature(manifest, { softFail: false, notOlderThan });
     if (!check.ok) {
         throw new ManifestSignatureError(check.reason);
     }
@@ -221,15 +262,15 @@ export async function fetchManifest(opts = {}) {
         });
         if (res.status === 304) {
             if (cached)
-                return verifiedOrThrow(cached.manifest);
+                return verifiedOrThrow(cached.manifest, lockFloor());
             const retry = await authedFetch("/api/manifest", { ...opts, allowNotModified: false });
             if (!retry.ok)
                 return null;
-            return verifiedOrThrow((await retry.json()));
+            return verifiedOrThrow((await retry.json()), lockFloor());
         }
         if (!res.ok)
             return null;
-        const manifest = verifiedOrThrow((await res.json()));
+        const manifest = verifiedOrThrow((await res.json()), maxFloor(trustedCacheFloor(cached), lockFloor()));
         const etag = res.headers.get("etag");
         if (etag)
             writeManifestCache(etag, manifest);

package/dist/bounce.js

@@ -23,6 +23,12 @@ export function shouldBounce(current, latest) {
         return false;
     return compareSemver(latest, current) > 0;
 }
+const WIN32_CMD_UNSAFE = /[&|<>^%!"\s]/;
+export function unsafeBounceArgs(argv, platform = process.platform) {
+    if (platform !== "win32")
+        return [];
+    return argv.filter((a) => WIN32_CMD_UNSAFE.test(a));
+}
 async function fetchLatestVersion() {
     try {
         const res = await fetch(REGISTRY_URL, {
@@ -45,6 +51,11 @@ export async function maybeBounceToLatest(argv) {
     const latest = await fetchLatestVersion();
     if (!shouldBounce(current, latest))
         return;
+    const unsafe = unsafeBounceArgs(argv);
+    if (unsafe.length > 0) {
+        process.stderr.write(`  ⚠ No reejecuto con ${COMMAND_NAME}@${latest}: estos argumentos tienen caracteres que cmd.exe interpreta (& | < > ^ % ! " o espacios): ${unsafe.map((a) => JSON.stringify(a)).join(", ")}. Sigo con la versión ${current}.\n`);
+        return;
+    }
     const child = spawnSync("pnpm", ["dlx", "--config.minimumReleaseAge=0", `${COMMAND_NAME}@${latest}`, ...argv], {
         stdio: "inherit",
         env: { ...process.env, [NO_BOUNCE_ENV]: "1" },

package/dist/colors.js

@@ -5,14 +5,8 @@ export const dim = wrap("\x1b[2m", "\x1b[22m");
 export const red = wrap("\x1b[31m", "\x1b[39m");
 export const green = wrap("\x1b[32m", "\x1b[39m");
 export const yellow = wrap("\x1b[33m", "\x1b[39m");
-export const blue = wrap("\x1b[34m", "\x1b[39m");
-export const magenta = wrap("\x1b[35m", "\x1b[39m");
 export const cyan = wrap("\x1b[36m", "\x1b[39m");
 export const gray = wrap("\x1b[90m", "\x1b[39m");
-export const HIDE_CURSOR = SUPPORTS_COLOR ? "\x1b[?25l" : "";
-export const SHOW_CURSOR = SUPPORTS_COLOR ? "\x1b[?25h" : "";
-export const CLEAR_LINE = SUPPORTS_COLOR ? "\r\x1b[K" : "\r";
-export const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 export function write(s) {
     process.stdout.write(s);
 }
@@ -28,6 +22,3 @@ export function logWarn(s) {
 export function logOk(s) {
     process.stdout.write(`${green("✓ ") + s}\n`);
 }
-export function logInfo(s) {
-    process.stdout.write(`${cyan("ℹ ") + s}\n`);
-}

package/dist/commands/hook.js

@@ -9,11 +9,12 @@ function versionRangeForHook(version) {
         return "latest";
     return major === 0 ? "0.x" : `^${major}.0.0`;
 }
+export const AUTO_UPDATE_MIN_RELEASE_AGE_MINUTES = 0;
 function hookCommandFor(mode) {
     const v = getPackageVersion();
     const range = versionRangeForHook(v);
     const verb = mode === "auto" ? "update --yes --background" : "check";
-    return `pnpm dlx --config.minimumReleaseAge=0 ${COMMAND_NAME}@${range} ${verb} --no-bounce`;
+    return `pnpm dlx --config.minimumReleaseAge=${AUTO_UPDATE_MIN_RELEASE_AGE_MINUTES} ${COMMAND_NAME}@${range} ${verb} --no-bounce`;
 }
 const HOOK_SIGNATURE = COMMAND_NAME;
 const HOOK_TIMEOUT_SECONDS = 120;

package/dist/commands/status.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { AuthRequiredError, fetchManifest } from "../api.js";
 import { readAuth } from "../auth.js";
 import { bold, cyan, dim, gray, green, log, logError, logWarn, yellow } from "../colors.js";
@@ -15,7 +15,27 @@ function reportAutoUpdateLog() {
         const lines = readFileSync(logPath, "utf-8").trim().split("\n").filter(Boolean);
         if (lines.length === 0)
             return;
-        logWarn(`El auto-update no pudo correr ${lines.length} vez/veces en un cliente GUI — última: "${lines[lines.length - 1]}". Agente: corré ${bold(`${COMMAND_NAME} update`)} (actualiza ya mismo y limpia este aviso); si reaparece, el cliente GUI no encuentra pnpm en su PATH y hay que reinstalar con ${bold(`${COMMAND_NAME} install`)} desde una terminal con pnpm disponible.`);
+        const last = lines[lines.length - 1];
+        if (/login no se completó/.test(last)) {
+            logWarn(`El auto-update necesita volver a iniciar sesión (el login automático no se completó ${lines.length} vez/veces) — última: "${last}". Agente: corré ${bold(`${COMMAND_NAME} update`)}, que abre el login y actualiza en el acto.`);
+        }
+        else {
+            logWarn(`El auto-update no pudo correr ${lines.length} vez/veces en un cliente GUI — última: "${last}". Agente: corré ${bold(`${COMMAND_NAME} update`)} (actualiza ya mismo y limpia este aviso); si reaparece, el cliente GUI no encuentra pnpm en su PATH y hay que reinstalar con ${bold(`${COMMAND_NAME} install`)} desde una terminal con pnpm disponible.`);
+        }
+        log("");
+    }
+    catch {
+    }
+}
+function reportSkillBackups() {
+    const backupsLog = join(dirname(getAutoUpdateLogPath()), "backups", "backups.log");
+    if (!existsSync(backupsLog))
+        return;
+    try {
+        const lines = readFileSync(backupsLog, "utf-8").trim().split("\n").filter(Boolean);
+        if (lines.length === 0)
+            return;
+        logWarn(`Se guardaron ${lines.length} backup(s) de skills que habías modificado antes de actualizarlas — último: "${lines[lines.length - 1]}". Están en ${dirname(backupsLog)}.`);
         log("");
     }
     catch {
@@ -288,6 +308,7 @@ export async function runStatus() {
         logWarn(`${scopeWarning} — los MCPs quedaron en scope usuario.`);
     log("");
     reportAutoUpdateLog();
+    reportSkillBackups();
     if (!auth) {
         logWarn(`Inicia sesión con: ${bold(`${COMMAND_NAME} login`)}`);
         log("");

package/dist/commands/uninstall.js

@@ -1,6 +1,3 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { removeAutoUpdate } from "../autoupdate.js";
 import { dim, gray, log, logOk, logWarn, red } from "../colors.js";
 import { uninstallAll } from "../installer.js";
@@ -37,7 +34,6 @@ export async function runUninstall(opts = {}) {
     if (!opts.dryRun) {
         for (const t of Object.keys(TARGETS))
             removeAutoUpdate(t);
-        removeNpmrcCooldownExclude();
     }
     log("");
     if (opts.dryRun) {
@@ -48,15 +44,3 @@ export async function runUninstall(opts = {}) {
     }
     return 0;
 }
-function removeNpmrcCooldownExclude() {
-    const npmrc = join(homedir(), ".npmrc");
-    if (!existsSync(npmrc))
-        return;
-    const EXCLUDE = "minimum-release-age-exclude[]=alegra-data-agent";
-    const lines = readFileSync(npmrc, "utf-8").split("\n");
-    const kept = lines.filter((l) => l.trim() !== EXCLUDE);
-    if (kept.length !== lines.length) {
-        writeFileSync(npmrc, kept.join("\n"));
-        logOk("Removido minimum-release-age-exclude de ~/.npmrc");
-    }
-}

package/dist/commands/update.js

@@ -1,45 +1,90 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { AuthRequiredError, fetchManifest } from "../api.js";
 import { hasValidAuth } from "../auth.js";
 import { refreshAutoUpdate } from "../autoupdate.js";
 import { cyan, dim, gray, green, log, logError, yellow } from "../colors.js";
 import { detectDrift, installAll, summarize } from "../installer.js";
-import { getAutoUpdateLogPath, getLastCheckPath } from "../lib.js";
+import { COMMAND_NAME, getAutoUpdateLogPath, getLastCheckPath } from "../lib.js";
 import { banner } from "../ui.js";
 import { runLogin } from "./login.js";
 const BACKGROUND_COOLDOWN_MS = 15 * 60_000;
-const BACKGROUND_LOGIN_TIMEOUT_MS = 90_000;
-function checkedRecently() {
+const BACKGROUND_LOGIN_TIMEOUT_MS = (() => {
+    const v = Number(process.env.ALEGRA_DATA_AGENT_BG_LOGIN_TIMEOUT_MS);
+    return Number.isFinite(v) && v > 0 ? v : 90_000;
+})();
+export const BACKGROUND_AUTH_FAIL_COOLDOWN_MS = 60 * 60_000;
+function readLastCheck() {
     try {
-        const raw = readFileSync(getLastCheckPath(), "utf-8");
-        const at = Date.parse(JSON.parse(raw).checkedAt ?? "");
-        if (Number.isNaN(at))
-            return false;
-        const age = Date.now() - at;
-        return age >= 0 && age < BACKGROUND_COOLDOWN_MS;
+        const parsed = JSON.parse(readFileSync(getLastCheckPath(), "utf-8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
     }
     catch {
+        return {};
+    }
+}
+function withinWindow(iso, windowMs) {
+    const at = Date.parse(iso ?? "");
+    if (Number.isNaN(at))
         return false;
+    const age = Date.now() - at;
+    return age >= 0 && age < windowMs;
+}
+function checkedRecently() {
+    return withinWindow(readLastCheck().checkedAt, BACKGROUND_COOLDOWN_MS);
+}
+function authFailedRecently() {
+    return withinWindow(readLastCheck().authFailedAt, BACKGROUND_AUTH_FAIL_COOLDOWN_MS);
+}
+function writeLastCheck(data) {
+    try {
+        const path = getLastCheckPath();
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`);
+    }
+    catch {
     }
 }
 function markChecked() {
+    writeLastCheck({ checkedAt: new Date().toISOString() });
+}
+function markAuthFailed() {
+    writeLastCheck({ ...readLastCheck(), authFailedAt: new Date().toISOString() });
+}
+function appendHookLog(message) {
     try {
-        const path = getLastCheckPath();
+        const path = getAutoUpdateLogPath();
         mkdirSync(dirname(path), { recursive: true });
-        writeFileSync(path, `${JSON.stringify({ checkedAt: new Date().toISOString() }, null, 2)}\n`);
+        appendFileSync(path, `${new Date().toISOString()} ${message}\n`);
     }
     catch {
     }
 }
+async function loginFromBackground(reason, force = false) {
+    const code = await runLogin({
+        timeoutMs: BACKGROUND_LOGIN_TIMEOUT_MS,
+        ...(force ? { force: true } : {}),
+    });
+    if (code === 0)
+        return true;
+    appendHookLog(`[update --background] ${reason} y el login no se completó. Se reintenta solo en la próxima sesión pasada 1 h (o al correr \`${COMMAND_NAME} update\`).`);
+    markAuthFailed();
+    return false;
+}
 export async function runUpdate(opts = {}) {
     if (opts.background && !opts.dryRun && checkedRecently())
         return 0;
+    if (opts.background && !hasValidAuth()) {
+        if (authFailedRecently())
+            return 0;
+        if (!(await loginFromBackground("sesión vencida o ausente")))
+            return 0;
+    }
     banner();
     if (!hasValidAuth()) {
-        const code = await runLogin(opts.background ? { timeoutMs: BACKGROUND_LOGIN_TIMEOUT_MS } : {});
+        const code = await runLogin({});
         if (code !== 0)
-            return opts.background ? 0 : code;
+            return code;
     }
     let reauthed = false;
     for (;;) {
@@ -47,6 +92,12 @@ export async function runUpdate(opts = {}) {
             return await runUpdateOnce(opts);
         }
         catch (err) {
+            if (err instanceof AuthRequiredError && opts.background && !reauthed) {
+                reauthed = true;
+                if (!(await loginFromBackground("el gateway rechazó la sesión", true)))
+                    return 0;
+                continue;
+            }
             if (err instanceof AuthRequiredError && !reauthed) {
                 reauthed = true;
                 log(dim("  La sesión expiró durante la actualización; reabro el login y reintento.\n"));
@@ -56,6 +107,8 @@ export async function runUpdate(opts = {}) {
                 continue;
             }
             if (err instanceof AuthRequiredError) {
+                if (opts.background)
+                    return 0;
                 logError(err.message);
                 return 2;
             }

package/dist/installer.js

@@ -1,12 +1,12 @@
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmodSync, copyFileSync, existsSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { appendFileSync, chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
-import { AuthRequiredError, fetchManifest, fetchSkillFile } from "./api.js";
-import { dim, gray, green, logError, red, yellow } from "./colors.js";
+import { AuthRequiredError, fetchManifest, fetchSkillFile, recordManifestFloor } from "./api.js";
+import { dim, gray, green, logError, logWarn, red, yellow } from "./colors.js";
 import { ensureLazyProxy, lazyMcpDir, lazyProxyPath, lazyToolsPath, stdioLaunch, } from "./lazy-mcp.js";
-import { ensureDir, getAntigravityGeminiLegacyMcpConfigPath, getAntigravityGeminiLegacySkillsDir, getAntigravityLegacyMcpConfigPath, getAntigravityLegacySkillsDir, getClaudeSettingsPath, getCursorLegacyRulesDir, getHermesBin, getLockFilePath, getMcpScopeDir, getMcpScopeWarning, getOpenCodeLegacyPromptsDir, getPackageVersion, getUserScopeMcpConfigPath, isMcpScopeEnvOverride, readLockFile, sha256File, writeLockFile, } from "./lib.js";
-import { inlineReferences, renderHermesMcpOps, renderMcpForTarget, } from "./render.js";
+import { computeBundleHash, ensureDir, getAntigravityGeminiLegacyMcpConfigPath, getAntigravityGeminiLegacySkillsDir, getAntigravityLegacyMcpConfigPath, getAntigravityLegacySkillsDir, getClaudeSettingsPath, getConfigDir, getCursorLegacyRulesDir, getHermesBin, getLockFilePath, getMcpScopeDir, getMcpScopeWarning, getOpenCodeLegacyPromptsDir, getPackageVersion, getUserScopeMcpConfigPath, isMcpScopeEnvOverride, readLockFile, sha256File, walkSkillFiles, writeLockFile, } from "./lib.js";
+import { renderHermesMcpOps, renderMcpForTarget } from "./render.js";
 import { TARGETS, detectInstalledTargets } from "./targets.js";
 const SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 const MCP_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
@@ -120,66 +120,100 @@ async function stageSkill(skillName, entry) {
 function skillDirsFor(spec) {
     return [spec.skillsDir, ...(spec.mirrorSkillsDirs ?? [])];
 }
-function writeSkillToTarget(skillName, staged, spec) {
-    validateSkillName(skillName);
-    if (spec.skillFormat === "folder") {
-        for (const base of skillDirsFor(spec)) {
-            const dst = join(base, skillName);
-            if (existsSync(dst))
-                withFsRetry(() => rmSync(dst, { recursive: true, force: true }));
-            ensureDir(dst);
-            for (const f of staged) {
-                const dstFile = safeJoinSkillFile(dst, f.rel);
-                ensureDir(dirname(dstFile));
-                withFsRetry(() => writeFileSync(dstFile, f.data));
-            }
+const OS_JUNK_FILES = new Set([".DS_Store", "Thumbs.db", "desktop.ini"]);
+function diskBundleHash(dir) {
+    const shas = {};
+    for (const rel of walkSkillFiles(dir)) {
+        if (OS_JUNK_FILES.has(basename(rel)))
+            continue;
+        shas[rel] = sha256File(join(dir, rel));
+    }
+    return computeBundleHash(shas);
+}
+function localDateStamp(d = new Date()) {
+    const p = (n) => String(n).padStart(2, "0");
+    return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+}
+export function skillBackupRoot(target) {
+    return join(getConfigDir(), "backups", target);
+}
+export function skillBackupLogPath() {
+    return join(getConfigDir(), "backups", "backups.log");
+}
+function moveToBackup(dir, skillName, backupRoot) {
+    mkdirSync(backupRoot, { recursive: true });
+    const base = join(backupRoot, `${skillName}-${localDateStamp()}`);
+    let dst = base;
+    for (let n = 2; existsSync(dst); n++)
+        dst = `${base}-${n}`;
+    try {
+        withFsRetry(() => renameSync(dir, dst));
+    }
+    catch (err) {
+        if (err.code !== "EXDEV")
+            throw err;
+        cpSync(dir, dst, { recursive: true });
+        withFsRetry(() => rmSync(dir, { recursive: true, force: true }));
+    }
+    return dst;
+}
+function noteSkillBackup(skillName, from, to) {
+    const line = `${skillName}: tenías cambios locales en ${from}; los guardé en ${to} antes de actualizar.`;
+    logWarn(line);
+    try {
+        mkdirSync(dirname(skillBackupLogPath()), { recursive: true });
+        appendFileSync(skillBackupLogPath(), `${new Date().toISOString()} ${line}\n`);
+    }
+    catch {
+    }
+}
+export function replaceSkillDir(dst, skillName, staged, opts) {
+    let backup = null;
+    if (existsSync(dst)) {
+        const known = new Set(opts.knownBundleHashes.filter((h) => !!h));
+        if (!known.has(diskBundleHash(dst))) {
+            backup = moveToBackup(dst, skillName, opts.backupRoot);
+            noteSkillBackup(skillName, dst, backup);
+        }
+        else {
+            withFsRetry(() => rmSync(dst, { recursive: true, force: true }));
         }
-        return;
     }
-    const entry = staged.find((f) => f.rel === "SKILL.md") ?? staged.find((f) => f.rel === "README.md");
-    if (!entry) {
-        throw new Error(`Para target ${spec.id} se requiere SKILL.md o README.md en la skill`);
-    }
-    const references = staged
-        .filter((f) => f.rel !== "SKILL.md" && f.rel !== "README.md")
-        .map((f) => ({ rel: f.rel, text: new TextDecoder().decode(f.data) }));
-    const content = new TextDecoder().decode(entry.data);
-    const rendered = renderSkillForTargetFromContent(content, skillName, spec.skillFormat, references);
-    ensureDir(spec.skillsDir);
-    const dst = join(spec.skillsDir, rendered.filename);
-    atomicWriteFile(dst, rendered.content);
-}
-function renderSkillForTargetFromContent(content, skillName, format, references = []) {
-    if (format === "folder") {
-        throw new Error("renderSkillForTargetFromContent no soporta 'folder'");
-    }
-    const stripped = content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n/, "").replace(/^\s+/, "");
-    const body = stripped + inlineReferences(references);
-    const fm = parseFrontmatterMinimal(content);
-    if (format === "cursor-mdc") {
-        const desc = fm.description ?? `Skill ${skillName}`;
-        const cursorDesc = desc.startsWith("USE WHEN") ? desc : `USE WHEN ${desc}`;
-        const safeDesc = cursorDesc.replace(/\n/g, " ").replace(/"/g, '\\"');
-        return {
-            filename: `${skillName}.mdc`,
-            content: `---\ndescription: "${safeDesc}"\nalwaysApply: false\n---\n\n${body}`,
-        };
+    ensureDir(dst);
+    for (const f of staged) {
+        const dstFile = safeJoinSkillFile(dst, f.rel);
+        ensureDir(dirname(dstFile));
+        withFsRetry(() => writeFileSync(dstFile, f.data));
     }
-    return { filename: `${skillName}.md`, content: body };
+    return backup;
 }
-function parseFrontmatterMinimal(content) {
-    const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-    if (!m)
-        return {};
-    const out = {};
-    for (const line of m[1].split(/\r?\n/)) {
-        const kv = line.match(/^description:\s*(.+)$/);
-        if (kv) {
-            out.description = kv[1].replace(/^["']|["']$/g, "").trim();
-            return out;
+function assertFolderFormat(spec) {
+    if (spec.skillFormat !== "folder") {
+        throw new Error(`formato de skill no soportado para ${spec.id}: ${spec.skillFormat}`);
+    }
+}
+function writeSkillToTarget(skillName, staged, spec, knownBundleHashes) {
+    validateSkillName(skillName);
+    assertFolderFormat(spec);
+    for (const base of skillDirsFor(spec)) {
+        replaceSkillDir(join(base, skillName), skillName, staged, {
+            knownBundleHashes,
+            backupRoot: skillBackupRoot(spec.id),
+        });
+    }
+}
+function brokenSkillDirs(name, entry, specs) {
+    const broken = [];
+    for (const spec of specs) {
+        if (spec.skillFormat !== "folder")
+            continue;
+        for (const base of skillDirsFor(spec)) {
+            const dir = join(base, name);
+            if (!verifyInstalledFiles(dir, entry).ok)
+                broken.push(dir);
         }
     }
-    return out;
+    return broken;
 }
 function sleepSync(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -885,14 +919,7 @@ export async function installSkill(name, manifest, opts = {}) {
         prev.targets.length === targetIds.length &&
         prev.targets.every((t) => targetIds.includes(t));
     if (prev && prev.bundleHash === entry.bundleHash && targetsMatch && !opts.force) {
-        const folderTarget = targets.find((t) => t.skillFormat === "folder");
-        if (folderTarget) {
-            const dst = join(folderTarget.skillsDir, name);
-            const drift = verifyInstalledFiles(dst, entry);
-            if (drift.ok)
-                return { name, kind: "skill", status: "unchanged", targets: targetIds };
-        }
-        else {
+        if (brokenSkillDirs(name, entry, targets).length === 0) {
             return { name, kind: "skill", status: "unchanged", targets: targetIds };
         }
     }
@@ -923,7 +950,7 @@ export async function installSkill(name, manifest, opts = {}) {
     const failures = [];
     for (const t of targets) {
         try {
-            writeSkillToTarget(name, staged, t);
+            writeSkillToTarget(name, staged, t, [prev?.bundleHash, entry.bundleHash]);
             okTargets.push(t.id);
         }
         catch (err) {
@@ -1193,6 +1220,8 @@ export async function installAll(opts = {}) {
         }
         results.push(installMcp(mcp, { ...opts, targets }));
     }
+    if (!opts.dryRun)
+        recordManifestFloor(manifest);
     return { manifest, results, targets };
 }
 export function uninstallSkill(name, opts = {}) {
@@ -1216,18 +1245,10 @@ export function uninstallSkill(name, opts = {}) {
     if (!opts.dryRun) {
         for (const tId of targetIds) {
             const spec = TARGETS[tId];
-            if (spec.skillFormat === "folder") {
-                for (const base of skillDirsFor(spec)) {
-                    const dst = join(base, name);
-                    if (existsSync(dst))
-                        rmSync(dst, { recursive: true, force: true });
-                }
-            }
-            else {
-                const ext = spec.skillFormat === "cursor-mdc" ? ".mdc" : ".md";
-                const dst = join(spec.skillsDir, `${name}${ext}`);
+            for (const base of skillDirsFor(spec)) {
+                const dst = join(base, name);
                 if (existsSync(dst))
-                    rmSync(dst, { force: true });
+                    rmSync(dst, { recursive: true, force: true });
             }
         }
         delete lock.skills[name];
@@ -1316,13 +1337,22 @@ export function detectDrift(manifest) {
     const toUpdate = [];
     const unchanged = [];
     const orphaned = [];
+    const detected = new Set(detectInstalledTargets());
     for (const name of Object.keys(manifest.skills)) {
         const prev = lock.skills[name];
         if (!prev) {
             toInstall.push(name);
             continue;
         }
-        if (prev.bundleHash !== manifest.skills[name].bundleHash) {
+        const entry = manifest.skills[name];
+        if (prev.bundleHash !== entry.bundleHash) {
+            toUpdate.push(name);
+            continue;
+        }
+        const specs = (prev.targets ?? ["claude-code"])
+            .filter((t) => detected.has(t) && TARGETS[t])
+            .map((t) => TARGETS[t]);
+        if (brokenSkillDirs(name, entry, specs).length > 0) {
             toUpdate.push(name);
         }
         else {

package/dist/lazy-mcp.js

@@ -58,6 +58,8 @@ const spec = JSON.parse(readFileSync(argv[0], "utf8"));
 const [cmd, ...args] = argv.slice(2);
 const INIT_ID = "__alegra_lazy_init__";
 const START_TIMEOUT_MS = 10 * 60 * 1000;
+const LEVELS = ["debug", "info", "notice", "warning", "error", "critical", "alert", "emergency"];
+let logLevel = "info";
 
 const send = (m) => process.stdout.write(JSON.stringify(m) + "\\n");
 const key = (id) => JSON.stringify(id);
@@ -102,8 +104,23 @@ function forward(m) {
   child.stdin.write(JSON.stringify(m) + "\\n");
 }
 
-function start() {
+function notifyStarting(trigger) {
+  const text =
+    "Preparando " + spec.name + ": la primera vez tarda 1-2 min mientras se descarga " +
+    "(las siguientes llamadas de la sesión son inmediatas).";
+  process.stderr.write("[" + spec.name + "] " + text + "\\n");
+  if (LEVELS.indexOf(logLevel) <= LEVELS.indexOf("info")) {
+    send({ jsonrpc: "2.0", method: "notifications/message", params: { level: "info", logger: spec.name, data: text } });
+  }
+  const token = trigger && trigger.params && trigger.params._meta && trigger.params._meta.progressToken;
+  if (token !== undefined && token !== null) {
+    send({ jsonrpc: "2.0", method: "notifications/progress", params: { progressToken: token, progress: 0, message: text } });
+  }
+}
+
+function start(trigger) {
   if (child || dead) return;
+  notifyStarting(trigger);
   child = spawn(cmd, args, { stdio: ["pipe", "pipe", "inherit"] });
   startTimer = setTimeout(
     () => die("El MCP " + spec.name + " tardó más de 10 min en arrancar (¿se cortó la descarga?). Reintentá en una sesión nueva."),
@@ -152,7 +169,7 @@ createInterface({ input: process.stdin }).on("line", (line) => {
         id: m.id,
         result: {
           protocolVersion: spec.protocolVersion ?? initParams.protocolVersion ?? "2025-06-18",
-          capabilities: { tools: {} },
+          capabilities: { tools: {}, logging: {} },
           serverInfo: { name: spec.name, version: "lazy" },
         },
       });
@@ -160,6 +177,10 @@ createInterface({ input: process.stdin }).on("line", (line) => {
     case "ping":
       send({ jsonrpc: "2.0", id: m.id, result: {} });
       return;
+    case "logging/setLevel":
+      if (LEVELS.includes(m.params?.level)) logLevel = m.params.level;
+      send({ jsonrpc: "2.0", id: m.id, result: {} });
+      return;
     case "tools/list":
       send({ jsonrpc: "2.0", id: m.id, result: { tools: spec.tools } });
       return;
@@ -185,7 +206,7 @@ createInterface({ input: process.stdin }).on("line", (line) => {
     return;
   }
   queue.push(m);
-  start();
+  start(m);
 });
 
 function shutdown() {

package/dist/lib.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync, } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -7,7 +7,34 @@ export const PRODUCT_NAME = "alegra-data-agent";
 export const COMMAND_NAME = "alegra-data-agent";
 export const REPO_SLUG = "Alegra-Team/data-agent-selfservice";
 export const REPO_DEFAULT_BRANCH = "main";
-export const GATEWAY_URL = process.env.ALEGRA_DATA_AGENT_GATEWAY_URL ?? "https://alegra-data-agent.vercel.app";
+export const DEFAULT_GATEWAY_URL = "https://alegra-data-agent.vercel.app";
+const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost"]);
+export function resolveGatewayUrl(raw) {
+    if (raw === undefined || raw.trim() === "")
+        return { url: DEFAULT_GATEWAY_URL };
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        return {
+            url: DEFAULT_GATEWAY_URL,
+            warning: `ALEGRA_DATA_AGENT_GATEWAY_URL no es una URL válida ('${raw}'); uso ${DEFAULT_GATEWAY_URL}.`,
+        };
+    }
+    if (parsed.protocol === "https:")
+        return { url: raw };
+    if (parsed.protocol === "http:" && LOOPBACK_HOSTS.has(parsed.hostname))
+        return { url: raw };
+    return {
+        url: DEFAULT_GATEWAY_URL,
+        warning: `ALEGRA_DATA_AGENT_GATEWAY_URL debe ser https:// (http:// solo para 127.0.0.1/localhost); ignoro '${raw}' y uso ${DEFAULT_GATEWAY_URL}.`,
+    };
+}
+const _gateway = resolveGatewayUrl(process.env.ALEGRA_DATA_AGENT_GATEWAY_URL);
+if (_gateway.warning)
+    process.stderr.write(`  ⚠ ${_gateway.warning}\n`);
+export const GATEWAY_URL = _gateway.url;
 export const ALL_TARGETS = [
     "claude-code",
     "cursor",
@@ -278,27 +305,226 @@ let _lockCache = null;
 function emptyLock() {
     return { schemaVersion: 1, productName: PRODUCT_NAME, skills: {} };
 }
+function warn(message) {
+    process.stderr.write(`  ⚠ ${message}\n`);
+}
+function isLockShape(v) {
+    if (!v || typeof v !== "object" || Array.isArray(v))
+        return false;
+    const skills = v.skills;
+    return !!skills && typeof skills === "object" && !Array.isArray(skills);
+}
 export function readLockFile() {
     if (_lockCache)
         return _lockCache;
     const path = getLockFilePath();
     let lock = emptyLock();
     if (existsSync(path)) {
+        let parsed;
+        let ok = false;
         try {
-            lock = JSON.parse(readFileSync(path, "utf-8"));
+            parsed = JSON.parse(readFileSync(path, "utf-8"));
+            ok = isLockShape(parsed);
         }
         catch {
-            lock = emptyLock();
+            ok = false;
+        }
+        if (ok) {
+            lock = parsed;
+        }
+        else {
+            const backup = `${path}.corrupt-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+            try {
+                renameSync(path, backup);
+                warn(`El lock del agente (${path}) estaba corrupto: lo aparté en ${backup} y sigo como si no hubiera nada instalado. Un \`install\` lo regenera.`);
+            }
+            catch {
+                warn(`El lock del agente (${path}) está corrupto y no pude apartarlo; lo leo como vacío.`);
+            }
         }
     }
     _lockCache = lock;
     return lock;
 }
-export function writeLockFile(lock) {
+export const LOCKFILE_STALE_MS = 60_000;
+export const LOCKFILE_MAX_WAIT_MS = 10_000;
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function tryCreateLock(lockPath) {
+    let fd;
+    try {
+        fd = openSync(lockPath, "wx");
+    }
+    catch (err) {
+        if (err.code === "EEXIST")
+            return false;
+        throw err;
+    }
+    try {
+        writeSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }));
+    }
+    finally {
+        closeSync(fd);
+    }
+    return true;
+}
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+function lockIsStale(lockPath) {
+    let at;
+    let pid;
+    try {
+        const raw = JSON.parse(readFileSync(lockPath, "utf-8"));
+        if (typeof raw.at === "number")
+            at = raw.at;
+        if (typeof raw.pid === "number")
+            pid = raw.pid;
+    }
+    catch {
+    }
+    if (at === undefined) {
+        try {
+            at = statSync(lockPath).mtimeMs;
+        }
+        catch {
+            return false;
+        }
+    }
+    const age = Date.now() - at;
+    if (age < 0 || age > LOCKFILE_STALE_MS)
+        return true;
+    if (pid !== undefined && pid !== process.pid && !pidAlive(pid))
+        return true;
+    return false;
+}
+function acquireWriteLock(lockPath, maxWaitMs) {
+    const deadline = Date.now() + maxWaitMs;
+    let backoff = 25;
+    for (;;) {
+        if (tryCreateLock(lockPath))
+            return true;
+        if (lockIsStale(lockPath)) {
+            const grave = `${lockPath}.stale-${process.pid}-${Date.now()}`;
+            try {
+                renameSync(lockPath, grave);
+                rmSync(grave, { force: true });
+            }
+            catch {
+            }
+            continue;
+        }
+        if (Date.now() >= deadline)
+            return false;
+        sleepSync(Math.min(backoff, Math.max(1, deadline - Date.now())));
+        backoff = Math.min(backoff * 2, 500);
+    }
+}
+export function writeLockFile(lock, opts = {}) {
     const path = getLockFilePath();
     _lockCache = lock;
     mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(lock, null, 2)}\n`, "utf-8");
+    const lockPath = `${path}.lock`;
+    if (!acquireWriteLock(lockPath, opts.maxWaitMs ?? LOCKFILE_MAX_WAIT_MS)) {
+        warn(`Otro proceso del agente está escribiendo ${path} (${lockPath}); no lo pisé. El próximo \`update\` lo reconcilia.`);
+        return false;
+    }
+    try {
+        const tmp = `${path}.tmp-${process.pid}`;
+        writeFileSync(tmp, `${JSON.stringify(lock, null, 2)}\n`, "utf-8");
+        renameSync(tmp, path);
+    }
+    finally {
+        rmSync(lockPath, { force: true });
+    }
+    return true;
+}
+export function parseTargetList(raw) {
+    const out = [];
+    for (const piece of raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)) {
+        if (ALL_TARGETS.includes(piece)) {
+            out.push(piece);
+        }
+        else {
+            throw new Error(`Target desconocido: '${piece}'. Válidos: ${ALL_TARGETS.join(", ")}`);
+        }
+    }
+    return out;
+}
+export function parseArgs(argv) {
+    const flags = {
+        yes: false,
+        dryRun: false,
+        force: false,
+        help: false,
+        version: false,
+        noHook: false,
+        noBounce: false,
+        autoUpdate: false,
+        background: false,
+    };
+    const positional = [];
+    const only = [];
+    const targets = [];
+    let i = 0;
+    while (i < argv.length) {
+        const a = argv[i];
+        if (a === "-y" || a === "--yes")
+            flags.yes = true;
+        else if (a === "--dry-run")
+            flags.dryRun = true;
+        else if (a === "--force")
+            flags.force = true;
+        else if (a === "--no-hook")
+            flags.noHook = true;
+        else if (a === "--no-bounce")
+            flags.noBounce = true;
+        else if (a === "--auto-update")
+            flags.autoUpdate = true;
+        else if (a === "--background")
+            flags.background = true;
+        else if (a === "-h" || a === "--help")
+            flags.help = true;
+        else if (a === "-v" || a === "--version")
+            flags.version = true;
+        else if (a === "--only") {
+            i++;
+            if (argv[i])
+                only.push(...argv[i].split(","));
+        }
+        else if (a.startsWith("--only=")) {
+            only.push(...a.slice("--only=".length).split(","));
+        }
+        else if (a === "--target") {
+            i++;
+            if (argv[i])
+                targets.push(...parseTargetList(argv[i]));
+        }
+        else if (a.startsWith("--target=")) {
+            targets.push(...parseTargetList(a.slice("--target=".length)));
+        }
+        else {
+            positional.push(a);
+        }
+        i++;
+    }
+    return {
+        command: positional[0] ?? "install",
+        subcommand: positional[1],
+        flags,
+        only,
+        targets,
+    };
 }
 export function sha256(buf) {
     return createHash("sha256").update(buf).digest("hex");

package/dist/main.js

@@ -1,6 +1,6 @@
 import { maybeBounceToLatest } from "./bounce.js";
 import { log, logError } from "./colors.js";
-import { ALL_TARGETS, getPackageVersion } from "./lib.js";
+import { getPackageVersion, parseArgs } from "./lib.js";
 import { helpText } from "./ui.js";
 import { runCheck } from "./commands/check.js";
 import { runHookInstall, runHookUninstall } from "./commands/hook.js";
@@ -12,92 +12,9 @@ import { runStatus } from "./commands/status.js";
 import { runUninstall } from "./commands/uninstall.js";
 import { runUpdate } from "./commands/update.js";
 import { runWhoami } from "./commands/whoami.js";
-function parseTargetList(raw) {
-    const out = [];
-    for (const piece of raw
-        .split(",")
-        .map((s) => s.trim())
-        .filter(Boolean)) {
-        if (ALL_TARGETS.includes(piece)) {
-            out.push(piece);
-        }
-        else {
-            throw new Error(`Target desconocido: '${piece}'. Válidos: ${ALL_TARGETS.join(", ")}`);
-        }
-    }
-    return out;
-}
-function parseArgs(argv) {
-    const flags = {
-        yes: false,
-        dryRun: false,
-        force: false,
-        help: false,
-        version: false,
-        noHook: false,
-        noBounce: false,
-        autoUpdate: false,
-        background: false,
-    };
-    const positional = [];
-    const only = [];
-    const targets = [];
-    let i = 0;
-    while (i < argv.length) {
-        const a = argv[i];
-        if (a === "-y" || a === "--yes")
-            flags.yes = true;
-        else if (a === "--dry-run")
-            flags.dryRun = true;
-        else if (a === "--force")
-            flags.force = true;
-        else if (a === "--no-hook")
-            flags.noHook = true;
-        else if (a === "--no-bounce")
-            flags.noBounce = true;
-        else if (a === "--auto-update")
-            flags.autoUpdate = true;
-        else if (a === "--background")
-            flags.background = true;
-        else if (a === "-h" || a === "--help")
-            flags.help = true;
-        else if (a === "-v" || a === "--version")
-            flags.version = true;
-        else if (a === "--only") {
-            i++;
-            if (argv[i])
-                only.push(...argv[i].split(","));
-        }
-        else if (a.startsWith("--only=")) {
-            only.push(...a.slice("--only=".length).split(","));
-        }
-        else if (a === "--target") {
-            i++;
-            if (argv[i])
-                targets.push(...parseTargetList(argv[i]));
-        }
-        else if (a.startsWith("--target=")) {
-            targets.push(...parseTargetList(a.slice("--target=".length)));
-        }
-        else {
-            positional.push(a);
-        }
-        i++;
-    }
-    return {
-        command: positional[0] ?? "install",
-        subcommand: positional[1],
-        flags,
-        only,
-        targets,
-    };
-}
 async function main() {
     const args = parseArgs(process.argv.slice(2));
-    if (!args.flags.noBounce) {
-        await maybeBounceToLatest(process.argv.slice(2));
-    }
-    if (args.flags.version) {
+    if (args.flags.version || args.command === "version") {
         log(getPackageVersion());
         process.exit(0);
     }
@@ -105,6 +22,9 @@ async function main() {
         log(helpText());
         process.exit(0);
     }
+    if (!args.flags.noBounce) {
+        await maybeBounceToLatest(process.argv.slice(2));
+    }
     let exitCode = 0;
     switch (args.command) {
         case "login":
@@ -158,9 +78,6 @@ async function main() {
                 exitCode = 1;
             }
             break;
-        case "version":
-            log(getPackageVersion());
-            break;
         default:
             logError(`Comando desconocido: '${args.command}'.`);
             log(helpText());

package/dist/render.js

@@ -1,76 +1,4 @@
-import { existsSync, readFileSync } from "node:fs";
-import { extname, join } from "node:path";
 import { stdioLaunch } from "./lazy-mcp.js";
-import { parseFrontmatter } from "./lib.js";
-function readSkillEntryPoint(skillDir) {
-    const candidates = ["SKILL.md", "README.md"];
-    for (const c of candidates) {
-        const p = join(skillDir, c);
-        if (existsSync(p)) {
-            return { content: readFileSync(p, "utf-8"), path: p };
-        }
-    }
-    throw new Error(`No SKILL.md ni README.md en ${skillDir}`);
-}
-export function renderSkillForTarget(skillSrcDir, skillName, format) {
-    if (format === "folder") {
-        return { kind: "folder" };
-    }
-    const { content } = readSkillEntryPoint(skillSrcDir);
-    const fm = parseFrontmatter(content);
-    const body = stripFrontmatter(content);
-    if (format === "cursor-mdc") {
-        const desc = fm.description ?? `Skill ${skillName}`;
-        const cursorDesc = desc.startsWith("USE WHEN") ? desc : `USE WHEN ${desc}`;
-        const safeDesc = cursorDesc.replace(/\n/g, " ").replace(/"/g, '\\"');
-        const mdc = `---\ndescription: "${safeDesc}"\nalwaysApply: false\n---\n\n${body}`;
-        return { kind: "single", filename: `${skillName}.mdc`, content: mdc };
-    }
-    if (format === "flat-md") {
-        return { kind: "single", filename: `${skillName}.md`, content: body };
-    }
-    const _exhaustive = format;
-    throw new Error(`SkillFormat no soportado: ${String(_exhaustive)}`);
-}
-function stripFrontmatter(content) {
-    const m = content.match(/^---\r?\n[\s\S]*?\r?\n---\r?\n([\s\S]*)$/);
-    if (!m)
-        return content;
-    return m[1].replace(/^\s+/, "");
-}
-const INLINE_TEXT_EXT = new Set([".md", ".sql", ".txt", ".json", ".yaml", ".yml", ".csv"]);
-const INLINE_MAX_BYTES = 64 * 1024;
-const FENCE_LANG = {
-    ".sql": "sql",
-    ".json": "json",
-    ".yaml": "yaml",
-    ".yml": "yaml",
-    ".csv": "csv",
-    ".txt": "",
-};
-export function inlineReferences(refs) {
-    const sections = [];
-    for (const ref of refs) {
-        const ext = extname(ref.rel).toLowerCase();
-        const bytes = Buffer.byteLength(ref.text, "utf-8");
-        if (!INLINE_TEXT_EXT.has(ext)) {
-            sections.push(`### \`${ref.rel}\`\n\n> (omitido: tipo \`${ext || "sin extensión"}\` no inlineable)`);
-        }
-        else if (bytes > INLINE_MAX_BYTES) {
-            sections.push(`### \`${ref.rel}\`\n\n> (omitido: ${Math.round(bytes / 1024)} KB; supera el límite de inline)`);
-        }
-        else if (ext === ".md") {
-            sections.push(`### \`${ref.rel}\`\n\n${ref.text.trim()}`);
-        }
-        else {
-            const lang = FENCE_LANG[ext] ?? "";
-            sections.push(`### \`${ref.rel}\`\n\n\`\`\`${lang}\n${ref.text.replace(/\s+$/, "")}\n\`\`\``);
-        }
-    }
-    if (sections.length === 0)
-        return "";
-    return `\n\n---\n\n# Referencias (incluidas inline)\n\n> Este cliente instala la skill como un solo archivo; el contenido de \`references/\` se incluye acá para que las menciones del cuerpo sigan disponibles.\n\n${sections.join("\n\n")}\n`;
-}
 export function renderMcpForTarget(mcp, spec) {
     if (mcp.transport === "stdio") {
         return renderStdioMcpForTarget(mcp, spec);
@@ -150,8 +78,3 @@ export function renderHermesMcpOps(mcp) {
     }
     return ops;
 }
-export function hermesManagedFields(mcp) {
-    return renderHermesMcpOps(mcp)
-        .map((op) => op.path)
-        .sort();
-}

package/dist/signature.js

@@ -5,10 +5,6 @@ export const TRUSTED_KEYS = [
         keyId: "alegra-data-agent-v2",
         publicKeyB64: "MCowBQYDK2VwAyEA5nrWo7oWlhyad9rJjQHqgL0xaPZ83Yn5dJotGXxCo0c=",
     },
-    {
-        keyId: "alegra-data-agent-v1",
-        publicKeyB64: "MCowBQYDK2VwAyEApoojQPy6INQXl/xZ0gQumsI3tt9HvMrb0PaVlNn7TkE=",
-    },
 ];
 export const PUBLIC_KEY_B64 = TRUSTED_KEYS[0].publicKeyB64;
 export function canonicalize(obj) {
@@ -27,6 +23,12 @@ function canonicalValue(value, isRoot) {
     return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalValue(o[k], false)}`).join(",")}}`;
 }
 const MAX_MANIFEST_AGE_DAYS = 90;
+export function manifestTimestamp(m) {
+    if (!m || typeof m.generatedAt !== "string")
+        return null;
+    const ts = Date.parse(m.generatedAt);
+    return Number.isNaN(ts) ? null : ts;
+}
 export function verifyManifestSignature(manifest, options = {}) {
     const sig = manifest.signature;
     if (!sig) {
@@ -46,21 +48,27 @@ export function verifyManifestSignature(manifest, options = {}) {
             reason: `keyId no reconocido: ${sig.keyId} (este CLI acepta ${keys.map((k) => k.keyId).join(", ")})`,
         };
     }
-    if (typeof manifest.generatedAt === "string") {
-        const ts = Date.parse(manifest.generatedAt);
-        if (!Number.isNaN(ts)) {
-            const ageMs = Date.now() - ts;
-            const maxAgeMs = MAX_MANIFEST_AGE_DAYS * 24 * 3600 * 1000;
-            if (ageMs > maxAgeMs) {
-                return {
-                    ok: false,
-                    reason: `manifest demasiado viejo (${Math.round(ageMs / (24 * 3600 * 1000))}d, máx ${MAX_MANIFEST_AGE_DAYS}d)`,
-                };
-            }
-            if (ageMs < -3600_000) {
-                return { ok: false, reason: "manifest tiene generatedAt en el futuro" };
-            }
-        }
+    const ts = manifestTimestamp(manifest);
+    if (ts === null) {
+        return { ok: false, reason: "manifest sin generatedAt válido (ISO 8601)" };
+    }
+    const ageMs = Date.now() - ts;
+    const maxAgeMs = MAX_MANIFEST_AGE_DAYS * 24 * 3600 * 1000;
+    if (ageMs > maxAgeMs) {
+        return {
+            ok: false,
+            reason: `manifest demasiado viejo (${Math.round(ageMs / (24 * 3600 * 1000))}d, máx ${MAX_MANIFEST_AGE_DAYS}d)`,
+        };
+    }
+    if (ageMs < -3600_000) {
+        return { ok: false, reason: "manifest tiene generatedAt en el futuro" };
+    }
+    const floor = options.notOlderThan;
+    if (typeof floor === "number" && Number.isFinite(floor) && ts < floor) {
+        return {
+            ok: false,
+            reason: `manifest más viejo que el ya aceptado en esta máquina (generatedAt ${manifest.generatedAt} < ${new Date(floor).toISOString()}): posible downgrade`,
+        };
     }
     const canonical = canonicalize(manifest);
     const publicKey = createPublicKey({

package/dist/ui.js

@@ -22,17 +22,6 @@ export async function confirm(question, defaultYes = true) {
         rl.close();
     }
 }
-export async function ask(question, defaultValue) {
-    const rl = createInterface({ input, output });
-    try {
-        const suffix = defaultValue ? `${dim(`(${defaultValue})`)} ` : "";
-        const answer = (await rl.question(`${question} ${suffix}`)).trim();
-        return answer === "" && defaultValue !== undefined ? defaultValue : answer;
-    }
-    finally {
-        rl.close();
-    }
-}
 export function helpText() {
     return `
 ${bold(COMMAND_NAME)} — Agente de Data interno de Alegra

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "alegra-data-agent",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "private": false,
   "description": "Agente de Data interno de Alegra. Instala skills + MCPs en tu cliente de IA con un comando.",
   "license": "UNLICENSED",
@@ -19,7 +19,7 @@
     "README.md"
   ],
   "devDependencies": {
-    "@types/node": "26.4.0",
+    "@types/node": "26.6.3",
     "typescript": "7.0.2"
   },
   "repository": {