summer-engine 4.0.0 → 4.2.0

package/dist/cli/commands/ops.js

@@ -1,7 +1,8 @@
 import { Command } from "commander";
+import { CLI_AREAS } from "../../core/ops/areas.js";
 import { localEntries, localInputSchema, localWireForm, missingInput } from "../../core/ops/catalog.js";
-import { answerOfHosted, callHostedV4, hostedCallFailure, searchEverywhere } from "../../core/ops/cloud.js";
-import { errorAnswer, isLocalOp, localToolsFor, opFromCli, OP_NAME } from "../../core/ops/contract.js";
+import { answerOfHosted, callHostedV4, describeFromShipped, hostedCallFailure, searchEverywhere } from "../../core/ops/cloud.js";
+import { errorAnswer, isLocalOp, localToolsFor, opFromCli, OP_NAME, resolveOpName } from "../../core/ops/contract.js";
 import { ENGINE_SPLIT_OPS, engineOpDef, splitToolArgs } from "../../core/ops/engine.js";
 import { engineFailure, engineNotRunning } from "../../core/ops/engine-answer.js";
 import { loadLibraryIndex } from "../../core/library-search.js";
@@ -18,12 +19,7 @@ import { dispatchTool, EngineUnavailableError, ToolResultError } from "../../cor
  * `summer tool` runs); cloud operations run on the hosted Summer server
  * through its summer_call, with the person's sign-in.
  */
-/** Areas with operations today; CLI command words stay out of this list. */
-export const CLI_AREAS = [
-    "team", "profile", "docs", "assets", "makers", "jobs", "projects", "plans", "games", "store", "jams", "pricing",
-    "analytics", "experiments", "marketing", "players", "economy", "inbox", "apps", "studio", "chats", "stories",
-    "plugins", "engine", "account",
-];
+export { CLI_AREAS };
 const RESERVED_FLAGS = new Set(["json", "dry-run", "wait", "idempotency-key", "input"]);
 const camel = (flag) => flag.replace(/-([a-z0-9])/g, (_match, letter) => letter.toUpperCase());
 /** A flag's field: camelCase (`--scene-path` is scenePath), or snake_case when the schema names it so (`--look-at` is look_at). */
@@ -95,6 +91,9 @@ export function parseCallFlags(argv, schema) {
         }
     }
     out.input = { ...out.input, ...fields };
+    // --dry-run anywhere makes a dry run, whatever the input says: allow rules for dry runs rely on it (installer/cli-permissions.ts).
+    if (out.dryRun)
+        delete out.input.dryRun;
     return out;
 }
 export const defaultOpsCliDeps = {
@@ -115,18 +114,21 @@ async function runLocal(op, call, deps) {
     const tool = split?.tool ?? entry?.mcpTool ?? localToolsFor(op)[0];
     if (!tool)
         return errorAnswer("not_found", `No operation is named "${op}".`, { next: { op: "ops.search", input: { query: op } } });
-    const args = split ? splitToolArgs(split, call.input) : call.input;
+    // maxCharacters cuts the text an MCP client gets; the CLI prints the whole answer.
+    const { maxCharacters, ...input } = call.input;
+    const uncut = maxCharacters === undefined ? undefined : ["maxCharacters: the CLI prints the whole answer; cut it in the shell (for example | head -c 8000)."];
+    const args = split ? splitToolArgs(split, input) : input;
     const def = engineOpDef(op);
     const guide = guideOf(tool);
     const describe = guide && def ? { op: "docs.read", input: { id: guide } } : { op: "ops.describe", input: { name: op } };
-    const missing = missingInput(localInputSchema(op), call.input);
+    const missing = missingInput(localInputSchema(op), input);
     if (missing)
         return errorAnswer("invalid_input", missing, { next: describe });
     if (call.dryRun) {
         return { ok: true, status: "dry_run", preview: { summary: `${entry?.title ?? op}: the input is valid. Nothing was done.`, changes: [], approval: entry?.approval ?? "none", estimate: null, valid: true } };
     }
     try {
-        return { ok: true, status: "done", result: await deps.dispatch(tool, args) };
+        return { ok: true, status: "done", result: await deps.dispatch(tool, args), ...(uncut ? { warnings: uncut } : {}) };
     }
     catch (error) {
         if (error instanceof EngineUnavailableError)
@@ -249,6 +251,44 @@ export async function runOpFromCli(op, argv, deps = defaultOpsCliDeps) {
             deps.printError(`Warning: ${warning}`);
     return answer.ok ? 0 : 1;
 }
+/**
+ * `summer ops search <words...>`: every operation, local and cloud, signed in
+ * or not; a cloud one that needs a sign-in says so. A how-to (docs.search
+ * first) points at the library.
+ */
+export async function searchFromCli(query, options, deps = defaultOpsCliDeps) {
+    const { items, warning } = await searchEverywhere(query, { area: options.area, limit: options.limit }, deps.hosted);
+    if (options.json) {
+        deps.print(JSON.stringify({ ok: true, status: "done", result: { items }, ...(warning ? { warnings: [warning] } : {}) }));
+        return;
+    }
+    for (const item of items)
+        deps.print(`${item.name.padEnd(32)} ${item.effect.padEnd(13)} ${item.title}${item.needsSignIn ? "  (needs sign-in)" : ""}`);
+    if (items[0]?.name === "docs.search")
+        deps.print(`How-to guides for this: summer docs search --query ${shellWord(query)}`);
+    if (warning)
+        deps.printError(warning);
+}
+/**
+ * `summer ops describe <op>`: a local operation from this package; a cloud
+ * one from Summer's server, or from the shipped catalog when the server
+ * cannot answer (signed out, offline).
+ */
+export async function describeFromCli(op, deps = defaultOpsCliDeps, options = {}) {
+    const local = localWireForm(resolveOpName(op));
+    if (local) {
+        // --json: the same answer shape as the cloud describe ({operation}).
+        deps.print(options.json ? JSON.stringify({ ok: true, status: "done", result: { operation: local } }) : JSON.stringify(local, null, 2));
+        return 0;
+    }
+    const asked = await runCloud("ops.describe", { input: { name: op }, json: options.json === true, dryRun: false, wait: false }, deps);
+    const answer = describeFromShipped(op, asked) ?? asked;
+    (answer.ok ? deps.print : deps.printError)(options.json ? JSON.stringify(answer) : formatAnswer(answer));
+    if (!options.json && answer.ok)
+        for (const warning of answer.warnings ?? [])
+            deps.printError(`Warning: ${warning}`);
+    return answer.ok ? 0 : 1;
+}
 function areaCommand(area) {
     return new Command(area)
         .description(`Summer ${area} operations: summer ${area} <action> --field value. Find them: summer ops search ${area}`)
@@ -276,26 +316,14 @@ export function opsCliCommands() {
         .option("--limit <n>", "Most results", "8")
         .option("--json", "Print the answer as JSON")
         .action(async (wordsArg, options) => {
-        const { items, warning } = await searchEverywhere(wordsArg.join(" "), { area: options.area, limit: Number(options.limit) || 8 }, defaultOpsCliDeps.hosted);
-        if (options.json) {
-            defaultOpsCliDeps.print(JSON.stringify({ ok: true, status: "done", result: { items }, ...(warning ? { warnings: [warning] } : {}) }));
-            return;
-        }
-        for (const item of items)
-            defaultOpsCliDeps.print(`${item.name.padEnd(32)} ${item.effect.padEnd(13)} ${item.title}`);
-        if (warning)
-            defaultOpsCliDeps.printError(warning);
+        await searchFromCli(wordsArg.join(" "), { area: options.area, limit: Number(options.limit) || 8, json: options.json === true });
     });
     ops
         .command("describe <op>")
         .description("Show one operation with its exact input")
-        .action(async (op) => {
-        const local = localWireForm(op);
-        if (local) {
-            defaultOpsCliDeps.print(JSON.stringify(local, null, 2));
-            return;
-        }
-        process.exitCode = await runOpFromCli("ops.describe", ["--name", op]);
+        .option("--json", "Print the answer as JSON")
+        .action(async (op, options) => {
+        process.exitCode = await describeFromCli(op, defaultOpsCliDeps, { json: options.json === true });
     });
     return [whoami, ops, ...CLI_AREAS.map(areaCommand)];
 }

package/dist/cli/commands/setup.d.ts

@@ -1,4 +1,6 @@
 import { Command } from "commander";
 export declare const setupCommand: Command;
+/** True when `path` sits in a git repository that does not ignore it (false outside git, or without git). */
+export declare function notGitIgnored(path: string, cwd?: string): boolean;
 /** One line instead of a row per three skills: the first few names and how many more. `--json` keeps the full list. */
 export declare function skillNamesSample(names: readonly string[], max?: number): string;

package/dist/cli/commands/setup.js

@@ -1,19 +1,31 @@
+import { spawnSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { relative } from "path";
 import { Command, Option } from "commander";
 import { configureAgentMcp, configureSummerGamesMcp, resolveAgentSelection, resolveConfigScope, supportedAgents, } from "../../installer/agent-config.js";
 import { previewNote, setupSkills } from "../../installer/setup.js";
 import { printDoctorResult, runDoctor } from "../../core/capabilities/doctor.js";
 import { brandLine, c, sym, tildeify } from "../../core/format.js";
 import { TOOLKIT_VERSION as cliVersion } from "../../core/version.js";
-import { resolveDefaultChannel } from "../../installer/version-check.js";
-import { agentLabel } from "../../installer/agent-table.js";
+import { listsSummerEngine, resolveDefaultChannel } from "../../installer/version-check.js";
+import { agentLabel, agentSpec, cliSetupRefusal, defaultPathContext } from "../../installer/agent-table.js";
+import { addAllowRules, allowRulesPath, removeAllowRules, supportsAllowRules } from "../../installer/cli-permissions.js";
 import { PROFILES, parseProfile } from "../../core/tool-profiles.js";
+import { findSetupProjectRoot, writeAgentInstructions } from "../../project-memory/agent-instructions.js";
 const PROFILE_NOTES = {
     full: "Every Summer tool.",
     engine: "Engine, generation and store tools. Every tool: summer setup <agent> --profile full",
     assets: "Generation and asset tools, no engine tools. Every tool: summer setup <agent> --profile full",
 };
+/** The options that only shape the MCP entry, which --cli does not write. */
+const MCP_ENTRY_FLAGS = [
+    ["print", "--print"],
+    ["localDev", "--local-dev"],
+    ["channel", "--channel"],
+    ["profile", "--profile"],
+];
 export const setupCommand = new Command("setup")
-    .description("Configure Summer Engine for an AI agent and run diagnostics. For agents that can sign in to it, it also adds Summer Games (summer-games).")
+    .description("Configure Summer Engine for an AI agent and run diagnostics. For agents that can sign in to it, it also adds Summer Games (summer-games). --cli installs the skills only: the agent runs summer commands in its shell, with no MCP server.")
     .argument("[agent]", `Agent to configure: ${supportedAgents.join(", ")}`)
     .option("--agent <agent>", `Agent to configure: ${supportedAgents.join(", ")}`)
     .option("--scope <scope>", "Configuration scope: user or project", "user")
@@ -25,6 +37,11 @@ export const setupCommand = new Command("setup")
     .option("--no-games", "Do not add the Summer Games MCP (summer-games: friends, parties and messages as you, signed in through summer.games)")
     .option("--profile <profile>", "MCP tool profile: full (every tool, the default), engine (engine, generation and the store; under 128 tools; the default for VS Code Copilot), assets (generation and the asset library, no engine tools)")
     .option("--assets-only", "Set up for making assets without Summer Engine: the assets profile, only the asset skills, and no Summer Games")
+    .option("--cli", "CLI only: install the skills and no MCP server (and no Summer Games). The agent runs Summer as summer <area> <action> commands in its shell; the summer-cli skill teaches it")
+    .option("--no-mcp", "Same as --cli")
+    .option("--allow-rules", "With --cli, for Claude Code and Codex: let the agent run read-only summer commands, and dry runs of spends, without asking. Prints every rule; written only with --yes")
+    .option("--remove-allow-rules", "Remove the allow rules --allow-rules added (Claude Code, Codex), and nothing else")
+    .option("--no-project-files", "Inside a Summer project, do not add the Summer instructions to its AGENTS.md and CLAUDE.md (added with --yes by default)")
     .option("--json", "Print setup result as JSON")
     .option("--force", "Overwrite existing skill content (passes --force through to skills install)")
     .option("--recommended", "Install only the recommended skill subset instead of the whole library")
@@ -34,6 +51,17 @@ export const setupCommand = new Command("setup")
     .action(async (agentArg, opts) => {
     const agent = resolveAgentSelection(agentArg, opts.agent);
     const scope = resolveConfigScope(opts.scope);
+    if (opts.removeAllowRules) {
+        await removeCliAllowRules(agent, scope, opts);
+        return;
+    }
+    if (opts.cli || opts.mcp === false) {
+        await setupCliOnly(agent, scope, opts);
+        return;
+    }
+    // On stderr, so --json output stays one JSON document.
+    if (opts.allowRules)
+        console.error(`  ${sym.warn()}  ${c.yellow("--allow-rules works with --cli only (the MCP server asks through the agent's own tool approvals); no rules were added.")}`);
     const profile = resolveSetupProfile(opts);
     const defaultChannel = await resolveDefaultChannel(cliVersion);
     const config = await configureAgentMcp({
@@ -60,6 +88,7 @@ export const setupCommand = new Command("setup")
         stableOnly: Boolean(opts.stableOnly),
         assetsOnly: Boolean(opts.assetsOnly),
     });
+    const projectFiles = setupProjectInstructions(opts);
     const doctor = await runDoctor({ quiet: true });
     if (opts.json) {
         console.log(JSON.stringify({
@@ -67,16 +96,184 @@ export const setupCommand = new Command("setup")
             config,
             games,
             skills,
+            projectFiles,
             doctor,
         }, null, 2));
     }
     else {
-        printSetupResult(config, games, skills, doctor);
+        printSetupResult(config, games, skills, doctor, projectFiles);
     }
     if (!doctor.ok || skills.status === "failed") {
         process.exit(1);
     }
 });
+/**
+ * `summer setup <agent> --cli`: the skills (the asset skills with --assets-only)
+ * and no MCP server, so the agent runs Summer as `summer <area> <action>` in its
+ * shell. Writes no agent config file; an existing summer-engine entry from an
+ * earlier setup is left as it is and named in a warning.
+ */
+async function setupCliOnly(agent, scope, opts) {
+    const spec = agentSpec(agent);
+    const mcpFlags = MCP_ENTRY_FLAGS.filter(([key]) => opts[key] !== undefined && opts[key] !== false).map(([, flag]) => flag);
+    if (mcpFlags.length > 0) {
+        throw new Error(`${mcpFlags.join(", ")} sets up the MCP entry, and --cli writes none. Leave ${mcpFlags.length === 1 ? "it" : "them"} out, or leave out --cli.`);
+    }
+    const refusal = cliSetupRefusal(spec);
+    if (refusal)
+        throw new Error(refusal);
+    const warnings = spec.status === "legacy" && spec.legacyNote ? [spec.legacyNote] : [];
+    const existing = await recordedMcpEntry(agent, scope);
+    if (existing) {
+        warnings.push(`${tildeify(existing)} still lists the summer-engine MCP server from an earlier setup. Remove that entry to use the CLI only.`);
+    }
+    const dryRun = Boolean(opts.dryRun);
+    const skills = setupSkills(agent, {
+        dryRun,
+        yes: Boolean(opts.yes),
+        force: Boolean(opts.force),
+        scope,
+        recommended: Boolean(opts.recommended),
+        stableOnly: Boolean(opts.stableOnly),
+        assetsOnly: Boolean(opts.assetsOnly),
+        commands: false,
+    });
+    // Read-only and dry-run summer commands run without asking, where the agent has clean allow rules.
+    // Opt-in: the flag is in the command the person approves.
+    let allowRules = null;
+    if (opts.allowRules && !supportsAllowRules(agent)) {
+        warnings.push(`--allow-rules is for Claude Code and Codex; ${agentLabel(agent)} manages command approvals in its own settings.`);
+    }
+    else if (opts.allowRules) {
+        try {
+            allowRules = await addAllowRules(agent, allowRulesPath(agent, scope, defaultPathContext()), Boolean(opts.yes) && !dryRun);
+            const shared = agent === "claude-code" && scope === "project" ? notGitIgnored(allowRules.path) : false;
+            if (shared)
+                warnings.push(`${tildeify(allowRules.path)} is not in .gitignore, so git would share these personal allow rules. Add .claude/settings.local.json to .gitignore.`);
+        }
+        catch (error) {
+            warnings.push(error instanceof Error ? error.message : String(error));
+        }
+    }
+    const projectFiles = setupProjectInstructions(opts);
+    const doctor = await runDoctor({ quiet: true });
+    const ok = doctor.ok && skills.status !== "failed";
+    if (opts.json) {
+        console.log(JSON.stringify({ ok, mcp: false, agent, scope, config: null, games: null, existingMcpEntry: existing, skills, allowRules, projectFiles, doctor, warnings }, null, 2));
+    }
+    else {
+        const label = agentLabel(agent);
+        console.log("");
+        console.log(brandLine(cliVersion));
+        console.log("");
+        console.log(`  ${dryRun ? c.dim("(dry run)") : sym.ok()}  ${c.bold(`CLI only for ${label}`)}: no MCP server`);
+        console.log(`     ${c.dim("The agent runs Summer in its shell: summer <area> <action>, or npx -y summer-engine@latest <area> <action>. The summer-cli skill teaches it.")}`);
+        printSkillsLine(skills, dryRun);
+        if (allowRules)
+            printAllowRules(allowRules, label, Boolean(opts.yes) && !dryRun);
+        else if (supportsAllowRules(agent) && !opts.allowRules) {
+            console.log(`  ${sym.arrow()}  ${c.dim(`${label} asks before each summer command. To run read-only and dry-run ones without asking: summer setup ${agent} --cli --allow-rules --yes (it prints every rule).`)}`);
+        }
+        printProjectFiles(projectFiles);
+        for (const warning of warnings)
+            console.log(`  ${sym.warn()}  ${c.yellow(warning)}`);
+        console.log("");
+        printDoctorResult(doctor);
+        if (ok && !dryRun)
+            printTryIt(label, Boolean(opts.assetsOnly));
+    }
+    if (!ok)
+        process.exit(1);
+}
+/** The allow rules, each on its line: what the agent now runs without asking, or would with --yes. */
+function printAllowRules(result, label, write) {
+    const where = c.dim(tildeify(result.path));
+    if (!write) {
+        console.log(`  ${sym.arrow()}  ${label} would run these summer commands without asking. Add them: run the same command with --yes.  ${where}`);
+    }
+    else if (result.changed.length === 0) {
+        console.log(`  ${sym.ok()}  ${label} already runs read-only and dry-run summer commands without asking  ${where}`);
+        return;
+    }
+    else {
+        console.log(`  ${sym.ok()}  ${label} runs these summer commands without asking (${result.changed.length} rules added)  ${where}`);
+    }
+    for (const rule of result.rules)
+        console.log(`     ${c.dim(rule)}`);
+    console.log(`     ${c.dim("Changes, publishing, prices, deletes and messages still ask. jobs wait and assets get save the files they name. Put --dry-run right after the action: summer assets generate-image --dry-run --prompt ... Undo: --remove-allow-rules")}`);
+}
+/** True when `path` sits in a git repository that does not ignore it (false outside git, or without git). */
+export function notGitIgnored(path, cwd = process.cwd()) {
+    const run = (args) => spawnSync("git", args, { cwd, stdio: "ignore" }).status;
+    if (run(["rev-parse", "--is-inside-work-tree"]) !== 0)
+        return false;
+    return run(["check-ignore", "-q", relative(cwd, path)]) === 1;
+}
+/** `summer setup <agent> --remove-allow-rules`: take out exactly the rules --allow-rules added. */
+async function removeCliAllowRules(agent, scope, opts) {
+    if (!supportsAllowRules(agent))
+        throw new Error(`--remove-allow-rules is for Claude Code and Codex; Summer adds no allow rules for ${agentLabel(agent)}.`);
+    const result = await removeAllowRules(agent, allowRulesPath(agent, scope, defaultPathContext()), !opts.dryRun);
+    if (opts.json) {
+        console.log(JSON.stringify({ ok: true, agent, scope, allowRules: result }, null, 2));
+        return;
+    }
+    const where = c.dim(tildeify(result.path));
+    if (result.changed.length === 0)
+        console.log(`  ${sym.ok()}  No Summer allow rules for ${agentLabel(agent)}  ${where}`);
+    else
+        console.log(`  ${opts.dryRun ? c.dim("(dry run)") : sym.ok()}  ${opts.dryRun ? "Would remove" : "Removed"} ${result.changed.length} Summer allow rules for ${agentLabel(agent)}  ${where}`);
+}
+/**
+ * Inside a Summer project (findSetupProjectRoot: project.godot at or above the
+ * working directory, no higher than the git top level, never home): its
+ * AGENTS.md and CLAUDE.md, added when missing and never overwritten
+ * (project-memory/agent-instructions.ts). Like the skills, they are only
+ * planned without --yes. Null outside a project, with --no-project-files,
+ * --print, and --assets-only (the block is about building in Summer Engine).
+ */
+function setupProjectInstructions(opts) {
+    if (opts.projectFiles === false || opts.print || opts.assetsOnly)
+        return null;
+    const root = findSetupProjectRoot();
+    if (!root)
+        return null;
+    const dryRun = Boolean(opts.dryRun);
+    const written = Boolean(opts.yes) && !dryRun;
+    return { root, written, dryRun, files: writeAgentInstructions(root, { dryRun: !written }) };
+}
+function printProjectFiles(project) {
+    if (!project)
+        return;
+    const changed = project.files.filter((file) => file.action === "created" || file.action === "added" || file.action === "updated");
+    if (changed.length) {
+        const where = c.dim(changed.map((file) => tildeify(file.path)).join(", "));
+        if (project.written)
+            console.log(`  ${sym.ok()}  Added the Summer instructions for agents  ${where}`);
+        else if (project.dryRun)
+            console.log(`  ${c.dim("(dry run)")}  Would add the Summer instructions for agents  ${where}`);
+        else
+            console.log(`  ${sym.warn()}  Instructions for agents not added. Run the same setup command again with --yes to add them  ${where}`);
+    }
+    for (const file of project.files) {
+        if (!file.reason)
+            continue;
+        const what = file.action === "skipped" ? "not written" : "left as it is";
+        console.log(`  ${sym.warn()}  ${c.yellow(`${tildeify(file.path)} ${what}: ${file.reason}`)}`);
+    }
+}
+/** The config file that already lists summer-engine for this agent and scope, or null. */
+async function recordedMcpEntry(agent, scope) {
+    try {
+        const target = await configureAgentMcp({ agent, scope, print: true });
+        if (!existsSync(target.path))
+            return null;
+        return listsSummerEngine(readFileSync(target.path, "utf-8"), target.format) ? target.path : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** --assets-only means the assets profile; --profile must name a profile and agree with it. */
 function resolveSetupProfile(opts) {
     const profile = opts.profile === undefined ? undefined : parseProfile(opts.profile);
@@ -90,7 +287,7 @@ function resolveSetupProfile(opts) {
     }
     return profile;
 }
-function printSetupResult(config, games, skills, doctor) {
+function printSetupResult(config, games, skills, doctor, projectFiles) {
     if (config.print) {
         console.log(config.snippet.trimEnd());
         return;
@@ -132,6 +329,22 @@ function printSetupResult(config, games, skills, doctor) {
         if (!config.dryRun)
             console.log(`     ${c.dim(`Sign in once: ${games.signIn}`)}`);
     }
+    printSkillsLine(skills, config.dryRun);
+    printProjectFiles(projectFiles);
+    for (const warning of config.warnings) {
+        console.log(`  ${sym.warn()}  ${c.yellow(warning)}`);
+    }
+    console.log("");
+    printDoctorResult(doctor);
+    if (doctor.ok && skills.status !== "failed" && !config.dryRun)
+        printTryIt(label, config.profile === "assets");
+}
+function printTryIt(label, assets) {
+    console.log("");
+    const ask = assets ? "make a sword clash sound effect" : "add a DirectionalLight3D and Camera3D to my scene";
+    console.log(`${c.dim("Try it:")} open ${label} and ask: ${c.bold(`"${ask}"`)}`);
+}
+function printSkillsLine(skills, dryRun) {
     if (skills.status === "installed") {
         const installed = parseInstalledSkills(skills.stdout);
         if (installed.length > 0) {
@@ -147,7 +360,7 @@ function printSetupResult(config, games, skills, doctor) {
             console.log(`  ${sym.ok()}  ${skills.message}`);
         }
     }
-    else if (skills.status === "planned" && config.dryRun) {
+    else if (skills.status === "planned" && dryRun) {
         const note = previewNote(skills);
         console.log(`  ${c.dim("(dry run)")}  Would install ${c.bold(String(skills.count ?? "?") + " skills")}${note ? c.dim(` (${note})`) : ""}  ${c.dim(skills.destination ?? "")}`);
     }
@@ -159,16 +372,6 @@ function printSetupResult(config, games, skills, doctor) {
         if (skills.stderr)
             console.log(`     ${c.dim(skills.stderr)}`);
     }
-    for (const warning of config.warnings) {
-        console.log(`  ${sym.warn()}  ${c.yellow(warning)}`);
-    }
-    console.log("");
-    printDoctorResult(doctor);
-    if (doctor.ok && skills.status !== "failed" && !config.dryRun) {
-        console.log("");
-        const ask = config.profile === "assets" ? "make a sword clash sound effect" : "add a DirectionalLight3D and Camera3D to my scene";
-        console.log(`${c.dim("Try it:")} open ${label} and ask: ${c.bold(`"${ask}"`)}`);
-    }
 }
 /** One line instead of a row per three skills: the first few names and how many more. `--json` keeps the full list. */
 export function skillNamesSample(names, max = 8) {

package/dist/cli/commands/skills.js

@@ -234,8 +234,13 @@ skillsCommand
     .command("list")
     .description("List available skills")
     .option("--by-domain", "Group skills by their primary domain (same grouping as library/skills/README.md)")
+    .option("--json", "Print the skills as JSON")
     .action((opts) => {
     const skills = getBuiltinSkills();
+    if (opts.json) {
+        console.log(JSON.stringify({ skills }));
+        return;
+    }
     if (skills.length === 0) {
         console.log("No skills found.");
         return;
@@ -287,6 +292,7 @@ skillsCommand
     // Pre-reversal opt-in, kept one release as a hidden no-op so old scripts still parse.
     .addOption(new Option("--include-preview", "No-op: preview skills install by default").hideHelp())
     .option("--force", "Overwrite existing skill files (wipe stale skill dirs before copying)")
+    .option("--no-commands", "Claude Code: skip the slash commands (/summer, /gameskill, /start), which start work through the MCP tools")
     .action((name, opts) => {
     const agent = orDie(() => resolveSkillAgent(opts));
     const scope = orDie(() => resolveSkillScope(agent, opts));
@@ -344,15 +350,16 @@ skillsCommand
         console.log(previewSkippedLine(previewSkipped));
     // Claude Code: also install slash commands (`commands/*.md`)
     // into `~/.claude/commands/`. Other agents don't have an equivalent today.
-    // The commands start and route game work in the engine, so the asset
-    // skills (--assets, setup --assets-only) leave them out.
-    if (agent === "claude-code" && !opts.assets) {
+    // The commands start and route game work in the engine through the MCP
+    // tools, so the asset skills (--assets, setup --assets-only) and a setup
+    // without MCP (--no-commands, setup --cli) leave them out.
+    if (agent === "claude-code" && !opts.assets && opts.commands !== false) {
         const commandResults = installClaudeCommands(scope, Boolean(opts.force));
         for (const r of commandResults) {
             console.log(`  ${r.action} command ${r.name} -> ${r.path}`);
         }
     }
-    writeMarkerForLocation(location);
+    writeMarkerForLocation(location, skills.map((skill) => skill.name));
     printInstallSummary(skills.length, agent, scope, location);
 });
 /**
@@ -390,12 +397,13 @@ function installClaudeCommands(scope, force) {
  * `skills-version-stale` check can detect drift later. Devin Desktop (formerly Windsurf) writes a
  * single rules file with no surrounding dir, so we skip it there.
  */
-function writeMarkerForLocation(location) {
+function writeMarkerForLocation(location, installed) {
     if (location.kind === "windsurf-rule-file")
         return;
     try {
         mkdirSync(location.path, { recursive: true });
-        writeSkillMarker(location.path, cliVersion);
+        // Skills the upgrade refresh left stay protected, unless this install just replaced them.
+        writeSkillMarker(location.path, cliVersion, new Date(), installed);
     }
     catch {
         // Marker is purely informational. If the FS rejects it (e.g. permission
@@ -405,7 +413,8 @@ function writeMarkerForLocation(location) {
 skillsCommand
     .command("info <name>")
     .description("Show skill description and preview")
-    .action((name) => {
+    .option("--json", "Print the skill and its full SKILL.md body as JSON")
+    .action((name, opts) => {
     const meta = getSkillMeta(name);
     if (!meta) {
         console.error(`Unknown skill: ${name}`);
@@ -416,6 +425,10 @@ skillsCommand
         die(`Skill files missing: ${name}`);
     const skillPath = join(src, "SKILL.md");
     const content = readFileSync(skillPath, "utf-8");
+    if (opts.json) {
+        console.log(JSON.stringify({ ...meta, file: skillPath, body: content.replace(/^---\s*\n[\s\S]*?\n---\s*\n/, "") }));
+        return;
+    }
     console.log(`\n${meta.name}`);
     console.log("-".repeat(40));
     console.log(meta.description);

package/dist/cli/commands/status.d.ts

@@ -1,3 +1,29 @@
 import { Command } from "commander";
 export declare const statusCommand: Command;
+/** What `summer status` reports; `--json` prints exactly this. */
+export interface StatusReport {
+    auth: {
+        signedIn: false;
+        loginUrl: string;
+    } | {
+        signedIn: true;
+        source: "env";
+    } | {
+        signedIn: true;
+        source: "stored";
+        email?: string;
+        identityError?: string;
+    };
+    engine: {
+        state: "not_running";
+    } | {
+        state: "not_responding";
+        port: number;
+    } | {
+        state: "running";
+        port: number;
+        version: string;
+    };
+}
+export declare function readStatus(): Promise<StatusReport>;
 export declare function runStatus(log: (message: string) => void): Promise<void>;

package/dist/cli/commands/status.js

@@ -4,52 +4,67 @@ import { resolveGatewayUrl } from "../../core/config.js";
 import { getApiToken, getApiPort, checkEngineHealth } from "../../core/engine.js";
 export const statusCommand = new Command("status")
     .description("Check Summer Engine status, connection, and auth state")
-    .action(async () => {
-    await runStatus(console.log);
+    .option("--json", "Print the status as JSON")
+    .action(async (opts) => {
+    if (opts.json)
+        console.log(JSON.stringify(await readStatus()));
+    else
+        await runStatus(console.log);
 });
+export async function readStatus() {
+    const authToken = await getAuthToken();
+    // The env credential is what every gateway call uses; a stored identity
+    // (if any) is not the one in effect, so it is not reported.
+    const auth = !authToken
+        ? { signedIn: false, loginUrl: await loginPageHint() }
+        : hasEnvAuthToken()
+            ? { signedIn: true, source: "env" }
+            : { signedIn: true, source: "stored", ...(await storedIdentity()) };
+    if (!(await getApiToken()))
+        return { auth, engine: { state: "not_running" } };
+    const port = await getApiPort();
+    const health = await checkEngineHealth(port);
+    // /api/health carries no project name/path/scene (see EngineHealth in
+    // core/engine.ts); summer_get_project_context is the read for those.
+    return { auth, engine: health ? { state: "running", port, version: health.version } : { state: "not_responding", port } };
+}
 export async function runStatus(log) {
+    const { auth, engine } = await readStatus();
     log("Summer Engine Status\n");
-    const authToken = await getAuthToken();
-    if (!authToken) {
+    if (!auth.signedIn) {
         log("  Auth: Not logged in");
         log("        Run: npx -y summer-engine@latest login");
-        log(`        Or: ${await loginPageHint()}`);
+        log(`        Or: ${auth.loginUrl}`);
     }
-    else if (hasEnvAuthToken()) {
-        // The env credential is what every gateway call uses; a stored identity
-        // (if any) is not the one in effect, so it is not printed.
+    else if (auth.source === "env") {
         log("  Auth: SUMMER_TOKEN (env) — logout does not affect it");
     }
     else {
-        log(`  Auth: Logged in${await storedIdentitySuffix()}`);
+        const identity = auth.identityError ? ` (identity unreadable: ${auth.identityError})` : auth.email ? ` as ${auth.email}` : "";
+        log(`  Auth: Logged in${identity}`);
     }
-    const apiToken = await getApiToken();
-    const port = await getApiPort();
-    if (!apiToken) {
+    if (engine.state === "not_running") {
         log("  Engine: Not running (no api-token found)");
         log("\n  To start: summer run");
         return;
     }
     log("  API Token: Found (~/.summer/api-token)");
-    log(`  Port: ${port}`);
-    const health = await checkEngineHealth(port);
-    if (!health) {
+    log(`  Port: ${engine.port}`);
+    if (engine.state === "not_responding") {
         log("  Engine: Not responding (may have closed since last launch)");
         log("\n  To start: summer run");
         return;
     }
-    // /api/health carries no project name/path/scene (see EngineHealth in
-    // core/engine.ts); summer_get_project_context is the read for those.
-    log(`  Engine: Running (v${health.version})`);
+    log(`  Engine: Running (v${engine.version})`);
 }
 /** A corrupt user.json must not take `summer status` down with it. */
-async function storedIdentitySuffix() {
+async function storedIdentity() {
     try {
         const userInfo = await getUserInfo();
-        return userInfo?.email ? ` as ${userInfo.email}` : "";
+        return userInfo?.email ? { email: userInfo.email } : {};
     }
     catch (error) {
-        return ` (identity unreadable: ${error instanceof Error ? error.message : String(error)})`;
+        return { identityError: error instanceof Error ? error.message : String(error) };
     }
 }
 async function loginPageHint() {