codiedev 0.9.66 → 0.9.68

package/dist/commands/pack.js

@@ -0,0 +1,602 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PACK_HELP = exports.DEFAULT_BACKEND_URL = void 0;
+exports.resolvePackConfig = resolvePackConfig;
+exports.ciHarnesses = ciHarnesses;
+exports.parsePackArgs = parsePackArgs;
+exports.runList = runList;
+exports.runInstall = runInstall;
+exports.runStatus = runStatus;
+exports.runPack = runPack;
+exports.commitExport = commitExport;
+exports.exportPluginFolder = exportPluginFolder;
+exports.runExport = runExport;
+exports.runApply = runApply;
+const install_1 = require("../packs/install");
+const harnesses_1 = require("../packs/harnesses");
+const manifest_1 = require("../packs/manifest");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const manifest_2 = require("../packs/manifest");
+const paths_1 = require("../packs/paths");
+const store_1 = require("../packs/store");
+const sync_1 = require("../packs/sync");
+const harnesses_2 = require("../packs/harnesses");
+const os = __importStar(require("os"));
+const utils_1 = require("../utils");
+const shared_1 = require("./shared");
+// --- CI (pack-scoped `cdvci_` keys) ------------------------------------------
+exports.DEFAULT_BACKEND_URL = "https://cli.codiedev.com";
+/** CODIEDEV_TOKEN alone is enough: no ~/.codiedev/config.json needed (CI).
+ * CODIEDEV_URL defaults to production. Otherwise the connected config. */
+function resolvePackConfig(env = process.env) {
+    const token = env.CODIEDEV_TOKEN?.trim();
+    if (token) {
+        return {
+            token,
+            backendUrl: env.CODIEDEV_URL?.trim() || exports.DEFAULT_BACKEND_URL,
+            companyId: "",
+            companyName: "",
+            repos: [],
+            lastSynced: "",
+        };
+    }
+    const config = (0, utils_1.readConfig)();
+    return config ? (0, shared_1.applyConfigEnvOverrides)(config) : null;
+}
+/** In CI, `--harness` defaults to claude when it's on PATH; anything else is
+ * ambiguous on a build box, so say what was found. */
+function ciHarnesses(args, env, home) {
+    if (args.harnesses?.length)
+        return args.harnesses;
+    if ((0, harnesses_2.onPath)("claude", env))
+        return ["claude"];
+    const root = (0, paths_1.packsRoot)(env, home);
+    const found = harnesses_2.ADAPTERS.filter((a) => a.name !== "codie" && a.detect({ root, env, home: home ?? os.homedir(), run: () => ({ status: 0, stdout: "", stderr: "" }) }))
+        .map((a) => a.name);
+    throw new Error(`CI mode needs --harness: claude isn't on PATH. Detected: ${found.length ? found.join(", ") : "none"}. ` +
+        `Install Claude Code (npm i -g @anthropic-ai/claude-code) or pass e.g. --harness ${found[0] ?? "codex"}.`);
+}
+const USAGE = `Usage:
+  codiedev pack list                     Packs assigned to your team
+  codiedev pack install [slug] [--harness claude,codex,copilot,cursor,codie] [--dry-run] [--json] [--quiet]
+                                         Install one pack, or every pack that applies
+  codiedev pack status [--json]          Installed packs and whether they're up to date
+  codiedev pack export <slug> --out <dir> [--git] [--manifest]
+                                         Write the pack as a Claude-format plugin folder plus
+                                         .claude-plugin/marketplace.json (commit it for CI).
+                                         --git inits the folder and commits; --manifest writes
+                                         an editable <slug>.pack.md instead
+  codiedev pack apply <pack.md>          Create or update a pack from a pack.md
+
+Cursor: packs are copied to ~/.cursor/plugins/local/codiedev-<slug>/. A Cursor
+team admin can disable "user local plugin imports"; then Cursor ignores them.
+
+Auto-update: session starts run \`codiedev pack install --quiet\` in the background
+about once an hour. Opt out with CODIEDEV_PACK_AUTOSYNC=0.
+
+Hooks for specific skills only: codiedev hook-gate --skills a,b --cmd-b64 <base64url of the command>
+(the pack editor writes this; the command runs via /bin/sh, or cmd.exe on Windows)
+
+CI: set CODIEDEV_TOKEN to a pack CI key (cdvci_…, from the pack's page in the portal).
+No \`codiedev connect\` or config file is needed. CI mode (a cdvci_ key, or CI=true)
+never auto-syncs, reports or prunes, installs the one pack the key can see, defaults
+--harness to claude when it's on PATH, and exits non-zero unless every requested tool
+got the pack. Skills from a pack are /<pack-slug>:<skill> in Claude Code.
+
+  GitLab CI (.gitlab-ci.yml; add CODIEDEV_TOKEN and ANTHROPIC_API_KEY as masked
+  CI/CD variables):
+    pack-scan:
+      image: node:22
+      script:
+        - npm i -g codiedev @anthropic-ai/claude-code
+        - codiedev pack install --harness claude
+        - claude -p "/platform-starter:healthcare-scan" --output-format text
+
+  GitHub Actions (repository secrets CODIEDEV_TOKEN and ANTHROPIC_API_KEY):
+    - uses: actions/setup-node@v4
+      with: { node-version: 22 }
+    - run: npm i -g codiedev @anthropic-ai/claude-code
+    - run: codiedev pack install --harness claude
+      env:
+        CODIEDEV_TOKEN: \${{ secrets.CODIEDEV_TOKEN }}
+    - run: claude -p "/platform-starter:healthcare-scan" --output-format text
+      env:
+        ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
+
+  Or vendor the plugin into the repo instead of installing at build time:
+    codiedev pack export <slug> --out .codiedev/packs`;
+function parsePackArgs(args) {
+    const out = { dryRun: false, json: false };
+    const positional = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--dry-run")
+            out.dryRun = true;
+        else if (a === "--json")
+            out.json = true;
+        else if (a === "--quiet" || a === "-q")
+            out.quiet = true;
+        else if (a === "--no-prune")
+            out.noPrune = true;
+        else if (a === "--git")
+            out.git = true;
+        else if (a === "--manifest")
+            out.manifest = true;
+        else if (a === "--out" || a === "-o") {
+            if (i + 1 >= args.length)
+                throw new Error("--out needs a directory");
+            out.out = args[++i];
+        }
+        else if (a.startsWith("--out="))
+            out.out = a.slice("--out=".length);
+        else if (a === "--harness" || a === "--harnesses") {
+            if (i + 1 >= args.length)
+                throw new Error("--harness needs a value");
+            out.harnesses = (0, harnesses_1.parseHarnessList)(args[++i]);
+        }
+        else if (a.startsWith("--harness="))
+            out.harnesses = (0, harnesses_1.parseHarnessList)(a.slice("--harness=".length));
+        else if (a.startsWith("--"))
+            throw new Error(`Unknown flag: ${a}`);
+        else
+            positional.push(a);
+    }
+    out.sub = positional[0];
+    out.slug = positional[1];
+    return out;
+}
+async function listPacks(config) {
+    const res = await (0, shared_1.apiRequest)("GET", "/api/cli/packs", { config });
+    return Array.isArray(res.packs) ? res.packs : [];
+}
+async function fetchManifest(config, slug) {
+    const raw = await (0, shared_1.apiRequest)("GET", "/api/cli/packs/manifest", { config, query: { slug } });
+    return (0, manifest_1.parseManifest)(raw);
+}
+async function runList(config, json, overrides = {}) {
+    const packs = await listPacks(config);
+    const registry = (0, store_1.readRegistry)((0, paths_1.packsRoot)(overrides.env, overrides.home));
+    if (json) {
+        console.log(JSON.stringify({ packs: packs.map((p) => ({ ...p, installed: registry.packs[p.slug] ?? null })) }, null, 2));
+        return;
+    }
+    if (packs.length === 0) {
+        console.log("No starter packs are assigned to your team yet.");
+        return;
+    }
+    for (const p of packs) {
+        const local = registry.packs[p.slug];
+        const state = local ? (local.version === p.version ? "installed" : `installed v${local.version}, v${p.version} available`) : "not installed";
+        const counts = [
+            `${p.itemCount ?? 0} skill${p.itemCount === 1 ? "" : "s"}`,
+            `${p.agentCount ?? 0} agent${p.agentCount === 1 ? "" : "s"}`,
+            ...(p.hasHooks ? ["hooks"] : []),
+        ].join(", ");
+        const channel = (0, manifest_2.cleanLabel)(p.channel, 16);
+        console.log(`${p.slug}  v${p.version}${channel ? ` [${channel}]` : ""}  ${(0, manifest_2.displayName)(p)}  (${counts}) — ${state}`);
+        if (p.description)
+            console.log(`  ${p.description}`);
+    }
+    console.log("\nInstall with: codiedev pack install <slug>   (no slug installs all)");
+}
+function isNotFound(error) {
+    return error?.status === 404;
+}
+async function runInstall(config, args, overrides = {}) {
+    const root = (0, paths_1.packsRoot)(overrides.env, overrides.home);
+    const registry = (0, store_1.readRegistry)(root);
+    const ci = (0, sync_1.isPackCiMode)(overrides.env ?? process.env);
+    const harnesses = ci && !args.dryRun ? ciHarnesses(args, overrides.env ?? process.env, overrides.home) : args.harnesses;
+    const listed = args.slug ? [args.slug] : (await listPacks(config)).map((p) => p.slug);
+    // With no slug, also re-check every locally installed pack: one that was
+    // unassigned or archived 404s and must be removed locally. Not in CI: no pruning.
+    const slugs = args.slug || ci ? listed : [...new Set([...listed, ...Object.keys(registry.packs)])];
+    const manifests = [];
+    const revoked = [];
+    for (const slug of slugs) {
+        try {
+            manifests.push(await fetchManifest(config, slug));
+        }
+        catch (error) {
+            if (error instanceof manifest_1.ManifestError)
+                throw new Error(`Refusing to install ${slug}: ${error.message}`);
+            if (!isNotFound(error))
+                throw error;
+            if (registry.packs[slug] && !ci)
+                revoked.push(slug);
+            else if (args.slug)
+                throw new Error(`Pack not found or not assigned to your team: ${slug}`);
+            // A listed pack that 404s a moment later (race with an unassign) is skipped.
+        }
+    }
+    let installed = manifests.length
+        ? (0, install_1.installPacks)({ ...overrides, manifests, harnesses, dryRun: args.dryRun })
+        : [];
+    let removed = [];
+    if (!args.dryRun && !ci) {
+        // A 404 on the installed report means the pack stopped applying between
+        // the manifest fetch and now: treat it exactly like a revoked pack.
+        const lateRevoked = await reportInstalled(config, installed);
+        installed = installed.filter((p) => !lateRevoked.includes(p.slug));
+        removed = await removePacks(config, [...revoked, ...lateRevoked], overrides);
+    }
+    const run = { installed, removed, wouldRemove: args.dryRun ? revoked : [] };
+    if (!args.dryRun && !ci) {
+        const previous = (0, sync_1.readStatusCache)(root);
+        const done = new Set(installed.map((p) => p.slug));
+        (0, sync_1.writeStatusCache)(root, {
+            checkedAt: Date.now(),
+            available: args.slug ? Math.max(previous?.available ?? 0, installed.length) : installed.length,
+            outdated: args.slug ? (previous?.outdated ?? []).filter((o) => !done.has(o.slug) && registry.packs[o.slug]) : [],
+        });
+    }
+    if (args.json) {
+        console.log(JSON.stringify({ dryRun: args.dryRun, packs: installed, removed, wouldRemove: run.wouldRemove }, null, 2));
+    }
+    else {
+        if (args.dryRun)
+            console.log("Dry run — nothing was written.\n");
+        if (installed.length === 0 && removed.length === 0 && revoked.length === 0) {
+            console.log("No starter packs are assigned to your team yet.");
+        }
+        for (const line of (0, install_1.formatResultLines)(installed))
+            console.log(line);
+        if (args.dryRun) {
+            for (const pack of installed)
+                console.log(`  files: ${pack.files.join(", ")}`);
+            for (const slug of revoked)
+                console.log(`${slug} would be removed (no longer assigned to your team)`);
+        }
+        for (const line of (0, install_1.formatUninstallLines)(removed))
+            console.log(line);
+    }
+    // Exit non-zero when a pack reached no tool because of a failure, or the
+    // pack explicitly asked for is no longer available.
+    const failed = installed.some((p) => p.results.some((r) => r.status === "failed") && !p.results.some((r) => r.status === "ok"));
+    // CI is strict: every requested tool must have taken every pack, and there
+    // must have been a pack to install at all.
+    const ciFailed = ci && !args.dryRun && (installed.length === 0 || installed.some((p) => p.results.some((r) => r.status !== "ok")));
+    if (ci && !args.dryRun && installed.length === 0)
+        console.error("No pack is visible to this key.");
+    if (failed || ciFailed || (args.slug && removed.length + revoked.length > 0))
+        process.exitCode = 1;
+    return run;
+}
+/** POST each install. Returns slugs the server answered 404 for (revoked);
+ * any other failure is only a warning. */
+async function reportInstalled(config, results) {
+    const revoked = [];
+    for (const pack of results) {
+        try {
+            await (0, shared_1.apiRequest)("POST", "/api/cli/packs/installed", {
+                config,
+                body: { slug: pack.slug, version: pack.version, contentHash: pack.contentHash, harnesses: pack.harnesses },
+            });
+        }
+        catch (error) {
+            if (isNotFound(error))
+                revoked.push(pack.slug);
+            else
+                console.error(`warning: couldn't report the ${pack.slug} install to Codiedev (${error.message})`);
+        }
+    }
+    return revoked;
+}
+/** Uninstall packs locally, then tell the server (best-effort, idempotent). */
+async function removePacks(config, slugs, overrides) {
+    if (slugs.length === 0)
+        return [];
+    const removed = (0, install_1.uninstallPacks)({ slugs: [...new Set(slugs)], env: overrides.env, home: overrides.home, run: overrides.run });
+    for (const pack of removed) {
+        try {
+            await (0, shared_1.apiRequest)("POST", "/api/cli/packs/uninstalled", { config, body: { slug: pack.slug } });
+        }
+        catch (error) {
+            console.error(`warning: couldn't report the ${pack.slug} removal to Codiedev (${error.message})`);
+        }
+    }
+    return removed;
+}
+async function runStatus(config, json, overrides = {}, options = {}) {
+    const root = (0, paths_1.packsRoot)(overrides.env, overrides.home);
+    const registry = (0, store_1.readRegistry)(root);
+    let available = null;
+    try {
+        available = await listPacks(config);
+    }
+    catch {
+        available = null;
+    }
+    const rows = [];
+    const revoked = [];
+    for (const [slug, entry] of Object.entries(registry.packs)) {
+        let upToDate = null;
+        let latestVersion = null;
+        let latestChannel = null;
+        if (available) {
+            try {
+                const m = await fetchManifest(config, slug);
+                upToDate = m.contentHash === entry.contentHash;
+                latestVersion = m.version;
+                latestChannel = m.channel ?? null;
+            }
+            catch (error) {
+                if (isNotFound(error)) {
+                    revoked.push(slug);
+                    continue;
+                }
+                upToDate = null;
+            }
+        }
+        rows.push({ slug, ...entry, upToDate, latestVersion, latestChannel });
+    }
+    // --no-prune (background check when auto-update is off) and CI: report only.
+    const ci = (0, sync_1.isPackCiMode)(overrides.env ?? process.env);
+    const removed = options.prune === false || ci ? [] : await removePacks(config, revoked, overrides);
+    if (available && !ci) {
+        (0, sync_1.writeStatusCache)(root, {
+            checkedAt: Date.now(),
+            available: available.length,
+            outdated: rows
+                .filter((r) => r.upToDate === false)
+                .map((r) => ({ slug: String(r.slug), ...(typeof r.name === "string" ? { name: r.name } : {}) })),
+        });
+    }
+    const notInstalled = (available ?? []).filter((p) => !registry.packs[p.slug]).map((p) => p.slug);
+    const result = { installed: rows, removed, notInstalled, offline: available === null };
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+        return result;
+    }
+    if (rows.length === 0 && removed.length === 0)
+        console.log("No starter packs installed.");
+    for (const row of rows) {
+        const state = row.upToDate === true ? "up to date" : row.upToDate === false ? `outdated (v${row.latestVersion} available)` : "unknown (offline)";
+        const channel = typeof row.latestChannel === "string" ? row.latestChannel : typeof row.channel === "string" ? row.channel : undefined;
+        console.log(`${(0, manifest_2.displayName)({ slug: String(row.slug), name: row.name, icon: row.icon })}  v${row.version}${channel ? ` [${channel}]` : ""}  ${state}  [${row.harnesses.join(", ") || "no tools"}]  installed ${(0, shared_1.timeAgo)(row.installedAt)}`);
+    }
+    for (const line of (0, install_1.formatUninstallLines)(removed))
+        console.log(line);
+    if (notInstalled.length)
+        console.log(`\nAvailable, not installed: ${notInstalled.join(", ")}`);
+    if (rows.some((r) => r.upToDate === false) || notInstalled.length)
+        console.log("Run `codiedev pack install` to sync.");
+    return result;
+}
+async function runPack(args) {
+    let parsed;
+    try {
+        parsed = parsePackArgs(args);
+    }
+    catch (error) {
+        console.error(error.message);
+        console.error(USAGE);
+        process.exit(1);
+    }
+    if (!parsed.sub || !["list", "ls", "install", "status", "export", "apply"].includes(parsed.sub)) {
+        console.error(USAGE);
+        process.exit(parsed.sub ? 1 : 0);
+    }
+    const config = resolvePackConfig() ?? (0, shared_1.requireConfig)();
+    const ci = (0, sync_1.isPackCiMode)();
+    // --quiet (the background auto-update): no output at all.
+    const restore = parsed.quiet ? silenceConsole() : () => { };
+    // CI keys can only read packs: no telemetry POST either.
+    const track = ci ? (_c, _t, fn) => fn() : shared_1.withTelemetry;
+    try {
+        await track(config, `codiedev_pack_${parsed.sub === "ls" ? "list" : parsed.sub}`, async () => {
+            if (parsed.sub === "list" || parsed.sub === "ls")
+                await runList(config, parsed.json);
+            else if (parsed.sub === "install")
+                await runInstall(config, parsed);
+            else if (parsed.sub === "export")
+                await runExport(config, parsed);
+            else if (parsed.sub === "apply")
+                await runApply(config, parsed);
+            else
+                await runStatus(config, parsed.json, {}, { prune: !parsed.noPrune });
+        });
+    }
+    catch (error) {
+        console.error(`pack ${parsed.sub} failed: ${error.message}`);
+        restore();
+        process.exit(1);
+    }
+    restore();
+}
+function silenceConsole() {
+    const log = console.log;
+    const error = console.error;
+    console.log = () => { };
+    console.error = () => { };
+    return () => {
+        console.log = log;
+        console.error = error;
+    };
+}
+// --- pack export / apply ---------------------------------------------------
+function gitIn(dir, args) {
+    const r = (0, child_process_1.spawnSync)("git", args, { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? (r.error?.message ?? "") };
+}
+/** Init (if needed) and commit everything under `dir`. Uses the user's git
+ * identity when configured, a neutral Codiedev one otherwise (fresh CI). */
+function commitExport(dir, message) {
+    if (!fs.existsSync(path.join(dir, ".git"))) {
+        const init = gitIn(dir, ["init", "-q"]);
+        if (init.status !== 0)
+            throw new Error(`git init failed: ${init.stderr.trim()}`);
+    }
+    const identity = gitIn(dir, ["config", "user.email"]).stdout.trim()
+        ? []
+        : ["-c", "user.name=Codiedev", "-c", "user.email=packs@codiedev.local"];
+    const add = gitIn(dir, ["add", "-A"]);
+    if (add.status !== 0)
+        throw new Error(`git add failed: ${add.stderr.trim()}`);
+    if (gitIn(dir, ["diff", "--cached", "--quiet"]).status === 0)
+        return "nothing to commit";
+    const commit = gitIn(dir, [...identity, "commit", "-q", "-m", message]);
+    if (commit.status !== 0)
+        throw new Error(`git commit failed: ${commit.stderr.trim()}`);
+    return gitIn(dir, ["rev-parse", "--short", "HEAD"]).stdout.trim();
+}
+function readMarketplaceEntries(dir) {
+    try {
+        const doc = JSON.parse(fs.readFileSync((0, paths_1.marketplacePath)(dir), "utf8"));
+        if (!Array.isArray(doc?.plugins))
+            return [];
+        return doc.plugins.flatMap((p) => {
+            const version = Number(String(p?.version ?? "").split(".")[0]);
+            return (0, manifest_2.isSafeSegment)(p?.name) && Number.isInteger(version)
+                ? [{ slug: p.name, description: typeof p.description === "string" ? p.description : undefined, version }]
+                : [];
+        });
+    }
+    catch {
+        return [];
+    }
+}
+/** Write a CI-committable copy of the pack: `<out>/plugins/<slug>/…` plus
+ * `<out>/.claude-plugin/marketplace.json` (existing entries for other packs
+ * in the same folder are kept). */
+function exportPluginFolder(out, manifest) {
+    fs.mkdirSync(out, { recursive: true });
+    const dir = (0, store_1.writePluginDir)(out, manifest);
+    const entries = readMarketplaceEntries(out).filter((e) => e.slug !== manifest.slug);
+    entries.push({ slug: manifest.slug, description: manifest.description || manifest.name, version: manifest.version });
+    (0, store_1.writeMarketplace)(out, entries);
+    return dir;
+}
+async function runExport(config, args) {
+    if (!args.slug)
+        throw new Error("Usage: codiedev pack export <slug> --out <dir> [--git] [--manifest]");
+    if (!args.out)
+        throw new Error("--out <dir> is required");
+    if (!(0, manifest_2.isSafeSegment)(args.slug))
+        throw new Error(`Not a pack slug: ${args.slug}`);
+    const out = path.resolve(args.out);
+    let written;
+    let message;
+    if (args.manifest) {
+        const res = await (0, shared_1.apiRequest)("GET", "/api/cli/packs/export", { config, query: { slug: args.slug } })
+            .catch((error) => {
+            if (isNotFound(error))
+                throw new Error(`Pack not found or not assigned to your team: ${args.slug}`);
+            throw error;
+        });
+        if (typeof res.markdown !== "string")
+            throw new Error("Server returned no markdown");
+        fs.mkdirSync(out, { recursive: true });
+        // <slug>.pack.md so several packs can share one folder.
+        written = path.join(out, `${args.slug}.pack.md`);
+        (0, store_1.writeFileAtomic)(written, res.markdown.endsWith("\n") ? res.markdown : `${res.markdown}\n`);
+        message = `codiedev pack export ${args.slug} (${args.slug}.pack.md)`;
+    }
+    else {
+        let manifest;
+        try {
+            manifest = await fetchManifest(config, args.slug);
+        }
+        catch (error) {
+            if (isNotFound(error))
+                throw new Error(`Pack not found or not assigned to your team: ${args.slug}`);
+            if (error instanceof manifest_1.ManifestError)
+                throw new Error(`Refusing to export ${args.slug}: ${error.message}`);
+            throw error;
+        }
+        written = exportPluginFolder(out, manifest);
+        message = `codiedev pack export ${manifest.slug} v${manifest.version}`;
+    }
+    const commit = args.git ? commitExport(out, message) : undefined;
+    if (args.json)
+        console.log(JSON.stringify({ written, ...(commit ? { commit } : {}) }));
+    else {
+        console.log(`✓ Exported ${args.slug} → ${written}`);
+        if (!args.manifest)
+            console.log(`  marketplace: ${(0, paths_1.marketplacePath)(out)}`);
+        if (commit)
+            console.log(`  git: ${commit}`);
+    }
+    return { written, ...(commit ? { commit } : {}) };
+}
+async function runApply(config, args) {
+    if (!args.slug)
+        throw new Error("Usage: codiedev pack apply <pack.md>");
+    const file = path.resolve(args.slug);
+    let markdown;
+    try {
+        markdown = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        throw new Error(`Can't read ${file}`);
+    }
+    if (!markdown.trim())
+        throw new Error(`${file} is empty`);
+    if (args.dryRun) {
+        console.log(`Dry run — would apply ${file} (${Buffer.byteLength(markdown)} bytes).`);
+        return {};
+    }
+    let res;
+    try {
+        res = await (0, shared_1.apiRequest)("POST", "/api/cli/packs/apply", { config, body: { markdown } });
+    }
+    catch (error) {
+        // The server reports pack.md problems with line numbers; show them as-is.
+        // The server's 400 is already "pack.md line N: …" — print it verbatim.
+        const e = error;
+        if (e.status === 403)
+            throw new Error(`You can't edit this pack (${e.message})`);
+        throw new Error(e.message);
+    }
+    if (args.json)
+        console.log(JSON.stringify(res));
+    else {
+        const slug = typeof res.slug === "string" ? res.slug : "pack";
+        const verb = res.created === true ? "Created" : res.changed === false ? "No changes to" : "Updated";
+        const version = typeof res.version === "number" ? ` v${res.version}` : "";
+        console.log(`✓ ${verb} ${slug}${version} from ${path.basename(file)}`);
+        if (Array.isArray(res.warnings)) {
+            for (const w of res.warnings) {
+                const text = typeof w === "string" ? w : typeof w?.message === "string" ? `${w.agent ? `${w.agent}: ` : ""}${w.message}` : JSON.stringify(w);
+                console.log(`  ⚠ ${text}`);
+            }
+        }
+    }
+    return res;
+}
+exports.PACK_HELP = USAGE;

package/dist/commands/pull.js

@@ -38,6 +38,7 @@ exports.runPull = runPull;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const shared_1 = require("./shared");
+const skillMarker_1 = require("../skillMarker");
 function parseArgs(args) {
     let key;
     let version;
@@ -104,6 +105,10 @@ async function runPull(args) {
             }
         }
         const a = res.artifact;
+        // A skill carries its identity onto disk so its runs attribute exactly
+        // (see skillMarker.ts). Docs are written verbatim.
+        const isSkill = a.kind ? a.kind === "skill" : (0, skillMarker_1.looksLikeSkill)(a.markdown);
+        const markdown = isSkill ? (0, skillMarker_1.stampSkillMarker)(a.markdown, a._id) : a.markdown;
         (0, shared_1.recordAgentEvent)(config, {
             tool: "codiedev_pull",
             ok: true,
@@ -111,7 +116,7 @@ async function runPull(args) {
         });
         if (out) {
             const absolute = path.isAbsolute(out) ? out : path.resolve(process.cwd(), out);
-            fs.writeFileSync(absolute, a.markdown, "utf8");
+            fs.writeFileSync(absolute, markdown, "utf8");
             console.log(`✓ Pulled ${a.key} v${a.version ?? 1} (${a.type}) → ${absolute}`);
             console.log(`  title:     ${a.title}`);
             console.log(`  lifecycle: ${a.lifecycle ?? "draft"}`);
@@ -119,8 +124,8 @@ async function runPull(args) {
         }
         else {
             // Stream to stdout — preserves shell pipes like `codiedev pull spec-214.md | less`.
-            process.stdout.write(a.markdown);
-            if (!a.markdown.endsWith("\n"))
+            process.stdout.write(markdown);
+            if (!markdown.endsWith("\n"))
                 process.stdout.write("\n");
         }
     }

package/dist/commands/push.js

@@ -37,6 +37,7 @@ exports.parseArgs = parseArgs;
 exports.pushFile = pushFile;
 exports.runPush = runPush;
 const fs = __importStar(require("fs"));
+const skillMarker_1 = require("../skillMarker");
 const path = __importStar(require("path"));
 const shared = __importStar(require("./shared"));
 const shared_1 = require("./shared");
@@ -120,7 +121,8 @@ function parseArgs(args) {
     return { file, type, kind, tags, force, as, private: priv };
 }
 async function pushFile(config, opts) {
-    const markdown = fs.readFileSync(opts.absPath, "utf8");
+    // Never upload another artifact's identity marker (skillMarker.ts).
+    const markdown = (0, skillMarker_1.stripSkillMarker)(fs.readFileSync(opts.absPath, "utf8"));
     const gitRemoteUrl = (0, utils_1.getGitRemoteUrl)(process.cwd()) ?? undefined;
     return shared.apiRequest("POST", "/api/cli/push", {
         config,