Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/lp/skills/shelve/cli-commands.md`:
- Line 141: The example JSON in cli-commands.md is inconsistent: it shows
"action": "pull" but uses a contradictory "pushed": true field; update the
example so the output reflects a pull operation (e.g., remove or replace
"pushed" with a neutral field like "direction": "pull" or use a pull-specific
flag) — locate the JSON example containing "action": "pull" and "pushed" and
change "pushed": true to a neutral or pull-accurate value (for example
"direction": "pull" or "pushed": false) so the example is semantically
consistent.

In `@apps/shelve/app/pages/`[teamSlug]/projects/[projectId]/index/settings.vue:
- Around line 16-28: The computed protectedEnvironmentsText currently normalizes
the value on every input (get + dead set) causing commas to disappear
mid-typing; replace it with a plain ref (e.g., protectedEnvironmentsTextInput)
that you initialize from
project.value?.syncPolicy?.protectedEnvironments.join(', ') and update directly
on input so the raw string (including trailing comma/whitespace) remains
displayed; remove the empty set on the computed; then call the existing parsing
logic (reuse onProtectedEnvironmentsInput or move its parsing code) from an
onBlur handler to parse the ref into names and set
project.value.syncPolicy.protectedEnvironments (names.length ? names :
undefined); keep onProtectedEnvironmentsInput as the parsing/updating routine or
rename it and call it from blur, and ensure UInput binds to the new ref instead
of the computed.

In `@apps/shelve/server/api/teams/`[slug]/projects/[projectId]/index.put.ts:
- Around line 4-8: syncPolicySchema currently permits arbitrary nested values
(uses z.unknown()) which doesn't match the canonical types; replace it by
importing/using the shared Zod validators for ShelveSyncConfig and SyncPolicy
(or define a strict SyncPolicy schema) and use those instead of z.record(...
z.unknown()); ensure you reject unknown keys (use .strict()) and validate typed
fields like allowPush?: boolean, allowPull?: boolean, etc., then wire that
schema into the project update handler in place of syncPolicySchema so default
and environments are validated against the real SyncPolicy shape and
protectedEnvironments remains an array of non-empty strings.

In `@apps/shelve/server/utils/sync-policy.ts`:
- Around line 30-39: Replace the serial getEnvironmentName calls with a single
batched query: use an inArray-based fetch (import inArray) to load all
environments for the given teamId in one query (e.g. a new
helper/getEnvironmentsByIds or inline query that filters id
inArray(environmentIds) and teamId) then iterate the returned rows and call
assertPushAllowedForEnvironment(name, syncPolicy) for each environment; ensure
missing IDs are handled consistently with previous behavior and that inArray is
imported where used.

In `@packages/cli/schema.json`:
- Around line 64-71: The syncPolicy JSON schema properties (sourceOfTruth,
onPushConflict, pullMode, allowPush, allowPull, requireConfirmation) lack
description fields; update the schema to add a descriptive "description" for
each property explaining its purpose and valid values (e.g., sourceOfTruth:
explain "remote" vs "local"; onPushConflict: list options and behavior;
pullMode: describe "replace" vs "merge"; allowPush/allowPull: booleans control
push/pull capabilities; requireConfirmation: when user confirmation is required)
so IDEs can surface helpful tooltips and autocomplete guidance.

In `@packages/cli/src/commands/diff.ts`:
- Line 98: The final conditional is redundant because isJson() already causes an
early return earlier; remove the unnecessary if (!isJson()) check and call
cliSuccess(undefined, 'Diff complete') directly (or eliminate the call only if
that code path is unreachable by design) — update the code around the Diff
completion to use cliSuccess unconditionally instead of wrapping it in isJson()
check; reference functions: isJson() and cliSuccess.
- Around line 88-95: The lookup mismatch occurs because localMap and remoteMap
are created with uppercased keys but diff.changed contains original-cased keys
when autoUppercase is false; update the lookup so it uses the same casing rule
as map construction: either build maps using the original key casing from
syncContext.local/remote (remove toUpperCase when creating localMap/remoteMap)
or, if maps must be uppercased, change the lookup in the loop to use
key.toUpperCase() (i.e., for (const key of diff.changed) { lines.push(`  ${key}:
${localMap.get(key.toUpperCase()) ?? '?'} → ${remoteMap.get(key.toUpperCase())
?? '?'}`) }); make the change in the block that constructs localMap/remoteMap
and in the loop that references diff.changed so both use identical casing logic.

In `@packages/cli/src/commands/push.ts`:
- Around line 89-90: The code mutates the result object returned from
pushEnvFile by adding skippedKeys and conflictKeys; instead modify pushEnvFile
to include skippedKeys and conflictKeys on its returned value (or have it return
a new structured object) and update the call site that currently assigns result
to use the new shape, or alternatively construct a new output object (e.g., {
...result, skippedKeys, conflictKeys }) instead of mutating result; locate
pushEnvFile and the variables result, skippedKeys, and conflictKeys to implement
the change and update any consumers accordingly.

In `@packages/cli/src/commands/sync.ts`:
- Around line 89-96: Extract the duplicated non-interactive confirmation check
into a shared helper (e.g., assertConfirmationAllowed or
ensureInteractiveOrConfirmed) and replace the inline block in sync.ts (the if
using confirmChanges, policy.requireConfirmation, skipConfirm,
isNonInteractive() that throws CliError) with a call to that helper; implement
the helper to accept the same flags/values (confirmChanges,
policy.requireConfirmation, skipConfirm) and throw the identical CliError with
the same message/code/suggestion when non-interactive confirmation is required,
then reuse that helper from push.ts and sync.ts to remove duplication and ensure
consistent behavior.

In `@packages/cli/src/services/sync.ts`:
- Around line 68-70: The current early return in the function in sync.ts hides
overwrite details by returning conflictKeys: [] when policy.onPushConflict ===
'overwrite'; change the logic so that you only return conflictKeys: [] when
conflictKeys.length === 0, but if conflicts exist and policy.onPushConflict ===
'overwrite' return the actual conflictKeys (alongside variables and skippedKeys)
so callers can detect which keys were overwritten; update the return at the
branch referencing variables, skippedKeys and conflictKeys accordingly.
- Around line 38-56: loadSyncContext currently takes five positional parameters
(project, environmentId, environmentName, slug, autoUppercase) which exceeds the
max-params lint rule; change its signature to accept a single options object
(e.g. { project, environmentId, environmentName, slug, autoUppercase }) and
update internal references to use options.project etc., keeping return type
SyncContext intact and still calling resolvePolicy(options.environmentName,
options.project, config.sync). Then update every call site that invokes
loadSyncContext in diff.ts, push.ts, pull.ts, and sync.ts to pass an object with
those named properties instead of positional arguments so the behavior remains
identical.
- Around line 130-138: confirmIfRequired currently discards the result of await
askBoolean(message) so a Ctrl+C cancel (the `@clack/prompts` cancel symbol) can
slip through; change confirmIfRequired to capture the response (const response =
await askBoolean(message)) and then if response is the cancel symbol (use
isCancel(response)) or response === false, call cliCancel() or throw to abort
the sync; update references to askBoolean, confirmIfRequired, isCancel, and
cliCancel accordingly so cancellation always stops the flow.

In `@packages/cli/test/sync-policy.test.ts`:
- Around line 10-32: Add tests to cover pullMode: 'merge' and allowPull blocking
in the resolveSyncPolicy suite: create one test calling
resolveSyncPolicy('development', { default: { pullMode: 'merge' } }) and assert
policy.pullMode === 'merge', and another test calling
resolveSyncPolicy('development', { default: { allowPull: false } }) and assert
policy.allowPull === false; place these alongside the existing tests in the
describe('resolveSyncPolicy') block so behavior for default overrides and
blocking is fully covered.

---

Outside diff comments:
In `@apps/lp/content/docs/3.cli/11.troubleshooting.md`:
- Line 123: Change the heading/text "Install the published skills:" to the
singular form "Install the published skill:" to match the new single-skill
model; locate the phrase in the document (appearing as the installation
instruction for the unified catalog) and update the wording accordingly so the
catalog entry uses singular "skill" instead of plural "skills."

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@packages/cli/src/services/sync.ts`:
- Around line 135-143: confirmIfRequired currently discards askBoolean(message)
result so a Ctrl+C cancel can slip through; update confirmIfRequired to await
and capture the result (e.g. const result = await askBoolean(message)), then
detect cancellation using the cancel symbol helper from `@clack/prompts` (or
compare against the cancel constant) and throw/reject (or call process.exit(1))
to abort when cancelled; otherwise continue only when the boolean result
indicates confirmation. Reference the confirmIfRequired function and the
askBoolean call when making this change.