dotcms 0.2.0 → 26.9.3-1-next.2657

package/index.js

@@ -45,9 +45,6 @@ var confirmExclude = (files) => ask(
   `Add ${files.length === 1 ? "this file" : `these ${files.length} files`} to .gitignore? They contain an access token.`
 );
 
-// libs/sdk/cli/src/commands/agent/setup.ts
-import { parse as parseToml } from "smol-toml";
-
 // libs/sdk/cli/src/commands/agent/connect.ts
 import * as childProcess from "node:child_process";
 
@@ -60,25 +57,49 @@ var SERVER_ENV = {
 };
 var SKILLS_SOURCE = "dotCMS/agent-toolkit";
 
+// libs/sdk/cli/src/shared/env.ts
+var ENV_KEYS = {
+  url: "DOTCMS_URL",
+  password: "DOTCMS_PASSWORD",
+  authToken: "DOTCMS_AUTH_TOKEN",
+  codexHome: "CODEX_HOME"
+};
+function readEnv(key) {
+  const value = process.env[key];
+  return value && value.trim() !== "" ? value : void 0;
+}
+function envWithoutSecrets(extra = {}) {
+  const clean = { ...process.env };
+  delete clean[ENV_KEYS.authToken];
+  delete clean[ENV_KEYS.password];
+  return { ...clean, ...extra };
+}
+
 // libs/sdk/cli/src/commands/agent/connect.ts
 var DEFAULT_TIMEOUT_MS = 6e4;
-function classify(stderr, code) {
+function classify(stderr) {
   if (/404|E404|not found|ETARGET|ENOTFOUND|registry/i.test(stderr))
     return "fetch-failed";
   if (/Unsupported engine|requires Node|SyntaxError|Unexpected token/i.test(stderr)) {
     return "runtime-unsupported";
   }
-  return code === null ? "exited" : "exited";
+  return "exited";
 }
 async function confirmConnection(args) {
   const timeoutMs = args.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const child = childProcess.spawn("npx", ["-y", MCP_SERVER_PACKAGE], {
     stdio: ["pipe", "pipe", "pipe"],
-    env: {
-      ...process.env,
+    // `npx` is `npx.cmd` on Windows and Node refuses `.cmd` without a shell since the
+    // CVE-2024-27980 fix — so FR-024a failed on every Windows run, reporting a broken
+    // server for a configuration that was written correctly.
+    shell: process.platform === "win32",
+    // This child needs the URL and the token; it has no use for the developer's
+    // DOTCMS_PASSWORD, and it is an unpinned `@latest` package by design — so the smaller
+    // the environment it sees, the better.
+    env: envWithoutSecrets({
       [SERVER_ENV.url]: args.url,
       [SERVER_ENV.token]: args.token
-    }
+    })
   });
   let stderr = "";
   child.stderr?.on("data", (chunk) => {
@@ -92,23 +113,48 @@ async function confirmConnection(args) {
       settled = true;
       clearTimeout(timer);
       try {
-        child.kill();
+        child.stdin?.end();
+      } catch {
+      }
+      try {
+        if (process.platform === "win32" && child.pid) {
+          childProcess.spawnSync("taskkill", ["/pid", String(child.pid), "/T", "/F"]);
+        } else {
+          child.kill();
+        }
       } catch {
       }
       resolve2(result);
     };
     const timer = setTimeout(
-      () => finish({ ok: false, cause: "timeout", detail: `No response within ${timeoutMs}ms.` }),
+      () => finish({
+        ok: false,
+        cause: "timeout",
+        detail: `No response within ${timeoutMs}ms.`
+      }),
       timeoutMs
     );
     let buffer = "";
     child.stdout?.on("data", (chunk) => {
       buffer += String(chunk);
-      for (const line of buffer.split("\n")) {
+      const frames = buffer.split("\n");
+      buffer = frames.pop() ?? "";
+      for (const line of frames) {
         if (!line.trim())
           continue;
         try {
           const message = JSON.parse(line);
+          if (message.id === 1) {
+            child.stdin?.write(
+              `${JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })}
+`
+            );
+            child.stdin?.write(
+              `${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" })}
+`
+            );
+            continue;
+          }
           const tools = message.result?.tools;
           if (Array.isArray(tools))
             finish({ ok: true, toolCount: tools.length });
@@ -124,7 +170,7 @@ async function confirmConnection(args) {
       "exit",
       (code) => finish({
         ok: false,
-        cause: classify(stderr, code),
+        cause: classify(stderr),
         detail: stderr.trim().split("\n").slice(-1)[0] || `Server exited with code ${code}.`
       })
     );
@@ -133,100 +179,32 @@ async function confirmConnection(args) {
         jsonrpc: "2.0",
         id: 1,
         method: "initialize",
-        params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "dotcms", version: "0" } }
+        params: {
+          protocolVersion: "2024-11-05",
+          capabilities: {},
+          clientInfo: { name: "dotcms", version: "0" }
+        }
       })}
 `
     );
-    child.stdin?.write(`${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" })}
-`);
   });
 }
 
 // libs/sdk/cli/src/commands/agent/gitignore.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync } from "node:fs";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-var CONVENTIONALLY_COMMITTED = /* @__PURE__ */ new Set([".mcp.json"]);
-function findRepositoryRoot(from) {
-  let dir = path.resolve(from);
-  for (; ; ) {
-    if (existsSync(path.join(dir, ".git")))
-      return dir;
-    const parent = path.dirname(dir);
-    if (parent === dir)
-      return null;
-    dir = parent;
-  }
-}
-async function protectFromVersionControl(args) {
-  const warnings = [];
-  const root = findRepositoryRoot(args.cwd);
-  for (const file of args.files) {
-    if (CONVENTIONALLY_COMMITTED.has(path.basename(file))) {
-      warnings.push(
-        `${path.basename(file)} is normally committed to version control \u2014 it now holds a token, so committing it would publish that token.`
-      );
-    }
-  }
-  if (!root) {
-    warnings.push(
-      "This directory is not under version control, so these files are unprotected \u2014 nothing here can exclude them for you."
-    );
-    return { files: args.files, inRepository: false, excluded: false, warnings };
-  }
-  const proceed = args.confirmExclude ? await args.confirmExclude(args.files) : false;
-  if (!proceed) {
-    return { files: args.files, inRepository: true, excluded: false, warnings };
-  }
-  const gitignorePath = path.join(root, ".gitignore");
-  let current = "";
-  try {
-    current = await fs.readFile(gitignorePath, "utf8");
-  } catch {
-  }
-  const already = new Set(current.split("\n").map((line) => line.trim()));
-  const toAdd = args.files.map((file) => path.relative(root, file).split(path.sep).join("/")).filter((entry) => !already.has(entry));
-  if (toAdd.length) {
-    const prefix = current === "" || current.endsWith("\n") ? "" : "\n";
-    const block = `${prefix}
-# dotCMS agent configuration \u2014 contains an access token
-${toAdd.join("\n")}
-`;
-    await fs.writeFile(gitignorePath, current + block, "utf8");
-  }
-  return { files: args.files, inRepository: true, excluded: true, warnings };
-}
-
-// libs/sdk/cli/src/commands/agent/skills.ts
-import * as childProcess2 from "node:child_process";
-function buildSkillsArgs(agentIds, global) {
-  return [
-    "-y",
-    "skills",
-    "add",
-    SKILLS_SOURCE,
-    ...agentIds.flatMap((id) => ["-a", id]),
-    ...global ? ["-g"] : [],
-    "-y"
-  ];
-}
-async function installSkills(args) {
-  const argv = buildSkillsArgs(args.agentIds, args.global);
-  const command = `npx ${argv.join(" ")}`;
-  try {
-    const result = childProcess2.spawnSync("npx", argv, { stdio: "inherit" });
-    if (result.status === 0)
-      return { ok: true, command };
-    return { ok: false, command, reason: `skills exited with code ${result.status}` };
-  } catch (error) {
-    return { ok: false, command, reason: error.message };
-  }
-}
-
-// libs/sdk/cli/src/shared/config-file.ts
 import * as fs2 from "node:fs/promises";
 import * as path2 from "node:path";
 
+// libs/sdk/cli/src/shared/config-file.ts
+import {
+  findNodeAtLocation,
+  parse as parseJsonc,
+  parseTree
+} from "jsonc-parser";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+
 // libs/sdk/cli/src/shared/errors.ts
 var CliError = class extends Error {
   constructor(message) {
@@ -236,22 +214,52 @@ var CliError = class extends Error {
 };
 var UsageError = class extends CliError {
 };
+function withoutCredentials(value) {
+  try {
+    const u = new URL(value);
+    u.username = "";
+    u.password = "";
+    const path5 = u.pathname === "/" && !/\/$/.test(value) ? "" : u.pathname;
+    return `${u.protocol}//${u.host}${path5}${u.search}`;
+  } catch {
+    return value.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/]*@/i, "$1");
+  }
+}
 var InvalidUrlError = class extends CliError {
   constructor(value) {
-    const host = value.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/^\/+/, "");
+    const safe = withoutCredentials(value);
+    const host = safe.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/^\/+/, "");
     super(
-      `"${value}" is not a valid instance address. Pass it with an http:// or https:// scheme, e.g. https://${host || "demo.dotcms.com"}`
+      `"${safe}" is not a valid instance address. Pass it with an http:// or https:// scheme, e.g. https://${host || "demo.dotcms.com"}`
+    );
+  }
+};
+var CredentialInUrlError = class extends CliError {
+  constructor(url) {
+    const safe = withoutCredentials(url);
+    super(
+      `The instance address must not carry a username or password. Use ${safe} on its own \u2014 setup will ask you to sign in, or pass --authToken.`
     );
   }
 };
 var InstanceUnreachableError = class extends CliError {
   constructor(url, reason) {
-    super(`Could not reach ${url} \u2014 ${reason}. Check the address and that the instance is running.`);
+    super(
+      `Could not reach ${url} \u2014 ${reason}. Check the address and that the instance is running.`
+    );
   }
 };
 var NotADotCmsInstanceError = class extends CliError {
   constructor(url) {
-    super(`${url} is not a valid dotCMS instance. Check the address.`);
+    let hint = " Check the address.";
+    try {
+      const parsed = new URL(url);
+      if (parsed.pathname !== "/" && parsed.pathname !== "") {
+        hint = ` That address includes a path; the instance itself is probably ${parsed.origin}.`;
+      }
+    } catch {
+    }
+    super(`${url} is not a valid dotCMS instance.${hint}`);
   }
 };
 var CredentialsRejectedError = class extends CliError {
@@ -284,20 +292,31 @@ var ConflictingAuthError = class extends UsageError {
 };
 var MissingInputError = class extends UsageError {
   constructor(what) {
-    super(`${what} is required and there is no terminal to prompt on. Pass it as an option or set its environment variable.`);
+    super(
+      `${what} is required and there is no terminal to prompt on. Pass it as an option or set its environment variable.`
+    );
   }
 };
 var NoConfigPathError = class extends CliError {
   constructor(displayName, scope) {
     super(
-      `${displayName} has no configuration file at ${scope} scope. Re-run with ${scope === "folder" ? "-g/--global" : "--project"}, or drop it from --agent.`
+      `${displayName} has no configuration file at ${scope} scope. Re-run ${scope === "folder" ? "with -g/--global" : "without -g/--global"}, or drop it from --agent.`
+    );
+  }
+};
+var UnreadableConfigError = class extends CliError {
+  constructor(file, reason) {
+    super(
+      `${file} could not be read \u2014 ${reason}. Nothing was changed. Check the file's permissions, or re-run with --skip-mcp.`
     );
   }
 };
 var MalformedConfigError = class extends CliError {
-  constructor(file) {
+  /** The format is passed, not sniffed from the extension: both callers know exactly which
+   *  parser just refused the file. */
+  constructor(file, format = "JSON") {
     super(
-      `${file} is not valid ${file.endsWith(".toml") ? "TOML" : "JSON"} \u2014 fix it or re-run with --skip-mcp. It has been left untouched.`
+      `${file} is not valid ${format} \u2014 fix it or re-run with --skip-mcp. It has been left untouched.`
     );
   }
 };
@@ -306,105 +325,243 @@ var MalformedConfigError = class extends CliError {
 var CAN_RESTRICT = process.platform !== "win32";
 var FILE_MODE = 384;
 var DIR_MODE = 448;
-async function readJsonDocument(file) {
-  let raw;
+async function readFileIfPresent(file) {
   try {
-    raw = await fs2.readFile(file, "utf8");
+    return await fs.readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return null;
+    throw new UnreadableConfigError(file, error.message);
+  }
+}
+async function writeFileAtomic(file, contents) {
+  const temp = `${file}.dotcms-${process.pid}.tmp`;
+  try {
+    await fs.writeFile(temp, contents, { encoding: "utf8", mode: FILE_MODE });
   } catch {
-    return null;
+    await fs.writeFile(file, contents, { encoding: "utf8", mode: FILE_MODE });
+    return;
+  }
+  try {
+    await fs.rename(temp, file);
+  } catch (error) {
+    await fs.rm(temp, { force: true });
+    throw error;
   }
+}
+var PARSE_OPTIONS = { allowTrailingComma: true, allowEmptyContent: true };
+function parseOrThrow(raw, file) {
   if (raw.trim() === "")
     return {};
-  try {
-    return JSON.parse(raw);
-  } catch {
+  const errors = [];
+  const doc = parseJsonc(raw, errors, PARSE_OPTIONS);
+  if (errors.length > 0 || doc === void 0)
+    throw new MalformedConfigError(file);
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
     throw new MalformedConfigError(file);
   }
+  return doc;
+}
+async function readJsonDocument(file) {
+  const raw = await readFileIfPresent(file);
+  return raw === null ? null : parseOrThrow(raw, file);
+}
+function detectIndent(raw) {
+  const match = raw.match(/\n([ \t]+)\S/);
+  if (!match)
+    return { insertSpaces: true, tabSize: 2 };
+  const indent = match[1];
+  return indent.startsWith("	") ? { insertSpaces: false, tabSize: 1 } : { insertSpaces: true, tabSize: indent.length };
 }
 async function hasEntry(args) {
-  let doc;
-  if (args.parse) {
-    try {
-      const raw = await fs2.readFile(args.file, "utf8");
-      doc = raw.trim() === "" ? {} : args.parse(raw);
-    } catch {
-      return false;
-    }
-  } else {
-    doc = await readJsonDocument(args.file);
-  }
+  const doc = await readJsonDocument(args.file).catch(() => null);
   const container = doc?.[args.containerKey] ?? {};
   return Object.prototype.hasOwnProperty.call(container, args.entryKey);
 }
 async function restrictFile(file, canRestrict = CAN_RESTRICT) {
   if (!canRestrict)
     return false;
-  await fs2.chmod(file, FILE_MODE);
+  await fs.chmod(file, FILE_MODE);
   return true;
 }
 async function ensureDir(dir) {
-  const created = await fs2.mkdir(dir, { recursive: true });
+  const created = await fs.mkdir(dir, { recursive: true });
   if (created && CAN_RESTRICT)
-    await fs2.chmod(dir, DIR_MODE).catch(() => void 0);
+    await fs.chmod(dir, DIR_MODE).catch(() => void 0);
+}
+function renderAt(value, unit, depth) {
+  const base = unit.repeat(depth);
+  return JSON.stringify(value, null, unit).split("\n").map((line, i) => i === 0 ? line : base + line).join("\n");
+}
+function setProperty(raw, object, key, value, unit, depth) {
+  const rendered = renderAt(value, unit, depth);
+  const properties = object.children ?? [];
+  const existing = properties.find((p) => p.children?.[0]?.value === key);
+  if (existing?.children?.[1]) {
+    const node = existing.children[1];
+    return raw.slice(0, node.offset) + rendered + raw.slice(node.offset + node.length);
+  }
+  const insertion = `"${key}": ${rendered}`;
+  const last = properties[properties.length - 1];
+  if (last) {
+    const end = last.offset + last.length;
+    return `${raw.slice(0, end)},
+${unit.repeat(depth)}${insertion}${raw.slice(end)}`;
+  }
+  const close = raw.lastIndexOf("}", object.offset + object.length);
+  return `${raw.slice(0, object.offset + 1)}
+${unit.repeat(depth)}${insertion}
+${unit.repeat(depth - 1)}${raw.slice(close)}`;
 }
 async function writeMerged(args) {
-  const existing = await readJsonDocument(args.file) ?? {};
+  const raw = await readFileIfPresent(args.file);
+  const existing = raw === null ? {} : parseOrThrow(raw, args.file);
   const container = existing[args.containerKey] ?? {};
   const replacedExisting = Object.prototype.hasOwnProperty.call(container, args.entryKey);
-  const next = {
-    ...existing,
-    [args.containerKey]: { ...container, [args.entryKey]: args.entry }
-  };
-  await ensureDir(path2.dirname(args.file));
-  await fs2.writeFile(args.file, `${JSON.stringify(next, null, 2)}
-`, "utf8");
+  let next;
+  const tree = raw === null ? void 0 : parseTree(raw, [], PARSE_OPTIONS);
+  if (raw === null || raw.trim() === "" || tree?.type !== "object") {
+    next = `${JSON.stringify({ [args.containerKey]: { [args.entryKey]: args.entry } }, null, 2)}
+`;
+  } else {
+    const { insertSpaces, tabSize } = detectIndent(raw);
+    const unit = insertSpaces ? " ".repeat(tabSize) : "	";
+    const containerNode = findNodeAtLocation(tree, [args.containerKey]);
+    next = containerNode?.type === "object" ? setProperty(raw, containerNode, args.entryKey, args.entry, unit, 2) : setProperty(
+      raw,
+      tree,
+      args.containerKey,
+      { [args.entryKey]: args.entry },
+      unit,
+      1
+    );
+  }
+  await ensureDir(path.dirname(args.file));
+  await writeFileAtomic(args.file, next);
   const permissionsApplied = await restrictFile(args.file, args.canRestrict ?? CAN_RESTRICT);
   return { path: args.file, permissionsApplied, replacedExisting };
 }
 
-// libs/sdk/cli/src/commands/agent/targets/json-target.ts
-function buildEntry(target, url, token) {
-  const env = { [SERVER_ENV.url]: url, [SERVER_ENV.token]: token };
-  if (target.entryShape === "opencode-local") {
-    return {
-      type: "local",
-      command: ["npx", "-y", MCP_SERVER_PACKAGE],
-      enabled: true,
-      environment: env
-    };
+// libs/sdk/cli/src/commands/agent/gitignore.ts
+function asPattern(relative2) {
+  const escaped = relative2.replace(/([\\*?[\]])/g, "\\$1").replace(/ $/, "\\ ");
+  return `/${escaped}`;
+}
+function confirmIgnored(root, files) {
+  const missed = [];
+  for (const file of files) {
+    const result = spawnSync2("git", ["check-ignore", "-q", file], { cwd: root });
+    if (result.error || result.status === null || result.status > 1)
+      return null;
+    if (result.status === 1)
+      missed.push(path2.basename(file));
   }
-  return { type: "stdio", command: "npx", args: ["-y", MCP_SERVER_PACKAGE], env };
+  return missed;
 }
-async function writeJsonTargetDetailed(args) {
-  const file = args.target.configPath(args.scope, args.cwd);
-  if (!file)
-    throw new NoConfigPathError(args.target.displayName, args.scope);
-  return writeMerged({
-    file,
-    containerKey: args.target.containerKey,
-    entryKey: ENTRY_KEY,
-    entry: buildEntry(args.target, args.url, args.token)
-  });
+function findRepositoryRoot(from) {
+  let dir = path2.resolve(from);
+  for (; ; ) {
+    if (existsSync(path2.join(dir, ".git")))
+      return dir;
+    const parent = path2.dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+async function protectFromVersionControl(args) {
+  const warnings = [];
+  const root = findRepositoryRoot(args.cwd);
+  const committed = new Set(args.committedByConvention ?? []);
+  for (const file of args.files) {
+    if (committed.has(file)) {
+      warnings.push(
+        `${path2.basename(file)} is normally committed to version control \u2014 it now holds a token, so committing it would publish that token.`
+      );
+    }
+  }
+  if (!root) {
+    warnings.push(
+      "This directory is not under version control, so these files are unprotected \u2014 nothing here can exclude them for you."
+    );
+    return { files: args.files, inRepository: false, excluded: false, warnings };
+  }
+  const proceed = args.confirmExclude ? await args.confirmExclude(args.files) : false;
+  if (!proceed) {
+    return { files: args.files, inRepository: true, excluded: false, warnings };
+  }
+  const gitignorePath = path2.join(root, ".gitignore");
+  const current = await readFileIfPresent(gitignorePath) ?? "";
+  const already = new Set(current.split("\n").map((line) => line.trim()));
+  const relatives = args.files.map((file) => path2.relative(root, file).split(path2.sep).join("/"));
+  const toAdd = relatives.filter((rel) => !already.has(rel) && !already.has(asPattern(rel)));
+  if (toAdd.length) {
+    const prefix = current === "" || current.endsWith("\n") ? "" : "\n";
+    const block = `${prefix}
+# dotCMS agent configuration \u2014 contains an access token
+${toAdd.map(asPattern).join("\n")}
+`;
+    await fs2.writeFile(gitignorePath, current + block, "utf8");
+  }
+  const unverified = confirmIgnored(root, args.files);
+  if (unverified === null) {
+    warnings.push(
+      "Could not confirm with git that these files are excluded \u2014 check `git status` before committing."
+    );
+  } else if (unverified.length) {
+    warnings.push(
+      `.gitignore was written but git still tracks: ${unverified.join(", ")}. Exclude them by hand before committing.`
+    );
+  }
+  return {
+    files: args.files,
+    inRepository: true,
+    excluded: unverified !== null && unverified.length === 0,
+    warnings
+  };
+}
+
+// libs/sdk/cli/src/commands/agent/skills.ts
+import * as childProcess2 from "node:child_process";
+function buildSkillsArgs(agentIds, global) {
+  return [
+    "-y",
+    "skills",
+    "add",
+    SKILLS_SOURCE,
+    ...agentIds.flatMap((id) => ["-a", id]),
+    ...global ? ["-g"] : [],
+    "-y"
+  ];
+}
+async function installSkills(args) {
+  const argv = buildSkillsArgs(args.agentIds, args.global);
+  const command = `npx ${argv.join(" ")}`;
+  try {
+    const result = childProcess2.spawnSync("npx", argv, {
+      stdio: "inherit",
+      // The doc comment above says no secret is passed; `spawnSync` defaults to the whole
+      // environment, so it was not true until this line.
+      env: envWithoutSecrets(),
+      // On Windows `npx` is `npx.cmd`, and since the CVE-2024-27980 fix Node refuses to
+      // execute `.cmd`/`.bat` without a shell — so this spawn failed on every Windows run
+      // and FR-025 never installed anything there.
+      shell: process.platform === "win32"
+    });
+    if (result.error)
+      return { ok: false, command, reason: result.error.message };
+    if (result.status === 0)
+      return { ok: true, command };
+    return { ok: false, command, reason: `skills exited with code ${result.status}` };
+  } catch (error) {
+    return { ok: false, command, reason: error.message };
+  }
 }
 
 // libs/sdk/cli/src/commands/agent/targets/registry.ts
 import { existsSync as existsSync2 } from "node:fs";
 import * as os from "node:os";
 import * as path3 from "node:path";
-
-// libs/sdk/cli/src/shared/env.ts
-var ENV_KEYS = {
-  url: "DOTCMS_URL",
-  password: "DOTCMS_PASSWORD",
-  authToken: "DOTCMS_AUTH_TOKEN",
-  codexHome: "CODEX_HOME"
-};
-function readEnv(key) {
-  const value = process.env[key];
-  return value && value.trim() !== "" ? value : void 0;
-}
-
-// libs/sdk/cli/src/commands/agent/targets/registry.ts
 var home = () => os.homedir();
 var inHome = (...parts) => path3.join(home(), ...parts);
 var inFolder = (cwd, ...parts) => path3.join(cwd ?? process.cwd(), ...parts);
@@ -431,6 +588,7 @@ var TARGETS = [
     containerKey: "mcpServers",
     entryShape: "stdio",
     detect: probe(".claude"),
+    folderConfigIsCommitted: true,
     configPath: (scope, cwd) => scope === "global" ? inHome(".claude.json") : inFolder(cwd, ".mcp.json")
   },
   {
@@ -519,12 +677,48 @@ async function detectTargets() {
   return results.filter((t) => t !== null);
 }
 
+// libs/sdk/cli/src/commands/agent/targets/entry.ts
+function buildEntry(target, url, token) {
+  const env = { [SERVER_ENV.url]: url, [SERVER_ENV.token]: token };
+  if (target.entryShape === "opencode-local") {
+    return {
+      type: "local",
+      command: ["npx", "-y", MCP_SERVER_PACKAGE],
+      enabled: true,
+      environment: env
+    };
+  }
+  return { type: "stdio", command: "npx", args: ["-y", MCP_SERVER_PACKAGE], env };
+}
+
+// libs/sdk/cli/src/commands/agent/targets/json-target.ts
+function hasJsonEntry(file, target) {
+  return hasEntry({ file, containerKey: target.containerKey, entryKey: ENTRY_KEY });
+}
+async function writeJsonTarget(args) {
+  const file = args.target.configPath(args.scope, args.cwd);
+  if (!file)
+    throw new NoConfigPathError(args.target.displayName, args.scope);
+  return writeMerged({
+    file,
+    containerKey: args.target.containerKey,
+    entryKey: ENTRY_KEY,
+    entry: buildEntry(args.target, args.url, args.token)
+  });
+}
+
 // libs/sdk/cli/src/commands/agent/targets/toml-target.ts
 import { parse, stringify } from "smol-toml";
-import * as fs3 from "node:fs/promises";
 import * as path4 from "node:path";
+async function hasTomlEntry(file, target) {
+  const raw = await readFileIfPresent(file);
+  return raw === null ? false : findEntrySpan(raw.split("\n"), target.containerKey) !== null;
+}
 function findEntrySpan(lines, containerKey) {
-  const ours = new RegExp(`^\\s*\\[\\s*${containerKey}\\.${ENTRY_KEY}\\s*(\\.[^\\]]+)?\\]`);
+  const spelt = (key) => `(?:${key}|"${key}"|'${key}')`;
+  const ours = new RegExp(
+    `^\\s*\\[\\s*${spelt(containerKey)}\\s*\\.\\s*${spelt(ENTRY_KEY)}\\s*(\\.[^\\]]*)?\\]`
+  );
   const anyHeader = /^\s*\[/;
   const start = lines.findIndex((line) => ours.test(line));
   if (start === -1)
@@ -551,26 +745,24 @@ async function writeTomlTarget(args) {
   if (!file) {
     throw new NoConfigPathError(args.target.displayName, args.scope);
   }
-  let original = "";
-  try {
-    original = await fs3.readFile(file, "utf8");
-  } catch {
-  }
+  const original = await readFileIfPresent(file) ?? "";
   if (original.trim() !== "") {
     try {
       parse(original);
     } catch {
-      throw new MalformedConfigError(file);
+      throw new MalformedConfigError(file, "TOML");
     }
   }
   const block = renderEntry(args.target, args.url, args.token, args.target.containerKey);
   let next;
+  let replacedExisting = false;
   if (original.trim() === "") {
     next = block;
   } else {
     const lines = original.split("\n");
     const span = findEntrySpan(lines, args.target.containerKey);
     if (span) {
+      replacedExisting = true;
       lines.splice(span.start, span.end - span.start, ...block.trimEnd().split("\n"));
       next = lines.join("\n");
     } else {
@@ -579,10 +771,50 @@ async function writeTomlTarget(args) {
     }
   }
   await ensureDir(path4.dirname(file));
-  await fs3.writeFile(file, next.endsWith("\n") ? next : `${next}
-`, "utf8");
-  await restrictFile(file);
-  return file;
+  await writeFileAtomic(file, next.endsWith("\n") ? next : `${next}
+`);
+  return { path: file, permissionsApplied: await restrictFile(file), replacedExisting };
+}
+
+// libs/sdk/cli/src/commands/agent/targets/writers.ts
+var WRITERS = {
+  json: { hasEntry: hasJsonEntry, write: writeJsonTarget },
+  toml: { hasEntry: hasTomlEntry, write: writeTomlTarget }
+};
+
+// libs/http/src/lib/fetch-retry.ts
+function isSuccessStatus(status) {
+  return status >= 200 && status < 300;
+}
+function describeRequestFailure(error) {
+  if (isHttpError(error)) {
+    if (error.code === "ECONNREFUSED") {
+      return "Connection refused - service not accepting connections yet";
+    }
+    if (error.code === "ETIMEDOUT") {
+      return "Connection timeout - service too slow or not responding";
+    }
+    if (error.code === "ENOTFOUND") {
+      return "Host not found (DNS lookup failed)";
+    }
+    if (error.code === "ECONNRESET") {
+      return "Connection reset by the server";
+    }
+    if (error.code === "CERT_HAS_EXPIRED") {
+      return "TLS certificate has expired";
+    }
+    if (error.code === "DEPTH_ZERO_SELF_SIGNED_CERT" || error.code === "SELF_SIGNED_CERT_IN_CHAIN") {
+      return "TLS certificate is self-signed and not trusted";
+    }
+    if (error.response) {
+      return `HTTP ${error.response.status}: ${error.response.statusText}`;
+    }
+    return error.code || error.message;
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
 }
 
 // libs/http/src/lib/http.ts
@@ -601,11 +833,37 @@ function isHttpError(error) {
   return error instanceof HttpError;
 }
 var DEFAULT_TIMEOUT_MS2 = 1e4;
-function isSuccess(status) {
-  return status >= 200 && status < 300;
-}
-async function readBody(response) {
-  const text = await response.text().catch(() => "");
+var MAX_BODY_BYTES = 10 * 1024 * 1024;
+async function readBody(response, url) {
+  const tooLarge = () => new HttpError(`Response from ${url} is too large (over ${MAX_BODY_BYTES} bytes)`, {
+    status: response.status,
+    code: "EBODYTOOLARGE"
+  });
+  const declared = Number(response.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES)
+    throw tooLarge();
+  let text = "";
+  if (!response.body) {
+    text = await response.text().catch(() => "");
+  } else {
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0;
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (!value)
+        continue;
+      size += value.byteLength;
+      if (size > MAX_BODY_BYTES) {
+        await reader.cancel().catch(() => void 0);
+        throw tooLarge();
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+    text += decoder.decode();
+  }
   if (!text) {
     return void 0;
   }
@@ -624,25 +882,38 @@ async function request(url, init, { token, timeoutMs = DEFAULT_TIMEOUT_MS2, acce
   }
   let response;
   try {
-    response = await fetch(url, { ...init, headers, signal: controller.signal });
-  } catch (error) {
-    const aborted = error?.name === "AbortError";
-    const cause = error?.cause;
-    throw new HttpError(
-      aborted ? `Request to ${url} timed out after ${timeoutMs}ms` : `Request to ${url} failed: ${error?.message ?? String(error)}`,
-      { status: null, code: aborted ? "ETIMEDOUT" : cause?.code }
-    );
+    try {
+      response = await fetch(url, { ...init, headers, signal: controller.signal });
+    } catch (error) {
+      const aborted = error?.name === "AbortError";
+      const cause = error?.cause;
+      throw new HttpError(
+        aborted ? `Request to ${url} timed out after ${timeoutMs}ms` : `Request to ${url} failed: ${error?.message ?? String(error)}`,
+        { status: null, code: aborted ? "ETIMEDOUT" : cause?.code }
+      );
+    }
+    let data;
+    try {
+      data = await readBody(response, url);
+    } catch (error) {
+      if (isHttpError(error))
+        throw error;
+      const aborted = error?.name === "AbortError";
+      throw new HttpError(
+        aborted ? `Request to ${url} timed out after ${timeoutMs}ms while reading the response` : `Reading the response from ${url} failed: ${error?.message ?? String(error)}`,
+        { status: response.status, code: aborted ? "ETIMEDOUT" : void 0 }
+      );
+    }
+    if (!isSuccessStatus(response.status) && !acceptAnyStatus) {
+      throw new HttpError(`Request failed with status code ${response.status}`, {
+        status: response.status,
+        statusText: response.statusText
+      });
+    }
+    return { status: response.status, data };
   } finally {
     clearTimeout(timer);
   }
-  const data = await readBody(response);
-  if (!isSuccess(response.status) && !acceptAnyStatus) {
-    throw new HttpError(`Request failed with status code ${response.status}`, {
-      status: response.status,
-      statusText: response.statusText
-    });
-  }
-  return { status: response.status, data };
 }
 function httpGet(url, options = {}) {
   return request(url, { method: "GET" }, options);
@@ -659,38 +930,6 @@ function httpPost(url, body, options = {}) {
   );
 }
 
-// libs/http/src/lib/fetch-retry.ts
-function describeRequestFailure(error) {
-  if (isHttpError(error)) {
-    if (error.code === "ECONNREFUSED") {
-      return "Connection refused - service not accepting connections yet";
-    }
-    if (error.code === "ETIMEDOUT") {
-      return "Connection timeout - service too slow or not responding";
-    }
-    if (error.code === "ENOTFOUND") {
-      return "Host not found (DNS lookup failed)";
-    }
-    if (error.code === "ECONNRESET") {
-      return "Connection reset by the server";
-    }
-    if (error.code === "CERT_HAS_EXPIRED") {
-      return "TLS certificate has expired";
-    }
-    if (error.code === "DEPTH_ZERO_SELF_SIGNED_CERT" || error.code === "SELF_SIGNED_CERT_IN_CHAIN") {
-      return "TLS certificate is self-signed and not trusted";
-    }
-    if (error.response) {
-      return `HTTP ${error.response.status}: ${error.response.statusText}`;
-    }
-    return error.code || error.message;
-  }
-  if (error instanceof Error) {
-    return error.message;
-  }
-  return String(error);
-}
-
 // libs/http/src/lib/endpoints.ts
 var DOTCMS_API = {
   /** Reachability probe, and the source of the instance version. */
@@ -737,14 +976,29 @@ async function verifyToken(url, token) {
 function normalizeUrl(url) {
   return url.trim().replace(/\/+$/, "");
 }
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+function insecureTransportWarning(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" || LOOPBACK.has(parsed.hostname))
+    return null;
+  return `${parsed.host} is plain http, so your password and the access token cross the network in the clear. Use https:// if the instance supports it.`;
+}
 function validateUrl(url) {
   if (!/^https?:\/\//i.test(url))
     throw new InvalidUrlError(url);
+  let parsed;
   try {
-    new URL(url);
+    parsed = new URL(url);
   } catch {
     throw new InvalidUrlError(url);
   }
+  if (parsed.username || parsed.password)
+    throw new CredentialInUrlError(url);
 }
 async function checkReachable(url) {
   let response;
@@ -773,6 +1027,26 @@ function readVersion(data) {
   const candidate = info?.version;
   return typeof candidate === "string" && candidate.trim() !== "" ? candidate : null;
 }
+function parseVersion(value) {
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(value.trim());
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+function compatibilityWarning(instanceVersion, toolVersion) {
+  if (!instanceVersion)
+    return null;
+  const instance = parseVersion(instanceVersion);
+  const tool = parseVersion(toolVersion);
+  if (!instance || !tool)
+    return null;
+  for (let i = 0; i < 3; i++) {
+    if (instance[i] > tool[i])
+      return null;
+    if (instance[i] < tool[i]) {
+      return `This tool targets dotCMS ${toolVersion}, but the instance reports ${instanceVersion}. Install dotcms@${instanceVersion} to match your instance.`;
+    }
+  }
+  return null;
+}
 
 // libs/sdk/cli/src/shared/prompts.ts
 var DEFAULT_URL = "http://localhost:8082";
@@ -791,50 +1065,52 @@ async function resolveInstanceUrl(opts, port, interactive = Boolean(port)) {
   return url;
 }
 async function resolveRequiredInputs(opts, port, interactive = Boolean(port)) {
-  let prompted = false;
   const ask2 = async (what, run) => {
     if (!interactive || !port)
       throw new MissingInputError(what);
-    prompted = true;
     return run();
   };
   const url = await resolveInstanceUrl(opts, port, interactive);
-  if (!opts.url && !readEnv(ENV_KEYS.url))
-    prompted = true;
   const authToken = opts.authToken ?? readEnv(ENV_KEYS.authToken);
   const user = opts.user;
   const password = opts.password ?? readEnv(ENV_KEYS.password);
   if (authToken)
-    return { url, authToken, prompted };
+    return { url, authToken };
   if (user && password)
-    return { url, user, password, prompted };
+    return { url, user, password };
   if (user) {
     const typed = await ask2("A password", () => port.password("Password"));
-    return { url, user, password: typed, prompted };
+    return { url, user, password: typed };
   }
   if (password) {
     const typed = await ask2("A username", () => port.text("Username"));
-    return { url, user: typed, password, prompted };
+    return { url, user: typed, password };
   }
   if (!interactive || !port) {
     throw new MissingInputError("A username and password, or an authentication token,");
   }
-  prompted = true;
+  return { url, ...await promptForAuth(port) };
+}
+async function promptForAuth(port) {
   const mode = await port.select("How should we authenticate?", [
     { name: "Sign in with a username and password", value: "signin" },
     { name: "Paste an existing authentication token", value: "token" }
   ]);
   if (mode === "token") {
-    return { url, authToken: await port.password("Authentication token"), prompted };
+    return { authToken: await port.password("Authentication token") };
   }
   return {
-    url,
     user: await port.text("Username"),
-    password: await port.password("Password"),
-    prompted
+    password: await port.password("Password")
   };
 }
 
+// libs/sdk/cli/package.json
+var version = "26.9.3-1-next.2657";
+
+// libs/sdk/cli/src/shared/version.ts
+var TOOL_VERSION = version;
+
 // libs/sdk/cli/src/commands/agent/setup.ts
 var MAX_AUTH_ATTEMPTS = 3;
 function resolveAuthMode(opts) {
@@ -861,10 +1137,31 @@ async function runSetup(opts) {
   const auth = resolveAuthMode(opts);
   const explicitTargets = resolveTargets(opts);
   const scope = opts.scope ?? "folder";
+  const outcome = (targetId, path5, result, reason = null, extra = {}) => ({
+    targetId,
+    scope,
+    path: path5,
+    result,
+    reason,
+    permissionsApplied: false,
+    skillsInstalled: "no",
+    ...extra
+  });
   const step = opts.onProgress ?? (() => void 0);
+  const warnings = [];
   const url = await resolveInstanceUrl(opts, opts.promptPort);
   step(`Checking ${url}`);
-  await checkReachable(url);
+  const instance = await checkReachable(url);
+  const warning = compatibilityWarning(instance.version, TOOL_VERSION);
+  if (warning) {
+    warnings.push(warning);
+    opts.onWarning?.(warning);
+  }
+  const insecure = insecureTransportWarning(url);
+  if (insecure) {
+    warnings.push(insecure);
+    opts.onWarning?.(insecure);
+  }
   let inputs = await resolveRequiredInputs(
     { ...opts, url, authToken: auth.token, user: auth.user, password: auth.password },
     opts.promptPort
@@ -890,7 +1187,8 @@ async function runSetup(opts) {
       if (!rejected || !opts.promptPort || attempt >= MAX_AUTH_ATTEMPTS)
         throw error;
       opts.onAuthRetry?.(error.message, attempt, MAX_AUTH_ATTEMPTS);
-      inputs = await resolveRequiredInputs({ url, cwd: opts.cwd }, opts.promptPort);
+      const fresh = await promptForAuth(opts.promptPort);
+      inputs = { url, ...fresh };
     }
   }
   let targets;
@@ -923,81 +1221,73 @@ async function runSetup(opts) {
     seen.add(file);
     plan.push({ target, file });
   }
+  const configuredNothing = !plan.length && !opts.skipMcp;
+  if (configuredNothing) {
+    const noEditors = `No editor was configured. None of the supported editors was detected, and none was named. Re-run with --agent <id>, choosing from: ${TARGET_IDS.join(", ")}.`;
+    warnings.push(noEditors);
+    opts.onWarning?.(noEditors);
+  }
   const outcomes = [];
   if (opts.skipMcp) {
     for (const { target, file } of plan) {
-      outcomes.push({
-        targetId: target.id,
-        scope,
-        path: file,
-        result: "skipped",
-        reason: "configuration writing skipped (--skip-mcp)",
-        permissionsApplied: false,
-        skillsInstalled: "no"
-      });
+      outcomes.push(
+        outcome(target.id, file, "skipped", "configuration writing skipped (--skip-mcp)")
+      );
     }
-  }
-  if (!opts.skipMcp && plan.length) {
+  } else if (plan.length) {
     step(`Writing configuration for ${plan.length} editor${plan.length === 1 ? "" : "s"}`);
   }
   for (const { target, file } of opts.skipMcp ? [] : plan) {
     try {
-      const isToml = target.format === "toml";
-      const existing = await hasEntry({
-        file,
-        containerKey: target.containerKey,
-        entryKey: ENTRY_KEY,
-        parse: isToml ? (raw) => parseToml(raw) : void 0
-      });
+      const writer = WRITERS[target.format];
+      const existing = await writer.hasEntry(file, target);
       if (existing && !opts.force && !opts.yes && opts.confirmOverwrite) {
         const proceed = await opts.confirmOverwrite(file);
         if (!proceed) {
-          outcomes.push({
-            targetId: target.id,
-            scope,
-            path: file,
-            result: "skipped",
-            reason: "left the existing entry in place",
-            permissionsApplied: false,
-            skillsInstalled: "no"
-          });
+          outcomes.push(
+            outcome(target.id, file, "skipped", "left the existing entry in place")
+          );
           continue;
         }
       }
-      const written2 = isToml ? {
-        path: await writeTomlTarget({ target, scope, url, token: token.value, cwd: opts.cwd }),
-        permissionsApplied: CAN_RESTRICT,
-        replacedExisting: existing
-      } : await writeJsonTargetDetailed({ target, scope, url, token: token.value, cwd: opts.cwd });
-      outcomes.push({
-        targetId: target.id,
+      const written2 = await writer.write({
+        target,
         scope,
-        path: written2.path,
-        result: written2.replacedExisting ? "replaced" : "written",
-        reason: null,
-        permissionsApplied: written2.permissionsApplied,
-        skillsInstalled: "no"
+        url,
+        token: token.value,
+        cwd: opts.cwd
       });
+      outcomes.push(
+        outcome(
+          target.id,
+          written2.path,
+          written2.replacedExisting ? "replaced" : "written",
+          null,
+          { permissionsApplied: written2.permissionsApplied }
+        )
+      );
     } catch (error) {
-      outcomes.push({
-        targetId: target.id,
-        scope,
-        path: file,
-        result: "failed",
-        reason: error.message,
-        permissionsApplied: false,
-        skillsInstalled: "no"
-      });
+      outcomes.push(outcome(target.id, file, "failed", error.message));
     }
   }
   let versionControl;
   const written = outcomes.filter((o) => (o.result === "written" || o.result === "replaced") && o.path).map((o) => o.path);
   if (scope === "folder" && written.length) {
-    versionControl = await protectFromVersionControl({
-      files: written,
-      cwd: opts.cwd ?? process.cwd(),
-      confirmExclude: opts.yes ? async () => true : opts.confirmExclude
-    });
+    try {
+      versionControl = await protectFromVersionControl({
+        files: written,
+        // Which of them a project would normally commit is the registry's to say, not a
+        // basename set inside the gitignore module.
+        committedByConvention: plan.filter(({ target }) => target.folderConfigIsCommitted).map(({ file }) => file),
+        cwd: opts.cwd ?? process.cwd(),
+        confirmExclude: opts.yes ? async () => true : opts.confirmExclude
+      });
+    } catch (error) {
+      const vcFailed = `Could not update .gitignore \u2014 ${error.message}. These files hold an access token and are NOT excluded from version control:
+      ${written.join("\n      ")}`;
+      warnings.push(vcFailed);
+      opts.onWarning?.(vcFailed);
+    }
   }
   if (!opts.skipSkills) {
     const eligible = opts.skipMcp ? plan.map((p) => p.target) : outcomes.filter((o) => o.result !== "failed").map((o) => byId.get(o.targetId)).filter((t) => Boolean(t));
@@ -1005,6 +1295,12 @@ async function runSetup(opts) {
     if (ids.length) {
       step("Installing the dotCMS skills");
       const skills = await installSkills({ agentIds: ids, global: scope === "global" });
+      if (!skills.ok) {
+        const failed = `Skills were not installed${skills.reason ? ` \u2014 ${skills.reason}` : ""}. Run this when the problem is fixed:
+      ${skills.command}`;
+        warnings.push(failed);
+        opts.onWarning?.(failed);
+      }
       for (const o of outcomes) {
         if (o.result === "failed")
           continue;
@@ -1016,14 +1312,24 @@ async function runSetup(opts) {
   let connection = "skipped";
   let connectionReason;
   if (!opts.skipVerify && !opts.skipMcp) {
-    step("Starting the server to confirm it responds (this can take a minute on a cold npx cache)");
+    step(
+      "Starting the server to confirm it responds (this can take a minute on a cold npx cache)"
+    );
     const result = await confirmConnection({ url, token: token.value });
     connection = result.ok ? "ok" : "failed";
     if (!result.ok)
       connectionReason = `${result.cause}: ${result.detail}`;
   }
   const anyFailed = outcomes.some((o) => o.result === "failed") || connection === "failed";
-  return { outcomes, versionControl, connection, connectionReason, exitCode: anyFailed ? 1 : 0 };
+  return {
+    outcomes,
+    versionControl,
+    warnings,
+    connection,
+    connectionReason,
+    skillsSkipped: Boolean(opts.skipSkills),
+    exitCode: anyFailed || configuredNothing ? 1 : 0
+  };
 }
 
 // libs/sdk/cli/src/shared/ui.ts
@@ -1041,10 +1347,11 @@ var RESULT_MARK = {
 };
 function renderSummary(input) {
   const lines = [];
+  const idWidth = Math.max(...input.outcomes.map((o) => o.targetId.length), 0);
   for (const o of input.outcomes) {
     const bits = [
       `  ${RESULT_MARK[o.result]}`,
-      o.targetId.padEnd(13),
+      o.targetId.padEnd(idWidth),
       o.scope.padEnd(7),
       o.path ?? "\u2014"
     ];
@@ -1055,9 +1362,14 @@ function renderSummary(input) {
       lines.push("      could not restrict file permissions on this platform");
     }
     if (o.skillsInstalled === "unverified") {
-      lines.push("      skills location unverified for this editor \u2014 not confirmed installed");
+      lines.push(
+        "      skills location unverified for this editor \u2014 not confirmed installed"
+      );
     }
   }
+  for (const w of input.warnings ?? []) {
+    lines.push(chalk.yellow(`  ! ${w}`));
+  }
   if (input.versionControl?.files.length) {
     const vc = input.versionControl;
     lines.push("");
@@ -1071,6 +1383,9 @@ function renderSummary(input) {
     for (const w of vc.warnings)
       lines.push(chalk.yellow(`  ! ${w}`));
   }
+  if (input.skillsSkipped) {
+    lines.push("  \xB7 skills installation skipped (--skip-skills)");
+  }
   lines.push("");
   if (input.connection === "ok") {
     lines.push(chalk.green("  \u2713 server responded"));
@@ -1080,10 +1395,16 @@ function renderSummary(input) {
     lines.push(chalk.red(`  \u2717 ${input.connectionReason ?? "the server did not start"}`));
     lines.push("    Configuration was written and left in place; the server did not come up.");
   }
-  const allGood = input.connection === "ok" && input.outcomes.every((o) => o.result !== "failed");
+  const done = (o) => o.result === "written" || o.result === "replaced";
+  const left = input.outcomes.filter((o) => !done(o) && o.result !== "failed");
+  const allGood = input.connection === "ok" && input.outcomes.length > 0 && input.outcomes.every(done);
+  lines.push("");
   if (allGood) {
-    lines.push("");
     lines.push(`  Ready \u2014 ${input.nextStep ?? "open your editor and start using dotCMS."}`);
+  } else if (left.length && input.connection === "ok") {
+    lines.push(
+      `  ${left.length} editor${left.length === 1 ? " was" : "s were"} left unchanged; what they already point at was not verified.`
+    );
   }
   return lines.join("\n");
 }
@@ -1106,8 +1427,24 @@ function makeProgress(interactive) {
     },
     done() {
       spinner?.stop();
+      spinner = null;
     },
-    /** Leave the failed step visible instead of a spinner that never stops. */
+    /**
+     * Hand the terminal over to a question.
+     *
+     * Keeps the finished step visible, then stops repainting. `done()` erases the line;
+     * here the step really did complete, so it should stay on screen above the prompt.
+     */
+    pause() {
+      spinner?.succeed();
+      spinner = null;
+    },
+    /**
+     * Leave the failed step visible instead of a spinner that never stops.
+     *
+     * `warn` was a byte-identical second copy of this: a retry notice and a failure render
+     * the same way — mark the attempt failed, then carry on.
+     */
     fail(text) {
       if (spinner)
         spinner.fail(text);
@@ -1115,16 +1452,37 @@ function makeProgress(interactive) {
         writeOut(`  \u2717 ${text}`);
       spinner = null;
     },
-    /** A retry notice: mark the attempt failed, then carry on. */
     warn(text) {
-      if (spinner)
-        spinner.fail(text);
-      else
-        writeOut(`  \u2717 ${text}`);
-      spinner = null;
+      this.fail(text);
     }
   };
 }
+function pausingPort(port, progress) {
+  return {
+    text(message, defaultValue) {
+      progress.pause();
+      return port.text(message, defaultValue);
+    },
+    password(message) {
+      progress.pause();
+      return port.password(message);
+    },
+    select(message, choices) {
+      progress.pause();
+      return port.select(message, choices);
+    },
+    multiSelect(message, choices) {
+      progress.pause();
+      return port.multiSelect(message, choices);
+    }
+  };
+}
+function pausingConfirm(confirm, progress) {
+  return (...args) => {
+    progress.pause();
+    return confirm(...args);
+  };
+}
 function registerAgentCommand(program2) {
   const agent = program2.command("agent").description("Connect an AI coding agent to dotCMS");
   agent.command("setup").description("Configure your editors to talk to a dotCMS instance").option("--url <url>", "dotCMS instance address (or set DOTCMS_URL)").option("--user <user>", "username, to mint a token").option(
@@ -1138,17 +1496,18 @@ function registerAgentCommand(program2) {
     `editor to configure, repeatable (${TARGET_IDS.join(", ")})`,
     (value, previous = []) => [...previous, value]
   ).option("-g, --global", "write to your user account instead of this folder").option("--skip-mcp", "do not write configuration").option("--skip-skills", "do not install the dotCMS skills").option("--skip-verify", "do not launch the server to confirm it responds").option("-y, --yes", "accept confirmations (never skips a required input)").option("--force", "replace an existing dotcms entry without asking").action(async (options) => {
-    if (canPrompt())
-      printBanner();
     const interactive = canPrompt();
+    if (interactive)
+      printBanner();
     const progress = makeProgress(interactive);
     try {
       const result = await runSetup({
         onProgress: progress.step,
         onAuthRetry: (message, attempt, max) => progress.warn(`${message}  (attempt ${attempt} of ${max})`),
-        promptPort: interactive ? inquirerPort : void 0,
-        confirmOverwrite: interactive ? confirmOverwrite : void 0,
-        confirmExclude: interactive ? confirmExclude : void 0,
+        onWarning: (message) => progress.warn(message),
+        promptPort: interactive ? pausingPort(inquirerPort, progress) : void 0,
+        confirmOverwrite: interactive ? pausingConfirm(confirmOverwrite, progress) : void 0,
+        confirmExclude: interactive ? pausingConfirm(confirmExclude, progress) : void 0,
         url: options["url"],
         user: options["user"],
         password: options["password"],
@@ -1166,8 +1525,10 @@ function registerAgentCommand(program2) {
         renderSummary({
           outcomes: result.outcomes,
           versionControl: result.versionControl,
+          warnings: result.warnings,
           connection: result.connection,
-          connectionReason: result.connectionReason
+          connectionReason: result.connectionReason,
+          skillsSkipped: result.skillsSkipped
         })
       );
       process.exitCode = result.exitCode;