Fix multi-file packages dropping supporting files on format conversion

[khaliqgant]

User description

Problem

Installing a multi-file package to a converted format drops every file except the main entry point. For example:

prpm install @agent-relay/creating-cloud-persona --as claude,codex

• claude (native, no conversion) → full tree: SKILL.md + references/ + agents/ + workforce/ …
• codex (converted) → only .agents/skills/<name>/SKILL.md

Root cause

In packages/cli/src/commands/install.ts, the --as conversion path converted only the main file and then replaced the entire extracted file list with that single file:

extractedFiles = [{ name: extractedFiles[0].name, content: convertedContent }];

All supporting files were discarded before the file-writing loop ran. The native install never converts, which is why only the converted target was affected.

Fix

• Convert only the main entry point; keep all other files verbatim. The package stays multi-file and flows through the existing multi-file install loop, which writes the full tree to the target's location (.agents/skills/<name>/ for codex, with subdirectories preserved).
• Single-file packages are unchanged.
• Guard the Cursor .mdc rename against progressive-disclosure skills so converted skills installed to .openskills/ keep their SKILL.md name and supporting files, matching the single-file install path.

Supporting files are copied as-is rather than symlinked: codex's SKILL.md is regenerated by the converter (frontmatter normalized, body rebuilt), so a directory symlink to the claude copy would point codex at the un-converted file. The support files are identical either way.

Tests

• New regression test: converting a multi-file claude skill --as codex now writes all files to .agents/skills/<name>/ with subdirectories preserved.
• Updated the existing cursor progressive-disclosure test to assert supporting files are preserved (it previously asserted the old drop-files behavior).
• All 12 multi-file install tests pass; tsc --noEmit is clean. The 2 failing tests in publish.test.ts are pre-existing on main and unrelated.

🤖 Generated with Claude Code

---

CodeAnt-AI Description

Keep supporting files when converting multi-file installs

What Changed

• Installing a multi-file package with --as now keeps all supporting files instead of dropping everything except the main file.
• The converted main file is still written in the target format, while files like helpers/ and references/ stay in place under the same package folder.
• Cursor installs from Claude skills now keep the main file name and supporting files when using progressive disclosure, instead of renaming or discarding them.
• Added regression coverage for both Codex conversion and Cursor installs to confirm all files are preserved.

Impact

✅ Preserved skill bundles during format conversion
✅ Fewer missing-file installs for Codex skills
✅ Clearer Cursor skill installs with supporting files intact

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[my-senior-dev-pr-review]

🤖 My Senior Dev — Analysis Complete

👤 For @khaliqgant

📁 Expert in packages/ (233 edits) • ⚡ 1st PR this month

View your contributor analytics →

---

📊 2 files reviewed • 1 high risk • 6 need attention

🚨 High Risk:

• packages/cli/src/commands/install.ts — Critical edge case not handled for empty file scenarios, which could lead to application crashes or unexpected behavior.
• packages/cli/src/commands/install.ts — Potential unvalidated file names could expose the application to path traversal vulnerabilities during file handling.

⚠️ Needs Attention:

• packages/cli/src/commands/install.ts — Important logic and performance issues that could lead to unintended behavior and inefficiencies in file processing.

---

🚀 Open Interactive Review →

The full interface unlocks features not available in GitHub:

• 💬 AI Chat — Ask questions on any file, get context-aware answers
• 🔍 Smart Hovers — See symbol definitions and usage without leaving the diff
• 📚 Code Archeology — Understand how files evolved over time (/archeology)
• 🎯 Learning Insights — See how this PR compares to similar changes

---

💬 Chat here: @my-senior-dev explain this change — or try @chaos-monkey @security-auditor @optimizer @skeptic @junior-dev

📖 View all 12 personas & slash commands

You can interact with me by mentioning @my-senior-dev in any comment:

In PR comments or on any line of code:

• Ask questions about the code or PR
• Request explanations of specific changes
• Get suggestions for improvements

Slash commands:

• /help — Show all available commands
• /archeology — See the history and evolution of changed files
• /profile — Performance analysis and suggestions
• /expertise — Find who knows this code best
• /personas — List all available AI personas

AI Personas (mention to get their perspective):

Persona	Focus
@chaos-monkey 🐵	Edge cases & failure scenarios
@skeptic 🤨	Challenge assumptions
@optimizer ⚡	Performance & efficiency
@security-auditor 🔒	Security vulnerabilities
@accessibility-advocate ♿	Inclusive design
@junior-dev 🌱	Simple explanations
@tech-debt-collector 💳	Code quality & shortcuts
@ux-champion 🎨	User experience
@devops-engineer 🚀	Deployment & scaling
@documentation-nazi 📚	Documentation gaps
@legacy-whisperer 🏛️	Working with existing code
@test-driven-purist ✅	Testing & TDD

For the best experience, view this PR on myseniordev.com — includes AI chat, file annotations, and interactive reviews.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[codeant-ai]

Suggestion: The added !needsProgressiveDisclosureMulti guard makes isCursorConversion false for multi-file skill installs that go through progressive disclosure (.openskills/), which skips the Cursor-specific processing block entirely. As a result, converted Cursor installs no longer get Cursor post-processing (like header/config application) in the multi-file path, creating behavior drift from the single-file path and potentially producing improperly configured installed content. Keep progressive-disclosure filename behavior, but still run the Cursor post-processing on the converted main file. [logic error]

Severity Level: Major ⚠️

- ❌ Multi-file Claude→Cursor skills ignore user cursor config overrides.
- ⚠️ Progressive `.openskills` installs behave differently from single-file installs.

Steps of Reproduction ✅

1. Configure a Cursor MDC override in user config as defined in
`packages/cli/src/core/user-config.ts:11-17,54-59` (e.g., set `cursor: { alwaysApply:
true, globs: ["src/**/*.ts"] }` in `~/.prpmrc` so `config.cursor` is non-empty when
`handleInstall` runs).

2. Create a multi-file Claude skill tarball using the `createTarGz` helper from
`packages/cli/src/__tests__/install-multifile.test.ts:56-104`, with at least `SKILL.md`
and one supporting file (e.g., `helpers/utils.md`), and a mocked registry package `{
format: 'claude', subtype: 'skill' }` as in the multi-file test at lines 175-187.

3. In a Vitest test similar to
`packages/cli/src/__tests__/install-format-conversion.test.ts:68-118`, mock `getConfig` to
return the config from step 1, mock `getPackage`/`downloadPackage` to return the
multi-file tarball from step 2, and call `handleInstall('complex-skill', { as: 'cursor'
})` so execution enters the conversion block at
`packages/cli/src/commands/install.ts:701-232` and produces `convertedContent` via
`toCursor(canonicalPkg)` (see `packages/converters/src/to-cursor.ts:28-51` which always
emits an MDC header).

4. Because the tarball is multi-file, `handleInstall` enters the multi-file branch at
`packages/cli/src/commands/install.ts:1400-1599`, computes
`needsProgressiveDisclosureMulti` as `true` for `effectiveFormat === 'cursor'` and
`effectiveSubtype === 'skill'` using `FORMAT_NATIVE_SUBTYPES.cursor` from
`packages/types/src/package.ts:12-26`, then evaluates `const isCursorConversion =
(effectiveFormat === 'cursor' && pkg.format === 'claude' && pkg.subtype === 'skill') &&
!needsProgressiveDisclosureMulti;` at line 1502, making `isCursorConversion` `false`.

5. In the multi-file write loop at `packages/cli/src/commands/install.ts:1540-1659`, the
Cursor post-processing block guarded by `if (isCursorConversion)` (around line 1575) is
skipped entirely, so the converted SKILL content is written without running
`addMDCHeader`/`applyCursorConfig(fileContent, config.cursor)` for this multi-file
progressive install, while the single-file path still applies Cursor post-processing
unconditionally for cursor installs via the `if (format === 'cursor' && effectiveFormat
=== 'cursor')` block at lines 1351-1359.

6. Inspect the arguments passed to the mocked `saveFile` (as done in the existing tests)
and observe that `.openskills/complex-skill/SKILL.md` contains the default MDC header
generated by `toCursor` (including `alwaysApply` from
`packages/converters/src/to-cursor.ts:110-129`) but does not reflect user-specified
overrides from `config.cursor` (e.g., custom `globs` or `alwaysApply` values),
demonstrating that multi-file progressive Claude→Cursor installs no longer receive the
Cursor config post-processing that single-file installs do.

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖

This is a comment left during a code review.

**Path:** packages/cli/src/commands/install.ts
**Line:** 1502:1502
**Comment:**
	*Logic Error: The added `!needsProgressiveDisclosureMulti` guard makes `isCursorConversion` false for multi-file skill installs that go through progressive disclosure (`.openskills/`), which skips the Cursor-specific processing block entirely. As a result, converted Cursor installs no longer get Cursor post-processing (like header/config application) in the multi-file path, creating behavior drift from the single-file path and potentially producing improperly configured installed content. Keep progressive-disclosure filename behavior, but still run the Cursor post-processing on the converted main file.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎