cue-ai 0.9.2 → 0.9.4

package/src/lib/runtime-materializer.test.ts

@@ -53,6 +53,29 @@ describe("materializeRuntime", () => {
     expect(hash).toMatch(/^[a-f0-9]{64}$/);
   });
 
+  test("surfaces allowlisted profile.env (CLAUDE_CODE_SUBAGENT_MODEL) into settings.env", async () => {
+    const out = await materializeRuntime({
+      profile: {
+        ...sampleProfile,
+        env: {
+          CLAUDE_CODE_SUBAGENT_MODEL: "claude-sonnet-4-6",
+          // secret reference — must NOT leak into settings.json
+          AWS_SECRET_ACCESS_KEY: "${AWS_SECRET_ACCESS_KEY}",
+        },
+      },
+      agent: "claude-code",
+      runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id) => `/fake/skills/${id}`,
+      mcpRegistry: { "claude-mem": { command: "claude-mem", args: [] } },
+      userClaudeMd: "# user CLAUDE.md\n",
+    });
+
+    const settings = JSON.parse(await readFile(join(out.runtimeDir, "settings.json"), "utf8"));
+    expect(settings.env).toEqual({ CLAUDE_CODE_SUBAGENT_MODEL: "claude-sonnet-4-6" });
+    // unresolved "${...}" placeholder and non-allowlisted keys stay out
+    expect(settings.env.AWS_SECRET_ACCESS_KEY).toBeUndefined();
+  });
+
   test("second call with same profile is a no-op (rebuilt=false)", async () => {
     const args = {
       profile: sampleProfile,
@@ -396,6 +419,120 @@ describe("materializeRuntime", () => {
     expect(creds.claudeAiOauth.refreshToken).toBe("live");
   });
 
+  test("credentialsSource: cache hit re-seeds a FILE .claude.json on account switch", async () => {
+    // Regression: runtime dirs are keyed by profile, so two authmux accounts
+    // share one runtime. Claude's atomic rewrite turns the .claude.json symlink
+    // into a local FILE owned by the last-logged-in account; the overlay's
+    // "cue override — don't touch" rule then left the OLD account's identity
+    // paired with the NEW account's tokens, forcing a re-login every time the
+    // accounts alternated on a profile.
+    const credSrcA = join(root, "accA");
+    const credSrcB = join(root, "accB");
+    await mkdir(credSrcA, { recursive: true });
+    await mkdir(credSrcB, { recursive: true });
+    await writeFile(join(credSrcA, ".credentials.json"), '{"claudeAiOauth":{"refreshToken":"A"}}');
+    await writeFile(join(credSrcB, ".credentials.json"), '{"claudeAiOauth":{"refreshToken":"B"}}');
+    await writeFile(join(credSrcA, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "uuid-A" } }));
+    await writeFile(join(credSrcB, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "uuid-B" } }));
+
+    const args = {
+      profile: { ...sampleProfile, name: "acct-switch" },
+      agent: "claude-code" as const,
+      runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id: string) => `/fake/source/${id}`,
+      mcpRegistry: { "claude-mem": { command: "claude-mem" } },
+      userClaudeMd: "",
+    };
+
+    const first = await materializeRuntime({ ...args, credentialsSource: credSrcA });
+    expect(first.rebuilt).toBe(true);
+    // Simulate Claude Code's atomic rewrite: the .claude.json symlink becomes
+    // a local regular file carrying account A's identity + session state.
+    await rm(join(first.runtimeDir, ".claude.json"), { force: true });
+    await writeFile(
+      join(first.runtimeDir, ".claude.json"),
+      JSON.stringify({ oauthAccount: { accountUuid: "uuid-A" }, projects: { "/w": {} } }),
+    );
+
+    // Account B launches the same profile → cache hit → identity must follow.
+    const second = await materializeRuntime({ ...args, credentialsSource: credSrcB });
+    expect(second.rebuilt).toBe(false);
+    const cj = JSON.parse(await readFile(join(second.runtimeDir, ".claude.json"), "utf8"));
+    expect(cj.oauthAccount.accountUuid).toBe("uuid-B");
+    const creds = JSON.parse(await readFile(join(second.runtimeDir, ".credentials.json"), "utf8"));
+    expect(creds.claudeAiOauth.refreshToken).toBe("B");
+  });
+
+  test("credentialsSource: cache hit keeps a FILE .claude.json when the account matches", async () => {
+    // Same-account relaunch must NOT clobber per-profile session state
+    // (projects list etc.) that Claude wrote into the runtime's local file.
+    const credSrc = join(root, "accSame");
+    await mkdir(credSrc, { recursive: true });
+    await writeFile(join(credSrc, ".credentials.json"), '{"claudeAiOauth":{"refreshToken":"A"}}');
+    await writeFile(join(credSrc, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "uuid-A" } }));
+
+    const args = {
+      profile: { ...sampleProfile, name: "acct-same" },
+      agent: "claude-code" as const,
+      runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id: string) => `/fake/source/${id}`,
+      mcpRegistry: { "claude-mem": { command: "claude-mem" } },
+      userClaudeMd: "",
+    };
+
+    const first = await materializeRuntime({ ...args, credentialsSource: credSrc });
+    await rm(join(first.runtimeDir, ".claude.json"), { force: true });
+    const localState = JSON.stringify({ oauthAccount: { accountUuid: "uuid-A" }, projects: { "/w": { history: [1] } } });
+    await writeFile(join(first.runtimeDir, ".claude.json"), localState);
+
+    const second = await materializeRuntime({ ...args, credentialsSource: credSrc });
+    expect(second.rebuilt).toBe(false);
+    // Identity + per-profile session state preserved (syncMcpsIntoClaudeJson
+    // legitimately rewrites the file to merge mcpServers, so compare fields,
+    // not bytes).
+    const cj = JSON.parse(await readFile(join(second.runtimeDir, ".claude.json"), "utf8"));
+    expect(cj.oauthAccount.accountUuid).toBe("uuid-A");
+    expect(cj.projects).toEqual({ "/w": { history: [1] } });
+  });
+
+  test("credentialsSource: rebuild does not resurrect another account's identity or tokens", async () => {
+    // The preserve step's expiresAt comparison is meaningless across accounts:
+    // the old runtime's token may expire later yet belong to the OTHER account.
+    // On a cross-account rebuild the source state must win wholesale.
+    const credSrcA = join(root, "rebA");
+    const credSrcB = join(root, "rebB");
+    await mkdir(credSrcA, { recursive: true });
+    await mkdir(credSrcB, { recursive: true });
+    const LATER = 9_000_000_000_000;
+    await writeFile(join(credSrcA, ".credentials.json"), JSON.stringify({ claudeAiOauth: { expiresAt: LATER, refreshToken: "A" } }));
+    await writeFile(join(credSrcB, ".credentials.json"), JSON.stringify({ claudeAiOauth: { expiresAt: 1_000, refreshToken: "B" } }));
+    await writeFile(join(credSrcA, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "uuid-A" } }));
+    await writeFile(join(credSrcB, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "uuid-B" } }));
+
+    const base = {
+      agent: "claude-code" as const,
+      runtimeRoot: join(root, "runtime"),
+      skillSourceLookup: async (id: string) => `/fake/source/${id}`,
+      mcpRegistry: { "claude-mem": { command: "claude-mem" } },
+      userClaudeMd: "",
+    };
+    const p1: ResolvedProfile = { ...sampleProfile, name: "acct-rebuild" };
+    const p2: ResolvedProfile = { ...sampleProfile, name: "acct-rebuild", skills: { local: [{ id: "design/ui-ux-pro-max" }, { id: "design/extra" }], npx: [] } };
+
+    const first = await materializeRuntime({ ...base, profile: p1, credentialsSource: credSrcA });
+    // Claude's rewrite pins account A's identity into the runtime as a FILE.
+    await rm(join(first.runtimeDir, ".claude.json"), { force: true });
+    await writeFile(join(first.runtimeDir, ".claude.json"), JSON.stringify({ oauthAccount: { accountUuid: "uuid-A" } }));
+
+    // Account B relaunches with a changed profile → rebuild + preserve step.
+    const second = await materializeRuntime({ ...base, profile: p2, credentialsSource: credSrcB });
+    expect(second.rebuilt).toBe(true);
+    const creds = JSON.parse(await readFile(join(second.runtimeDir, ".credentials.json"), "utf8"));
+    expect(creds.claudeAiOauth.refreshToken).toBe("B");
+    const cj = JSON.parse(await readFile(join(second.runtimeDir, ".claude.json"), "utf8"));
+    expect(cj.oauthAccount.accountUuid).toBe("uuid-B");
+  });
+
   test("CLAUDE.md stamp uses real ISO timestamp, not literal $(date)", async () => {
     const out = await materializeRuntime({
       profile: sampleProfile,

package/src/lib/runtime-materializer.ts

@@ -531,11 +531,18 @@ export async function materializeRuntime(input: MaterializeInput): Promise<Mater
     process.env.CUE_TRIGGER_PHRASES === "1" ||
     process.env.CUE_TRIGGER_PHRASES === "true"
   );
+  // Cap the capability table so heavy profiles (60+ skills) don't blow past
+  // Claude Code's 40KB CLAUDE.md perf threshold. Overflow skills stay listed
+  // under "Available Skills" and loadable on demand. Override with
+  // CUE_MAX_CAPABILITY_ROWS (0 disables the cap).
+  const maxCapEnv = Number(process.env.CUE_MAX_CAPABILITY_ROWS);
+  const maxCapabilityRows = Number.isFinite(maxCapEnv) && maxCapEnv >= 0 ? maxCapEnv : 50;
   const routerBlock = renderRouter(routerParsed, {
     overrides: routerOverrides,
     zombies: zombieIds,
     lean,
     omitTriggerPhrases,
+    maxCapabilityRows,
   });
   if (routerBlock) stamp += routerBlock;
 
@@ -716,7 +723,21 @@ export async function materializeRuntime(input: MaterializeInput): Promise<Mater
   //   rm ~/.config/cue/runtime/<profile>/claude/.credentials.json
   //   rm ~/.config/cue/runtime/<profile>/claude/.claude.json
   // Next launch will copy current source state.
-  const preserveFiles = [".claude.json", ".credentials.json", "backups"];
+  // Account-identity guard: runtime dirs are keyed by PROFILE, so two authmux
+  // accounts (claude-account1 / claude-account2 with different
+  // CLAUDE_CONFIG_DIRs) share the same runtime. When the OLD runtime belongs
+  // to a different account than the current credentialsSource, resurrecting
+  // its .claude.json/.credentials.json would pair the old account's identity
+  // with the new account's tokens (or vice versa) — and the expiresAt
+  // comparison below is meaningless across accounts. Skip preservation
+  // entirely and let the overlay's source state win.
+  let sameAccount = true;
+  if (input.credentialsSource) {
+    const srcUuid = await accountUuidAt(join(input.credentialsSource, ".claude.json"));
+    const oldUuid = await accountUuidAt(join(runtimeDir, ".claude.json"));
+    if (srcUuid && oldUuid && srcUuid !== oldUuid) sameAccount = false;
+  }
+  const preserveFiles = sameAccount ? [".claude.json", ".credentials.json", "backups"] : [];
   for (const name of preserveFiles) {
     const oldPath = join(runtimeDir, name);
     const newPath = join(tmpDir, name);
@@ -770,6 +791,24 @@ async function credentialsExpiresAt(path: string): Promise<number> {
   }
 }
 
+/**
+ * Read `oauthAccount.accountUuid` from a `.claude.json` at `path`. Returns
+ * undefined when the file is missing, unparseable, or carries no account —
+ * callers treat "unknown" as "don't make account-based decisions".
+ *
+ * Sibling of `readAccountUuid` in credentials-sync.ts (dir-based); keep the
+ * schema (`oauthAccount.accountUuid`) in sync if it ever changes.
+ */
+async function accountUuidAt(path: string): Promise<string | undefined> {
+  try {
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw) as { oauthAccount?: { accountUuid?: string } };
+    return parsed?.oauthAccount?.accountUuid;
+  } catch {
+    return undefined;
+  }
+}
+
 function collectProfileMcps(
   profile: ResolvedProfile,
   agent: AgentKind,
@@ -900,7 +939,36 @@ async function overlaySourceState(targetDir: string, sourceDir: string): Promise
     // a shared one that gets clobbered when 2 profiles run concurrently.
     const isCopyFile = name === ".credentials.json" || isLegacyClaudeJson;
 
-    if (existingType === "other" && !isCopyFile) continue; // cue override — don't touch
+    if (existingType === "other" && !isCopyFile) {
+      // Account-identity guard: .claude.json starts life as a symlink into the
+      // source dir, but Claude Code's atomic rewrite (tmp → rename) replaces it
+      // with a local FILE owned by whichever account last logged in here. Since
+      // runtime dirs are keyed by profile (not account), a different authmux
+      // account launching the same profile used to find its fresh tokens paired
+      // with the OLD account's identity — booting into the login flow every time
+      // the two accounts alternated on a profile. When the uuids differ, re-seed
+      // identity from the source so it follows CLAUDE_CONFIG_DIR.
+      //
+      // Trade-off: the swap replaces the whole file, so the OLD account's
+      // per-profile session state (projects list etc.) in this runtime is
+      // discarded — acceptable, since it belongs to a different account.
+      if (name === ".claude.json") {
+        const srcUuid = await accountUuidAt(sourcePath);
+        const dstUuid = await accountUuidAt(targetPath);
+        if (srcUuid && dstUuid && srcUuid !== dstUuid) {
+          try {
+            // Copy to a sibling tmp + atomic rename — never leaves a window
+            // where .claude.json is missing/partial while a concurrent claude
+            // process might read or atomically rewrite it.
+            const { copyFile } = await import("node:fs/promises");
+            const tmp = `${targetPath}.cue-swap.${process.pid}`;
+            await copyFile(sourcePath, tmp);
+            await rename(tmp, targetPath);
+          } catch { /* non-fatal — keep existing file */ }
+        }
+      }
+      continue; // cue override — don't touch
+    }
 
     if (existingType === "symlink" || (existingType === "other" && isCopyFile)) {
       // Replace if it points elsewhere (e.g. previous account on cache hit).
@@ -1057,6 +1125,41 @@ async function buildClaudeSettings(
   if (Object.keys(mergedHooks).length > 0) {
     settings.hooks = mergedHooks;
   }
+
+  // Surface an allowlisted subset of profile.env into settings.json `env` so
+  // Claude Code's cost/runtime knobs actually reach the session. profile.env is
+  // otherwise consumed only for MCP-placeholder substitution (mcp-materializer)
+  // and never reaches the agent process. We allowlist deliberately: profile.env
+  // also holds secret references like "${AWS_SECRET_ACCESS_KEY}" that must NOT
+  // be written into settings.json. Gated to claude-code (these keys are
+  // Claude-Code-specific; codex uses its own config). Set in `core` so it fans
+  // out to every inheriting profile — e.g. CLAUDE_CODE_SUBAGENT_MODEL pins
+  // subagents to Sonnet, ~50-60% cheaper than Opus on file-read/grep/review.
+  if (agent === "claude-code") {
+    // Allowlist of Claude-Code cost/runtime knobs that may flow from profile.env
+    // into settings.json. To surface a new one, append its key here.
+    const CLAUDE_RUNTIME_ENV_KEYS = [
+      "CLAUDE_CODE_SUBAGENT_MODEL", // run Task/Agent subagents on a cheaper model
+    ];
+    // Preserve any account-level env from credentialsSource (spread in via
+    // baseSettings above); profile-declared keys overlay it (profile is more
+    // specific). Skip unset values and unresolved placeholders — the `${`
+    // check is deliberately conservative: any "${...}"-shaped value is treated
+    // as an unresolved secret reference and dropped, never written out.
+    const runtimeEnv: Record<string, string> = {
+      ...((settings.env as Record<string, string> | undefined) ?? {}),
+    };
+    for (const key of CLAUDE_RUNTIME_ENV_KEYS) {
+      const val = profile.env?.[key];
+      if (typeof val === "string" && val.length > 0 && !val.includes("${")) {
+        runtimeEnv[key] = val;
+      }
+    }
+    if (Object.keys(runtimeEnv).length > 0) {
+      settings.env = runtimeEnv;
+    }
+  }
+
   return JSON.stringify(settings, null, 2);
 }
 

package/src/lib/skill-router.test.ts

@@ -297,3 +297,41 @@ describe("renderRouter zombie compaction", () => {
     expect(md).toContain("Rarely-used skills (3)");
   });
 });
+
+describe("renderRouter capability cap", () => {
+  function manySkills(n: number): ParsedSkill[] {
+    return Array.from({ length: n }, (_, i) =>
+      parseSkillFromContent(
+        `cat/skill-${i}`,
+        `---\ndescription: Does useful thing number ${i} for the pipeline workflow.\n---`,
+      ),
+    );
+  }
+
+  test("no cap → every capability row renders", () => {
+    const md = renderRouter(manySkills(60));
+    const rows = md.split("\n").filter((l) => l.startsWith("| Does useful thing"));
+    expect(rows.length).toBe(60);
+  });
+
+  test("cap truncates capability rows and emits an on-demand note", () => {
+    const md = renderRouter(manySkills(60), { maxCapabilityRows: 50 });
+    const rows = md.split("\n").filter((l) => l.startsWith("| Does useful thing"));
+    expect(rows.length).toBe(50);
+    expect(md).toMatch(/\+10 more skills/);
+    expect(md).toContain("loadable via the Skill tool on demand");
+  });
+
+  test("cap is a no-op when row count is at or below the cap", () => {
+    const md = renderRouter(manySkills(50), { maxCapabilityRows: 50 });
+    expect(md).not.toMatch(/more skill.* loadable via the Skill tool/);
+  });
+
+  test("manual persona_routing rows survive the cap", () => {
+    const md = renderRouter(manySkills(60), {
+      maxCapabilityRows: 50,
+      overrides: [{ capability: "ALWAYS-KEEP this manual row", skill: "x/manual" }],
+    });
+    expect(md).toContain("ALWAYS-KEEP this manual row");
+  });
+});

package/src/lib/skill-router.ts

@@ -324,6 +324,16 @@ export interface RouterRenderOptions {
    * push the file past Claude Code's 40KB perf-warning threshold.
    */
   omitTriggerPhrases?: boolean;
+  /**
+   * Cap the number of rows in the capability table. On heavy profiles (60+
+   * skills) the auto-built capability table is the single largest block in
+   * the materialized CLAUDE.md. Beyond the cap, the lowest-signal skills
+   * (weak metadata first) drop their capability row and collapse into a
+   * single "+N more loadable on demand" note — they stay listed under
+   * "Available Skills" and remain invokable via the Skill tool. Manual
+   * `persona_routing:` rows are always kept. 0 / undefined → no cap.
+   */
+  maxCapabilityRows?: number;
 }
 
 /**
@@ -370,15 +380,23 @@ export function renderRouter(
   // Capability rows: any skill with a capability blurb OR explicit
   // when_to_invoke entries. We surface up to 3 task-shapes per skill;
   // skills with only a capability blurb render a single "any X work" row.
-  const capabilityRows: { task: string; skill: string; manual?: boolean; note?: string }[] = [];
+  const capabilityRows: {
+    task: string;
+    skill: string;
+    manual?: boolean;
+    note?: string;
+    quality?: ParseQuality;
+  }[] = [];
   for (const s of activeSkills) {
     if (s.whenToInvoke.length > 0) {
-      for (const task of s.whenToInvoke.slice(0, 3)) {
-        capabilityRows.push({ task, skill: s.name });
+      // Two task-shapes per skill is enough to prime routing; a third row
+      // rarely adds signal and inflates the table on heavy profiles.
+      for (const task of s.whenToInvoke.slice(0, 2)) {
+        capabilityRows.push({ task, skill: s.name, quality: s.quality });
       }
     } else if (s.capability) {
       const summary = truncate(s.capability, 70);
-      capabilityRows.push({ task: summary, skill: s.name });
+      capabilityRows.push({ task: summary, skill: s.name, quality: s.quality });
     }
   }
 
@@ -411,6 +429,44 @@ export function renderRouter(
     }
   }
 
+  // Capability-table cap. On heavy profiles this table is the largest block
+  // in the materialized CLAUDE.md. Keep manual (persona_routing) rows plus the
+  // highest-signal skills; collapse the overflow into a single on-demand note.
+  // The dropped skills stay listed under "Available Skills" and invokable via
+  // the Skill tool — only their capability hint is omitted.
+  let capOverflowSkills = 0;
+  const cap = options.maxCapabilityRows ?? 0;
+  if (cap > 0 && capabilityRows.length > cap) {
+    const qualityRank: Record<ParseQuality, number> = { good: 0, partial: 1, none: 2 };
+    const ordered = capabilityRows
+      .map((row, idx) => ({ row, idx }))
+      .sort((a, b) => {
+        // Manual rows first (always kept), then by metadata quality, then
+        // stable on original order so a skill's rows stay together.
+        const am = a.row.manual ? 0 : 1;
+        const bm = b.row.manual ? 0 : 1;
+        if (am !== bm) return am - bm;
+        const aq = qualityRank[a.row.quality ?? "none"];
+        const bq = qualityRank[b.row.quality ?? "none"];
+        if (aq !== bq) return aq - bq;
+        return a.idx - b.idx;
+      });
+    const keptSet = new Set(ordered.slice(0, cap).map((e) => e.idx));
+    const keptSkills = new Set<string>();
+    const droppedSkills = new Set<string>();
+    capabilityRows.forEach((row, idx) => {
+      if (keptSet.has(idx)) keptSkills.add(row.skill);
+    });
+    capabilityRows.forEach((row, idx) => {
+      if (!keptSet.has(idx) && !keptSkills.has(row.skill)) droppedSkills.add(row.skill);
+    });
+    capOverflowSkills = droppedSkills.size;
+    // Re-filter in original order so kept rows read naturally.
+    const filtered = capabilityRows.filter((_, idx) => keptSet.has(idx));
+    capabilityRows.length = 0;
+    capabilityRows.push(...filtered);
+  }
+
   // Tail: skills that yielded nothing or are missing on disk. Zombies that
   // already match the "no metadata" criterion are deduped here so they don't
   // appear in both the "Other skills" tail AND the "Rarely-used" tail.
@@ -448,6 +504,11 @@ export function renderRouter(
       "These wrap the underlying tools with prompt-enhancement, house " +
       "style, or correct CLI invocations. Freestyling around them produces " +
       "worse output.\n\n";
+    if (capOverflowSkills > 0) {
+      out +=
+        `_+${capOverflowSkills} more skill${capOverflowSkills === 1 ? "" : "s"} in this profile — ` +
+        "listed under \"Available Skills\" and loadable via the Skill tool on demand._\n\n";
+    }
   }
 
   if (triggerRows.length > 0 && !options.omitTriggerPhrases) {

package/profiles/eu-tender-research/README.md

@@ -1,48 +0,0 @@
-# 🏛️ eu-tender-research
-
-EU funding research for **agentic AI companies in Slovakia or Hungary**. Two jobs in one
-profile: find public-procurement **tenders** to bid on, and map the **grants, cheap loans,
-and venture capital** a company can apply for. Built so the second run is faster, cheaper,
-and more accurate than the first.
-
-## Two channels, two skills
-
-| You want to... | Skill | Source |
-|---|---|---|
-| Find EU tenders to bid on | `eu-funding/ted-tender-search` | Official TED API (free, no key) |
-| Find grants / loans / VC for a company | `eu-funding/hu-grant-finder` | palyazat.gov.hu, NKFIH, MFB, Hiventures, EIC |
-
-Both skills carry the **verified recipes** so the agent doesn't rediscover them:
-the TED API endpoint + Expert-Search query language, the Hungarian funding ladder,
-the canonical sources, and the eligibility gotchas that disqualify fastest.
-
-## The funding channels (the #1 thing users confuse)
-
-- **Tender / közbeszerzés** — TED procurement: you *sell* services to the state.
-- **Grant / támogatás** — GINOP/DIMOP: non-repayable project money.
-- **Loan / hitel** — MFB / GINOP 1.4.x: cheap (often 0%) but you repay.
-- **VC / kockázati tőke** — Hiventures (GINOP 2.5.1), EIC: equity investment.
-
-## Gotchas baked into the persona
-
-- **Closed-year wall** — most KKV grants/loans need ≥1 closed business year. An egyéni
-  vállalkozó's closed tax year counts; don't found a fresh Kft and reset the clock.
-- **Region split** — DIMOP/GINOP: Budapest (`/C`) vs every other county (`/B`, favoured).
-- **Timing** — frames close on *forráskimerülés*, often before the deadline; re-check live.
-- **VC is not free** — equity + TRL6 product; GINOP 2.5.1 excludes "only software" firms.
-- **Deep-tech ≠ SaaS** — an LLM-wrapper won't win EIC; Hungary's route is EIC Pre-Accelerator.
-
-## MCPs
-
-`ted-eu` (free single-notice fetch), `lightpanda` (page render), `gbrain` (track
-shortlisted opportunities across sessions). No paid scraper, no API token. Apify is
-re-addable if ever wanted: `cue mcps add apify-ted-eu` (needs `APIFY_API_TOKEN`).
-
-## Use it
-
-```bash
-cue use eu-tender-research
-```
-
-Then ask things like *"find open IT tenders from Hungarian buyers"* or *"what grants can a
-new Hungarian AI company apply for?"* — the matching skill activates and runs the verified flow.

package/profiles/eu-tender-research/profile.yaml

@@ -1,108 +0,0 @@
-name: eu-tender-research
-icon: "🏛️"
-iconImage: "logo.png"
-description: "EU funding research for agentic AI companies in Slovakia or Hungary: TED tenders + grants/loans/VC (GINOP, DIMOP, Hiventures, EIC). Find, filter, assess eligibility, draft briefs."
-agents: [claude-code]
-inherits: core
-skills:
-  local:
-    - eu-funding/ted-tender-search
-    - eu-funding/hu-grant-finder
-    - eu-funding/grant-outreach
-    - research/find-skills
-    - research/defuddle
-    - research/trendradar
-    - gstack/scrape
-    - gstack/document-generate
-    - gstack/make-pdf
-    - content/article-writer
-mcps:
-  - lightpanda
-  - gbrain
-  - trendradar
-env:
-  EU_TENDER_HQ_COUNTRIES: "SK,HU"
-  TED_API_BASE: "https://api.ted.europa.eu/v3"
-persona: |
-  You run EU funding research for agentic AI companies headquartered in
-  Slovakia (SK) or Hungary (HU). Two jobs: (1) surface TED procurement
-  tenders these firms can bid on, and (2) map the grants, cheap loans, and
-  venture capital they can apply for. Rank by fit and eligibility, then turn
-  winners into a clean brief.
-
-  ## Funding channels (DON'T conflate them, this is the #1 user confusion)
-
-  | Channel | What it is | Lead skill |
-  |---|---|---|
-  | Tender / közbeszerzés | TED procurement, you *sell* to the state | `eu-funding/ted-tender-search` |
-  | Grant / támogatás | GINOP/DIMOP, non-repayable | `eu-funding/hu-grant-finder` |
-  | Cheap loan / hitel | MFB / GINOP 1.4.x, 0% but repay | `eu-funding/hu-grant-finder` |
-  | Venture capital | Hiventures (GINOP 2.5.1), EIC, equity | `eu-funding/hu-grant-finder` |
-
-  The two `eu-funding/*` skills carry the verified recipes (TED API query
-  language, the Hungarian funding ladder, the sources, the eligibility
-  gotchas). Read the matching skill first, don't rediscover the endpoint or
-  the gotchas from scratch.
-
-  ## Gotchas that gate everything (check before detailing amounts)
-
-  - **Closed-year wall** — most KKV grants/loans need >=1 closed business
-    year + 1 employee; a brand-new company can't apply day one. An egyeni
-    vallalkozo's closed tax year counts, so don't found a fresh Kft and
-    reset that clock.
-  - **Region split** — DIMOP/GINOP is Budapest (`/C`) vs every other county
-    (`/B`, "less developed"); wealthy counties are in the favoured `/B`.
-  - **Timing** — frames close on forraskimerules, often before the deadline;
-    re-check the live active list at palyazat.gov.hu the same day.
-  - **VC is not free** — Hiventures/EIC take equity, need a TRL6 working
-    product, and GINOP 2.5.1 excludes "only software" firms.
-  - **Deep-tech vs SaaS** — an LLM-wrapper is SaaS, not deep tech; EIC wants
-    breakthrough. Hungary is a "widening" country, so EIC Pre-Accelerator is
-    the realistic stepping stone.
-
-  ## Data sources (route by need)
-
-  | Need                                                              | Tool                          |
-  |-------------------------------------------------------------------|-------------------------------|
-  | Search TED notices (CPV, country, deadline, value) — free, no key | Official TED API, `${TED_API_BASE}/notices/search` (POST) |
-  | Fetch one notice in full by publication number                    | Same TED API: `query: "publication-number IN (123456-2025)"` |
-  | Render a TED portal page that the API can't reach                 | `lightpanda` MCP, gstack/scrape |
-  | Strip a notice page to clean text                                 | research/defuddle             |
-  | Track shortlisted tenders + buyer contacts across sessions        | `gbrain` MCP                  |
-  | Spot which procurement themes are heating up                      | research/trendradar           |
-  | Draft a bid summary / capability statement                        | content/article-writer        |
-  | Export the brief as a shareable doc/PDF                           | gstack/document-generate, gstack/make-pdf |
-
-  ## Defaults
-
-  - **Fit before volume.** A relevant notice an SK/HU agentic-AI firm can win
-    beats ten generic IT tenders. Filter hard on CPV codes for software, AI,
-    data, and consulting services (72xxxxxx, 48xxxxxx, 73xxxxxx), buyer
-    country, deadline still open, and eligibility (no incumbent lock-in).
-  - **Source every notice.** Each tender in a brief carries its TED
-    publication number (e.g. `123456-2025`), buyer, country, value, deadline,
-    and the live notice URL. No number, not in the brief.
-  - **Rank, don't dump.** When you produce a list of tenders (3+), run
-    `/roi-estimator` so each row carries a fit/value tag the user can sort by.
-  - **Both bid angles.** A notice can fit either as the prime bidder or as a
-    subcontractor to a local integrator — flag which when it's not obvious.
-  - **Verify before claiming done.** Confirm a notice is still open and the
-    publication number resolves before putting it in front of the user.
-
-  ## Free stack, no credentials
-
-  Everything here runs without an API key or paid scraper:
-
-  - **Search** is the official EU TED API at `${TED_API_BASE}/notices/search`
-    (POST JSON `{query, fields, limit, scope:"ACTIVE"}`). The Expert Search
-    query language filters on `classification-cpv`, `place-of-performance`,
-    `deadline-date`, `notice-type`, etc. No key needed.
-    Example: `classification-cpv IN (72000000) AND place-of-performance IN (SVK HUN)`.
-  - **Single-notice detail** comes from the same API:
-    `query: "publication-number IN (123456-2025)"`, `scope: "ALL"`. No MCP needed.
-  - **Page scraping** uses `lightpanda` + `defuddle` locally — no cloud
-    scraper (Apify, Firecrawl, etc.) required.
-  - **Why no TED MCP:** the `ted-eu` gateway exposes 22 tools for 2 useful
-    ones, and its search is an NL-router black box. The API above is precise,
-    verified, and zero-bloat. Re-add it only if you want NL queries:
-    `cue mcps add ted-eu` (or `apify-ted-eu`, needs `APIFY_API_TOKEN`).