cue-ai 0.9.2 → 0.9.4

package/src/commands/launch.e2e.test.ts

@@ -38,18 +38,23 @@ function cue(args: string[], opts: { cwd?: string; env?: Record<string, string>
 
 describe.skipIf(!BUN_SPAWNABLE)("cue launch e2e", () => {
   let tmpDir: string;
+  let oldXdgConfigHome: string | undefined;
 
   beforeEach(async () => {
     tmpDir = await mkdtemp(join(tmpdir(), "cue-e2e-launch-"));
+    oldXdgConfigHome = process.env.XDG_CONFIG_HOME;
+    process.env.XDG_CONFIG_HOME = join(tmpDir, "xdg");
   });
 
   afterEach(async () => {
+    if (oldXdgConfigHome === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = oldXdgConfigHome;
     await rm(tmpDir, { recursive: true, force: true });
   });
 
-  test("launch --rematerialize with .cue-profile resolves and builds runtime", async () => {
-    // Create a .cue-profile pointing to a real profile
-    await writeFile(join(tmpDir, ".cue-profile"), "caveman-quick\n");
+  test("launch --rematerialize with .cue.profile resolves and builds runtime", async () => {
+    // Create a .cue.profile pointing to a real profile
+    await writeFile(join(tmpDir, ".cue.profile"), "caveman-quick\n");
 
     const res = cue(["launch", "claude", "--rematerialize"], { cwd: tmpDir });
 
@@ -67,7 +72,7 @@ describe.skipIf(!BUN_SPAWNABLE)("cue launch e2e", () => {
   });
 
   test("launch --rematerialize second call is cache hit (rebuilt=false)", async () => {
-    await writeFile(join(tmpDir, ".cue-profile"), "core\n");
+    await writeFile(join(tmpDir, ".cue.profile"), "core\n");
 
     const first = cue(["launch", "claude", "--rematerialize"], { cwd: tmpDir });
     expect(first.status).toBe(0);
@@ -83,12 +88,12 @@ describe.skipIf(!BUN_SPAWNABLE)("cue launch e2e", () => {
     expect(secondJson.profile).toBe("core");
   });
 
-  test("launch resolves profile from .cue-profile in parent directory", async () => {
-    // Create a subdirectory and put .cue-profile in parent
+  test("launch resolves profile from .cue.profile in parent directory", async () => {
+    // Create a subdirectory and put .cue.profile in parent
     const { mkdir } = await import("node:fs/promises");
     const subDir = join(tmpDir, "src", "lib");
     await mkdir(subDir, { recursive: true });
-    await writeFile(join(tmpDir, ".cue-profile"), "rust\n");
+    await writeFile(join(tmpDir, ".cue.profile"), "rust\n");
 
     const res = cue(["launch", "claude", "--rematerialize"], { cwd: subDir });
     expect(res.status).toBe(0);
@@ -97,7 +102,7 @@ describe.skipIf(!BUN_SPAWNABLE)("cue launch e2e", () => {
   });
 
   test("launch produces CLAUDE.md with profile stamp in runtime dir", async () => {
-    await writeFile(join(tmpDir, ".cue-profile"), "backend\n");
+    await writeFile(join(tmpDir, ".cue.profile"), "backend\n");
 
     const res = cue(["launch", "claude", "--rematerialize"], { cwd: tmpDir });
     expect(res.status).toBe(0);
@@ -109,7 +114,7 @@ describe.skipIf(!BUN_SPAWNABLE)("cue launch e2e", () => {
   });
 
   test("launch produces settings.json with MCPs and plugins", async () => {
-    await writeFile(join(tmpDir, ".cue-profile"), "backend\n");
+    await writeFile(join(tmpDir, ".cue.profile"), "backend\n");
 
     const res = cue(["launch", "claude", "--rematerialize"], { cwd: tmpDir });
     expect(res.status).toBe(0);
@@ -121,7 +126,7 @@ describe.skipIf(!BUN_SPAWNABLE)("cue launch e2e", () => {
   });
 
   test("launch creates skills/ symlinks in runtime dir", async () => {
-    await writeFile(join(tmpDir, ".cue-profile"), "backend\n");
+    await writeFile(join(tmpDir, ".cue.profile"), "backend\n");
 
     const res = cue(["launch", "claude", "--rematerialize"], { cwd: tmpDir });
     expect(res.status).toBe(0);

package/src/commands/launch.ts

@@ -29,12 +29,13 @@ import {
 import { loadProfile, listProfiles, listFeaturedProfiles, parseProfileSelector } from "../lib/profile-loader";
 import { resolveProfileForCwd } from "../lib/cwd-resolver";
 import { DIVIDER_PREFIX, runPicker, type PickerOption, type ProfileTally } from "../lib/picker";
-import { materializeRuntime, type McpServerConfig } from "../lib/runtime-materializer";
-import { resolveLocalSkill, listAllSkillIds } from "../lib/resolver-local";
+import { materializeRuntime } from "../lib/runtime-materializer";
+import { resolveLocalSkill } from "../lib/resolver-local";
+import { expandSkillWildcards, loadMcpRegistry, resolveClaudeCredentialsSource as resolveSharedClaudeCredentialsSource } from "../lib/runtime-install";
 import { detectKittyTerminal, kittyPlaceholderLabel, transmitKittyImage } from "../lib/kitty-image";
 import { computeStats } from "../lib/analytics";
 import { detectProfileV2, type DetectionResultV2 } from "../lib/auto-detect";
-import { detectCompanions, type CompanionSignal } from "../lib/companion-detect";
+import { detectCompanions, serviceCompanions, type CompanionSignal } from "../lib/companion-detect";
 import type { ResolvedProfile } from "../../profiles/_types";
 import type { ProfileAffinity, UniversalSuggestion } from "../lib/pair-suggestions";
 import { hasWorkspaces, getActiveWorkspace, computeOverrides, resolveWorkspaceForCwd } from "../lib/workspaces";
@@ -144,6 +145,18 @@ function execAgent(bin: string, args: string[], env: NodeJS.ProcessEnv): Promise
   });
 }
 
+function isAgentHelpPassthrough(parsed: ParsedArgs): boolean {
+  return (
+    !parsed.override &&
+    !parsed.forcePick &&
+    !parsed.dryRun &&
+    !parsed.rematerialize &&
+    parsed.subset === null &&
+    parsed.passthrough.length === 1 &&
+    (parsed.passthrough[0] === "--help" || parsed.passthrough[0] === "-h")
+  );
+}
+
 export interface TmuxAnnounceExtras {
   /** Token-overhead summary: dot = 🟢/🟡/🟠/🔴, size = "8K". Both optional. */
   overhead?: { dot: string; size: string };
@@ -281,16 +294,7 @@ function announceTmuxProfile(
  * Used by both the launch hot path and the picker `details` callback so the
  * shown summary matches what materializeRuntime will actually link.
  */
-async function expandWildcards(profile: ResolvedProfile): Promise<void> {
-  if (!profile.skills.local.some((s) => s.id === "*/*")) return;
-  const allIds = await listAllSkillIds();
-  const wildcard = profile.skills.local.find((s) => s.id === "*/*")!;
-  const existing = new Set(profile.skills.local.filter((s) => s.id !== "*/*").map((s) => s.id));
-  profile.skills.local = [
-    ...profile.skills.local.filter((s) => s.id !== "*/*"),
-    ...allIds.filter((id) => !existing.has(id)).map((id) => ({ ...wildcard, id })),
-  ];
-}
+const expandWildcards = expandSkillWildcards;
 
 /**
  * Compact human-readable summary of what a profile would load. Each returned
@@ -1061,52 +1065,6 @@ async function listProfileOptions(pinnedProfile?: string): Promise<PickerOption[
   return buildPickerSections(defaultOpt, sorted, recent, 3, Date.now(), suggested, featured);
 }
 
-async function loadMcpRegistry(agent: "claude-code" | "codex"): Promise<Record<string, McpServerConfig>> {
-  const root = process.env.CUE_REPO_ROOT ?? process.env.SOUL_REPO_ROOT ?? resolve(
-    new URL(import.meta.url).pathname,
-    "..",
-    "..",
-    "..",
-  );
-  // Files to merge, in priority order. The master `claude.sanitized.json` wins
-  // on key collisions; `claude_runtime.sanitized.json` is the live snapshot
-  // captured from the user's actual `~/.claude.json` (covers servers
-  // registered at runtime but not yet promoted to the master registry).
-  // Without this merge, profiles like `marketing` that reference
-  // `reddit`/`google-ads-mcp`/`meta-ads`/`Higgsfield` (runtime-only entries)
-  // would silently drop those MCPs at materialize time.
-  const files = agent === "claude-code"
-    ? ["claude_runtime.sanitized.json", "claude.sanitized.json"]
-    : ["codex.sanitized.json"];
-
-  const merged: Record<string, McpServerConfig> = {};
-  for (const file of files) {
-    const path = join(root, "resources", "mcps", "configs", file);
-    try {
-      const text = await readFile(path, "utf8");
-      const raw = JSON.parse(text) as { servers?: Record<string, McpServerConfig> };
-      for (const [k, v] of Object.entries(raw.servers ?? {})) {
-        // First file wins (claude_runtime first, then claude master).
-        // We want master to win, so only set if not already present.
-        if (!(k in merged)) merged[k] = v;
-      }
-    } catch { /* file missing — skip */ }
-  }
-  // Second pass: let the master registry override the runtime snapshot
-  // (master is the curated source of truth; runtime is just a fallback).
-  const masterPath = join(root, "resources", "mcps", "configs",
-    agent === "claude-code" ? "claude.sanitized.json" : "codex.sanitized.json");
-  try {
-    const text = await readFile(masterPath, "utf8");
-    const raw = JSON.parse(text) as { servers?: Record<string, McpServerConfig> };
-    for (const [k, v] of Object.entries(raw.servers ?? {})) {
-      merged[k] = v;
-    }
-  } catch (err) { debug("launch:master-config", err); /* keep runtime fallbacks */ }
-
-  return merged;
-}
-
 async function readSharedClaudeMd(profile?: { name: string; inheritanceChain?: string[] }): Promise<string> {
   const root = process.env.CUE_REPO_ROOT ?? process.env.SOUL_REPO_ROOT ?? resolve(
     new URL(import.meta.url).pathname, "..", "..", "..",
@@ -1147,15 +1105,17 @@ async function readSharedClaudeMd(profile?: { name: string; inheritanceChain?: s
 async function buildUserClaudeMd(profile: ResolvedProfile, agent: "claude-code" | "codex"): Promise<string> {
   let content = await readSharedClaudeMd(profile) + await readUserClaudeMd(agent);
 
-  // First-time profile suggestion: if no .cue-profile in cwd, inject marker
-  const cueProfilePath = join(process.cwd(), ".cue-profile");
+  // First-time profile suggestion: if no .cue.profile in cwd, inject marker
+  const cueProfilePath = join(process.cwd(), ".cue.profile");
   if (!existsSync(cueProfilePath)) {
     content += "\n<!-- cue:first-time-suggest -->\n" +
       "## ⚡ First-Time Setup\n\n" +
-      "No `.cue-profile` is pinned to this directory. Before answering the user's first message, " +
-      "quickly scan this repo (package.json, Cargo.toml, Dockerfile, etc.) and suggest the best " +
-      "profile from `cue list`. Present your suggestion in 3-4 lines with reasoning, then offer " +
-      "to pin it with `echo <name> > .cue-profile`. After suggesting, proceed with the user's request.\n\n" +
+      "No `.cue.profile` is pinned to this directory. Before answering the user's first message, " +
+      "summon the right profile into THIS session — no restart. Invoke the `meta/profile-summon` " +
+      "skill, or run `cue summon` (auto-detects from the repo). It soft-loads the profile's persona " +
+      "and skill playbooks inline, pins `.cue.profile`, and prints `claude --continue` for the MCP / " +
+      "/slash-command tail (which needs a warm re-exec). Propose the detected profile in 3-4 lines, " +
+      "apply on the user's OK, then proceed with their request.\n\n" +
       "Available profiles:\n```\n" +
       (await getProfileListForStamp()) +
       "```\n\n";
@@ -1238,56 +1198,31 @@ async function findRealBinary(name: string): Promise<string | null> {
  * accountUuid and copies the freshest one back to source.
  */
 async function resolveClaudeCredentialsSource(): Promise<string> {
-  const picked = await pickClaudeCredentialsSource();
-  // Heal source from freshest sibling runtime (if any). Silent best-effort.
-  try {
-    const { syncFreshestToSource } = await import("../lib/credentials-sync");
-    const runtimeRoot = join(configDir(), "runtime");
-    const result = await syncFreshestToSource(picked, runtimeRoot);
-    if (result.synced) {
-      // Tiny breadcrumb so users can see when the heal kicked in. Stays on
-      // stderr so it doesn't pollute pipelines or `claude --print` output.
-      process.stderr.write(
-        `▸ cue: refreshed source credentials from a sibling runtime (rotated refresh-token healed)\n`,
-      );
-    }
-  } catch (err) { debug("launch:runtime-heal", err); /* best-effort — never blocks launch */ }
-  return picked;
+  return resolveSharedClaudeCredentialsSource({ healFromRuntime: true });
 }
 
-async function pickClaudeCredentialsSource(): Promise<string> {
-  if (process.env.CLAUDE_CONFIG_DIR) return process.env.CLAUDE_CONFIG_DIR;
-
-  const homeClaude = join(homedir(), ".claude");
-  if (existsSync(join(homeClaude, ".credentials.json"))) return homeClaude;
-
+/**
+ * Write the runtime's login-fresh `.credentials.json` back to the account
+ * dir that owns it (matched by accountUuid). Runs (a) before materialization
+ * — so the account-identity guard can't destroy the only live copy of the
+ * OTHER account's rotated token when two authmux accounts alternate on one
+ * profile — and (b) after the agent exits, so a `/login` done inside the
+ * session lands in the account's CLAUDE_CONFIG_DIR immediately instead of
+ * waiting for that account's next launch. Best-effort: never blocks launch.
+ */
+async function rescueRuntimeCredsToOwner(profileName: string): Promise<void> {
   try {
-    const { spawnSync } = await import("node:child_process");
-    const { statSync } = await import("node:fs");
-    const res = spawnSync("authmux", ["parallel", "--list", "--json"], {
-      encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "pipe"],
-    });
-    if (res.status === 0 && res.stdout) {
-      const parsed = JSON.parse(res.stdout) as { data?: { profiles?: Array<{ name: string; configDir: string }> } };
-      const profiles = parsed?.data?.profiles ?? [];
-      const withMtime = profiles
-        .map((p) => {
-          const credsPath = join(p.configDir, ".credentials.json");
-          let mtime = 0;
-          try { mtime = statSync(credsPath).mtimeMs; } catch { /* missing */ }
-          return { ...p, mtime };
-        })
-        .filter((p) => p.mtime > 0)
-        .sort((a, b) => b.mtime - a.mtime);
-      const pick = withMtime[0];
-      if (pick) {
-        process.stderr.write(`▸ cue: inheriting auth from authmux profile "${pick.name}"\n`);
-        return pick.configDir;
-      }
+    const { listKnownAccountDirs, rescueRuntimeCredentials } = await import("../lib/credentials-sync");
+    // basename() pins the path inside the runtime tree — this helper WRITES
+    // token files, so a profile name with a path separator must not escape.
+    const runtimeClaudeDir = join(configDir(), "runtime", basename(profileName), "claude");
+    const result = await rescueRuntimeCredentials(runtimeClaudeDir, await listKnownAccountDirs(homedir()));
+    if (result.rescued) {
+      process.stderr.write(`▸ cue: wrote login-fresh credentials back to ${result.to}\n`);
     }
-  } catch { /* authmux not installed or query failed — fall through */ }
-
-  return homeClaude;
+  } catch (err) {
+    debug("launch:cred-rescue", err);
+  }
 }
 
 // ---------------------------------------------------------------------------
@@ -1308,6 +1243,16 @@ export async function run(args: string[]): Promise<number> {
     process.stderr.write("cue launch: missing agent (use 'claude' or 'codex')\n");
     return 1;
   }
+  if (isAgentHelpPassthrough(parsed)) {
+    const realBin = await findRealBinary(parsed.agent);
+    if (!realBin) {
+      process.stderr.write(
+        `cue launch: couldn't find the real '${parsed.agent}' binary on PATH=${process.env.PATH}\n`,
+      );
+      return 127;
+    }
+    return execAgent(realBin, parsed.passthrough, process.env);
+  }
   const agentKind = parsed.agent === "claude" ? "claude-code" : "codex";
 
   // Resolve profile.
@@ -1405,16 +1350,19 @@ export async function run(args: string[]): Promise<number> {
     // with what the directory actually looks like (e.g. picking medusa-next
     // in a vite.config.ts project).
     let detected: ReadonlyArray<{ name: string; reasons: string[]; confidence: number }> = [];
+    let rawDetections: DetectionResultV2[] = [];
     try {
-      detected = detectProfileV2(cwd)
-        .filter((d) => knownProfileNames.has(d.profile))
-        .map((d) => ({ name: d.profile, reasons: d.reasons, confidence: d.confidence }));
+      rawDetections = detectProfileV2(cwd).filter((d) => knownProfileNames.has(d.profile));
+      detected = rawDetections.map((d) => ({ name: d.profile, reasons: d.reasons, confidence: d.confidence }));
     } catch (err) { debug("launch:autodetect", err); }
     // Content-aware combine companions: scan the cwd for asset/draft/brand
-    // signals and feed matching profiles into the combine multiselect.
+    // signals and feed matching profiles into the combine multiselect — plus
+    // dep-detected service profiles (stripe, @aws-sdk/*, …), which join as
+    // pre-checked rows (see serviceCompanions).
     let companions: CompanionSignal[] = [];
     try {
       companions = detectCompanions({ cwd, knownProfiles: knownProfileNames, brands: listPostizzBrands() });
+      companions = companions.concat(serviceCompanions(rawDetections, knownProfileNames));
     } catch (err) { debug("launch:companions", err); }
     // Cross-profile combine suggestions offered under every primary: the curated
     // `_featured.yaml` set (improver, secops, builder, …) plus the profiles the
@@ -1635,6 +1583,11 @@ export async function run(args: string[]): Promise<number> {
     }
   }
 
+  // Rescue-before-wipe: if this runtime's credentials belong to a different
+  // account than credentialsSource, the materializer's identity guard is
+  // about to discard them — return them to their owning account dir first.
+  if (agentKind === "claude-code") await rescueRuntimeCredsToOwner(profileName);
+
   const runtime = await materializeRuntime({
     profile: await applyWorkspaceOverrides(profile),
     agent: agentKind,
@@ -1918,5 +1871,9 @@ export async function run(args: string[]): Promise<number> {
     health: healthBadge,
   });
 
-  return execAgent(realBin, parsed.passthrough, childEnv);
+  const exitCode = await execAgent(realBin, parsed.passthrough, childEnv);
+  // Persist any /login done inside the session to its account dir now —
+  // don't leave the only live rotated token stranded in the shared runtime.
+  if (agentKind === "claude-code") await rescueRuntimeCredsToOwner(profileName);
+  return exitCode;
 }

package/src/commands/materialize.ts

@@ -50,7 +50,7 @@ Agents: ${AGENT_IDS.join(", ")}
 
 Flags:
   --dir <path>       Target directory (default: cwd or agent's config dir)
-  --profile <name>   Use specific profile (default: resolved from .cue-profile)
+  --profile <name>   Use specific profile (default: resolved from .cue.profile)
   --all              Materialize for all agents listed in the profile
   --dry-run          Show what would be written without writing
 
@@ -89,7 +89,7 @@ Examples:
     if (!name) throw new Error("no active profile");
     profile = await loadProfile(name);
   } catch {
-    process.stderr.write("No active profile. Pin one with `echo <name> > .cue-profile`\n");
+    process.stderr.write("No active profile. Pin one with `echo <name> > .cue.profile`\n");
     return 1;
   }
 

package/src/commands/prune.ts

@@ -77,7 +77,7 @@ function helpText(): string {
 
 function resolveActiveProfile(explicit: string | null): string | null {
   if (explicit) return explicit;
-  const pin = join(process.cwd(), ".cue-profile");
+  const pin = join(process.cwd(), ".cue.profile");
   if (existsSync(pin)) {
     try {
       const txt = readFileSync(pin, "utf8").trim().split("\n")[0]?.trim();

package/src/commands/security-audit.ts

@@ -126,7 +126,7 @@ export async function runSecurityAudit(args: string[]): Promise<number> {
   }
 
   if (!profileName) {
-    process.stderr.write("No active profile. Specify a profile name or set .cue-profile.\n");
+    process.stderr.write("No active profile. Specify a profile name or set .cue.profile.\n");
     return 1;
   }
 

package/src/commands/shell.ts

@@ -3,7 +3,7 @@
  * `cue shell install` — install shims
  *
  * Usage: eval "$(cue shell hook)"
- * Adds a cd wrapper that checks .cue-profile on directory change.
+ * Adds a cd wrapper that checks .cue.profile on directory change.
  */
 
 import { existsSync, readFileSync, statSync, accessSync, constants } from "node:fs";
@@ -33,8 +33,8 @@ __cue_check_profile() {
   local dir="$PWD"
   local profile=""
   while [ "$dir" != "/" ] && [ "$dir" != "$HOME" ]; do
-    if [ -f "$dir/.cue-profile" ]; then
-      profile="$(cat "$dir/.cue-profile" 2>/dev/null | tr -d '\\n')"
+    if [ -f "$dir/.cue.profile" ]; then
+      profile="$(cat "$dir/.cue.profile" 2>/dev/null | tr -d '\\n')"
       break
     fi
     dir="$(dirname "$dir")"
@@ -57,8 +57,8 @@ __cue_check_profile() {
   local dir="$PWD"
   local profile=""
   while [[ "$dir" != "/" && "$dir" != "$HOME" ]]; do
-    if [[ -f "$dir/.cue-profile" ]]; then
-      profile="$(cat "$dir/.cue-profile" | tr -d '\\n')"
+    if [[ -f "$dir/.cue.profile" ]]; then
+      profile="$(cat "$dir/.cue.profile" | tr -d '\\n')"
       break
     fi
     dir="$(dirname "$dir")"
@@ -82,8 +82,8 @@ function __cue_check_profile --on-variable PWD
   set -l dir $PWD
   set -l profile ""
   while test "$dir" != "/" -a "$dir" != "$HOME"
-    if test -f "$dir/.cue-profile"
-      set profile (cat "$dir/.cue-profile" | string trim)
+    if test -f "$dir/.cue.profile"
+      set profile (cat "$dir/.cue.profile" | string trim)
       break
     end
     set dir (dirname "$dir")

package/src/commands/skill-report.ts

@@ -74,7 +74,7 @@ function helpText(): string {
 
 function resolveActiveProfile(explicit: string | null): string | null {
   if (explicit) return explicit;
-  const pin = join(process.cwd(), ".cue-profile");
+  const pin = join(process.cwd(), ".cue.profile");
   if (existsSync(pin)) {
     try {
       const txt = readFileSync(pin, "utf8").trim().split("\n")[0]?.trim();

package/src/commands/skills.ts

@@ -219,7 +219,7 @@ async function cmdSearch(query: string, json: boolean): Promise<number> {
 async function cmdAddToProfile(id: string, preview = false): Promise<number> {
   const profileName = await getActiveProfileName();
   if (!profileName) {
-    process.stderr.write("No active profile. Pin one with `echo <name> > .cue-profile`\n");
+    process.stderr.write("No active profile. Pin one with `echo <name> > .cue.profile`\n");
     return 1;
   }
 
@@ -808,8 +808,8 @@ async function cmdNpxAdd(args: string[]): Promise<number> {
     // #2: Auto-pin option
     const pin = await p.confirm({ message: `Pin "${name}" to current directory?`, initialValue: true });
     if (!p.isCancel(pin) && pin) {
-      await writeFile(join(process.cwd(), ".cue-profile"), `${name}\n`);
-      p.log.success(`Pinned → .cue-profile`);
+      await writeFile(join(process.cwd(), ".cue.profile"), `${name}\n`);
+      p.log.success(`Pinned → .cue.profile`);
     }
 
     // #10: Post-create launch prompt

package/src/commands/snapshot.ts

@@ -25,7 +25,7 @@ async function cmdSnapshot(args: string[]): Promise<number> {
 
   const profileName = await resolveActiveProfile();
   if (!profileName) {
-    process.stderr.write("No active profile. Pin one with `echo <name> > .cue-profile`\n");
+    process.stderr.write("No active profile. Pin one with `echo <name> > .cue.profile`\n");
     return 1;
   }
 
@@ -101,6 +101,6 @@ async function cmdRestore(args: string[]): Promise<number> {
 
   writeFileSync(join(profileDir, "profile.yaml"), yaml.stringify(profileYaml));
   process.stdout.write(`✅ Restored profile "${snapshot.profile.name}" from snapshot\n`);
-  process.stdout.write(`   Pin with: echo ${snapshot.profile.name} > .cue-profile\n`);
+  process.stdout.write(`   Pin with: echo ${snapshot.profile.name} > .cue.profile\n`);
   return 0;
 }

package/src/commands/summon.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, test, beforeEach, afterEach } from "bun:test";
+import { mkdtemp, rm, writeFile, readFile, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { summon, detectActiveProfile, REEXEC_CMD } from "./summon";
+
+let dir: string;
+beforeEach(async () => { dir = await mkdtemp(join(tmpdir(), "cue-summon-")); });
+afterEach(async () => { await rm(dir, { recursive: true, force: true }); });
+
+describe("detectActiveProfile", () => {
+  test("prefers CUE_ACTIVE_PROFILE, then CUE_PROFILE", () => {
+    // Arrange / Act / Assert
+    expect(detectActiveProfile({ CUE_ACTIVE_PROFILE: "a", CUE_PROFILE: "b" } as NodeJS.ProcessEnv)).toBe("a");
+    expect(detectActiveProfile({ CUE_PROFILE: "b" } as NodeJS.ProcessEnv)).toBe("b");
+  });
+
+  test("falls back to the CLAUDE_CONFIG_DIR runtime path", () => {
+    const env = { CLAUDE_CONFIG_DIR: "/home/u/.config/cue/runtime/core+skill-writer/claude" } as NodeJS.ProcessEnv;
+    expect(detectActiveProfile(env)).toBe("core+skill-writer");
+  });
+
+  test("returns null when nothing identifies the session", () => {
+    expect(detectActiveProfile({} as NodeJS.ProcessEnv)).toBeNull();
+  });
+});
+
+describe("summon", () => {
+  test("explicit profile arg overrides an auto-detect signal", async () => {
+    // Arrange: a dir that WOULD auto-detect vercel...
+    await writeFile(join(dir, "vercel.json"), "{}");
+    // Act: ...but an explicit profile is passed.
+    const r = await summon({ cwd: dir, profile: "core", active: null, noPin: true });
+    // Assert
+    expect(r.profile).toBe("core");
+    expect(r.detected).toBe(false);
+    expect(r.reexec_cmd).toBe(REEXEC_CMD);
+    expect(r.skills.length).toBeGreaterThan(0);
+    expect(r.skills.every((s) => s.id.length > 0 && typeof s.mcp_status === "string")).toBe(true);
+  });
+
+  test("auto-detects vercel from vercel.json + @vercel deps", async () => {
+    // Arrange
+    await writeFile(join(dir, "vercel.json"), "{}");
+    await writeFile(join(dir, "next.config.js"), "");
+    await writeFile(join(dir, "package.json"), JSON.stringify({ dependencies: { next: "15", vercel: "39" } }));
+    // Act
+    const r = await summon({ cwd: dir, active: null, noPin: true });
+    // Assert
+    expect(r.profile).toBe("vercel");
+    expect(r.detected).toBe(true);
+    expect(r.confidence ?? 0).toBeGreaterThanOrEqual(0.9);
+    expect(r.persona.length).toBeGreaterThan(0);
+  });
+
+  test("throws when no profile resolves from an empty dir", async () => {
+    await expect(summon({ cwd: dir, active: null, noPin: true })).rejects.toThrow();
+  });
+
+  test("throws on an unknown explicit profile", async () => {
+    await expect(summon({ cwd: dir, profile: "does-not-exist-xyz", active: null })).rejects.toThrow(/unknown profile/);
+  });
+
+  test("writes the .cue.profile pin by default, skips it with noPin", async () => {
+    // Arrange / Act
+    const r1 = await summon({ cwd: dir, profile: "vercel", active: null });
+    // Assert
+    expect(r1.pin_written).toBe(true);
+    expect(r1.pin_path).toBe(join(dir, ".cue.profile"));
+    expect((await readFile(join(dir, ".cue.profile"), "utf8")).trim()).toBe("vercel");
+
+    const r2 = await summon({ cwd: dir, profile: "vercel", active: null, noPin: true });
+    expect(r2.pin_written).toBe(false);
+  });
+
+  test("dry-run computes a result without writing the pin", async () => {
+    const r = await summon({ cwd: dir, profile: "vercel", active: null, dryRun: true });
+    expect(r.pin_written).toBe(false);
+    expect(r.pin_previous).toBeNull();
+    await expect(stat(join(dir, ".cue.profile"))).rejects.toThrow();
+  });
+
+  test("re-pinning the same profile is a no-op, not a clobber", async () => {
+    // Arrange: already pinned to vercel
+    await writeFile(join(dir, ".cue.profile"), "vercel\n");
+    // Act
+    const r = await summon({ cwd: dir, profile: "vercel", active: null });
+    // Assert: no rewrite, but the prior pin is surfaced
+    expect(r.pin_written).toBe(false);
+    expect(r.pin_previous).toBe("vercel");
+  });
+
+  test("re-pinning a different profile surfaces the replaced pin", async () => {
+    // Arrange: pinned to a different profile
+    await writeFile(join(dir, ".cue.profile"), "core\n");
+    // Act
+    const r = await summon({ cwd: dir, profile: "vercel", active: null });
+    // Assert: written, and the previous pin is reported (not silently clobbered)
+    expect(r.pin_written).toBe(true);
+    expect(r.pin_previous).toBe("core");
+    expect((await readFile(join(dir, ".cue.profile"), "utf8")).trim()).toBe("vercel");
+  });
+
+  test("mcp_status reflects the active session's loaded MCPs", async () => {
+    // browser/lightpanda needs the `lightpanda` MCP; core loads it.
+    const lp = (skills: { id: string; mcp_status: string }[]) =>
+      skills.find((s) => s.id === "browser/lightpanda");
+
+    const noActive = await summon({ cwd: dir, profile: "vercel", active: null, noPin: true });
+    const withCore = await summon({ cwd: dir, profile: "vercel", active: "core", noPin: true });
+
+    expect(lp(noActive.skills)?.mcp_status).toBe("missing:lightpanda");
+    expect(lp(withCore.skills)?.mcp_status).toBe("ok");
+  });
+});