fix(cli): disable unmanaged skill synchronization

package-lock.json

@@ -24,7 +24,7 @@
         "cross-spawn": "7.0.6",
         "diff": "9.0.0",
         "ignore": "7.0.6",
-        "incur": "0.4.13",
+        "incur": "0.6.1",
         "isomorphic-git": "1.38.7",
         "jsonc-parser": "3.3.1",
         "pino": "10.4.0",
@@ -2054,9 +2054,9 @@
       }
     },
     "node_modules/@toon-format/toon": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@toon-format/toon/-/toon-2.3.0.tgz",
-      "integrity": "sha512-/Ew9etdRQKVMnm9fDaCG0JjyAOK/O7T0M97oum1aW4W+UR8ZhVVPBanIV7oWgHBiGlnVxV9M55PWQCHofDV07w==",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/@toon-format/toon/-/toon-2.3.1.tgz",
+      "integrity": "sha512-sWqEMeAJGMda9qRrfPKrX3C4c33CO9SJuvJzzrcBEn5sbDB+k6pSLkDsfN0rVnLQwR97MV3sDgVbcxQNsq8xVw==",
       "license": "MIT"
     },
     "node_modules/@turbo/darwin-64": {
@@ -3581,27 +3581,39 @@
       }
     },
     "node_modules/incur": {
-      "version": "0.4.13",
-      "resolved": "https://registry.npmjs.org/incur/-/incur-0.4.13.tgz",
-      "integrity": "sha512-BeKlYFLIsRCgC8IxsUd3S2/4kPeZaNf1Rbz+Kz41jQII4jOgr7j5w4KYe00aAEQa3V0Ur57BVxE5JDTx8L2s5Q==",
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/incur/-/incur-0.6.1.tgz",
+      "integrity": "sha512-QgaPKsKH+/3SLdUTSkCYwMWzL56vO3wn7iheEwKE0jOtWSa9Irzn8KeyhkRIkTzHW0ReiQwo0EtT8bBGR9PpMw==",
       "license": "MIT",
       "dependencies": {
         "@cfworker/json-schema": "^4.1.1",
-        "@modelcontextprotocol/server": "^2.0.0-alpha.2",
+        "@modelcontextprotocol/server": "2.0.0-alpha.4",
         "@scalar/openapi-types": "^0.8.0",
-        "@toon-format/toon": "^2.1.0",
+        "@toon-format/toon": "^2.3.1",
         "tokenx": "^1.3.0",
         "yaml": "^2.8.2",
         "zod": "^4.3.6"
       },
       "bin": {
-        "incur": "dist/bin.js",
-        "incur.src": "src/bin.ts"
+        "incur": "dist/cli/index.js",
+        "incur.src": "src/cli/index.ts"
       },
       "engines": {
         "node": ">=22"
       }
     },
+    "node_modules/incur/node_modules/@modelcontextprotocol/server": {
+      "version": "2.0.0-alpha.4",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/server/-/server-2.0.0-alpha.4.tgz",
+      "integrity": "sha512-/KEo3ZJ50HlagHp0lz2vPgfBZFtXHu6zTBXT9XqPc+4O9i4+IbBVWKq/a9yAfv/ifp0u3+mRo8SUk5kMKzhN8A==",
+      "license": "MIT",
+      "dependencies": {
+        "zod": "^4.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
     "node_modules/inherits": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",

package.json

@@ -179,7 +179,7 @@
     "cross-spawn": "7.0.6",
     "diff": "9.0.0",
     "ignore": "7.0.6",
-    "incur": "0.4.13",
+    "incur": "0.6.1",
     "isomorphic-git": "1.38.7",
     "jsonc-parser": "3.3.1",
     "pino": "10.4.0",

src/cli.ts

@@ -1,5 +1,4 @@
 import { Cli } from "incur";
-import { fileURLToPath } from "node:url";
 
 import { createLogger, parseLogLevel } from "./logger.js";
 import { PRODUCT_IDENTITY } from "./identity.js";
@@ -40,15 +39,7 @@ export const createCli = (
       instructions:
         "Ask what software, artifact, protocol, or behavior the user wants to understand, then choose the available investigation capabilities that can produce evidence.",
     },
-    sync: {
-      cwd: fileURLToPath(new URL("..", import.meta.url)),
-      include: ["skills/*"],
-      suggestions: [
-        "understand how a software feature works",
-        "investigate an artifact or observed behavior",
-        "check my REA setup",
-      ],
-    },
+    sync: false,
   });
 
   registerSetupCommands(cli, logger);

tests/boundary/cli/skillSync.test.ts

@@ -0,0 +1,30 @@
+import { readdir } from "node:fs/promises";
+
+import { describe, expect } from "vitest";
+
+import { workspaceCliTest } from "../../support/cli/workspaceCliFixture.js";
+
+const CLI_INTEGRATION_TIMEOUT_MS = 60_000;
+
+describe("CLI skill lifecycle boundary", () => {
+  workspaceCliTest(
+    "does not expose the unmanaged Incur skill generator",
+    async ({ cli, workspace }) => {
+      const help = await cli.run({
+        arguments: ["--help"],
+        environment: workspace.environment,
+      });
+      expect(help).toMatchObject({ exitCode: 0 });
+      expect(help.stdout).not.toMatch(/^\s+skills\b/mu);
+
+      const result = await cli.run({
+        arguments: ["skills", "add"],
+        environment: workspace.environment,
+      });
+      expect(result.exitCode).toBe(1);
+      expect(result.stdout).toContain("COMMAND_NOT_FOUND");
+      await expect(readdir(workspace.home)).resolves.toEqual([]);
+    },
+    CLI_INTEGRATION_TIMEOUT_MS,
+  );
+});