cue-ai 0.5.0 → 0.7.0

package/src/commands/submit-profile.ts

@@ -0,0 +1,262 @@
+/**
+ * `cue submit-profile <path>` — fork opencue/cue, branch, commit the profile,
+ * open a PR. Lowers contribution friction for community profiles.
+ *
+ * Workflow:
+ *   1. Validate the input profile.yaml via the existing linter (no E-errors)
+ *   2. `gh repo fork opencue/cue --clone` into a tmp dir (or use existing fork)
+ *   3. Copy profile.yaml into profiles/<name>/ on a new branch
+ *   4. Commit + push + `gh pr create`
+ *
+ * Safety: dry-run by default. The user must pass --yes to actually push + PR.
+ */
+
+import { existsSync, mkdtempSync, mkdirSync, copyFileSync, readFileSync } from "node:fs";
+import { tmpdir, homedir } from "node:os";
+import { join, basename, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+
+import { parse as parseYaml } from "yaml";
+
+import { lintProfile, type ProfileLintResult } from "../lib/profile-linter";
+
+const bold = (s: string) => `\x1b[1m${s}\x1b[0m`;
+const dim = (s: string) => `\x1b[2m${s}\x1b[0m`;
+const green = (s: string) => `\x1b[32m${s}\x1b[0m`;
+const red = (s: string) => `\x1b[31m${s}\x1b[0m`;
+const yellow = (s: string) => `\x1b[33m${s}\x1b[0m`;
+
+const UPSTREAM_REPO = "opencue/cue";
+
+interface ProfileMeta {
+  name: string;
+  description: string;
+  icon?: string;
+  inherits?: string;
+}
+
+function readProfileMeta(path: string): ProfileMeta {
+  const content = readFileSync(path, "utf8");
+  const parsed = parseYaml(content);
+  if (!parsed || typeof parsed !== "object") throw new Error(`${path} is not valid YAML`);
+  const { name, description, icon, inherits } = parsed as ProfileMeta;
+  if (!name) throw new Error(`profile.yaml missing required field: name`);
+  if (!description) throw new Error(`profile.yaml missing required field: description`);
+  if (!/^[a-z][a-z0-9-]{1,63}$/.test(name)) throw new Error(`profile name "${name}" must be kebab-case ([a-z][a-z0-9-]{1,63})`);
+  return { name, description, icon, inherits };
+}
+
+function run(cmd: string, args: string[], opts: { cwd?: string; inherit?: boolean } = {}): { ok: boolean; out: string; err: string } {
+  const res = spawnSync(cmd, args, {
+    cwd: opts.cwd,
+    encoding: "utf8",
+    stdio: opts.inherit ? "inherit" : ["ignore", "pipe", "pipe"],
+    timeout: 60000,
+  });
+  return {
+    ok: res.status === 0,
+    out: res.stdout?.trim() ?? "",
+    err: res.stderr?.trim() ?? "",
+  };
+}
+
+function hasGh(): boolean {
+  return run("gh", ["--version"]).ok;
+}
+
+function ghUser(): string | null {
+  const r = run("gh", ["api", "user", "--jq", ".login"]);
+  return r.ok ? r.out : null;
+}
+
+function printLintReport(result: ProfileLintResult): boolean {
+  let hasErrors = false;
+  for (const issue of result.issues) {
+    if (issue.severity === "error") hasErrors = true;
+    const icon = issue.severity === "error" ? red("✗") : yellow("⚠");
+    process.stdout.write(`  ${icon} ${issue.rule}: ${issue.message}\n`);
+  }
+  return !hasErrors;
+}
+
+export async function runCmd(args: string[]): Promise<number> {
+  if (args.includes("-h") || args.includes("--help") || args.length === 0) {
+    process.stdout.write(`cue submit-profile — open a PR adding a profile to ${UPSTREAM_REPO}
+
+Usage:
+  cue submit-profile <path/to/profile.yaml> [--yes] [--dry-run] [--branch <name>]
+
+Flow:
+  1. Validate the profile (schema + linter)
+  2. Fork ${UPSTREAM_REPO} (or use existing fork)
+  3. Branch, copy profile.yaml to profiles/<name>/profile.yaml
+  4. Commit, push, open PR via gh
+
+Defaults to --dry-run. Pass --yes to actually fork + push + PR.
+
+Examples:
+  cue submit-profile ./my-profile/profile.yaml
+  cue submit-profile ./my-profile/profile.yaml --yes
+  cue submit-profile ./my-profile/profile.yaml --yes --branch add-data-engineering-profile
+`);
+    return 0;
+  }
+
+  const path = args.find(a => !a.startsWith("-"));
+  if (!path) {
+    process.stderr.write("Usage: cue submit-profile <path/to/profile.yaml>\n");
+    return 1;
+  }
+  if (!existsSync(path)) {
+    process.stderr.write(`File not found: ${path}\n`);
+    return 1;
+  }
+  const dryRun = !args.includes("--yes");
+  const branchIdx = args.indexOf("--branch");
+  const branchOverride = branchIdx >= 0 ? args[branchIdx + 1] : undefined;
+
+  // ── 1. Parse + validate ───────────────────────────────────────────────
+  let meta: ProfileMeta;
+  try {
+    meta = readProfileMeta(path);
+  } catch (e) {
+    process.stderr.write(red(`✗ Schema error: `) + (e as Error).message + "\n");
+    return 1;
+  }
+  process.stdout.write(`\n  ${bold("Profile:")} ${meta.name}  ${dim(meta.description)}\n`);
+
+  // ── 2. Run the linter (requires the file to be in profiles/<name>/) ───
+  // We stage to a tmp profiles dir + lint there so the resolver finds it.
+  const stagingRoot = mkdtempSync(join(tmpdir(), "cue-submit-"));
+  const profilesDir = join(stagingRoot, "profiles", meta.name);
+  mkdirSync(profilesDir, { recursive: true });
+  copyFileSync(resolve(path), join(profilesDir, "profile.yaml"));
+  process.stdout.write(`  ${dim("Staged to:")} ${profilesDir}\n`);
+
+  process.stdout.write(`\n  ${bold("Lint report:")}\n`);
+  const lintResult = await lintProfile(meta.name, { profilesDir: join(stagingRoot, "profiles") } as any).catch((e: Error) => {
+    process.stderr.write(red(`✗ Lint failed: `) + e.message + "\n");
+    return null;
+  });
+  if (!lintResult) return 1;
+
+  const lintOk = printLintReport(lintResult);
+  if (!lintOk) {
+    process.stderr.write(`\n  ${red("✗ Fix the E-errors above before submitting.")}\n\n`);
+    return 1;
+  }
+  process.stdout.write(`  ${green("✓ Lint passed")}\n`);
+
+  // ── 3. gh fork + branch + commit + PR ────────────────────────────────
+  if (!hasGh()) {
+    process.stderr.write(red("✗ gh CLI not found. Install: https://cli.github.com/\n"));
+    return 1;
+  }
+  const user = ghUser();
+  if (!user) {
+    process.stderr.write(red("✗ Not authenticated. Run: gh auth login\n"));
+    return 1;
+  }
+  process.stdout.write(`  ${dim("gh user:")} ${user}\n`);
+
+  const branch = branchOverride ?? `add-profile-${meta.name}`;
+  const prTitle = `Add ${meta.icon ? meta.icon + " " : ""}${meta.name} profile`;
+  const prBody = `## What
+
+Adds a new \`${meta.name}\` profile to cue.
+
+**Description**: ${meta.description}
+${meta.inherits ? `**Inherits**: \`${meta.inherits}\`\n` : ""}
+
+## Why
+
+[Briefly explain the use case — what kind of project benefits from this profile, and what's missing in the existing profiles that prompted you to create it.]
+
+## Validation
+
+\`\`\`
+cue validate ${meta.name}
+\`\`\`
+
+- ✅ Schema valid
+- ✅ All skill / MCP / rule / command references resolve
+- ✅ No W1-W5 hard warnings
+
+## Submitted via
+
+\`cue submit-profile\` — happy to iterate on the profile based on review feedback.
+
+---
+
+<sub>Opened with [\`cue submit-profile\`](https://github.com/opencue/cue/blob/main/src/commands/submit-profile.ts).</sub>`;
+
+  if (dryRun) {
+    process.stdout.write(`\n  ${bold("─── DRY RUN ───")}\n`);
+    process.stdout.write(`  ${dim("Would:")}\n`);
+    process.stdout.write(`    1. ${green("gh repo fork " + UPSTREAM_REPO + " --clone")} (if needed)\n`);
+    process.stdout.write(`    2. ${green(`git checkout -b ${branch}`)}\n`);
+    process.stdout.write(`    3. ${green(`cp ${path} profiles/${meta.name}/profile.yaml`)}\n`);
+    process.stdout.write(`    4. ${green(`git commit -m "feat: add ${meta.name} profile"`)}\n`);
+    process.stdout.write(`    5. ${green(`git push -u origin ${branch}`)}\n`);
+    process.stdout.write(`    6. ${green("gh pr create")}\n`);
+    process.stdout.write(`\n  ${bold("PR Title:")} ${prTitle}\n`);
+    process.stdout.write(`\n  ${bold("PR Body preview:")}\n${prBody.split("\n").map(l => "    " + l).join("\n")}\n`);
+    process.stdout.write(`\n  ${dim("(dry-run — pass --yes to execute)")}\n\n`);
+    return 0;
+  }
+
+  // ── Real execution path ──────────────────────────────────────────────
+  const forkDir = join(homedir(), ".cache", "cue", "submit-fork");
+  mkdirSync(join(homedir(), ".cache", "cue"), { recursive: true });
+
+  if (!existsSync(join(forkDir, ".git"))) {
+    process.stdout.write(`\n  ${bold("Forking")} ${UPSTREAM_REPO}...\n`);
+    const fork = run("gh", ["repo", "fork", UPSTREAM_REPO, "--clone", forkDir, "--remote=true"], { inherit: true });
+    if (!fork.ok) {
+      process.stderr.write(red("✗ Fork failed\n"));
+      return 1;
+    }
+  } else {
+    process.stdout.write(`  ${dim(`Reusing existing fork at ${forkDir}`)}\n`);
+    run("git", ["fetch", "upstream", "main"], { cwd: forkDir });
+    run("git", ["checkout", "main"], { cwd: forkDir });
+    run("git", ["reset", "--hard", "upstream/main"], { cwd: forkDir });
+  }
+
+  process.stdout.write(`  ${bold("Creating branch:")} ${branch}\n`);
+  run("git", ["checkout", "-b", branch], { cwd: forkDir });
+  const destDir = join(forkDir, "profiles", meta.name);
+  mkdirSync(destDir, { recursive: true });
+  copyFileSync(resolve(path), join(destDir, "profile.yaml"));
+
+  run("git", ["add", "profiles/" + meta.name + "/profile.yaml"], { cwd: forkDir });
+  const commit = run("git", ["commit", "-m", `feat: add ${meta.name} profile`], { cwd: forkDir });
+  if (!commit.ok) {
+    process.stderr.write(red("✗ Commit failed: ") + commit.err + "\n");
+    return 1;
+  }
+
+  process.stdout.write(`  ${bold("Pushing branch...")}\n`);
+  const push = run("git", ["push", "-u", "origin", branch], { cwd: forkDir, inherit: true });
+  if (!push.ok) {
+    process.stderr.write(red("✗ Push failed\n"));
+    return 1;
+  }
+
+  process.stdout.write(`  ${bold("Opening PR...")}\n`);
+  const pr = run("gh", [
+    "pr", "create",
+    "--repo", UPSTREAM_REPO,
+    "--title", prTitle,
+    "--body", prBody,
+    "--head", `${user}:${branch}`,
+  ], { cwd: forkDir });
+  if (!pr.ok) {
+    process.stderr.write(red("✗ PR creation failed: ") + pr.err + "\n");
+    return 1;
+  }
+  process.stdout.write(`\n  ${green("✓ PR opened:")} ${pr.out}\n\n`);
+  return 0;
+}
+
+export { runCmd as run };

package/src/commands/upgrade.ts

@@ -12,7 +12,7 @@ import { fileURLToPath } from "node:url";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
 const REGISTRY_PATH = join(REPO_ROOT, "docs", "registry", "index.json");
-const REGISTRY_URL = "https://recodeee.github.io/cue/registry/index.json";
+const REGISTRY_URL = "https://opencue.github.io/cue/registry/index.json";
 const UPGRADE_STATE = join(REPO_ROOT, "profiles", "_cache", "last-upgrade.json");
 
 interface RegistrySkill {

package/src/commands/use.ts

@@ -1,8 +1,38 @@
 /**
- * `soul use <profile>` — stub.
- * Real implementation belongs to agent A14 (materializer driver).
+ * `cue use <profile>` — pin a profile to the current directory.
+ *
+ * Writes `.cue-profile` in CWD (or $HOME with --global).
  */
-export async function run(_args: string[]): Promise<number> {
-  process.stderr.write("[A14] not yet implemented (owned by agent A14)\n");
-  return 1;
+
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+
+import { listProfiles } from "../lib/profile-loader";
+
+export async function run(args: string[]): Promise<number> {
+  const global = args.includes("--global") || args.includes("-g");
+  const profileName = args.find(a => !a.startsWith("-"));
+
+  if (!profileName) {
+    process.stderr.write("Usage: cue use <profile> [--global]\n");
+    const profiles = await listProfiles();
+    process.stderr.write(`\nAvailable: ${profiles.join(", ")}\n`);
+    return 1;
+  }
+
+  // Validate profile exists
+  const profiles = await listProfiles();
+  if (!profiles.includes(profileName)) {
+    process.stderr.write(`Profile "${profileName}" not found.\n`);
+    process.stderr.write(`Available: ${profiles.join(", ")}\n`);
+    return 1;
+  }
+
+  const target = global ? join(homedir(), ".cue-profile") : join(process.cwd(), ".cue-profile");
+  writeFileSync(target, profileName + "\n");
+
+  const scope = global ? "globally" : `in ${process.cwd()}`;
+  process.stdout.write(`✅ Now using "${profileName}" ${scope}\n`);
+  return 0;
 }

package/src/commands/validate.ts

@@ -76,7 +76,7 @@ function printHelp(stream: Pick<NodeJS.WriteStream, "write"> = process.stdout):
       "",
       "Checks:",
       "  schema validity, inheritance, local/npx/plugin skill resolution, MCP registry resolution",
-      "  W1-W4 warnings and E1-E3 lint errors",
+      "  W1-W5 warnings and E1-E3 lint errors",
       "",
     ].join("\n"),
   );

package/src/index.ts

@@ -132,9 +132,75 @@ function similarity(a: string, b: string): number {
   return (2 * matches) / (a.length - 1 + b.length - 1);
 }
 
+// ---------------------------------------------------------------------------
+// Auto-update check — runs at most once per 24h, non-blocking
+// ---------------------------------------------------------------------------
+
+async function checkForUpdate(currentVersion: string): Promise<void> {
+  const { existsSync, readFileSync: rf, writeFileSync: wf, mkdirSync } = await import("node:fs");
+  const { join } = await import("node:path");
+  const { homedir } = await import("node:os");
+
+  const configDir = join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "cue");
+  const checkFile = join(configDir, ".last-update-check");
+
+  // Only check once per 24 hours
+  if (existsSync(checkFile)) {
+    const last = parseInt(rf(checkFile, "utf8").trim(), 10) || 0;
+    if (Date.now() - last < 86400000) return;
+  }
+
+  // Fetch latest version from npm
+  const res = await fetch("https://registry.npmjs.org/cue-ai/latest", { signal: AbortSignal.timeout(3000) });
+  if (!res.ok) return;
+  const data = await res.json() as { version?: string };
+  const latest = data.version;
+  if (!latest) return;
+
+  // Save check timestamp
+  mkdirSync(configDir, { recursive: true });
+  wf(checkFile, String(Date.now()));
+
+  // Compare versions
+  if (latest === currentVersion) return;
+  const [cMaj, cMin, cPatch] = currentVersion.split(".").map(Number);
+  const [lMaj, lMin, lPatch] = latest.split(".").map(Number);
+  if (lMaj! < cMaj! || (lMaj === cMaj && lMin! < cMin!) || (lMaj === cMaj && lMin === cMin && lPatch! <= cPatch!)) return;
+
+  // Prompt user
+  process.stderr.write(`\n  ⬆️  Update available: ${currentVersion} → ${latest}\n`);
+  process.stderr.write(`     Run: npm install -g cue-ai\n\n`);
+
+  // Auto-install prompt (only in interactive TTY)
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    const readline = await import("node:readline");
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    const answer = await new Promise<string>((resolve) => {
+      rl.question("     Install now? [Y/n] ", (a) => { rl.close(); resolve(a); });
+      // Auto-accept after 5 seconds
+      setTimeout(() => { rl.close(); resolve("y"); }, 5000);
+    });
+    if (!answer || answer.toLowerCase() === "y" || answer.toLowerCase() === "yes") {
+      process.stderr.write("     📦 Updating...\n");
+      const { spawnSync } = await import("node:child_process");
+      const result = spawnSync("npm", ["install", "-g", "cue-ai"], { encoding: "utf8", timeout: 60000, stdio: ["ignore", "pipe", "pipe"] });
+      if (result.status === 0) {
+        process.stderr.write(`     ✅ Updated to ${latest}\n\n`);
+      } else {
+        process.stderr.write(`     ⚠️  Update failed. Run manually: npm install -g cue-ai\n\n`);
+      }
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+
 async function main(argv: string[]): Promise<number> {
   const args = argv.slice(2);
 
+  // Non-blocking update check (runs in background, shows prompt if outdated)
+  checkForUpdate(readVersion()).catch(() => {});
+
   if (args.length === 0) {
     // Show status dashboard by default (like `git status`)
     const statusCmd = COMMANDS["status"];

package/src/lib/analytics.ts

@@ -13,6 +13,39 @@ const ANALYTICS_PATH = join(
   "analytics.jsonl",
 );
 
+/**
+ * Session-summary hook (resources/hooks/session-summary.sh) appends one line
+ * per session end here. Read it as a secondary source for sessions counts so
+ * usage stats reflect real hook data, not just the launch-time analytics path.
+ */
+const SESSION_LOG_PATH = join(
+  process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"),
+  "cue",
+  "session-log.jsonl",
+);
+
+interface SessionLogEntry {
+  ts: string;
+  cwd: string;
+  profile: string;
+  session_id: string;
+}
+
+function readSessionLog(since?: Date): SessionLogEntry[] {
+  if (!existsSync(SESSION_LOG_PATH)) return [];
+  const out: SessionLogEntry[] = [];
+  for (const line of readFileSync(SESSION_LOG_PATH, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const e = JSON.parse(line) as SessionLogEntry;
+      if (!e.profile) continue;
+      if (since && new Date(e.ts) < since) continue;
+      out.push(e);
+    } catch { /* skip malformed */ }
+  }
+  return out;
+}
+
 export interface SessionEvent {
   ts: string;
   event: "start" | "end" | "skill_hit";
@@ -100,11 +133,24 @@ export interface ProfileStats {
 
 export function computeStats(since?: Date): ProfileStats[] {
   const events = readEvents(since);
-  const map = new Map<string, { sessions: number; total_s: number; last: string }>();
+  const map = new Map<string, { sessions: number; total_s: number; last: string; seenIds: Set<string> }>();
 
   for (const e of events) {
     if (e.event !== "start") continue;
-    const entry = map.get(e.profile) ?? { sessions: 0, total_s: 0, last: "" };
+    const entry = map.get(e.profile) ?? { sessions: 0, total_s: 0, last: "", seenIds: new Set<string>() };
+    entry.sessions++;
+    if (e.ts > entry.last) entry.last = e.ts;
+    map.set(e.profile, entry);
+  }
+
+  // Fold in hook-emitted session-log entries (Stop hook). Dedupe by session_id
+  // so a session that fires both the launch-time analytics and the Stop hook
+  // doesn't double-count. Entries without an id fall through as best-effort.
+  for (const e of readSessionLog(since)) {
+    const entry = map.get(e.profile) ?? { sessions: 0, total_s: 0, last: "", seenIds: new Set<string>() };
+    const key = e.session_id || `${e.ts}|${e.cwd}`;
+    if (entry.seenIds.has(key)) continue;
+    entry.seenIds.add(key);
     entry.sessions++;
     if (e.ts > entry.last) entry.last = e.ts;
     map.set(e.profile, entry);

package/src/lib/claude-binary.ts

@@ -0,0 +1,39 @@
+/**
+ * Locate the real `claude` binary on PATH, skipping cue's shim.
+ *
+ * cue installs ~/.local/bin/claude as a bash one-liner that calls `cue launch
+ * claude`; shelling to that from within cue would recurse or trigger the picker.
+ *
+ * Lookup order:
+ *   1. $CUE_REAL_CLAUDE (explicit override)
+ *   2. $CLAUDE_CODE_EXECPATH (set by claude-code itself on subprocesses)
+ *   3. Walk $PATH, skipping any small bash shim that contains `cue launch`.
+ */
+
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+export function findRealClaudeBin(): string | null {
+  if (process.env.CUE_REAL_CLAUDE && existsSync(process.env.CUE_REAL_CLAUDE)) {
+    return process.env.CUE_REAL_CLAUDE;
+  }
+  if (process.env.CLAUDE_CODE_EXECPATH && existsSync(process.env.CLAUDE_CODE_EXECPATH)) {
+    return process.env.CLAUDE_CODE_EXECPATH;
+  }
+  const pathDirs = (process.env.PATH ?? "").split(":").filter(Boolean);
+  for (const dir of pathDirs) {
+    const candidate = join(dir, "claude");
+    if (!existsSync(candidate)) continue;
+    try {
+      const stat = statSync(candidate);
+      if (stat.size < 500) {
+        const content = readFileSync(candidate, "utf8");
+        if (/cue\s+launch/i.test(content)) continue;
+      }
+      return candidate;
+    } catch {
+      return candidate;
+    }
+  }
+  return null;
+}

package/src/lib/cli-extractor.ts

@@ -0,0 +1,77 @@
+/**
+ * Extract required-CLI list for a profile by parsing every skill's frontmatter
+ * `allowed-tools:`, Prerequisites section, and name. Delegates the actual
+ * single-skill parsing to commands/optimizer.ts (where the original logic
+ * already lives) so the two paths stay in lockstep.
+ *
+ * Glob entries like the "every skill" wildcard expand to every skill on disk
+ * — mirrors what the materializer / optimizer panel does so `cue cli list
+ * full` actually sees the underlying skills rather than returning 0.
+ */
+
+import { existsSync, readdirSync } from "node:fs";
+import { join, resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { homedir } from "node:os";
+
+import { loadProfile } from "./profile-loader";
+import { extractCLIsFromSkill } from "../commands/optimizer";
+
+const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const SKILLS_ROOT = join(REPO_ROOT, "resources", "skills", "skills");
+const HOME_SKILLS = join(homedir(), ".claude", "skills");
+
+export interface CliRequirement {
+  cli: string;
+  skills: string[];
+}
+
+/** Expand wildcard ids (containing `*`) to concrete skill ids on disk. */
+function expandGlob(id: string): string[] {
+  if (!id.includes("*")) return [id];
+  const out: string[] = [];
+  try {
+    for (const cat of readdirSync(SKILLS_ROOT)) {
+      const catPath = join(SKILLS_ROOT, cat);
+      try {
+        for (const skill of readdirSync(catPath)) {
+          if (existsSync(join(catPath, skill, "SKILL.md"))) {
+            out.push(`${cat}/${skill}`);
+          }
+        }
+      } catch {}
+    }
+  } catch {}
+  try {
+    for (const skill of readdirSync(HOME_SKILLS)) {
+      if (!out.some((e) => e.endsWith(`/${skill}`))) out.push(skill);
+    }
+  } catch {}
+  return out;
+}
+
+export async function requiredClisFor(profileName: string): Promise<CliRequirement[]> {
+  const profile = await loadProfile(profileName);
+  const byCli = new Map<string, string[]>();
+  const add = (cli: string, skillId: string) => {
+    const list = byCli.get(cli) ?? [];
+    list.push(skillId);
+    byCli.set(cli, list);
+  };
+
+  for (const skill of profile.skills.local) {
+    for (const id of expandGlob(skill.id)) {
+      const slug = id.split("/").pop() ?? id;
+      for (const cli of extractCLIsFromSkill(slug)) add(cli, id);
+    }
+  }
+  for (const entry of profile.skills.npx) {
+    for (const slug of entry.skills) {
+      for (const cli of extractCLIsFromSkill(slug)) add(cli, `${entry.repo}:${slug}`);
+    }
+  }
+
+  return [...byCli.entries()]
+    .map(([cli, skills]) => ({ cli, skills }))
+    .sort((a, b) => b.skills.length - a.skills.length);
+}