showdar-skills 0.14.2 → 0.15.1

package/CHANGELOG.md

@@ -6,6 +6,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.15.1]
+
+### Fixed
+
+- Reject malformed or unauthorized managed paths before removing project files; block symlink-based command writes and preflight installation collisions before replacing existing skills.
+- Make extension pack updates fail closed on conflicts and installed drift, stage changes safely, restore the previous installation on failure, remove obsolete owned files and clean staging directories.
+- Separate source pack identity from installed-tree hashes to avoid false drift reports when source-only documentation is not installed.
+- Ensure adding an existing skill to another AI target installs that target, and return nonzero exit codes for failed JSON diagnostics.
+- Correct `create-pack` destination handling and adapt the Codex benchmark to the current structural routing contract.
+- Remove unused legacy scoring helpers from the thin router.
+
+### Tests
+
+- Add regression coverage for destructive manifest paths, symlink boundaries, failed replacements, pack drift and updates, CLI diagnostics, target switching, scaffold paths, and Codex benchmark guidance.
+
+
+## [0.15.0]
+
+### Changed
+
+- Replaced the CLI `showdar wizard` entry point with `showdar setup`, preserving the interactive skills installer flow and `add --interactive` alias.
+- Replaced the generated project-context template CLI with `/showdar-setup`, an evidence-based AI onboarding command for Cursor, OpenCode and Claude Code.
+- Agent-driven setup now audits product/domain context alongside repository conventions, proposes diffs and requires approval and Git preflight before modifying docs.
+- Retained existing intent routing and installation safeguards; no separate setup engine or router.
+
 ## [0.14.2]
 
 ### Changed

package/README.md

@@ -14,18 +14,17 @@ Requires **Node.js 20+**. From your project root:
 
 ```bash
 npm install -g showdar-skills
-showdar wizard
 showdar setup
 showdar doctor
 ```
 
 | Step | What it does |
 | --- | --- |
-| `wizard` | Pick AI target, skill profile, optional skills and workflows; preview before installing. |
-| `setup` | Detect Git host, stack, scripts, and docs; create missing shared context in `docs/agents/`. |
+| `setup` | Pick AI target, skill profile, optional skills and workflows; preview before installing. |
+| Agent setup | Analyze the repository, propose grounded shared context, and update docs after approval. |
 | `doctor` | Check the installation and flag problems. |
 
-**OpenCode / Claude Code:** after installation, use `/showdar/setup` for agent-guided onboarding. It can help with both skill selection (wizard) and project context (setup); it does not silently install or write files. **Cursor / Codex:** ask the agent to configure Showdar for this repository or use the terminal commands above. Cursor does not currently generate a native slash command.
+**OpenCode / Claude Code:** after installation, use `/showdar-setup` to audit the codebase and prepare project context. The agent previews a diff and requests approval before changes. **Cursor:** use `/showdar-setup` as a project slash command. **Codex:** ask the agent to audit this repository and set up Showdar project context.
 
 Already configured? Just give the coding agent a normal task, such as *"Fix the checkout validation bug and add regression tests."* Showdar guidance routes requests to the relevant installed skills; you do not need to call each skill manually.
 
@@ -35,12 +34,11 @@ Already configured? Just give the coding agent a normal task, such as *"Fix the
 showdar status
 showdar add profile insurance     # Add, preserving existing skills
 showdar add workflow feature      # Include the workflow and missing stages
-showdar setup --dry-run --json     # Preview project context
 showdar route --prompt "Review this PR" --json
 showdar doctor
 ```
 
-**Install vs. configure:** `showdar init` installs/replaces a skill selection, `showdar add` extends it, and `showdar wizard` is the interactive installer. `showdar setup` does **not** install skills: it creates shared project context. Re-running `setup` keeps existing user-owned context files.
+**Install vs. configure:** `showdar init` installs/replaces a skill selection, `showdar add` extends it, and `showdar setup` is the interactive installer. Project context is created or enriched by the AI agent using repository evidence and explicit approval; the CLI `showdar setup` runs the interactive installer and does not generate project context.
 
 ## How it works
 
@@ -54,7 +52,7 @@ User task
 
 Showdar ships **18 primitive** and **4 workflow** skills, including optional insurance-domain coverage. Only relevant instructions and references are loaded as needed.
 
-Before local source/config/docs changes, follow the project's Git policy and run `showdar guard --mutation local-write --json`; work on a task branch when required. Routing and setup do not grant permission to commit, merge, push, or deploy.
+Before local source/config/docs changes, follow the project's Git policy and run `showdar guard --mutation local-write --json`; work on a task branch when required. Routing and onboarding do not grant permission to commit, merge, push, or deploy.
 
 ## Documentation
 

package/bin/showdar.js

@@ -1,8 +1,6 @@
 #!/usr/bin/env node
 import path from 'node:path';
 import { parseArgs } from 'node:util';
-import { collectProjectSetupAnswers } from '../src/setup-prompt.js';
-import { planProjectSetup, applyProjectSetup } from '../src/setup.js';
 import { buildWizardPlan, applyWizardPlan, collectWizardAnswers } from '../src/wizard.js';
 import { startTaskBranch, formatGitStart } from '../src/git-start.js';
 import { guardMutation, formatMutationGuard } from '../src/git-guard.js';
@@ -53,11 +51,7 @@ function printHelp(version, command = null) {
     return;
   }
   if (command === 'setup') {
-    console.log('Usage: showdar setup [--dry-run|--yes] [--tracker github|gitlab|local] [--docs-dir docs/agents] [--json]');
-    return;
-  }
-  if (command === 'wizard') {
-    console.log('Usage: showdar wizard [--mode add|replace] [--profile name] [--skills comma,list] [--workflow comma,list] [--ai target] [--scope project|global] [--yes|--dry-run] [--json]');
+    console.log('Usage: showdar setup [--mode add|replace] [--profile name] [--skills comma,list] [--workflow comma,list] [--ai target] [--scope project|global] [--yes|--dry-run] [--json]');
     return;
   }
   if (command === 'init') {
@@ -72,7 +66,7 @@ function printHelp(version, command = null) {
     console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar add <skill> [--ai <target>] [--scope <project|global>]\n  showdar add profile <profile> [--ai <target>] [--scope <project|global>]\n  showdar add workflow <builtin-name|local-json-path> [--ai <target>] [--scope <project|global>]\n\nExamples:\n  showdar add git\n  showdar add showdar-git\n  showdar add profile insurance\n  showdar add workflow feature\n  showdar add workflow ./workflows/acme-release.json\n\nAdd preserves installed skills; init replaces the managed set. Built-in workflows add required stages.`);
     return;
   }
-  console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <universal|codex|opencode|cursor|claude|all>] [--pack <local-path>]\n  showdar add <skill> [--ai <target>] [--scope <project|global>]\n  showdar add profile <profile> [--ai <target>] [--scope <project|global>]\n  showdar add workflow <builtin-name|local-json-path> [--ai <target>] [--scope <project|global>]\n  showdar route (--stdin | --prompt <text>) [--json]\n  showdar git-start --type <type> --name <task> [--base <branch>] [--dry-run] [--json]\n  showdar guard --mutation <read-only|local-write> [--json]\n  showdar setup [--dry-run|--yes] [--tracker github|gitlab|local] [--json]\n  showdar wizard [--mode add|replace] [--profile <name>] [--skills <names>] [--workflow <names>] [--ai <target>] [--scope <project|global>] [--yes|--dry-run]\n  showdar add-pack <local-path>\n  showdar remove-pack <name>\n  showdar add-workflow <local-path>\n  showdar status ${scopeUsage}\n  showdar doctor ${scopeUsage}\n  showdar validate\n  showdar list [--extensions]\n  showdar remove ${scopeUsage}\n  showdar create-pack <path> [--vendor <vendor>] [--description <text>] [--with-workflow <id>] [--with-profile <name>]\n  showdar validate-pack <local-path> [--json]\n  showdar inspect-pack <local-path> [--json] [--checkpoint <file>]\n  showdar doctor ${scopeUsage} [--extensions] [--json]\n  showdar update-pack <local-path> [--dry-run] [--json]\n  showdar validate\n  showdar list [--extensions] [--json]\n  showdar remove ${scopeUsage}\n\nExtension packs accept local directories/workspace paths only; tarball, URL, Git, and registry sources are rejected.\n\nDefaults: scope project, profile full, AI target universal.\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
+  console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <universal|codex|opencode|cursor|claude|all>] [--pack <local-path>]\n  showdar add <skill> [--ai <target>] [--scope <project|global>]\n  showdar add profile <profile> [--ai <target>] [--scope <project|global>]\n  showdar add workflow <builtin-name|local-json-path> [--ai <target>] [--scope <project|global>]\n  showdar route (--stdin | --prompt <text>) [--json]\n  showdar git-start --type <type> --name <task> [--base <branch>] [--dry-run] [--json]\n  showdar guard --mutation <read-only|local-write> [--json]\n  showdar setup [--mode add|replace] [--profile <name>] [--skills <names>] [--workflow <names>] [--ai <target>] [--scope <project|global>] [--yes|--dry-run]\n  showdar add-pack <local-path>\n  showdar remove-pack <name>\n  showdar add-workflow <local-path>\n  showdar status ${scopeUsage}\n  showdar doctor ${scopeUsage}\n  showdar validate\n  showdar list [--extensions]\n  showdar remove ${scopeUsage}\n  showdar create-pack <path> [--vendor <vendor>] [--description <text>] [--with-workflow <id>] [--with-profile <name>]\n  showdar validate-pack <local-path> [--json]\n  showdar inspect-pack <local-path> [--json] [--checkpoint <file>]\n  showdar doctor ${scopeUsage} [--extensions] [--json]\n  showdar update-pack <local-path> [--dry-run] [--json]\n  showdar validate\n  showdar list [--extensions] [--json]\n  showdar remove ${scopeUsage}\n\nExtension packs accept local directories/workspace paths only; tarball, URL, Git, and registry sources are rejected.\n\nDefaults: scope project, profile full, AI target universal.\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
 }
 
 async function main() {
@@ -82,7 +76,7 @@ async function main() {
   const version = await packageVersion();
 
   if (command === 'help' || command === '--help' || command === '-h') return printHelp(version);
-  if (command === '--version' || command === '-V') {
+    if (command === '--version' || command === '-V') {
     console.log(version);
     return;
   }
@@ -90,35 +84,7 @@ async function main() {
 
   const scope = ['init', 'status', 'doctor', 'remove', 'add'].includes(command) ? scopeAfter(args) : null;
 
-  if (command === 'setup') {
-    const { values } = parseArgs({ args: args.slice(1), options: {
-      'dry-run': { type: 'boolean' }, yes: { type: 'boolean' },
-      tracker: { type: 'string' }, 'docs-dir': { type: 'string' },
-      json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
-    } });
-    if (values.help) return printHelp(version, command);
-    let tracker = values.tracker ?? null;
-    let docsDir = values['docs-dir'] ?? 'docs/agents';
-    if (!values.yes && !values['dry-run']) {
-      const answers = await collectProjectSetupAnswers({ cwd: projectRoot, tracker, docsDir });
-      if (answers.cancelled) return;
-      tracker = answers.tracker;
-      docsDir = answers.docsDir;
-    }
-    const plan = await planProjectSetup({ cwd: projectRoot, tracker, docsDir });
-    if (values['dry-run']) {
-      console.log(values.json ? JSON.stringify({ ok: true, command, data: plan }, null, 2)
-        : 'Setup preview:\n' + plan.files.map(f => '  ' + f.action + ' ' + f.path).join('\n'));
-      return;
-    }
-    const result = await applyProjectSetup({ cwd: projectRoot, plan });
-    console.log(values.json ? JSON.stringify({ ok: true, command, data: result }, null, 2)
-      : 'Setup completed. Created: ' + result.created.length + '; preserved: ' + result.preserved.length
-        + '. Shared context: ' + result.docsDir);
-    return;
-  }
-
-  if (command === 'wizard' || (command === 'add' && args.includes('--interactive'))) {
+  if (command === 'setup' || (command === 'add' && args.includes('--interactive'))) {
     const wizardArgs = command === 'add' ? args.filter(a => a !== '--interactive').slice(1) : args.slice(1);
     const { values } = parseArgs({ args: wizardArgs, options: {
       mode: { type: 'string' }, profile: { type: 'string' },
@@ -127,7 +93,7 @@ async function main() {
       yes: { type: 'boolean' }, 'dry-run': { type: 'boolean' },
       json: { type: 'boolean' }, help: { type: 'boolean', short: 'h' },
     } });
-    if (values.help) return printHelp(version, 'wizard');
+    if (values.help) return printHelp(version, 'setup');
     let plan;
     if (values.yes || values['dry-run']) {
       plan = buildWizardPlan({
@@ -144,7 +110,7 @@ async function main() {
       plan = collected.plan;
     }
     if (values['dry-run']) {
-      console.log(values.json ? JSON.stringify({ ok: true, command: 'wizard', data: plan }, null, 2)
+      console.log(values.json ? JSON.stringify({ ok: true, command: 'setup', data: plan }, null, 2)
         : 'Wizard preview (' + plan.action + '): ' + plan.skills.join(', '));
       return;
     }
@@ -286,11 +252,12 @@ async function main() {
         console.log(JSON.stringify({
           schemaVersion: 1,
           command: 'doctor',
-          ok: true,
+          ok: result.healthy,
           data: { ...result, checkpointCompatibility: 'not-assessed' },
           warnings: result.warnings ?? [],
           errors: [],
         }, null, 2));
+        if (!result.healthy) process.exitCode = 1;
         return;
       }
       console.log(`Extension diagnostics\nHealth: ${result.healthy ? 'OK' : 'BROKEN'}`);
@@ -299,6 +266,7 @@ async function main() {
       for (const issue of result.issues) console.log(`- ${issue}`);
       for (const warning of result.warnings ?? []) console.log(`warning: ${warning}`);
       if (!result.healthy) {
+        process.exitCode = 1;
         console.log(`Checkpoint compatibility: not-assessed (supply a checkpoint via inspect-pack --checkpoint)`);
         if (result.customWorkflows.length) console.log(`Note: checkpoints referencing changed workflow definitions will be revalidated on resume.`);
       }
@@ -390,6 +358,7 @@ async function main() {
     if (!packPath) throw new Error('Pack path is required. Usage: showdar validate-pack <local-path> [--json]');
     const isJson = args.includes('--json');
     const result = await validatePackSource({ cwd: projectRoot, source: packPath });
+    if (!result.ok) process.exitCode = 1;
     if (isJson) {
       console.log(JSON.stringify(result, null, 2));
     } else {

package/docs/REFERENCE.md

@@ -1,3 +1,5 @@
+> **Historical reference:** This document contains older CLI descriptions. Current commands: `showdar setup` is the interactive skills installer (formerly `showdar wizard`); `/showdar-setup` is the agent-driven project-context audit on OpenCode/Claude. See [README](../README.md) for the current quick start.
+
 # Showdar Skills
 
 [![npm version](https://img.shields.io/npm/v/showdar-skills?logo=npm)](https://www.npmjs.com/package/showdar-skills)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "showdar-skills",
-  "version": "0.14.2",
+  "version": "0.15.1",
   "description": "Production-grade software engineering lifecycle skills for coding agents.",
   "type": "module",
   "bin": {

package/src/adapter-renderers.js

@@ -4,7 +4,7 @@ const RUNTIME_GUIDANCE = `Automatic Showdar selection: route the current request
 Explicit named-skill requests may load that installed skill directly without automatic routing. Workflow skills remain native discoverable choices; the router does not select workflows. If the CLI is unavailable, use native skill discovery/static descriptions below. Do not fetch a CLI through npx or install dependencies automatically.
 Routing does not authorize mutation. Inspect the returned mutation class and current task authority before work. For local-write tasks, before the first task-owned source edit inspect Git state. On develop, development, dev, main, master or the repository default/integration branch, DO NOT begin source edits yet: prepare one branch per coherent task first. Follow repository instructions/documented convention, explicit current user instruction, clearly detected convention, then the Showdar safe default. Explicit trunk/direct-work policy wins.
 Before ANY task-owned source/config/test/docs write, execute Git preflight even if the router selected build directly. On integration/default branches inspect repository policy and EXECUTE \`showdar git-start --type <type> --name <task>\` (not just --dry-run), or equivalent repository-safe branch preparation. Then EXECUTE \`showdar guard --mutation local-write --json\` and require ok=true AND data.allowed=true BEFORE invoking any file-writing tool. If blocked, STOP before editing. On a matching task branch run guard without creating a new branch. Recheck before each later mutating stage. Do not infer permission from \`showdar route\`. If the CLI is unavailable, manually inspect Git and confirm the appropriate task branch or documented direct-work policy; never silently write on develop/main. Dirty ownership/branch collisions require inspection; never infer stash/reset/restore/clean. Guard and git-start do not authorize source edits, commit, merge or push. Completion means verify and report.
-Shared project context: before project work, read the relevant existing files under docs/agents/ (project.md, issue-tracker.md, verification.md, domain.md) when present. These are project-specific conventions, not mutation authority. Use the canonical glossary and ADRs when present; do not invent them. If project setup has not run, proceed using normal repository evidence and suggest showdar setup only when useful.`;
+Shared project context: before project work, read the relevant existing files under docs/agents/ (project.md, issue-tracker.md, verification.md, domain.md) when present. These are project-specific conventions, not mutation authority. Use the canonical glossary and ADRs when present; do not invent them. If project context is missing or stale, read repository evidence and suggest agent-led /showdar-setup when useful; do not run a CLI setup generator.`;
 
 const CANONICAL_ROUTE_ORDER = [
   ['map repository architecture, dependencies, or impact', 'showdar-understand'],
@@ -99,19 +99,20 @@ export function renderManagedBlock(skillIds, kind) {
 export function renderShowdarSetupCommand() {
   return [
     '---',
-    'description: Guide Showdar installation and repository onboarding with existing CLI commands',
+    'description: Analyze this repository and maintain grounded Showdar project context',
     '---',
     '',
-    'You are the Showdar onboarding guide. Use existing CLI capabilities, not a new setup engine or intent router.',
-    'First inspect the repository and existing Showdar installation (showdar status, and relevant project conventions).',
-    'If the required skills are absent or the user wants to change the selection, explain wizard vs init/add. Recommend showdar wizard for interactive selection. Do not silently install, replace, or remove skills. Ask for approval before any installer write.',
-    'If skills are already installed and sufficient, skip wizard. Do not reinstall merely because this command was invoked.',
-    'For project context, run showdar setup --dry-run --json and show the detected Git host, stack, scripts, existing documents, and exact proposed file actions.',
-    'Ask only about ambiguous or missing decisions. Do not invent architectural, domain, tracker, or verification conventions.',
-    'Before any local write (including installer/setup configuration changes), inspect Git state and project branch policy; use showdar git-start when on an integration branch and allowed, then require showdar guard --mutation local-write --json with ok=true and data.allowed=true.',
-    'Only after explicit approval apply the selected installation step (if needed) and run showdar setup --yes with confirmed --tracker and --docs-dir. Avoid unnecessary interactive commands in non-TTY environments.',
-    'Do not overwrite user-owned files. The setup CLI only creates missing context documents. Never edit source code, create remote issues, commit, merge, or push as part of onboarding.',
-    'Run showdar doctor, report the installed skills, context documents, verification results, unresolved warnings, and a short example of how to request a task.',
+    'Act as a repository onboarding agent. The showdar setup CLI is an interactive skill installer, not a project-context generator; do not run it to generate context.',
+    'Read repository instructions and existing context before proposing changes: AGENTS.md, CLAUDE.md, relevant project docs, package manifests, scripts, and source layout.',
+    'Check showdar status and installed skills when useful. Recommend showdar setup (installer) only if skills are missing or the user explicitly wants to change selection; never install automatically.',
+    'Audit product purpose, user roles, key business flows, domain terminology, and relevant acceptance rules alongside architecture, module boundaries, dependencies, state/routing/API patterns, coding conventions, test/build commands, and Git branch policy. Follow relevant source files instead of inventing facts.',
+    'For each proposed convention, record concrete evidence (source path and relevant symbol/config). Distinguish observed facts from unresolved questions.',
+    'Reuse existing canonical docs. Create or enrich only useful documents under docs/agents/ (project.md, issue-tracker.md, verification.md, domain.md). Do not duplicate AGENTS.md, glossary, or ADR text.',
+    'Perform a context gap analysis and show a concise proposed file-by-file diff before changes. Prefer small focused edits over generated boilerplate. Preserve user-owned material and never overwrite it blindly.',
+    'Before any file write, inspect Git state and instructions. On integration/default branches prepare a safe task branch following repository policy, then require showdar guard --mutation local-write --json with ok=true and data.allowed=true. No automatic stash, reset, stage, commit, merge, or push.',
+    'Request explicit approval for proposed content edits; if declined, report the draft and leave files unchanged.',
+    'After approval, create/update the approved context documents, validate file links and command references, run showdar doctor, and summarize evidence, remaining gaps, and changes.',
+    'This command is onboarding, not feature implementation or a second routing engine. Do not modify application source code, call remote issue APIs, or publish as part of setup.',
     '',
     'Request: $ARGUMENTS',
     '',

package/src/pack-inspect.js

@@ -151,7 +151,7 @@ async function inspectPackInstalled(cwd, packName, manifest) {
   const sourceValidation = await validatePack(path.join(cwd, '.showdar', 'extensions', 'packs', packName)).catch(() => ({ ok: false, errors: ['validation failed'] }));
   const sourceHash = await hashTree(path.join(cwd, '.showdar', 'extensions', 'packs', packName)).catch(() => null);
   
-  const recordedHash = manifest.hash;
+  const recordedHash = manifest.installedHash ?? sourceHash;
   let drift = 'no-drift';
   let details = '';
   
@@ -160,7 +160,7 @@ async function inspectPackInstalled(cwd, packName, manifest) {
     details = 'Cannot compute source hash';
   } else if (sourceHash !== recordedHash) {
     drift = 'source-drift';
-    details = 'Full-tree hash differs from recorded manifest hash';
+    details = 'Installed-tree hash differs from recorded installed hash';
   }
   
   return {

package/src/pack-plan.js

@@ -111,7 +111,7 @@ function compareWorkflowDefinitions(oldManifest, newManifest) {
 async function computeManifestHash(manifest) {
   const relevant = {
     packs: (manifest.extensions?.packs ?? []).map((p) => ({
-      name: p.name, version: p.version, source: p.source, hash: p.hash,
+      name: p.name, version: p.version, source: p.source, hash: p.hash, installedHash: p.installedHash,
     })),
     customWorkflows: (manifest.extensions?.customWorkflows ?? []).map((w) => ({
       id: w.id, source: w.source, path: w.path,
@@ -307,7 +307,19 @@ export async function planPackUpdate({ cwd, source }) {
 
   const installedHash = await computeInstalledHash(cwd, existingPack.name, existing);
   const recordedHash = existingPack.hash;
-  const installedDrift = installedHash !== null && installedHash !== recordedHash;
+  const expectedInstalledHash = existingPack.installedHash ?? installedHash;
+  let installedDrift = installedHash === null || installedHash !== expectedInstalledHash ||
+    installedHash === 'missing-managed-file' || installedHash?.startsWith('foreign-files:');
+  // Per-file ownership hashes are the source of truth for older installations.
+  const oldPrefix = `${EXTENSION_DIR}/packs/${existingPack.name}/`;
+  for (const entry of existing.files ?? []) {
+    if (!entry.path.startsWith(oldPrefix)) continue;
+    const installedFile = path.join(cwd, entry.path);
+    if (!entry.hash || !(await exists(installedFile)) || await hashTree(installedFile) !== entry.hash) {
+      installedDrift = true;
+      break;
+    }
+  }
 
   const sourceHash = newPackHash;
   const manifestHash = await computeManifestHash(existing);
@@ -369,7 +381,7 @@ export async function planPackUpdate({ cwd, source }) {
     warnings.push('Existing checkpoints referencing changed workflows will be revalidated on resume.');
   }
 
-  const executable = conflicts.length === 0 && validation.ok;
+  const executable = conflicts.length === 0 && validation.ok && !installedDrift;
 
   return deepFreeze({
     ok: true,
@@ -451,6 +463,7 @@ export async function verifyPlanPreconditions(plan, { cwd }) {
 }
 
 export async function executePackUpdate(plan, { cwd }) {
+  if (!plan.ok || !plan.executable) throw new Error('Pack update is blocked by validation, ownership conflicts, or installed drift. No files changed.');
   const verification = await verifyPlanPreconditions(plan, { cwd });
   if (!verification.ok) {
     throw new Error(`Plan is stale (${verification.reason} changed since preview). Re-run: showdar update-pack <path> --dry-run`);
@@ -474,71 +487,79 @@ export async function executePackUpdate(plan, { cwd }) {
   const tempDir = path.join(cwd, EXTENSION_DIR, 'packs', `.${newManifest.name}.tmp-${process.pid}-${Date.now()}`);
   const destination = path.join(cwd, EXTENSION_DIR, 'packs', newManifest.name);
 
+  const { mkdir, cp, rm, rename } = await import('node:fs/promises');
+  const backupDir = path.join(cwd, EXTENSION_DIR, 'packs', `.${newManifest.name}.backup-${process.pid}-${Date.now()}`);
+  let backedUp = false;
+  let promoted = false;
   try {
+    // Stage every candidate file without touching the installed tree.
     for (const file of fileList) {
       await assertSafeManagedPath(packRootSafe(cwd, plan.candidate.source), file.source);
       const dest = path.join(tempDir, file.relative);
       await assertSafeManagedPath(cwd, dest);
-      const { mkdir, cp } = await import('node:fs/promises');
       await mkdir(path.dirname(dest), { recursive: true });
-      await cp(file.source, dest, { recursive: true });
+      await cp(file.source, dest, { recursive: false });
+    }
+    // All existing installed files must be owned and unchanged.
+    const prefix = `${EXTENSION_DIR}/packs/${newManifest.name}/`;
+    const oldEntries = (existing.files ?? []).filter(entry => entry.path.startsWith(prefix));
+    for (const entry of oldEntries) {
+      const dest = path.join(cwd, entry.path);
+      await assertSafeManagedPath(cwd, dest);
+      if (!(await exists(dest)) || await hashTree(dest) !== entry.hash) {
+        throw new Error('Installed pack drift detected: ' + entry.path);
+      }
     }
-
-    const newFiles = [];
     for (const file of fileList) {
       const dest = path.join(destination, file.relative);
       await assertSafeManagedPath(cwd, dest);
       const relative = manifestPathFor(cwd, dest);
-      if ((await exists(dest)) && !priorOwned.has(relative)) {
-        throw new Error(`Refusing to overwrite existing non-Showdar-managed file: ${dest}`);
-      }
-      const { mkdir, cp, rm } = await import('node:fs/promises');
-      await rm(dest, { recursive: true, force: true });
-      await mkdir(path.dirname(dest), { recursive: true });
-      await cp(file.source, dest, { recursive: true });
-      newFiles.push({ path: relative, hash: await hashTree(dest), extension: true });
+      if ((await exists(dest)) && !priorOwned.has(relative)) throw new Error('Foreign pack file: ' + relative);
     }
 
-    const merged = new Map((existing.files ?? []).map((e) => [e.path, e]));
+    const newFiles = [];
+    for (const file of fileList) {
+      const dest = path.join(tempDir, file.relative);
+      newFiles.push({ path: manifestPathFor(cwd, path.join(destination, file.relative)),
+        hash: await hashTree(dest), extension: true });
+    }
+    const merged = new Map((existing.files ?? []).filter(entry => !entry.path.startsWith(prefix)).map(e => [e.path, e]));
     for (const file of newFiles) merged.set(file.path, file);
-
+    const stagedInstalledHash = await hashTree(tempDir);
     const updated = {
       ...existing,
       files: [...merged.values()],
       extensions: {
         ...(existing.extensions ?? {}),
-        packs: (existing.extensions?.packs ?? []).map((p) => p.name === newManifest.name
-          ? { ...p, version: newManifest.version, hash: plan.candidate.hash, installedAt: new Date().toISOString() }
+        packs: (existing.extensions?.packs ?? []).map(p => p.name === newManifest.name
+          ? { ...p, version: newManifest.version, hash: plan.candidate.hash, installedHash: stagedInstalledHash, installedAt: new Date().toISOString() }
           : p),
-        customWorkflows: existing.extensions?.customWorkflows?.filter((w) => w.source !== `pack:${newManifest.name}`) ?? [],
+        customWorkflows: [
+          ...(existing.extensions?.customWorkflows ?? []).filter(w => w.source !== `pack:${newManifest.name}`),
+          ...(newManifest.workflows ?? []).map(w => ({
+            id: w.id, source: `pack:${newManifest.name}`,
+            path: `${EXTENSION_DIR}/packs/${newManifest.name}/${w.path}`.replaceAll(path.sep, '/'),
+          })),
+        ],
       },
     };
 
-    if (newManifest.workflows) {
-      updated.extensions.customWorkflows = [
-        ...updated.extensions.customWorkflows,
-        ...newManifest.workflows.map((w) => ({
-          id: w.id,
-          source: `pack:${newManifest.name}`,
-          path: `${EXTENSION_DIR}/packs/${newManifest.name}/${w.path}`.replaceAll(path.sep, '/'),
-        })),
-      ];
+    if (await exists(destination)) {
+      await rename(destination, backupDir);
+      backedUp = true;
     }
-
+    await rename(tempDir, destination);
+    promoted = true;
     await writeJsonAtomic(manifestPath, updated);
-
-    return {
-      pack: newManifest.name,
-      version: newManifest.version,
-      status: 'updated',
-      oldHash: plan.current.hash,
-      newHash: plan.candidate.hash,
-      files: newFiles.length,
-    };
+    if (backedUp) await rm(backupDir, { recursive: true, force: true });
+    return { pack: newManifest.name, version: newManifest.version, status: 'updated',
+      oldHash: plan.current.hash, newHash: plan.candidate.hash, files: newFiles.length };
   } catch (error) {
-    const { rm } = await import('node:fs/promises');
-    await rm(tempDir, { recursive: true, force: true }).catch(() => {});
+    if (promoted) await rm(destination, { recursive: true, force: true }).catch(() => {});
+    if (backedUp) await rename(backupDir, destination).catch(() => {});
     throw error;
+  } finally {
+    await rm(tempDir, { recursive: true, force: true }).catch(() => {});
   }
 }
 

package/src/project.js

@@ -144,6 +144,7 @@ async function generateCommandFiles({ baseRoot, skillIds, target, commandRoot, p
   for (const skillId of skillIds) {
     const shortName = skillId.replace(/^showdar-/, '');
     const destination = path.join(commandRoot, `${shortName}.md`);
+    await assertSafeManagedPath(baseRoot, destination, managedRoots);
     const relative = manifestPathFor(baseRoot, destination);
     if ((await exists(destination)) && !priorOwned.has(relative)) {
       throw new Error(`Refusing to overwrite existing non-Showdar-managed command: ${destination}`);
@@ -155,6 +156,7 @@ async function generateCommandFiles({ baseRoot, skillIds, target, commandRoot, p
     files.push({ destination, skillId, shortName });
   }
   const aggregatorDest = path.join(commandRoot, 'skill.md');
+  await assertSafeManagedPath(baseRoot, aggregatorDest, managedRoots);
   const aggregatorRel = manifestPathFor(baseRoot, aggregatorDest);
   if ((await exists(aggregatorDest)) && !priorOwned.has(aggregatorRel)) {
     throw new Error(`Refusing to overwrite existing non-Showdar-managed command: ${aggregatorDest}`);
@@ -164,17 +166,34 @@ async function generateCommandFiles({ baseRoot, skillIds, target, commandRoot, p
   await writeTextAtomic(aggregatorDest, aggregatorContent);
   newFiles.push({ path: aggregatorRel, hash: await hashTree(aggregatorDest) });
   files.push({ destination: aggregatorDest, skillId: 'aggregator', shortName: 'skill' });
-  const setupDest = path.join(commandRoot, 'setup.md');
+  const setupDest = path.join(path.dirname(commandRoot), 'showdar-setup.md');
+  await assertSafeManagedPath(baseRoot, setupDest, managedRoots);
   const setupRel = manifestPathFor(baseRoot, setupDest);
   if ((await exists(setupDest)) && !priorOwned.has(setupRel)) {
     throw new Error('Refusing to overwrite existing non-Showdar-managed command: ' + setupDest);
   }
   await writeTextAtomic(setupDest, renderShowdarSetupCommand());
   newFiles.push({ path: setupRel, hash: await hashTree(setupDest) });
-  files.push({ destination: setupDest, skillId: 'setup', shortName: 'setup' });
+  files.push({ destination: setupDest, skillId: 'setup', shortName: 'showdar-setup' });
   return files;
 }
 
+async function generateCursorSetupCommand({ baseRoot, scope, homeRoot, priorOwned, newFiles }) {
+  const root = scope === 'global'
+    ? path.join(homeRoot, '.cursor', 'commands')
+    : path.join(baseRoot, '.cursor', 'commands');
+  const destination = path.join(root, 'showdar-setup.md');
+  await assertSafeManagedPath(baseRoot, destination);
+  const relative = manifestPathFor(baseRoot, destination);
+  if ((await exists(destination)) && !priorOwned.has(relative)) {
+    throw new Error('Refusing to overwrite existing non-Showdar-managed command: ' + destination);
+  }
+  await mkdir(root, { recursive: true });
+  await writeTextAtomic(destination, renderShowdarSetupCommand());
+  newFiles.push({ path: relative, hash: await hashTree(destination) });
+  return { destination, skillId: 'setup', shortName: 'showdar-setup', target: 'cursor' };
+}
+
 async function initInstallation({
   baseRoot, manifestPath, packageRoot, profile, ai, skillIds, packageVersion = '0.2.0',
   scope, homeRoot = homedir(),
@@ -226,6 +245,7 @@ async function initInstallation({
     ? [...new Set([
         ...NATIVE_TARGETS.map((t) => globalSkillRootFor(t, { homeRoot })),
         ...NATIVE_TARGETS.filter((t) => globalCommandRootForTarget(t, { homeRoot })).map((t) => globalCommandRootForTarget(t, { homeRoot })),
+        ...NATIVE_TARGETS.filter((t) => globalCommandRootForTarget(t, { homeRoot })).map((t) => path.dirname(globalCommandRootForTarget(t, { homeRoot }))),
       ])]
     : [];
   const commandHarnesses = [];
@@ -239,19 +259,74 @@ async function initInstallation({
           desiredPaths.add(manifestPathFor(baseRoot, path.join(root, `${shortName}.md`)));
         }
         desiredPaths.add(manifestPathFor(baseRoot, path.join(root, 'skill.md')));
+        desiredPaths.add(manifestPathFor(baseRoot, path.join(path.dirname(root), 'showdar-setup.md')));
         commandHarnesses.push({ target, root });
       }
     }
   }
 
+  if (targets.includes('cursor')) {
+    const cursorRoot = scope === 'global' ? homeRoot : baseRoot;
+    desiredPaths.add(manifestPathFor(baseRoot, path.join(cursorRoot, '.cursor', 'commands', 'showdar-setup.md')));
+  }
+
+  // Validate instruction surfaces before removing any previously managed files.
+  if (scope === 'project') {
+    const nextTarget = ai === 'all' ? 'universal' : targets[0];
+    const nextInstruction = instructionSurfaceFor(nextTarget, baseRoot);
+    if (nextInstruction) {
+      await assertSafeManagedPath(baseRoot, nextInstruction.targetPath);
+      if (nextInstruction.kind === 'block' && await exists(nextInstruction.targetPath)) {
+        stripManagedBlock(await readFile(nextInstruction.targetPath, 'utf8'));
+      }
+      if (nextInstruction.kind === 'file' && await exists(nextInstruction.targetPath) &&
+          prior?.instructions?.file !== nextInstruction.file) {
+        throw new Error('Refusing to overwrite existing non-Showdar-managed instruction: ' + nextInstruction.targetPath);
+      }
+    }
+    if (prior?.instructions?.file) {
+      const previous = path.resolve(baseRoot, prior.instructions.file);
+      const valid = prior.instructions.kind === 'block'
+        ? ['AGENTS.md', 'CLAUDE.md'].map(file => path.resolve(baseRoot, file))
+        : [path.resolve(baseRoot, '.cursor/rules/showdar.mdc')];
+      if (!valid.includes(previous)) throw new Error('Unsafe prior instruction path: ' + prior.instructions.file);
+      await assertSafeManagedPath(baseRoot, previous);
+      if (prior.instructions.kind === 'block' && await exists(previous)) {
+        stripManagedBlock(await readFile(previous, 'utf8'));
+      }
+    }
+  }
+
   const staleTargets = [];
   for (const entry of prior?.files ?? []) {
     const targetPath = safeOwnedPath(baseRoot, entry.path, managedRoots);
     if (targetPath && !desiredPaths.has(entry.path)) {
+      if (path.resolve(targetPath) === path.resolve(baseRoot) || !isManagedDeletionTarget(baseRoot, targetPath, scope, homeRoot, prior)) throw new Error('Unsafe stale managed path: ' + entry.path);
       await assertSafeManagedPath(baseRoot, targetPath, managedRoots);
       staleTargets.push(targetPath);
     }
   }
+  // Preflight all destinations before deleting the previous installation.
+  for (const { destination } of skillDestinations) {
+    await assertSafeManagedPath(baseRoot, destination, managedRoots);
+    const rel = manifestPathFor(baseRoot, destination);
+    if ((await exists(destination)) && !priorOwned.has(rel)) throw new Error('Refusing to overwrite existing non-Showdar-managed skill or command: ' + destination);
+  }
+  for (const { root } of commandHarnesses) {
+    for (const filename of [...skillIds.map(id => id.replace(/^showdar-/, '') + '.md'), 'skill.md']) {
+      const dest = path.join(root, filename);
+      await assertSafeManagedPath(baseRoot, dest, managedRoots);
+      if ((await exists(dest)) && !priorOwned.has(manifestPathFor(baseRoot, dest))) throw new Error('Foreign command destination: ' + dest);
+    }
+    const top = path.join(path.dirname(root), 'showdar-setup.md');
+    await assertSafeManagedPath(baseRoot, top, managedRoots);
+    if ((await exists(top)) && !priorOwned.has(manifestPathFor(baseRoot, top))) throw new Error('Foreign setup command: ' + top);
+  }
+  if (targets.includes('cursor')) {
+    const cursorDest = path.join(scope === 'global' ? homeRoot : baseRoot, '.cursor', 'commands', 'showdar-setup.md');
+    await assertSafeManagedPath(baseRoot, cursorDest, managedRoots);
+    if ((await exists(cursorDest)) && !priorOwned.has(manifestPathFor(baseRoot, cursorDest))) throw new Error('Foreign Cursor setup command: ' + cursorDest);
+  }
   for (const stale of staleTargets) await rm(stale, { recursive: true, force: true });
 
   const files = [];
@@ -262,6 +337,9 @@ async function initInstallation({
   }
 
   const commandsGenerated = [];
+  if (targets.includes('cursor')) {
+    commandsGenerated.push(await generateCursorSetupCommand({ baseRoot, scope, homeRoot, priorOwned, newFiles: files }));
+  }
   for (const { target, root } of commandHarnesses) {
     const generated = await generateCommandFiles({
       baseRoot,
@@ -475,7 +553,7 @@ async function inspectInstallation({
       if (!commandRoot) continue;
       for (const cmd of manifest.commands ?? []) {
         if (cmd.target !== harness) continue;
-        const dest = path.join(commandRoot, `${cmd.name}.md`);
+        const dest = cmd.name === 'showdar-setup' ? path.join(path.dirname(commandRoot), 'showdar-setup.md') : path.join(commandRoot, `${cmd.name}.md`);
         const rel = manifestPathFor(baseRoot, dest);
         const owned = projectOwned.has(rel);
         if (!(await exists(dest))) {
@@ -518,6 +596,44 @@ async function inspectInstallation({
   };
 }
 
+function isManagedDeletionTarget(baseRoot, target, scope, homeRoot, manifest) {
+  const absolute = path.resolve(target);
+  const installedSkills = new Set(manifest?.skills ?? []);
+  const targets = scope === 'global' ? NATIVE_TARGETS : (manifest?.targets ?? resolveTargets(manifest?.ai ?? 'universal'));
+  for (const agent of targets) {
+    const skillRoot = scope === 'global'
+      ? globalSkillRootFor(agent, { homeRoot })
+      : skillRootFor(agent, baseRoot);
+    const skillName = path.relative(skillRoot, absolute);
+    if (!skillName.includes(path.sep) && installedSkills.has(skillName) && skillName.startsWith('showdar-')) return true;
+
+    const commandsRoot = scope === 'global'
+      ? globalCommandRootForTarget(agent, { homeRoot })
+      : commandRootFor(agent, baseRoot);
+    if (commandsRoot) {
+      const commandName = path.relative(commandsRoot, absolute);
+      const supported = new Set(['skill.md', ...[...installedSkills].map(id => id.replace(/^showdar-/, '') + '.md')]);
+      if (!commandName.includes(path.sep) && supported.has(commandName)) return true;
+      if (absolute === path.resolve(path.dirname(commandsRoot), 'showdar-setup.md')) return true;
+    }
+    if (agent === 'cursor' && absolute === path.resolve(
+      scope === 'global' ? homeRoot : baseRoot, '.cursor', 'commands', 'showdar-setup.md')) return true;
+    if (agent === 'cursor' && absolute === path.resolve(
+      scope === 'global' ? homeRoot : baseRoot, '.cursor', 'rules', 'showdar.mdc')) return true;
+  }
+  const packRoot = path.resolve(baseRoot, EXTENSION_DIR, 'packs');
+  for (const pack of manifest?.extensions?.packs ?? []) {
+    if (typeof pack.name !== 'string' || !/^[a-z0-9][a-z0-9_-]*$/.test(pack.name)) continue;
+    const ownedPackRoot = path.resolve(packRoot, pack.name);
+    if (absolute.startsWith(ownedPackRoot + path.sep)) return true;
+  }
+  for (const workflow of manifest?.extensions?.customWorkflows ?? []) {
+    if (workflow.source !== 'standalone' || typeof workflow.id !== 'string' || !/^[a-z0-9][a-z0-9_-]*$/.test(workflow.id)) continue;
+    if (absolute === path.resolve(baseRoot, EXTENSION_DIR, 'workflows', workflow.id + '.json')) return true;
+  }
+  return false;
+}
+
 async function removeInstallation({ baseRoot, manifestPath, scope, homeRoot = homedir() }) {
   await assertSafeManagedPath(baseRoot, manifestPath);
   let manifest;
@@ -527,19 +643,27 @@ async function removeInstallation({ baseRoot, manifestPath, scope, homeRoot = ho
     ? [...new Set([
         ...NATIVE_TARGETS.map((t) => globalSkillRootFor(t, { homeRoot })),
         ...NATIVE_TARGETS.filter((t) => globalCommandRootForTarget(t, { homeRoot })).map((t) => globalCommandRootForTarget(t, { homeRoot })),
+        ...NATIVE_TARGETS.filter((t) => globalCommandRootForTarget(t, { homeRoot })).map((t) => path.dirname(globalCommandRootForTarget(t, { homeRoot }))),
       ])]
     : [];
 
+  const removalTargets = [];
   for (const entry of manifest?.files ?? []) {
     const target = safeOwnedPath(baseRoot, entry.path, managedRoots);
-    if (target) {
-      await assertSafeManagedPath(baseRoot, target, managedRoots);
-      await rm(target, { recursive: true, force: true });
+    if (!target || path.resolve(target) === path.resolve(baseRoot) || !isManagedDeletionTarget(baseRoot, target, scope, homeRoot, manifest)) {
+      throw new Error('Unsafe Showdar manifest deletion path: ' + entry.path);
     }
+    await assertSafeManagedPath(baseRoot, target, managedRoots);
+    removalTargets.push(target);
   }
+  for (const target of removalTargets) await rm(target, { recursive: true, force: true });
 
   if (scope === 'project' && manifest?.instructions) {
-    const filePath = path.join(baseRoot, manifest.instructions.file);
+    const filePath = path.resolve(baseRoot, manifest.instructions.file);
+    const expected = manifest.instructions.kind === 'block'
+      ? new Set([path.join(baseRoot, 'AGENTS.md'), path.join(baseRoot, 'CLAUDE.md')])
+      : new Set([path.join(baseRoot, '.cursor', 'rules', 'showdar.mdc')]);
+    if (!expected.has(filePath)) throw new Error('Unsafe Showdar instruction path: ' + manifest.instructions.file);
     if (manifest.instructions.kind === 'block') {
       await removeManagedBlock(filePath);
     } else if (manifest.instructions.kind === 'file') {
@@ -595,7 +719,8 @@ export async function addSkill({ cwd, skill, ai = null, scope = null, home = hom
   if (effectiveAi !== 'all' && !NATIVE_TARGETS.includes(effectiveAi)) throw new Error(`Unknown AI target "${effectiveAi}".`);
   if (effectiveScope !== 'project' && effectiveScope !== 'global') throw new Error(`Unknown scope "${effectiveScope}".`);
 
-  if (existingManifest?.skills?.includes(skillId)) {
+  if (existingManifest?.skills?.includes(skillId) &&
+      resolveTargets(effectiveAi).every(target => (existingManifest.targets ?? []).includes(target))) {
     const refreshedFiles = [];
     const priorOwned = ownedPathSet(existingManifest);
     const source = path.join(packageRoot, 'skills', skillId);
@@ -624,6 +749,9 @@ export async function addSkill({ cwd, skill, ai = null, scope = null, home = hom
     for (const destination of destinations) {
       await copyOwned({ baseRoot, source, destination, priorOwned, newFiles: refreshedFiles });
     }
+    if ((existingManifest.targets ?? []).includes('cursor')) {
+      await generateCursorSetupCommand({ baseRoot, scope: effectiveScope, homeRoot: home, priorOwned, newFiles: refreshedFiles });
+    }
     for (const target of existingManifest.commandHarness ?? []) {
       const commandRoot = effectiveScope === 'global' ? globalCommandRootForTarget(target, { homeRoot: home }) : commandRootFor(target, cwd);
       if (commandRoot) await generateCommandFiles({ baseRoot, skillIds: existingManifest.skills, target, commandRoot, priorOwned, newFiles: refreshedFiles });
@@ -686,6 +814,10 @@ export async function addSkill({ cwd, skill, ai = null, scope = null, home = hom
 
   const allSkillIds = [...new Set([...(existingManifest?.skills ?? []), skillId])];
   const newCommands = [];
+  if (targets.includes('cursor')) {
+    const generated = await generateCursorSetupCommand({ baseRoot, scope: effectiveScope, homeRoot: home, priorOwned, newFiles: files });
+    newCommands.push({ target: 'cursor', name: 'showdar-setup', path: manifestPathFor(baseRoot, generated.destination) });
+  }
   const harnessTargets = [...new Set([...(existingManifest?.commandHarness ?? []), ...commandHarnesses.map(c => c.target)])];
   for (const target of harnessTargets) {
     const root = effectiveScope === 'global' ? globalCommandRootForTarget(target, { homeRoot: home }) : commandRootFor(target, cwd);
@@ -885,6 +1017,7 @@ export async function addPack({ cwd, source, home = homedir(), packageVersion =
         version: manifest.version,
         source: path.relative(cwd, packRoot).replaceAll(path.sep, '/'),
         hash: packHash,
+        installedHash: await hashTree(destination),
         installedAt: new Date().toISOString(),
       }],
       customWorkflows: [...(existing.extensions?.customWorkflows ?? []), ...((manifest.workflows ?? []).map((w) => ({
@@ -1031,7 +1164,7 @@ export async function createPack({ cwd, path: packPath, vendor, description, wit
   const { createPackScaffold } = await import('./pack-scaffold.js');
   const absolutePath = path.resolve(cwd, packPath);
   const name = path.basename(absolutePath);
-  return createPackScaffold({ destination: absolutePath, name, vendor, description, withWorkflow, withProfile });
+  return createPackScaffold({ destination: path.dirname(absolutePath), name, vendor, description, withWorkflow, withProfile });
 }
 
 export async function inspectPack({ cwd, source }) {

package/src/route-plan.js

@@ -1,5 +1,3 @@
-import { CAPABILITIES } from './capabilities.js';
-import { rankCapabilities } from './capability-score.js';
 import { normalizeIntent } from './intent.js';
 
 export const MAX_ADVISORS = 2;
@@ -20,44 +18,6 @@ const SECONDARY_ACTION_SKILLS = Object.freeze({
   requirements: 'showdar-requirements',
 });
 
-function addUnique(list, value) {
-  if (!list.includes(value)) list.push(value);
-}
-
-function signalForSecondaryAction(action) {
-  const skill = SECONDARY_ACTION_SKILLS[action] ?? (action.startsWith('showdar-') ? action : null);
-  return skill ? `secondary action ${action} targets ${skill}` : null;
-}
-
-function advisorSignals(intent, candidate) {
-  const signals = [];
-  for (const action of intent.secondaryActions) {
-    if (SECONDARY_ACTION_SKILLS[action] === candidate.skill || action === candidate.skill) {
-      addUnique(signals, signalForSecondaryAction(action) ?? `secondary action ${action} targets ${candidate.skill}`);
-    }
-  }
-  return signals;
-}
-
-function candidateWithMetadata(candidate, intent, primarySkill) {
-  const signals = candidate.skill === primarySkill ? [] : advisorSignals(intent, candidate);
-  return {
-    ...candidate,
-    reasons: [...candidate.reasons, ...signals],
-    advisorEligible: signals.length > 0,
-    advisorReasons: signals,
-  };
-}
-
-function confidenceFor(primary, candidates, decisive) {
-  const next = candidates.find((candidate) => candidate.skill !== primary.skill);
-  const margin = primary.score - (next?.score ?? primary.score);
-  const level = decisive || (margin >= 6 && primary.matched.some((value) => value.startsWith('phase:') || value.startsWith('action:')))
-    ? 'high'
-    : margin > 0 ? 'medium' : 'low';
-  return { level, margin, decisive };
-}
-
 // Thin deterministic structural route path (Phase 6G T16).
 // Structural path: internal primaryCapability → primary skill via CAPABILITY_TO_SKILL
 // + secondaryActions → advisor map (SECONDARY_ACTION_SKILLS, deduplicated, primary excluded, capped at MAX_ADVISORS).

package/src/setup-prompt.js

@@ -1,70 +0,0 @@
-import { stdin, stdout } from 'node:process';
-import { planProjectSetup, validateDocsDir } from './setup.js';
-
-/**
- * Clack-driven setup configuration. Passing a prompt API makes selections
- * testable without requiring a pseudo-terminal; no file writes happen here.
- */
-export async function collectProjectSetupAnswers({
-  cwd, tracker = null, docsDir = 'docs/agents',
-} = {}, promptApi = null) {
-  if ((!stdin.isTTY || !stdout.isTTY) && !promptApi) {
-    throw new Error('Interactive setup requires a TTY. Use --dry-run or --yes for automation.');
-  }
-  const p = promptApi ?? await import('@clack/prompts');
-  p.intro('Showdar Skills · Project setup');
-  const initial = await planProjectSetup({ cwd, tracker, docsDir });
-
-  p.note([
-    'Repository: ' + initial.inspection.packageName,
-    'Detected host: ' + (initial.inspection.remote ?? 'no remote'),
-    'Detected stack: ' + (initial.inspection.technologies.join(', ') || 'not detected'),
-    'Layout: ' + initial.inspection.workspace,
-    'Verification scripts: ' + (Object.keys(initial.inspection.scripts).join(', ') || 'none'),
-    'Existing AGENTS.md: ' + (initial.inspection.docs.agents ? 'yes' : 'no'),
-  ].join('\n'), 'Repository inspection');
-
-  const stop = () => {
-    p.cancel('Setup cancelled. No files changed.');
-    return { cancelled: true };
-  };
-  const chosenTracker = await p.select({
-    message: 'Issue tracker',
-    initialValue: initial.tracker,
-    options: [
-      { value: 'github', label: 'GitHub Issues', hint: 'Store tickets alongside GitHub repository' },
-      { value: 'gitlab', label: 'GitLab Issues', hint: 'Use GitLab issues and merge requests' },
-      { value: 'local', label: 'Local / custom tracker', hint: 'Document team convention later' },
-    ],
-  });
-  if (p.isCancel(chosenTracker)) return stop();
-
-  const chosenDir = await p.text({
-    message: 'Shared project-context directory',
-    initialValue: docsDir,
-    placeholder: docsDir,
-    validate(value) {
-      try { validateDocsDir(value || docsDir); }
-      catch (error) { return error.message; }
-    },
-  });
-  if (p.isCancel(chosenDir)) return stop();
-  const resolvedDir = chosenDir || docsDir;
-  const plan = await planProjectSetup({ cwd, tracker: chosenTracker, docsDir: resolvedDir });
-  p.note([
-    'Tracker: ' + plan.tracker,
-    'Docs directory: ' + plan.docsDir,
-    ...plan.files.map((file) => (file.action === 'create' ? '+ create  ' : '✓ keep    ') + file.path),
-    '',
-    'User-owned documents are never overwritten.',
-    'Git preflight must pass before writing.',
-  ].join('\n'), 'Preview · no files changed');
-
-  const approved = await p.confirm({
-    message: 'Apply project setup?',
-    initialValue: false,
-  });
-  if (p.isCancel(approved) || !approved) return stop();
-  p.outro('Configuration confirmed.');
-  return { cancelled: false, tracker: plan.tracker, docsDir: plan.docsDir };
-}

package/src/setup.js

@@ -1,136 +0,0 @@
-import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
-import { execFileSync } from 'node:child_process';
-import path from 'node:path';
-import { assertSafeManagedPath } from './path-safety.js';
-import { guardMutation } from './git-guard.js';
-
-const DOC_ROOT = 'docs/agents';
-const DOCS = ['project.md', 'issue-tracker.md', 'verification.md', 'domain.md'];
-const codeQuote = text => String.fromCharCode(96) + text + String.fromCharCode(96);
-
-async function exists(file) {
-  try { await access(file); return true; }
-  catch (e) { if (e.code === 'ENOENT') return false; throw e; }
-}
-function git(cwd, ...args) {
-  try {
-    return execFileSync('git', ['--no-optional-locks', ...args], {
-      cwd, encoding: 'utf8', timeout: 6000, stdio: ['ignore', 'pipe', 'ignore'],
-    }).trim();
-  } catch { return ''; }
-}
-async function readJson(file) {
-  if (!(await exists(file))) return null;
-  try { return JSON.parse(await readFile(file, 'utf8')); }
-  catch { return null; }
-}
-export function validateDocsDir(value) {
-  if (typeof value !== 'string' || !value.trim()) throw new Error('Document directory must be a relative path.');
-  if (value.includes('\0') || value.includes('\\') || path.isAbsolute(value) ||
-      value.split('/').some(part => !part || part === '.' || part === '..') ||
-      value === '.git' || value.startsWith('.git/')) {
-    throw new Error('Invalid document directory: use a safe project-relative path.');
-  }
-  return value;
-}
-export async function inspectSetupProject(cwd) {
-  const pkg = await readJson(path.join(cwd, 'package.json'));
-  const scripts = pkg?.scripts && typeof pkg.scripts === 'object' ? pkg.scripts : {};
-  const remote = git(cwd, 'remote', 'get-url', 'origin');
-  const tracker = /github\.com[:/]/i.test(remote) ? 'github'
-    : /gitlab/i.test(remote) ? 'gitlab' : 'local';
-  const workspace = await exists(path.join(cwd, 'pnpm-workspace.yaml')) || !!pkg?.workspaces;
-  const technologies = [
-    ['next', 'Next.js'], ['react', 'React'], ['react-native', 'React Native'],
-    ['vue', 'Vue'], ['vite', 'Vite'], ['typescript', 'TypeScript'],
-    ['vitest', 'Vitest'], ['jest', 'Jest'],
-  ].filter(([key]) => pkg?.dependencies?.[key] || pkg?.devDependencies?.[key]).map(([, label]) => label);
-  const docs = {
-    glossary: await exists(path.join(cwd, 'GLOSSARY.md')),
-    glossaryMap: await exists(path.join(cwd, 'GLOSSARY-MAP.md')),
-    adr: await exists(path.join(cwd, 'docs', 'adr')),
-    agents: await exists(path.join(cwd, 'AGENTS.md')),
-    claude: await exists(path.join(cwd, 'CLAUDE.md')),
-  };
-  return {
-    root: cwd, remote: remote || null, tracker,
-    workspace: workspace ? 'monorepo' : 'single-context',
-    packageName: pkg?.name || path.basename(cwd),
-    technologies, scripts: Object.fromEntries(Object.entries(scripts).filter(
-      ([name, script]) => ['test', 'typecheck', 'type-check', 'lint', 'build', 'check', 'validate'].includes(name)
-        && typeof script === 'string')),
-    docs,
-  };
-}
-function docText(name, details, tracker, docsDir) {
-  const { technologies, packageName, scripts, workspace, docs } = details;
-  if (name === 'project.md') return [
-    '# Project context', '', 'Project: ' + packageName, 'Layout: ' + workspace,
-    'Detected stack: ' + (technologies.join(', ') || 'not detected'), '',
-    'Project-specific context for all installed Showdar skills. Review detected values.',
-    'Detection does not authorize changes to code or configuration.', '',
-  ].join('\n');
-  if (name === 'issue-tracker.md') return [
-    '# Issue tracker', '', 'Provider: ' + tracker,
-    'Remote: ' + (details.remote || 'not configured'), '',
-    tracker === 'github' ? 'Use repository GitHub Issues and PR conventions.'
-      : tracker === 'gitlab' ? 'Use repository GitLab Issues and MR conventions.'
-        : 'Use local files or replace this section with your tracker convention.',
-    'Do not modify remote issues without explicit task authorization.', '',
-  ].join('\n');
-  if (name === 'verification.md') {
-    const lines = Object.entries(scripts).map(([name, script]) =>
-      '- ' + name + ': ' + codeQuote(script.replaceAll('\n', ' ')));
-    return ['# Verification', '', 'Detected package scripts (inspect before running):',
-      ...(lines.length ? lines : ['- No standard verification scripts detected']),
-      '', 'Run narrow checks first and full checks before handoff.',
-      'Never execute untrusted project scripts without reviewing their content.', ''].join('\n');
-  }
-  return ['# Domain context', '', 'Layout: ' + workspace,
-    'Glossary: ' + (docs.glossary ? 'GLOSSARY.md' : docs.glossaryMap ? 'GLOSSARY-MAP.md' : 'not yet present'),
-    'Architecture decisions: ' + (docs.adr ? 'docs/adr/' : 'not yet present'), '',
-    'Read an existing glossary and relevant ADRs before changing domain names.',
-    'Create glossary entries and ADRs lazily when actual decisions are resolved.',
-    'Shared context directory: ' + docsDir, ''].join('\n');
-}
-export async function planProjectSetup({ cwd, docsDir = DOC_ROOT, tracker = null } = {}) {
-  if (!cwd) throw new Error('Project directory is required.');
-  const root = path.resolve(cwd);
-  const folder = validateDocsDir(docsDir);
-  const details = await inspectSetupProject(root);
-  const selected = tracker || details.tracker;
-  if (!['github', 'gitlab', 'local'].includes(selected)) throw new Error('Tracker must be github, gitlab or local.');
-  const files = [];
-  for (const name of DOCS) {
-    const rel = folder + '/' + name;
-    const dest = path.resolve(root, rel);
-    await assertSafeManagedPath(root, dest);
-    const present = await exists(dest);
-    files.push({ path: rel, action: present ? 'preserve' : 'create',
-      content: present ? null : docText(name, details, selected, folder) });
-  }
-  return { schemaVersion: 1, tracker: selected, docsDir: folder, inspection: details, files };
-}
-export async function applyProjectSetup({ cwd, plan }) {
-  if (!plan || plan.schemaVersion !== 1) throw new Error('Invalid setup plan.');
-  const root = path.resolve(cwd);
-  const gate = guardMutation({ cwd: root, mutation: 'local-write' });
-  if (!gate.allowed) throw new Error('Setup blocked by Git preflight: ' + gate.code + '. Run showdar git-start first.');
-  const folder = validateDocsDir(plan.docsDir);
-  const fresh = await planProjectSetup({ cwd: root, docsDir: folder, tracker: plan.tracker });
-  const created = [], preserved = [];
-  for (const file of fresh.files) {
-    const dest = path.resolve(root, file.path);
-    await assertSafeManagedPath(root, dest);
-    if (file.action === 'preserve') { preserved.push(file.path); continue; }
-    await mkdir(path.dirname(dest), { recursive: true });
-    try {
-      await writeFile(dest, file.content, { flag: 'wx' });
-      created.push(file.path);
-    } catch (e) {
-      if (e.code === 'EEXIST') { preserved.push(file.path); continue; }
-      throw e;
-    }
-  }
-  return { created, preserved, docsDir: folder, tracker: fresh.tracker };
-}