Teach but-skill what a GUI needs

[schacon]

Four capabilities the desktop settings screen needs and the CLI never had. Stacked on #15189.

The theme for review

Every operation here touches the user's filesystem. Three of them delete things. The guards are the interesting part of this PR, so they are called out individually below.

1. Framework table covering all supported agents

AgentTarget (8 agents, has detection markers) and SKILL_FORMATS (21 agents, has install paths) were different taxonomies. The settings tab needs to list and detect all of them.

Adds a framework table keyed by skill-format name, holding the stable id, display text, detection markers, and instruction paths. Kept separate from SKILL_FORMATS because four frameworks have two formats each (repo-local and global) while markers and instruction files are per-framework — putting markers on SkillFormat would duplicate them across those pairs. AgentTarget now delegates to this table, so the wizard and the app cannot disagree.

Markers are written out explicitly, never derived from install paths. Deriving is tempting and wrong: Copilot's local skill path is .github/skills/gitbutler, so a derived repo marker would be .github — present in essentially every repository on GitHub. A regression test pins that, and another pins that a shared AGENTS.md never identifies a specific agent.

The 13 newly covered agents have no global instruction file I was confident writing to, so their policy is surfaced for manual copying rather than guessed at.

2. CLI install-state and uninstall

cli_install_state() is pure inspection — deliberately not repairing a stale link the way startup does, so a status query cannot silently rewrite the filesystem and make "not installed" unreproducible.

uninstall_cli() only removes a symlink it can identify as ours:

• a regular file is refused — a package manager's real but looks exactly like that, and deleting it would be unrecoverable
• a symlink pointing at another binary is refused and reported
• a dangling but link is ours (that is the stale state auto-repair exists to fix)

The link path resolves through link_path(), which honours E2E_TEST_APP_DATA_DIR, and the removal decision is split into a path-explicit core so it is testable against temp dirs. The load-bearing test asserts the target binary still exists after the link is removed — getting that backwards would delete the user's CLI, or with builtin-but, the running app.

3. Round-trippable workflow policy

cleanup.rs said it outright: "The wizard's answers are not persisted, so the full block cannot be re-rendered for existing installs." There was a renderer and no parser, so an installed policy could be written but never read back — and a settings UI has to show what is currently installed.

Adds section_title() as the single source for each option's heading, makes rendering use it, and parses those headings back. Matching headings rather than embedding a machine-readable payload is what makes this work on blocks users already have; a payload would only help installs made from this version onward.

Rendering is not injective, so WizardAnswers::normalized() models the loss: the branch-pattern and commit-convention sections render from their value being set rather than from the checkbox, and a publish phrase is only written when its option is on. Without normalizing, a settings UI would show a checkbox that silently un-checks itself after saving.

A property test covers all 1024 option combinations. That is what makes heading-matching safe: reword a heading without updating section_title and it fails immediately. Unknown headings are ignored, so a block written by a newer version still parses as far as this version understands it.

4. Removal primitives

remove_skill_files refuses anything whose SKILL.md does not identify it as ours, reusing the same check discovery uses — so uninstall and discovery agree by construction. It deletes only the four files this crate writes and removes the directory non-recursively, never remove_dir_all. If the user kept notes alongside the skill, the directory survives and the leftovers are reported so the UI can say so. The agent's own skills/ directory is never touched.

remove_managed_block splices the block out of an instruction file and nothing else. It inherits the existing marker protections — a marker quoted in prose or inside a fenced code block is left alone, a malformed pair errors rather than guessing at a span to delete. It never deletes the file, even when the block was all it contained: these are usually git-tracked files the user owns.

Verification

cargo test -p but-skill — 175 pass, including the 1024-case property test and the uninstall safety tests. cargo clippy --workspace clean. CLI integration tests still pass unmodified.

[Copilot]

Pull request overview

Adds the missing “GUI needs” capabilities to but-skill so the desktop settings UI can inspect, render, and safely remove agent setup artifacts (skills, managed blocks, and the CLI link) without relying on CLI-only behaviors.

Changes:

• Introduces a unified Framework table (markers + instruction paths) and routes AgentTarget detection/instruction resolution through it.
• Makes managed workflow policy blocks round-trippable by single-sourcing section headings and adding a parser + normalization.
• Adds uninstall/removal primitives for installed skills, managed policy blocks, and the but CLI symlink (plus UI-friendly inspection state).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/but-skill/src/framework.rs	Adds the shared framework table (stable id, display name, markers, instruction paths) and detection helpers.
crates/but-skill/src/target.rs	Delegates AgentTarget detection/instruction paths to the framework table to prevent wizard/UI drift.
crates/but-skill/src/policy.rs	Single-sources section titles, adds parser + normalization, and property/tests for round-trip stability.
crates/but-skill/src/files.rs	Adds managed-block read/remove primitives (conservative marker handling, never deletes files).
crates/but-skill/src/install.rs	Adds remove_skill_files() and RemovalOutcome for safe skill uninstall and UI reporting.
crates/but-skill/src/cli_link.rs	Adds read-only CLI install-state inspection and safe uninstall logic around the but symlink.
crates/but-skill/src/lib.rs	Exposes the new framework module.
crates/but-error/src/lib.rs	Adds CliUninstallCancelled error code for macOS privilege prompt dismissal.

Suppressed comments (1)

crates/but-skill/src/cli_link.rs:170

• Dangling-link detection uses Path::new(&actual).exists(), but actual comes from read_link() and may be relative. Interpreting a relative target against the current working directory can cause a non-dangling link to be treated as dangling (or vice versa). Resolve relative targets against the symlink’s parent directory before checking exists().

            let dangling_but = !std::path::Path::new(&actual).exists()
                && link.file_name().is_some_and(|name| {
                    name == std::ffi::OsStr::new("but") || name == std::ffi::OsStr::new("but.exe")
                });
            if !dangling_but {