feat(sync): reconcile variation attachments

[ctawiah]

Context

This layer connects tool and skill attachments to the prompt sync lifecycle. A synchronized variation can now reference local tool and skill files, compare them with LaunchDarkly, and update both sides without treating version numbers as content changes.

What changes

• Stores tools as JSON files and skills as Markdown files with frontmatter.
• Compiles referenced attachment files into the variation that owns them.
• Fetches the latest tool and skill versions when bootstrapping or planning a sync.
• Fingerprints canonical attachment content while keeping runtime version pins out of the fingerprint.
• Creates or versions an attachment before updating the variation to use the returned version.
• Records tools and skills in the manifest so later syncs have a stable baseline.
• Groups conflicts for attachments shared by more than one variation.
• Writes local attachment and variation changes as one transaction so a partial failure does not leave the workspace inconsistent.
• Includes attachment files in bootstrap and detach behavior.

A synchronized workspace now uses this layout:

.launchdarkly/<project>/
  configs/<config>/<variation>.prompt.md
  tools/<tool-key>.json
  skills/<skill-key>.md

Review focus

• Are attachment fingerprints stable across local and server round trips?
• Is the update order safe when an attachment must be created or versioned before a variation can reference it?
• Are exact server version pins refreshed without becoming part of the canonical content fingerprint?
• Do shared attachment conflicts produce one consistent decision for every variation that references them?
• Are local writes and rollbacks safe when several files are updated together?

Verification

• go test ./internal/sync/...
• go test ./cmd/sync
• go test ./...
• git diff --check

Related changes

Review the stack in this order:

1. Confirm destructive watch actions
2. Guarantee prompt fingerprint convergence
3. Add searchable attachment API foundations
4. Reconcile variation attachments
5. Attach tools and skills to variations
6. Render attachment-aware review output
7. Safely clean unreferenced attachments
8. Persist sync manifests in LaunchDarkly

---

Note

Overview
Adds tool and skill attachments to prompt sync so variations can reference shared tools/*.json and skills/*.md files under .launchdarkly/<project>/, compile them into the variation payload, and round-trip tools / skills on create/update variation API calls.

Local workspace & bootstrap: Bootstrap hydrates attachment content and version pins from the API before writing files; creation writes variation wrappers and dependency files together, records tool/skill baselines in the manifest, and rolls back only newly created paths if manifest persistence fails. Compile/load resolves attachment refs from disk (with symlink rejection on managed paths).

Fingerprints & manifest: Variation fingerprints include canonical attachment content while ignoring runtime version pins; separate attachment fingerprints track shared tools/skills once. Detach and post-sync pruning drop manifest entries for attachments no longer referenced by any remaining variation.

Sync planning & execution: Plans hydrate server attachments, diff tools/skills separately, detect stale version pins, and group conflicts when multiple variations share a changed dependency. Execution versions or creates tools (with optional local upsert) before patching variations, blocks the whole plan while any conflict remains unresolved, and refreshes server pins when pulling LaunchDarkly locally.

^{Reviewed by Cursor Bugbot for commit 0cde3fe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0cde3fe. Configure here.}

[cursor]

Add fingerprints skipped attachment files

Medium Severity

finishSelection fingerprints a new variation from hydrated server attachment content, then createResourceFile leaves any existing tool or skill file untouched. The stored baseline can describe content that is not on disk, so the wrapper looks dirty on the next sync.

Additional Locations (1)

• internal/sync/bootstrap/bootstrap.go#L242-L261

 

^{Reviewed by Cursor Bugbot for commit 0cde3fe. Configure here.}