tokentracker-cli 0.96.3 → 0.97.1

package/src/lib/rollout.js

@@ -21,6 +21,11 @@ const {
   currentCodexModel,
   snapshotCodexModelAttributionState,
 } = require("./codex-model-attribution");
+const {
+  CODEX_SERVICE_TIER_MARKER,
+  readCodexServiceTier,
+  isPriorityServiceTier,
+} = require("./codex-service-tier");
 const {
   DEVIN_TABLE_PROBE_SQL,
   devinUsageSql,
@@ -471,6 +476,7 @@ async function parseRolloutIncremental({
       ? prev.tokenUsageBaselines || null
       : null;
     const lastModel = sameInode && !truncated ? prev.lastModel || null : null;
+    const lastServiceTier = sameInode && !truncated ? prev.lastServiceTier || null : null;
     const modelAttributionState = sameInode && !truncated
       ? prev.modelAttributionState || null
       : null;
@@ -551,6 +557,7 @@ async function parseRolloutIncremental({
           lastTotal,
           tokenUsageBaselines,
           lastModel,
+          lastServiceTier,
           modelAttributionState,
           projectState,
           projectMetaCache,
@@ -566,6 +573,7 @@ async function parseRolloutIncremental({
           lastTotal,
           tokenUsageBaselines,
           lastModel,
+          lastServiceTier,
           modelAttributionState,
           hourlyState,
           touchedBuckets,
@@ -589,6 +597,7 @@ async function parseRolloutIncremental({
       lastTotal: result.lastTotal,
       tokenUsageBaselines: result.tokenUsageBaselines,
       lastModel: result.lastModel,
+      lastServiceTier: result.lastServiceTier || null,
       modelAttributionState: result.modelAttributionState,
       updatedAt: new Date().toISOString(),
     };
@@ -2060,6 +2069,7 @@ async function parseRolloutFile({
   lastTotal,
   tokenUsageBaselines,
   lastModel,
+  lastServiceTier,
   modelAttributionState: previousModelAttributionState,
   hourlyState,
   touchedBuckets,
@@ -2086,6 +2096,7 @@ async function parseRolloutFile({
       lastTotal,
       tokenUsageBaselines,
       lastModel,
+      lastServiceTier: typeof lastServiceTier === "string" ? lastServiceTier : null,
       modelAttributionState: previousModelAttributionState,
       eventsAggregated: 0,
       projectFileContexts,
@@ -2098,6 +2109,12 @@ async function parseRolloutFile({
   });
 
   let model = typeof lastModel === "string" ? lastModel : null;
+  // Codex writes thread_settings_applied before the turn_context of the turn it
+  // takes effect on, and token_count rows carry no turn id, so a row's tier is
+  // whatever the last such record said. A session's first turn has none, and
+  // most CLI sessions have none at all — that stays null, and null is billed at
+  // Standard rather than guessed from the current config.
+  let serviceTier = typeof lastServiceTier === "string" ? lastServiceTier : null;
   const modelAttributionState = createCodexModelAttributionState(
     previousModelAttributionState || { model },
   );
@@ -2148,7 +2165,10 @@ async function parseRolloutFile({
         line.includes('"cwd"') ||
         line.includes('"current_date"') ||
         line.includes('"forked_from_id"'));
-    if (!maybeTokenCount && !maybeTurnContext && !maybeModelReroute) {
+    const maybeServiceTier =
+      !maybeTokenCount && !maybeModelReroute && !maybeTurnContext &&
+      line.includes(CODEX_SERVICE_TIER_MARKER);
+    if (!maybeTokenCount && !maybeTurnContext && !maybeModelReroute && !maybeServiceTier) {
       if (invalidRecordPolicy === "throw" || !record.terminated) {
         try {
           JSON.parse(line);
@@ -2174,6 +2194,12 @@ async function parseRolloutFile({
     applyCodexModelEvent(modelAttributionState, obj);
     model = currentCodexModel(modelAttributionState) || model;
 
+    const appliedServiceTier = readCodexServiceTier(obj);
+    if (appliedServiceTier) {
+      serviceTier = appliedServiceTier;
+      continue;
+    }
+
     if (
       (obj?.type === "turn_context" || obj?.type === "session_meta") &&
       obj?.payload &&
@@ -2301,6 +2327,9 @@ async function parseRolloutFile({
 
     const bucket = getHourlyBucket(hourlyState, source, model, bucketStart);
     addTotals(bucket.totals, delta);
+    // Only the model bucket gets the subset: the project bucket below carries
+    // no model, so no per-model rate can be applied to it anyway.
+    if (isPriorityServiceTier(serviceTier)) addPriorityUsage(bucket.totals, delta);
     touchedBuckets.add(bucketKey(source, model, bucketStart));
     if (currentProjectKey && projectState && projectTouchedBuckets) {
       const projectBucket = getProjectBucket(
@@ -2321,6 +2350,7 @@ async function parseRolloutFile({
     lastTotal: latestTotal,
     tokenUsageBaselines: snapshotUsageBaselines(usageDeltaState),
     lastModel: model,
+    lastServiceTier: serviceTier,
     modelAttributionState: snapshotCodexModelAttributionState(modelAttributionState),
     eventsAggregated,
     projectFileContexts,
@@ -2333,6 +2363,7 @@ async function scanRolloutProjectFileContexts({
   lastTotal,
   tokenUsageBaselines,
   lastModel,
+  lastServiceTier,
   modelAttributionState,
   projectState,
   projectMetaCache,
@@ -2351,6 +2382,7 @@ async function scanRolloutProjectFileContexts({
       lastTotal,
       tokenUsageBaselines,
       lastModel,
+      lastServiceTier: lastServiceTier || null,
       modelAttributionState,
       eventsAggregated: 0,
       projectFileContexts,
@@ -2428,6 +2460,7 @@ async function scanRolloutProjectFileContexts({
     lastTotal,
     tokenUsageBaselines,
     lastModel,
+    lastServiceTier: lastServiceTier || null,
     modelAttributionState,
     eventsAggregated: 0,
     projectFileContexts,
@@ -3003,6 +3036,7 @@ async function enqueueTouchedBuckets({ queuePath, hourlyState, touchedBuckets })
             billable_total_tokens: totals.billable_total_tokens ?? totals.total_tokens,
             total_cost_usd: totals.total_cost_usd || 0,
             usage_precision: usagePrecision || undefined,
+            ...prioritySubsetOf(totals),
             conversation_count: totals.conversation_count,
           }),
         );
@@ -3083,6 +3117,7 @@ async function enqueueTouchedBuckets({ queuePath, hourlyState, touchedBuckets })
         billable_total_tokens: unknownBucket.totals.billable_total_tokens ?? unknownBucket.totals.total_tokens,
         total_cost_usd: unknownBucket.totals.total_cost_usd || 0,
         usage_precision: usagePrecision || undefined,
+        ...prioritySubsetOf(unknownBucket.totals),
         conversation_count: unknownBucket.totals.conversation_count,
       }),
     );
@@ -3131,6 +3166,7 @@ async function enqueueTouchedBuckets({ queuePath, hourlyState, touchedBuckets })
           total_tokens: group.totals.total_tokens,
           billable_total_tokens: group.totals.billable_total_tokens ?? group.totals.total_tokens,
           total_cost_usd: group.totals.total_cost_usd || 0,
+          ...prioritySubsetOf(group.totals),
           conversation_count: group.totals.conversation_count,
         }),
       );
@@ -3716,7 +3752,43 @@ function initTotals() {
   };
 }
 
+// Observed-subset markers, same shape as the session sidecar's
+// long_context_* columns: "how much of the columns above came from requests on
+// the priority (Astra Fast) service tier". They annotate the existing columns
+// and are NEVER part of any sum — total_tokens stays
+// input + output + cache_creation + cache_read + reasoning_output. They are
+// omitted entirely when zero so no other provider's queue rows change.
+const PRIORITY_SUBSET_FIELDS = [
+  ["priority_input_tokens", "input_tokens"],
+  ["priority_cached_input_tokens", "cached_input_tokens"],
+  ["priority_cache_creation_input_tokens", "cache_creation_input_tokens"],
+  ["priority_output_tokens", "output_tokens"],
+  ["priority_reasoning_output_tokens", "reasoning_output_tokens"],
+];
+
+// The whole delta belongs to a priority request, so every base column it
+// carries is priority usage.
+function addPriorityUsage(target, delta) {
+  for (const [field, base] of PRIORITY_SUBSET_FIELDS) {
+    const value = Number(delta?.[base] || 0);
+    if (value > 0) target[field] = (Number(target[field]) || 0) + value;
+  }
+}
+
+function prioritySubsetOf(totals) {
+  const subset = {};
+  for (const [field] of PRIORITY_SUBSET_FIELDS) {
+    const value = Number(totals?.[field]) || 0;
+    if (value > 0) subset[field] = value;
+  }
+  return subset;
+}
+
 function addTotals(target, delta) {
+  for (const [field] of PRIORITY_SUBSET_FIELDS) {
+    const value = Number(delta?.[field]) || 0;
+    if (value > 0) target[field] = (Number(target[field]) || 0) + value;
+  }
   target.input_tokens += delta.input_tokens || 0;
   target.cached_input_tokens += delta.cached_input_tokens || 0;
   target.cache_creation_input_tokens += delta.cache_creation_input_tokens || 0;
@@ -3731,6 +3803,11 @@ function addTotals(target, delta) {
 }
 
 function subtractTotals(target, totals) {
+  for (const [field] of PRIORITY_SUBSET_FIELDS) {
+    const current = Number(target[field]) || 0;
+    if (current <= 0) continue;
+    target[field] = Math.max(0, current - (Number(totals?.[field]) || 0));
+  }
   target.input_tokens = Math.max(0, target.input_tokens - (totals.input_tokens || 0));
   target.cached_input_tokens = Math.max(
     0,
@@ -3764,7 +3841,7 @@ function subtractTotals(target, totals) {
 }
 
 function totalsKey(totals) {
-  return [
+  const base = [
     totals.input_tokens || 0,
     totals.cached_input_tokens || 0,
     totals.cache_creation_input_tokens || 0,
@@ -3775,6 +3852,10 @@ function totalsKey(totals) {
     totals.total_cost_usd || 0,
     totals.conversation_count || 0,
   ].join("|");
+  // Appended only when a priority subset exists, so buckets that never see the
+  // tier keep their previously persisted queuedKey and are not re-enqueued.
+  const priority = PRIORITY_SUBSET_FIELDS.map(([field]) => Number(totals[field]) || 0);
+  return priority.some((value) => value > 0) ? `${base}|p:${priority.join(",")}` : base;
 }
 
 function toUtcHalfHourStart(ts) {

package/src/lib/session-analytics.js

@@ -131,9 +131,20 @@ const MODEL_USAGE_SUM_FIELDS = [
   "long_context_cache_creation_input_tokens",
   "long_context_output_tokens",
   "long_context_reasoning_output_tokens",
+  "priority_input_tokens",
+  "priority_cached_input_tokens",
+  "priority_cache_creation_input_tokens",
+  "priority_output_tokens",
+  "priority_reasoning_output_tokens",
+  "priority_long_context_input_tokens",
+  "priority_long_context_cached_input_tokens",
+  "priority_long_context_cache_creation_input_tokens",
+  "priority_long_context_output_tokens",
+  "priority_long_context_reasoning_output_tokens",
   "usage_events",
   "rerouted_usage_events",
   "long_context_usage_events",
+  "priority_usage_events",
   // Not a token counter: an edit turn is a turn, and turn_context both marks
   // where a turn begins and names its model, so an edit turn has exactly one
   // owner. Splitting it here keeps by_model.tokens_per_edit a ratio over one

package/src/lib/skills-manager.js

@@ -909,7 +909,12 @@ function listInstalledSkills() {
   });
 }
 
-async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
+async function installSkill(
+  skillInput,
+  targetIds = ["claude", "codex"],
+  prefetchedTree = null,
+  { expectExistingId = null } = {},
+) {
   const skill = {
     key: String(skillInput?.key || ""),
     name: String(skillInput?.name || ""),
@@ -939,7 +944,9 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
     );
   }
 
-  const { branch, tree } = await getRepoTree({
+  // Bulk update hands in the repo tree it already fetched, so N skills from one
+  // repo cost one GitHub call instead of N.
+  const { branch, tree } = prefetchedTree || await getRepoTree({
     owner: skill.repoOwner,
     name: skill.repoName,
     branch: skill.repoBranch,
@@ -950,9 +957,10 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
   if (!files.some((entry) => /(^|\/)SKILL\.md$/i.test(entry.path))) throw new Error("SKILL.md not found in selected directory");
 
   const dest = managedSkillPath(installName);
-  const temp = path.join(dataDir(), "tmp", `${installName}-${Date.now()}`);
-  removePath(temp);
-  ensureDir(temp);
+  let selectedTargets = targetIds.filter((id) => TARGETS[id]);
+  const tempRoot = path.join(dataDir(), "tmp");
+  ensureDir(tempRoot);
+  const temp = fs.mkdtempSync(path.join(tempRoot, `${installName}-`));
   try {
     for (const entry of files) {
       const relative = entry.path === sourceDir ? path.basename(entry.path) : entry.path.slice(sourceDir.length + 1);
@@ -962,6 +970,17 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
       ensureDir(path.dirname(out));
       fs.writeFileSync(out, await fetchText(githubRawUrl(skill.repoOwner, skill.repoName, branch, entry.path)));
     }
+    // An update must not recreate a skill that was uninstalled while we were
+    // downloading, nor overwrite whatever took its install directory in the
+    // meantime. Checked here because everything from this point to
+    // saveRegistry() is synchronous — no await can interleave a change we would
+    // then clobber.
+    if (expectExistingId) {
+      const current = readRegistry().skills.find((entry) => !entry.trashedAt && entry.id === expectExistingId);
+      if (!current) throw new Error("Skill is no longer installed");
+      // Another page or API caller may have changed target intent during a download.
+      selectedTargets = (current.targets || []).filter((id) => TARGETS[id]);
+    }
     removePath(dest);
     ensureDir(path.dirname(dest));
     fs.renameSync(temp, dest);
@@ -973,7 +992,6 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
   const skillMarker = findSkillMarker(dest);
   const skillMd = skillMarker ? fs.readFileSync(skillMarker, "utf8") : "";
   const metadata = readSkillMetadata(skillMd, skill.name || installName);
-  const selectedTargets = targetIds.filter((id) => TARGETS[id]);
   const installed = {
     id: `${skill.repoOwner}/${skill.repoName}:${sourceDir}`,
     key: `${skill.repoOwner}/${skill.repoName}:${sourceDir}`,
@@ -992,9 +1010,13 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
     targets: selectedTargets,
   };
 
-  registry.skills = registry.skills.filter((entry) => entry.id !== installed.id && entry.directory.toLowerCase() !== installName.toLowerCase());
-  registry.skills.push(installed);
-  saveRegistry(registry);
+  // Re-read: the downloads above can take minutes and the registry is shared
+  // with every other mutation path, so the copy fetched before them is stale by
+  // now. Reading here keeps the read/modify/write window down to this block.
+  const latest = readRegistry();
+  latest.skills = latest.skills.filter((entry) => entry.id !== installed.id && entry.directory.toLowerCase() !== installName.toLowerCase());
+  latest.skills.push(installed);
+  saveRegistry(latest);
 
   for (const id of selectedTargets) syncSkillToTarget(installName, id);
   appendActivity({ action: "install", name: installed.name, directory: installName, targets: selectedTargets, source: `${skill.repoOwner}/${skill.repoName}` });
@@ -1244,20 +1266,89 @@ function updateCachePath() {
   return path.join(dataDir(), "updates-cache.json");
 }
 
+// checkUpdates() and updateSkills() have to agree on three things: which skills
+// are candidates, how a cached verdict is keyed, and which tree a skill's
+// signature comes from. They share these so the badge and the update can never
+// disagree about the same skill.
+function managedUpdateCandidates(registry) {
+  return registry.skills.filter(
+    (skill) => !skill.trashedAt && skill.repoOwner && skill.repoName && skill.sourceSignature,
+  );
+}
+
+function updateFingerprint(managed) {
+  return managed
+    .map((skill) => `${skill.id}@${skill.sourceSignature}`)
+    .sort()
+    .join("|");
+}
+
+// Write the verdicts a round derived, carrying forward the previous map for
+// anything it could not derive — a repo whose tree failed, everything past a
+// rate-limited stop. "We could not check" must not render as "nothing is
+// stale": that clears every badge and with it the way to retry. Returns the
+// merged map. Entries for skills that are no longer installed are dropped.
+//
+// `full` says the round attempted the whole library, which only checkUpdates()
+// does. An update attempts the ids it was handed, so it may only publish an
+// entry when the carried map fills in the rest — see the guard below.
+function writeUpdateCache(verdicts, { full = false } = {}) {
+  const managed = managedUpdateCandidates(readRegistry());
+  const live = new Set(managed.map((skill) => skill.id));
+  const cached = readJson(updateCachePath(), null);
+  const carriedFresh = Boolean(
+    cached &&
+      cached.updates &&
+      typeof cached.updates === "object" &&
+      Number.isFinite(cached.checkedAt) &&
+      Date.now() - cached.checkedAt < UPDATE_CACHE_TTL_MS,
+  );
+  const updates = {};
+  if (carriedFresh) {
+    for (const [id, stale] of Object.entries(cached.updates)) if (live.has(id)) updates[id] = Boolean(stale);
+  }
+  for (const [id, stale] of Object.entries(verdicts)) if (live.has(id)) updates[id] = Boolean(stale);
+
+  // The entry is read back as a verdict for the entire library, and a missing
+  // key reads as "not stale". A partial round that stamped the library
+  // fingerprint would therefore publish silence about skills nobody looked at,
+  // and the next check would hit it. Leave the cache alone instead and let that
+  // check do the work.
+  if (!full && !managed.every((skill) => Object.prototype.hasOwnProperty.call(updates, skill.id))) {
+    return updates;
+  }
+
+  writeJson(updateCachePath(), {
+    fingerprint: updateFingerprint(managed),
+    // A prime inherits the window of the check it built on: it re-derived some
+    // ids, not the library, so it must not restart the hour for the rest.
+    checkedAt: full || !carriedFresh ? Date.now() : cached.checkedAt,
+    updates,
+  });
+  return updates;
+}
+
+function groupSkillsByRepo(skills) {
+  const byRepo = new Map();
+  for (const skill of skills) {
+    const branch = skill.repoBranch || "main";
+    const key = `${skill.repoOwner}/${skill.repoName}@${branch}`.toLowerCase();
+    if (!byRepo.has(key)) {
+      byRepo.set(key, { owner: skill.repoOwner, name: skill.repoName, branch, skills: [] });
+    }
+    byRepo.get(key).skills.push(skill);
+  }
+  return Array.from(byRepo.values());
+}
+
 // Compare each managed GitHub/skills.sh skill's stored source signature against a
 // freshly fetched repo tree. One tree call per repo (skills from the same repo
 // share it), concurrency-limited and cached for an hour so a background check
 // can't trip GitHub's unauthenticated rate limit. Returns { updates: {id:bool} }.
 // Read-only: never mutates the registry or the on-disk skills.
 async function checkUpdates({ force = false } = {}) {
-  const registry = readRegistry();
-  const managed = registry.skills.filter(
-    (skill) => !skill.trashedAt && skill.repoOwner && skill.repoName && skill.sourceSignature,
-  );
-  const fingerprint = managed
-    .map((skill) => `${skill.id}@${skill.sourceSignature}`)
-    .sort()
-    .join("|");
+  const managed = managedUpdateCandidates(readRegistry());
+  const fingerprint = updateFingerprint(managed);
 
   if (!force) {
     const cached = readJson(updateCachePath(), null);
@@ -1273,18 +1364,8 @@ async function checkUpdates({ force = false } = {}) {
     }
   }
 
-  const byRepo = new Map();
-  for (const skill of managed) {
-    const branch = skill.repoBranch || "main";
-    const key = `${skill.repoOwner}/${skill.repoName}@${branch}`.toLowerCase();
-    if (!byRepo.has(key)) {
-      byRepo.set(key, { owner: skill.repoOwner, name: skill.repoName, branch, skills: [] });
-    }
-    byRepo.get(key).skills.push(skill);
-  }
-
   const updates = {};
-  await mapWithConcurrency(Array.from(byRepo.values()), UPDATE_CHECK_CONCURRENCY, async (repo) => {
+  await mapWithConcurrency(groupSkillsByRepo(managed), UPDATE_CHECK_CONCURRENCY, async (repo) => {
     let tree;
     try {
       ({ tree } = await getRepoTree(repo));
@@ -1299,8 +1380,122 @@ async function checkUpdates({ force = false } = {}) {
   });
 
   const checkedAt = Date.now();
-  writeJson(updateCachePath(), { fingerprint, checkedAt, updates });
-  return { updates, checkedAt, cached: false };
+  return { updates: writeUpdateCache(updates, { full: true }), checkedAt, cached: false };
+}
+
+// Re-install managed skills from upstream, grouped by repo like checkUpdates()
+// so N skills from one repo cost one tree call. Sequential by necessity:
+// installSkill() read/modify/writes the registry, so parallel installs would
+// drop each other's entries. Every requested id gets a result row — including
+// ones that are no longer installed — so updated + skipped + failed always
+// reconciles with what the caller asked for.
+async function updateSkills(ids = []) {
+  // An empty or malformed list means "nothing was asked for", never "every
+  // managed skill" — the permissive reading turned one bad request field into a
+  // full re-install of the library.
+  const wanted = new Set(
+    (Array.isArray(ids) ? ids : []).map((id) => String(id || "")).filter(Boolean),
+  );
+  if (!wanted.size) return { results: [], updated: 0, skipped: 0, failed: 0, rateLimited: null };
+  const managed = readRegistry().skills.filter(
+    (skill) => !skill.trashedAt && skill.repoOwner && skill.repoName && wanted.has(skill.id),
+  );
+
+  const results = [];
+  const verdicts = {};
+  let rateLimited = null;
+
+  const known = new Set(managed.map((skill) => skill.id));
+  for (const id of wanted) {
+    if (!known.has(id)) results.push({ id, name: null, ok: false, error: "Skill is no longer installed" });
+  }
+
+  for (const repo of groupSkillsByRepo(managed)) {
+    let branch;
+    let tree;
+    try {
+      ({ branch, tree } = await getRepoTree(repo));
+    } catch (error) {
+      if (error instanceof RateLimitError) {
+        rateLimited = error;
+        break;
+      }
+      for (const skill of repo.skills) {
+        results.push({ id: skill.id, name: skill.name, ok: false, error: error?.message || "Unable to read repository" });
+      }
+      continue;
+    }
+
+    for (const skill of repo.skills) {
+      const sourceDir = skill.sourceDirectory || skill.directory;
+      const fresh = sourceSignatureFromTree(tree, sourceDir);
+      if (skill.sourceSignature && fresh === skill.sourceSignature) {
+        results.push({ id: skill.id, name: skill.name, ok: true, skipped: true });
+        verdicts[skill.id] = false;
+        continue;
+      }
+      // This loop runs for as long as the downloads take, and the registry is
+      // shared with every other mutation path — re-check rather than write back
+      // a skill that was uninstalled while we were working.
+      if (!readRegistry().skills.some((entry) => !entry.trashedAt && entry.id === skill.id)) {
+        results.push({ id: skill.id, name: skill.name, ok: false, error: "Skill is no longer installed" });
+        continue;
+      }
+      try {
+        await installSkill(
+          {
+            key: skill.key,
+            name: skill.name,
+            description: skill.description,
+            // installSkill() wants the repo path, not the flat install name.
+            directory: sourceDir,
+            readmeUrl: skill.readmeUrl,
+            repoOwner: skill.repoOwner,
+            repoName: skill.repoName,
+            repoBranch: branch,
+          },
+          skill.targets || [],
+          { branch, tree },
+          { expectExistingId: skill.id },
+        );
+        results.push({ id: skill.id, name: skill.name, ok: true, skipped: false });
+        if (fresh) verdicts[skill.id] = false;
+      } catch (error) {
+        if (error instanceof RateLimitError) {
+          rateLimited = error;
+          break;
+        }
+        results.push({ id: skill.id, name: skill.name, ok: false, error: error?.message || "Update failed" });
+        if (fresh) verdicts[skill.id] = true;
+      }
+    }
+    if (rateLimited) break;
+  }
+
+  // A rate-limited stop breaks out of both loops, leaving the skill it happened
+  // on and everything after it unreported. Backfill so every requested id comes
+  // back with a row and the counts still reconcile with what was asked for.
+  if (rateLimited) {
+    const reported = new Set(results.map((row) => row.id));
+    const nameById = new Map(managed.map((skill) => [skill.id, skill.name]));
+    for (const id of wanted) {
+      if (reported.has(id)) continue;
+      results.push({ id, name: nameById.get(id) || null, ok: false, error: rateLimited.message });
+    }
+  }
+
+  // Prime the cache from the trees this run already holds, so the refresh that
+  // follows is a cache hit rather than a second tree call per repo. Skipped when
+  // the run derived nothing — there is no fresh verdict to record.
+  if (Object.keys(verdicts).length) writeUpdateCache(verdicts);
+
+  return {
+    results,
+    updated: results.filter((entry) => entry.ok && !entry.skipped).length,
+    skipped: results.filter((entry) => entry.skipped).length,
+    failed: results.filter((entry) => !entry.ok).length,
+    rateLimited: rateLimited ? rateLimited.message : null,
+  };
 }
 
 // skills.sh exposes only /api/search (no leaderboard endpoint), so "Popular" is
@@ -1385,4 +1580,5 @@ module.exports = {
   sourceSignatureFromTree,
   targetList,
   uninstallSkill,
+  updateSkills,
 };

package/dashboard/dist/assets/DialogDescription-BMyOicfz.js

@@ -1 +0,0 @@
-import{r as n,v as a}from"./__vite-browser-external-BDkeh90N.js";import{u as p}from"./DialogTitle-DL5nvD31.js";import{u as c}from"./composite-BIgEqWZD.js";const x=n.forwardRef(function(e,r){const{render:l,className:u,style:m,id:s,...t}=e,i=p(),o=c(s);return i.useSyncedValueWithCleanup("descriptionElementId",o),a("p",e,{ref:r,props:[{id:o},t]})});export{x as D};