@aitne/daemon 0.1.7 → 0.1.9

package/dist/core/skills-compiler.js

@@ -1,211 +1,38 @@
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { dirname, join, relative } from "node:path";
-import { APP_NAME, BACKEND_IDS, INTEGRATION_DESCRIPTORS, INTEGRATION_KEYS, applyIntegrationModeFilter, collectSessionDeniedTools, filterDeniedToolsForBackend, selectSkillVariantFile, selectTaskFlowVariantSuffix, substituteBrandTokens, } from "@aitne/shared";
-import { getProfileForEvent, getProfileForProcess, getSkillsForEvent, getSkillsForProcess } from "./skills-manifest.js";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { APP_NAME, INTEGRATION_KEYS, applyIntegrationModeFilter, selectSkillVariantFile, substituteBrandTokens, } from "@aitne/shared";
+import { composeSkillSet, getProfileForEvent, getProfileForProcess, resolveSkillManifest, resolveSkillManifestForProcess, } from "./skills-manifest.js";
 import { applyCharacterBlockRewrite, buildCharacterBlock } from "./character-block.js";
-import { applyOutputLanguagePointerRewrite, renderOutputLanguagePolicyPointer, } from "./output-language-policy.js";
+import { applyOutputLanguagePointerRewrite } from "./output-language-policy.js";
 import { createLogger } from "../logging.js";
+import { loadFetchWindowSystemPrompt } from "./fetch-window-prompt-loader.js";
 import { substituteIntegrationRoutingTables } from "./management-md.js";
 import { loadCurationDeclaration, } from "./skill-curation/declarations.js";
-import { listBuiltinSlugs, resolveBuiltinSkillDir, } from "./skill-source-paths.js";
+import { resolveBuiltinSkillDir } from "./skill-source-paths.js";
 import { OverlayStore } from "./skill-curation/overlay-store.js";
 import { hasCurationAnchors, spliceCurationAnchors, } from "./skill-curation/splicer.js";
-// Exported so tests can spy on `logger.warn` (e.g. the missing-reference
-// branch of `renderReferenceIncludes`). Production callers do not import it.
-export const logger = createLogger("skills-compiler");
-/**
- * Check whether the skill AND task-flow variants a given integration would
- * require when delegated to `delegatedBackend` are all present on disk.
- * Returns missing file paths split by kind.
- *
- * DELEGATED-MODE-V2-DESIGN.md §4.1.1 — variant filenames are keyed on
- * **session backend**, not the delegated backend. Three resolutions:
- *  - sessionBackend === delegatedBackend → `null` (no skill body, native MCP)
- *  - sessionBackend !== delegatedBackend → `SKILL.delegated.<sessionBackend>.md`
- *    (cross-backend; the daemon proxy spawns delegatedBackend)
- *  - non-delegated touch → `SKILL.md` (no delegated variant required)
- *
- * Task flow variants always fire as `delegated.<sessionBackend>` whenever
- * any touched integration is delegated, regardless of same- vs cross-backend
- * (`selectTaskFlowVariantSuffix`).
- *
- * The gate enumerates every potential session backend (`BACKEND_IDS`) and
- * defers to the resolvers; that keeps the gate automatically aligned with
- * `selectSkillVariantFile` / `selectTaskFlowVariantSuffix` if those grow new
- * cases. We pin the integration's mode locally as `delegated` with the
- * supplied `delegatedBackend` so the resolvers see the post-PATCH state.
- *
- * Consumed by:
- *  - `SkillsCompiler.validateDelegatedVariants()` — startup aggregate
- *  - `PATCH /api/integrations/:key` — pre-commit hard reject (§4.7)
- *  - `buildIntegrationHealthMap` — surfaces the list in
- *    `/health.integrationModes.<key>.variantsMissing`
- */
-/**
- * Walk a materialized session subdirectory and rewrite every `.md` file with
- * `{APP_NAME}` tokens resolved. Called immediately after `cpSync(src, dest, …)`
- * so the verbatim copy from `agent-assets/` becomes brand-substituted before
- * any downstream transform (renderReferenceIncludes, applyIntegrationModeFilter,
- * tool-deny filter) reads it. Idempotent — running it twice is a no-op.
- */
-function substituteBrandTokensInDir(dir) {
-    if (!existsSync(dir))
-        return;
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-        const full = join(dir, entry.name);
-        if (entry.isDirectory()) {
-            substituteBrandTokensInDir(full);
-        }
-        else if (entry.isFile() && entry.name.endsWith(".md")) {
-            const original = readFileSync(full, "utf-8");
-            const substituted = substituteBrandTokens(original);
-            if (substituted !== original) {
-                writeFileSync(full, substituted, "utf-8");
-            }
-        }
-    }
-}
-let wikiWorkspaceTokenResolver = null;
-export function setWikiWorkspaceTokenResolver(resolver) {
-    wikiWorkspaceTokenResolver = resolver;
-}
-function wikiTokensFor(processKey, workspaceName) {
-    if (!processKey?.startsWith("wiki."))
-        return null;
-    return wikiWorkspaceTokenResolver?.(processKey, workspaceName) ?? null;
-}
-function substituteWikiWorkspaceTokens(content, processKey, workspaceName) {
-    const tokens = wikiTokensFor(processKey, workspaceName);
-    if (!tokens)
-        return content;
-    return content
-        .replaceAll("{{vault_path}}", tokens.vault_path)
-        .replaceAll("{{language}}", tokens.language)
-        .replaceAll("{{workspace_name}}", tokens.workspace_name)
-        .replaceAll("{{schema_version}}", tokens.schema_version);
-}
-function substituteWikiWorkspaceTokensInDir(dir, processKey, workspaceName) {
-    if (!existsSync(dir))
-        return;
-    for (const entry of readdirSync(dir, { withFileTypes: true })) {
-        const full = join(dir, entry.name);
-        if (entry.isDirectory()) {
-            substituteWikiWorkspaceTokensInDir(full, processKey, workspaceName);
-        }
-        else if (entry.isFile() && entry.name.endsWith(".md")) {
-            const original = readFileSync(full, "utf-8");
-            const substituted = substituteWikiWorkspaceTokens(original, processKey, workspaceName);
-            if (substituted !== original) {
-                writeFileSync(full, substituted, "utf-8");
-            }
-        }
-    }
-}
-export function missingDelegatedVariants(workspaceDir, integrationKey, delegatedBackend) {
-    return missingVariantsForMode(workspaceDir, integrationKey, {
-        mode: "delegated",
-        delegatedBackend,
-    });
-}
-/**
- * INTEGRATION_NATIVE_MODE_DESIGN.md §7.4 / §8.5 — symmetric to
- * {@link missingDelegatedVariants} for the new `native` mode. Used by
- * the PATCH route's pre-commit hard reject and (Phase B2 onwards) by
- * `skills-manifest.test.ts` to assert variant existence on every
- * supported `(integration, native backend)` pair before a release.
- */
-export function missingNativeVariants(workspaceDir, integrationKey, nativeBackend) {
-    return missingVariantsForMode(workspaceDir, integrationKey, {
-        mode: "native",
-        nativeBackend,
-    });
-}
-function missingVariantsForMode(workspaceDir, integrationKey, pinnedState) {
-    const descriptor = INTEGRATION_DESCRIPTORS[integrationKey];
-    const skillsRoot = join(workspaceDir, "agent-assets", "skills");
-    const taskFlowsRoot = join(workspaceDir, "agent-assets", "task-flows");
-    // Synthetic post-PATCH state. The resolvers consume only `mode` and
-    // the backend binding; `lastChangedAt` is required by the type but not
-    // read here.
-    const synthetic = pinnedState.mode === "delegated"
-        ? {
-            mode: "delegated",
-            delegatedBackend: pinnedState.delegatedBackend,
-            deniedTools: [],
-            lastChangedAt: "1970-01-01T00:00:00.000Z",
-        }
-        : {
-            mode: "native",
-            nativeBackend: pinnedState.nativeBackend,
-            deniedTools: [],
-            lastChangedAt: "1970-01-01T00:00:00.000Z",
-        };
-    const integrationsState = {
-        [integrationKey]: synthetic,
-    };
-    // For `native` mode the variant is only required when the session
-    // backend is the bound native backend (other session backends would
-    // resolve to `disabled` per §5.4.1's safety degrade, so they don't need
-    // a SKILL.native.<other>.md file). For `delegated` we keep the original
-    // walk over every session backend since cross-backend variants ARE
-    // required.
-    const sessionBackendsToCheck = pinnedState.mode === "native"
-        ? [pinnedState.nativeBackend]
-        : BACKEND_IDS;
-    // De-dup with sets — the same file path can come up under multiple
-    // session backends when descriptors share a slug.
-    const skills = new Set();
-    for (const slug of descriptor.skillsTouched) {
-        for (const sessionBackend of sessionBackendsToCheck) {
-            const variantFile = selectSkillVariantFile(slug, sessionBackend, integrationsState);
-            // null  → same-backend delegated drops body; no file required.
-            // SKILL.md → resolver fell back to direct/disabled; no variant file.
-            if (variantFile === null || variantFile === "SKILL.md")
-                continue;
-            const variantPath = join(resolveBuiltinSkillDir(skillsRoot, slug), variantFile);
-            if (!existsSync(variantPath))
-                skills.add(variantPath);
-        }
-    }
-    const taskFlows = new Set();
-    for (const flowKey of descriptor.taskFlowsTouched) {
-        for (const sessionBackend of sessionBackendsToCheck) {
-            const suffix = selectTaskFlowVariantSuffix(flowKey, sessionBackend, integrationsState);
-            if (suffix === "direct")
-                continue;
-            const variantPath = join(taskFlowsRoot, `${flowKey}.${suffix}.md`);
-            if (existsSync(variantPath))
-                continue;
-            // INTEGRATION_NATIVE_MODE_DESIGN.md §8.1 — when a task-flow lists a
-            // mode-aware integration in `taskFlowsTouched` but doesn't ship a
-            // per-mode variant file, the loader (`prompts.ts:loadFlowVariant`)
-            // gracefully falls back to the canonical base file. Treat that as
-            // a valid coverage path so the `missingDelegatedVariants` /
-            // `missingNativeVariants` PATCH-time check doesn't reject a flip
-            // for which the loader's base-file fallback is the designed answer.
-            //
-            // Concrete example: `message.received.dm` is listed in gmail /
-            // google_calendar / notion `taskFlowsTouched` so the native DM
-            // variant resolves; the matching delegated variant
-            // (`message.received.dm.delegated.<backend>.md`) is intentionally
-            // absent. The base `message.received.dm.md` carries inline
-            // `<!-- mode:<predicate>:<key> -->` markers for the Calendar block
-            // and routes other integrations through their per-skill bodies. The
-            // loader correctly falls back, so the missing variant is not a real
-            // configuration gap.
-            //
-            // Skill variants remain strict — a missing `SKILL.<mode>.<backend>.md`
-            // leaves the agent with no per-mode body for the integration, which
-            // IS a real gap. The strict check above (no leniency branch) handles
-            // that.
-            const basePath = join(taskFlowsRoot, `${flowKey}.md`);
-            if (!existsSync(basePath)) {
-                taskFlows.add(variantPath);
-            }
-        }
-    }
-    return { skills: [...skills], taskFlows: [...taskFlows] };
-}
+import { isValidSkillSlug, missingDelegatedVariants, } from "./skills-compiler-variants.js";
+import { EMPTY_MAIL_ACCOUNTS_MD, pruneStaleBuiltinSkillDirs, readTreeFiles, renderMailAccountsMd, substituteBrandTokensInDir, substituteWikiWorkspaceTokens, substituteWikiWorkspaceTokensInDir, } from "./skills-compiler-tree.js";
+import { loadSkillIndexPreamble, renderPartialIncludes, renderReferenceIncludes, renderSkillIndexBlock, stripUnconfiguredServices, } from "./skills-compiler-skill-index.js";
+import { applyAllDeniedToolsForSkill, buildSameBackendDenyBlock } from "./skills-compiler-denied-tools.js";
+import { cliInstructionFileName, cliSkillsDirName, prependCodexReadSensitiveBanner, renderCliInstructionFile, renderDaemonApiUsageSection, } from "./skills-compiler-cli-renderer.js";
+// Module logger for the class's own warn callsites (invalid-slug warning
+// in writeSkillsDir, skill-curation declaration / anchor warnings in
+// spliceCurationAnchorsInSkill). Not exported — sibling modules carry
+// their own peer loggers; the test suite spies on those.
+const logger = createLogger("skills-compiler");
+// docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — single shared constant
+// for the pre-pass process key. Typed as `ProcessKey` (not the inferred
+// string literal) so a rename in `@aitne/shared/process-key.ts` lights up
+// here rather than silently dead-branching the slim materializer.
+const FETCH_WINDOW_PROCESS_KEY = "routine.fetch_window";
+// Single skill kept in the slim fetch_window CLI session: the
+// `observations` SKILL.md is the POST contract for
+// `/api/observations/batch` and the fetcher's only structural assertion.
+// The other skills the wide path inlines (`mail`, `notion`,
+// `external-services`, `attach`) are already restated by the integration
+// partial the runner inlines into the user prompt.
+const FETCH_WINDOW_SLIM_SKILL = "observations";
 /**
  * Materializes backend-specific instruction files for session workdirs
  * by reading directly from the source tree (agent-assets/agent-profiles/ and
@@ -259,7 +86,7 @@ export class SkillsCompiler {
     /**
      * P22 — skill-curation overlay context. When set, the materializer runs an
      * extra pass that resolves `<!-- CURATION:<kind> id="<id>" -->` anchors in
-     * each skill's SKILL.md against `<dataDir>/skills/overlays/<slug>/<id>.json`
+     * each skill's SKILL.md against `<dataDir>/skill-curation-overlays/<slug>/<id>.json`
      * (overlay) or `agent-assets/skills/<slug>/seeds/<id>.seed.json` (seed).
      *
      * Optional and default-OFF — daemon code is expected to call
@@ -289,10 +116,10 @@ export class SkillsCompiler {
      * §4.7 "Missing-variant policy": if any paths come back, the caller
      * should refuse to enter delegated mode or at least log a loud warning.
      * The per-integration variant for the hypothetical PATCH path lives in
-     * the standalone `missingDelegatedVariants` helper below; this method
-     * aggregates across every currently-delegated integration using its
-     * declared `delegatedBackend` (not the session backend — see the helper
-     * docstring for the rationale).
+     * `missingDelegatedVariants` in `./skills-compiler-variants.js`; this
+     * method aggregates across every currently-delegated integration using
+     * its declared `delegatedBackend` (not the session backend — see the
+     * helper docstring for the rationale).
      */
     validateDelegatedVariants() {
         const skills = [];
@@ -357,18 +184,36 @@ export class SkillsCompiler {
         const profileName = params.processKey
             ? getProfileForProcess(params.processKey)
             : getProfileForEvent(params.eventType);
+        // `evening-review-slimdown.md` §2.1 — route through the predicate-aware
+        // wrapper so the evening rulebook gate (and any future per-event
+        // predicate) is consulted exactly once per session, at materialization
+        // time. The wrapper passes non-conditional events through verbatim, so
+        // every other process key keeps its old behaviour.
+        const manifestOpts = {
+            ...(params.contextDir ? { contextDir: params.contextDir } : {}),
+            ...(params.db !== undefined ? { db: params.db } : {}),
+            ...(params.messageText !== undefined ? { messageText: params.messageText } : {}),
+        };
+        const hasManifestOpts = Object.keys(manifestOpts).length > 0;
         const manifestSkills = params.processKey
-            ? getSkillsForProcess(params.processKey)
-            : getSkillsForEvent(params.eventType);
+            ? resolveSkillManifestForProcess(params.processKey, hasManifestOpts ? manifestOpts : undefined)
+            : resolveSkillManifest(params.eventType, hasManifestOpts ? manifestOpts : undefined);
         // Custom bang command override: when the dispatcher passes a slug array
         // we use it verbatim, ignoring the manifest. Empty array is allowed and
         // means "no skills." `null` keeps manifest behavior — the override is a
         // partial replacement so a future caller can pass just `profileBody`
         // without affecting skill selection.
-        const skills = params.override?.skillSlugs !== null
+        const baseSkills = params.override?.skillSlugs !== null
             && params.override?.skillSlugs !== undefined
             ? [...params.override.skillSlugs]
             : manifestSkills;
+        // AGENT_DEFINITIONS_DESIGN.md §4.2 — fold the firing Agent's `tools.skills`
+        // onto the resolved bundle (union, or replace when `skillsReplace`). A
+        // no-op when `extraSkills` is empty/absent, so every non-Agent site keeps
+        // its prior set verbatim. Applied AFTER the bang-command override so the
+        // two surfaces never silently fight; in practice they never co-occur (an
+        // Agent firing carries no `override`).
+        const skills = composeSkillSet(baseSkills, params.extraSkills, params.skillsReplace ?? false);
         const profileBodyOverride = params.override?.profileBody ?? null;
         // Always materialize the `mail` skill when the manifest asks for it —
         // even if the current account list is empty. The skill is inert when
@@ -378,13 +223,32 @@ export class SkillsCompiler {
         // adds their first account mid-session (0→N transition). Filtering
         // here would leave the skill dir absent forever since refresh only
         // writes into existing dirs.
+        // docs/design/appendices/opencode-backend.md §6.5 / Phase 4 — opencode discovers
+        // skills via cwd auto-discovery from `.claude/skills/` (V2) AND uses
+        // a per-process agent file at `.opencode/agent/<slug>.md` (V5,
+        // singular `agent/`). Routing through `materializeCliSession` would
+        // inline skill bodies into AGENTS.md, which we explicitly do NOT
+        // want for opencode (skills are auto-discovered by the `skill` tool).
         if (params.backendId === "claude") {
             this.materializeClaudeSession(params.sessionDir, profileName, skills, profileBodyOverride, params.processKey ?? params.eventType, params.wikiWorkspaceName);
         }
+        else if (params.backendId === "opencode") {
+            this.materializeOpencodeSession(params.sessionDir, profileName, skills, profileBodyOverride, params.processKey ?? params.eventType, params.wikiWorkspaceName);
+        }
         else {
             this.materializeCliSession(params.sessionDir, profileName, skills, params.backendId, params.processKey ?? params.eventType, profileBodyOverride, params.wikiWorkspaceName);
         }
-        return { profile: profileName, skills };
+        // docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — the slim
+        // CLI materializer drops every manifest skill except `observations`.
+        // The Claude path is wide for fetch_window today (Phase 1 swaps only
+        // the system prompt, not the workdir layout). Report what was
+        // actually written so log lines / callers see truth, not the
+        // manifest's pre-narrow list.
+        const effectiveSkills = params.backendId !== "claude"
+            && (params.processKey ?? params.eventType) === FETCH_WINDOW_PROCESS_KEY
+            ? [FETCH_WINDOW_SLIM_SKILL]
+            : skills;
+        return { profile: profileName, skills: effectiveSkills };
     }
     /** Read raw profile .md without safety injection. */
     readProfile(profileName) {
@@ -492,8 +356,39 @@ export class SkillsCompiler {
             mkdirSync(dirname(join(sessionDir, "CLAUDE.md")), { recursive: true });
             writeFileSync(join(sessionDir, "CLAUDE.md"), profileContent, "utf-8");
         }
+        this.writeSkillsDir(sessionDir, join(".claude", "skills"), skillSlugs, "claude", processKey, wikiWorkspaceName);
+    }
+    /**
+     * docs/design/appendices/skills-unification.md Phase 1 — per-backend skill-dir writer.
+     *
+     * Writes `<sessionDir>/<destSkillsRootRelative>/<slug>/SKILL.md` for each
+     * slug, applying the full per-skill transformation pipeline:
+     * variant resolution → brand tokens → partial / reference inlining →
+     * service strip → mode filter → deny filter → curation splice → mail
+     * `accounts.md`. The destination directory is the only thing that varies
+     * across backends:
+     *
+     *   - Claude  → `.claude/skills`
+     *   - OpenCode → `.opencode/skills`
+     *   - Codex   → `.codex/skills`
+     *   - Gemini  → `.gemini/skills`
+     *
+     * For Codex sessions, this method ALSO prepends a one-line read-sensitive
+     * banner to each materialised SKILL.md whose body references a read-
+     * sensitive `/api/*` endpoint (those endpoints 401 on Codex because the
+     * Codex backend does not hold the read-sensitive token). The banner
+     * points the agent at the `## Read-sensitive endpoints are UNAVAILABLE`
+     * section already rendered into `AGENTS.md`.
+     *
+     * Returns the list of slugs that ended up on disk (slugs whose variant
+     * resolved to `null` for same-backend native MCP and slugs whose source
+     * SKILL.md was missing are excluded). Callers use this list to render
+     * the `<skill-index>` block from a stable, post-materialisation source.
+     */
+    writeSkillsDir(sessionDir, destSkillsRootRelative, skillSlugs, sessionBackend, processKey, wikiWorkspaceName) {
+        const materialised = [];
         const skillsRoot = this.getSourceSkillsRoot();
-        const destSkillsRoot = join(sessionDir, ".claude", "skills");
+        const destSkillsRoot = join(sessionDir, destSkillsRootRelative);
         mkdirSync(destSkillsRoot, { recursive: true });
         // Re-materialize cleanup: a previous turn (especially one with a wider
         // skill set or a different custom-command override) may have left
@@ -504,11 +399,19 @@ export class SkillsCompiler {
         // `syncAllUserSkills` is the authoritative writer for that subset.
         pruneStaleBuiltinSkillDirs(destSkillsRoot, skillsRoot, skillSlugs);
         for (const skillSlug of skillSlugs) {
+            // docs/design/appendices/opencode-backend.md §10 D6 / Phase 4 — slug must match
+            // opencode's skill-name lint regex `[a-z0-9-]{1,64}` because a
+            // future opencode release may reject names that fall outside it.
+            // Warn at materialisation; do not strip the skill (every Aitne
+            // built-in slug already conforms — see audit acceptance criterion).
+            if (!isValidSkillSlug(skillSlug)) {
+                logger.warn({ skillSlug, expected: "[a-z0-9-]{1,64}" }, "skills_compiler.skill_slug_invalid");
+            }
             const src = resolveBuiltinSkillDir(skillsRoot, skillSlug);
             if (!existsSync(join(src, "SKILL.md"))) {
                 continue;
             }
-            const variantFile = this.resolveSkillVariantFile(skillSlug, "claude");
+            const variantFile = this.resolveSkillVariantFile(skillSlug, sessionBackend);
             const destDir = join(destSkillsRoot, skillSlug);
             // DELEGATED-MODE-V2-DESIGN.md §4.1.2 — same-backend native MCP. The
             // agent already has the connector's tools in its inventory; a skill
@@ -545,10 +448,10 @@ export class SkillsCompiler {
             //
             // Order: refs BEFORE strip-services. The CLI paths
             // (`materializeCliSession` inline + directory copy) both run refs
-            // before strip; aligning Claude here preserves the byte-equivalence
+            // before strip; aligning here preserves the byte-equivalence
             // contract (plan §3.1) for the case where a reference file carries
             // `<!-- service:* -->` markers — strip-first would leak those on
-            // Claude while CLI scrubs them.
+            // Claude/OpenCode while CLI scrubs them.
             const destSkillMdForRefs = join(destDir, "SKILL.md");
             if (existsSync(destSkillMdForRefs)) {
                 const raw = readFileSync(destSkillMdForRefs, "utf-8");
@@ -578,18 +481,20 @@ export class SkillsCompiler {
             const destSkillMdForMode = join(destDir, "SKILL.md");
             if (existsSync(destSkillMdForMode)) {
                 const raw = readFileSync(destSkillMdForMode, "utf-8");
-                const filtered = applyIntegrationModeFilter(raw, this.integrations, "claude");
+                const filtered = applyIntegrationModeFilter(raw, this.integrations, sessionBackend);
                 if (filtered !== raw) {
                     writeFileSync(destSkillMdForMode, filtered, "utf-8");
                 }
             }
             // §7.7 — apply tool-deny policy AFTER partial includes and
-            // service-section stripping. For Claude this rewrites the
-            // `allowed-tools` frontmatter; the SDK enforces hard.
+            // service-section stripping. For the Claude SDK this rewrites the
+            // `allowed-tools` frontmatter (hard); for opencode the rewrite is
+            // a soft-enforcement prose body addition that the runtime config
+            // doubles up via `permission.bash.deny` rules.
             const destSkillMdForDeny = join(destDir, "SKILL.md");
             if (existsSync(destSkillMdForDeny)) {
                 const raw = readFileSync(destSkillMdForDeny, "utf-8");
-                const filtered = applyAllDeniedToolsForSkill(raw, skillSlug, "claude", this.integrations);
+                const filtered = applyAllDeniedToolsForSkill(raw, skillSlug, sessionBackend, this.integrations);
                 if (filtered !== raw) {
                     writeFileSync(destSkillMdForDeny, filtered, "utf-8");
                 }
@@ -608,7 +513,141 @@ export class SkillsCompiler {
                     ? renderMailAccountsMd(this.mailAccounts)
                     : EMPTY_MAIL_ACCOUNTS_MD, "utf-8");
             }
+            // Phase 1 §"Codex read-sensitive banner inheritance" — prepend the
+            // 3-line caveat banner to every Codex skill body that touches a
+            // read-sensitive `/api/*` endpoint. Skipped for the other three
+            // backends: Claude / Gemini hold the read-sensitive token; OpenCode
+            // surfaces those routes via its own credential flow.
+            if (sessionBackend === "codex") {
+                prependCodexReadSensitiveBanner(join(destDir, "SKILL.md"));
+            }
+            materialised.push(skillSlug);
         }
+        return materialised;
+    }
+    /**
+     * docs/design/appendices/opencode-backend.md §6.5 / Phase 4 — opencode-specific
+     * materialisation.
+     *
+     * Three on-disk artefacts are written per session:
+     *   1. `AGENTS.md` (cwd-auto-discovered by opencode per V1) — same
+     *      shape as `materializeCliSession` produces for Codex EXCEPT
+     *      skill bodies are NOT inlined (skills auto-discover from
+     *      `.claude/skills/` via opencode's `skill` tool — V2). Includes
+     *      safety, character, behavioral rules, daemon-API, integration
+     *      routing tables, and the runtime profile body.
+     *   2. `.opencode/agent/<profile-slug>.md` (singular `agent/` per V5)
+     *      — the per-process agent persona with V5-correct frontmatter
+     *      (`mode: primary`, `permission` block keyed only on
+     *      `edit/bash/webfetch/doom_loop/external_directory` — NO `read`
+     *      key per V5 contract). Body is the profile body; opencode
+     *      invokes this via `session.prompt({ body: { agent: <slug> } })`
+     *      so the per-agent permission overrides the server-level
+     *      defaults.
+     *   3. `.opencode/skills/<slug>/` via `writeSkillsDir` — every
+     *      manifest skill becomes a discoverable SKILL.md tree opencode
+     *      reads on `skill` tool activation. `.claude/skills/` is
+     *      intentionally NOT written: docs/design/appendices/skills-unification.md Phase 1
+     *      flipped opencode from V2 path (b) (`.claude/skills/`
+     *      redundancy-avoiding alias) to V2 path (c) (`.opencode/skills/`)
+     *      so each backend lives under its own brand-aligned namespace.
+     *
+     * The dispatcher passes `agent: <slug>` (where `<slug>` matches the
+     * profile filename without `.md`) on every `session.prompt` call so
+     * the right agent file is selected.
+     */
+    materializeOpencodeSession(sessionDir, profileName, skillSlugs, profileBodyOverride, processKey, wikiWorkspaceName) {
+        // ── 1. AGENTS.md — cwd context (no skill inlining) ──
+        let profileContent = profileBodyOverride !== null
+            ? profileBodyOverride.trim()
+            : (this.readProfile(profileName) ?? "");
+        profileContent = substituteWikiWorkspaceTokens(profileContent, processKey, wikiWorkspaceName);
+        const safetyContent = this.readSafetyPreamble();
+        const characterBlock = buildCharacterBlock(this.character);
+        // DELEGATED-MODE-V2-DESIGN.md §4.3.3-§4.3.4 — same-backend deny prose.
+        // Opencode's MCP-tool deny is server-level only (§5.6 v1: drop the
+        // server from config to deny). The prose duplicates intent so the
+        // agent doesn't waste tokens drafting calls that will be dropped.
+        const sameBackendDenyBlock = buildSameBackendDenyBlock(this.integrations, "opencode");
+        const rawInstruction = renderCliInstructionFile({
+            backendId: "opencode",
+            processKey,
+            profileName,
+            profileContent,
+            safetyContent,
+            characterBlock,
+            skillSlugs,
+            // R3 — OpenCode never gets a `<skill-index>` block. The cwd
+            // auto-discovery loader is the source of truth; emitting an index
+            // here would inject a second listing the runtime ignores and the
+            // agent could mistake for canonical. The `## Skills` slug manifest
+            // (no path, no inlined bodies) survives as a turn-scope hint.
+            skillPreamble: null,
+            skillIndexBlock: null,
+            sameBackendDenyBlock,
+        });
+        const instruction = substituteWikiWorkspaceTokens(substituteIntegrationRoutingTables(rawInstruction, this.integrations), processKey, wikiWorkspaceName);
+        writeFileSync(join(sessionDir, "AGENTS.md"), instruction, "utf-8");
+        // ── 2. .opencode/agent/<profileName>.md — V5 frontmatter wrapper ──
+        this.writeOpencodeAgentFile(sessionDir, profileName, profileContent, safetyContent, characterBlock);
+        // ── 3. .opencode/skills/ — auto-discovered by opencode 1.14+ ──
+        // docs/design/appendices/skills-unification.md Phase 1 — opencode 1.14+ auto-discovers
+        // skills from `.opencode/skills/<slug>/SKILL.md` (V2 path (c),
+        // empirically verified). The earlier path (b) (`.claude/skills/`)
+        // worked as a redundancy-avoiding alias; per-backend brand-aligned
+        // naming now picks (c) explicitly.
+        this.writeSkillsDir(sessionDir, join(".opencode", "skills"), skillSlugs, "opencode", processKey, wikiWorkspaceName);
+    }
+    /**
+     * docs/design/appendices/opencode-backend.md §6.5 / V5 — write the per-process agent
+     * profile to `.opencode/agent/<slug>.md` (singular `agent/`; the
+     * plural form does NOT register per V5).
+     *
+     * Frontmatter shape (V5-correct keys only):
+     *   - `mode: primary` — opencode's primary-agent mode; subagent is
+     *     reserved for the disabled `task` tool path.
+     *   - NO `permission` block here — the server-level
+     *     `OpencodeRuntimeConfig.permission` is the per-session truth and
+     *     is stricter for narrow agents (delegated runs use a separate
+     *     `delegated-<callId>` agent file with its own tight permission).
+     *     Emitting `permission: {}` here would NOT widen anything (the
+     *     server-level deny still wins), but the absence keeps the
+     *     frontmatter a manifest and avoids drift between two seats.
+     *   - NO `model` field — opencode falls back to `OPENCODE_CONFIG_CONTENT.model`
+     *     (set per-session by `OpencodeCore`'s runtime-config builder),
+     *     and the dispatcher additionally overrides per `session.prompt`
+     *     body. Pinning here would either drift from the per-call value
+     *     or duplicate it.
+     *
+     * Body composition mirrors AGENTS.md (safety + character + profile)
+     * so an `agent: <slug>` invocation that REPLACES opencode's default
+     * cwd context still gets safety/character rules — V5 confirmed the
+     * agent body becomes the system prompt for that turn.
+     */
+    writeOpencodeAgentFile(sessionDir, profileName, profileBody, safetyContent, characterBlock) {
+        const agentDir = join(sessionDir, ".opencode", "agent");
+        mkdirSync(agentDir, { recursive: true });
+        // Strip a description from the profile body's first paragraph for
+        // the frontmatter `description` field. Opencode displays this in
+        // its agent picker; we use a stable phrasing so re-renders produce
+        // identical bytes.
+        const description = `${APP_NAME} ${profileName} — per-process persona`;
+        const frontmatter = [
+            "---",
+            `description: ${description}`,
+            "mode: primary",
+            "---",
+            "",
+        ].join("\n");
+        const bodySections = [];
+        if (safetyContent)
+            bodySections.push(safetyContent);
+        if (characterBlock)
+            bodySections.push(characterBlock);
+        if (profileBody.trim())
+            bodySections.push(profileBody.trim());
+        const body = bodySections.join("\n\n");
+        writeFileSync(join(agentDir, `${profileName}.md`), `${frontmatter}${body}\n`, "utf-8");
     }
     /**
      * P22 §1.5 — splice CURATION anchors in a single skill's materialized
@@ -648,64 +687,121 @@ export class SkillsCompiler {
             writeFileSync(skillMdPath, result.body, "utf-8");
         }
     }
-    materializeCliSession(sessionDir, profileName, skillSlugs, backendId, processKey, profileBodyOverride, wikiWorkspaceName) {
-        // Skills are inlined in the instruction file (AGENTS.md / GEMINI.md) for
-        // guaranteed availability AND copied to the backend-specific skill
-        // directory for native CLI skill discovery. The directory copy only adds
-        // ~20 tokens per skill at session start (name + description); full body
-        // is lazy-loaded on activation. Belt-and-suspenders: inline ensures task
-        // flow prompts always have API references in context; directories let the
-        // CLI's native skill activation and tooling work.
+    /**
+     * docs/design/appendices/skills-unification.md Phase 1 item 15 — the slim path does NOT
+     * emit a `<skill-index>` block or the skill-discovery preamble. The
+     * fetch_window system prompt is a self-contained operational contract
+     * (one-window-one-curl, no sub-tasks, exactly-one JSON-on-stdout) and
+     * the only skill copied (`observations`) is referenced inline by the
+     * runner-emitted user prompt. Adding the index would mis-signal the
+     * fetcher to scan for skills before executing the acquisition plan.
+     *
+     * docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — slim instruction-file
+     * materializer for `routine.fetch_window` on Codex / Gemini CLI.
+     *
+     * Mirrors the Claude SDK's Phase 1 systemPrompt swap (the same
+     * `agent-assets/system-prompts/routine-fetch-window.md` template is the
+     * single source of truth): write the slim body verbatim as AGENTS.md /
+     * GEMINI.md and copy only the `observations` skill — the
+     * `/api/observations/batch` POST contract is the fetcher's sole
+     * structural assertion. The integration partial inlined by the runner
+     * (`routine-fetch-window-runner.ts:reassemblePrompt`) covers the
+     * per-attempt call shape, so `mail` / `notion` / `external-services` /
+     * `attach` skill bodies are deliberately omitted.
+     *
+     * No safety preamble / character / behavioral-rules / daemon-API
+     * sections — the slim template restates the only rules the fetcher
+     * needs (localhost-only curl, no sub-tasks, no context writes, no
+     * notify, JSON-on-stdout-and-exit). The destructive-action policy layer
+     * (absolute-block list, Codex sandbox, Gemini admin TOML) still applies
+     * unchanged at runtime.
+     *
+     * The `<mcp-servers>` section is appended downstream by
+     * `services/mcp/session-materializer.ts:appendMcpSection` exactly as on
+     * the wide path — Phase 3's allowlist filter, when it lands, will scope
+     * that section without further changes here.
+     */
+    materializeFetchWindowCliSession(sessionDir, backendId) {
+        mkdirSync(sessionDir, { recursive: true });
+        const slim = loadFetchWindowSystemPrompt();
+        writeFileSync(join(sessionDir, cliInstructionFileName(backendId)), slim, "utf-8");
+        // Copy ONLY the `observations` skill dir. The wide path's prune step
+        // is replaced by an explicit single-slug list — `pruneStaleBuiltinSkillDirs`
+        // removes any other built-in skill dir that a prior re-materialization
+        // (e.g. a fallback-driven wide path on the same workdir) may have left.
+        const cliSkillsRoot = cliSkillsDirName(backendId);
+        if (cliSkillsRoot === null)
+            return; // Claude-only — fetch_window slim runs on Claude SDK natively.
         const skillsRoot = this.getSourceSkillsRoot();
-        const skillContents = {};
-        for (const skillSlug of skillSlugs) {
-            const src = resolveBuiltinSkillDir(skillsRoot, skillSlug);
-            const variantFile = this.resolveSkillVariantFile(skillSlug, backendId);
-            // DELEGATED-MODE-V2-DESIGN.md §4.1.2 — same-backend native MCP path:
-            // skip the inline. The connector's own tool descriptions, present in
-            // the CLI's tool inventory at session-init, are the authoritative
-            // surface for the agent.
-            if (variantFile === null)
-                continue;
-            const skillMdPath = join(src, variantFile);
-            if (!existsSync(skillMdPath)) {
-                continue;
-            }
-            let raw = substituteBrandTokens(readFileSync(skillMdPath, "utf-8"));
-            // Resolve {{> base }} partials before inlining. Wrap the result —
-            // SKILL.base.md is read directly from src and would slip past the
-            // single-point-of-change contract if it grew an `{APP_NAME}` token.
-            raw = substituteBrandTokens(renderPartialIncludes(raw, join(src, "SKILL.base.md")));
-            // Resolve `{{> ref:<name> }}` directives by inlining
-            // `references/<name>.md` from the source skill dir. Runs AFTER the
-            // base-partial resolver so a base-partial fragment can itself carry
-            // `{{> ref:* }}` markers (one-level nesting cap; references inside
-            // references are intentionally NOT resolved per §4.7 / NG5). Same
-            // src-bypass concern as above — wrap the result.
-            raw = substituteBrandTokens(renderReferenceIncludes(raw, src));
-            raw = substituteWikiWorkspaceTokens(raw, processKey, wikiWorkspaceName);
-            // Strip unconfigured service sections before inlining
-            if (skillSlug === "external-services" && this.configuredServices.size > 0) {
-                raw = stripUnconfiguredServices(raw, this.configuredServices);
-            }
-            // Mode-conditional sections — see materializeClaudeSession for the
-            // ordering rationale. Same filter, same ordering: service-strip
-            // then mode-filter then deny.
-            raw = applyIntegrationModeFilter(raw, this.integrations, backendId);
-            // §7.7 — apply tool-deny policy. For CLI backends this appends the
-            // soft-enforcement prose block; the inline-into-AGENTS.md path
-            // strips frontmatter below, so the deny block must already be in
-            // body content before that strip.
-            raw = applyAllDeniedToolsForSkill(raw, skillSlug, backendId, this.integrations);
-            // Inline content for instruction file — strip frontmatter (Claude-specific
-            // YAML metadata like allowed-tools has no meaning for CLI backends).
-            skillContents[skillSlug] = stripFrontmatter(raw);
+        const destSkillsRoot = join(sessionDir, cliSkillsRoot, "skills");
+        mkdirSync(destSkillsRoot, { recursive: true });
+        pruneStaleBuiltinSkillDirs(destSkillsRoot, skillsRoot, [FETCH_WINDOW_SLIM_SKILL]);
+        const src = resolveBuiltinSkillDir(skillsRoot, FETCH_WINDOW_SLIM_SKILL);
+        const skillMdPath = join(src, "SKILL.md");
+        if (!existsSync(skillMdPath))
+            return;
+        const destDir = join(destSkillsRoot, FETCH_WINDOW_SLIM_SKILL);
+        cpSync(src, destDir, { recursive: true });
+        substituteBrandTokensInDir(destDir);
+        // No `substituteWikiWorkspaceTokensInDir` — fetch_window never touches
+        // wiki workspace state, and the resolver is a no-op for non-wiki
+        // process keys anyway.
+        let adapted = substituteBrandTokens(readFileSync(skillMdPath, "utf-8"));
+        // observations/SKILL.md ships no `{{> base }}` or `{{> ref:* }}`
+        // directives today, but run the resolvers anyway so a future curation
+        // edit cannot silently drop content. Idempotent on plain content.
+        adapted = substituteBrandTokens(renderPartialIncludes(adapted, join(src, "SKILL.base.md")));
+        adapted = substituteBrandTokens(renderReferenceIncludes(adapted, src));
+        // Mode-conditional filter — observations/SKILL.md carries
+        // `<!-- mode:<predicate>:notion -->` markers (lines 273-345 today)
+        // because the source / consume contract differs across `direct` /
+        // `delegated-same` / `delegated-cross` / `native` / `disabled`. The
+        // wide path applies this filter at `materializeCliSession`; the
+        // slim path must match so the agent doesn't get every mode's prose
+        // for every integration. Idempotent on bodies that lack markers.
+        adapted = applyIntegrationModeFilter(adapted, this.integrations, backendId);
+        // Tool-deny policy stays in force — even though the fetcher is fed a
+        // narrow allowlist, the soft-enforcement prose lands in the body
+        // BEFORE the CLI frontmatter strip so it's not lost.
+        adapted = applyAllDeniedToolsForSkill(adapted, FETCH_WINDOW_SLIM_SKILL, backendId, this.integrations);
+        // docs/design/appendices/skills-unification.md Phase 1 §R6 — frontmatter stays intact
+        // across all backends. `adaptSkillForCli` is gone; the source body's
+        // YAML preamble flows through verbatim.
+        writeFileSync(join(destDir, "SKILL.md"), adapted, "utf-8");
+        this.spliceCurationAnchorsInSkill(destDir, FETCH_WINDOW_SLIM_SKILL);
+    }
+    materializeCliSession(sessionDir, profileName, skillSlugs, backendId, processKey, profileBodyOverride, wikiWorkspaceName) {
+        // docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — divert
+        // `routine.fetch_window` to a slim materializer that mirrors the
+        // Claude SDK's Phase 1 systemPrompt swap. Custom bang commands cannot
+        // reach this branch (they bind to `messaging.custom_command`), so
+        // `profileBodyOverride` is intentionally NOT forwarded.
+        if (processKey === FETCH_WINDOW_PROCESS_KEY) {
+            this.materializeFetchWindowCliSession(sessionDir, backendId);
+            return;
+        }
+        // docs/design/appendices/skills-unification.md Phase 1 — directory-based skill delivery.
+        // The Codex / Gemini CLIs have no native cwd auto-discovery today, so
+        // the instruction file (AGENTS.md / GEMINI.md) carries a compact
+        // `<skill-index>` block and the agent `Read`s each `SKILL.md` from the
+        // per-backend dir on demand. Skill bodies are NEVER inlined into the
+        // instruction file.
+        //
+        // OpenCode reaches `materializeOpencodeSession` instead, so this method
+        // only handles Codex and Gemini. The defensive `null` check below
+        // protects future backends that might temporarily route through here
+        // before getting their own materialiser.
+        const cliSkillsDir = cliSkillsDirName(backendId);
+        if (cliSkillsDir === null) {
+            throw new Error(`materializeCliSession: no skills directory mapped for backend "${backendId}"`);
         }
+        const destSkillsRootRelative = join(cliSkillsDir, "skills");
+        const materialisedSlugs = this.writeSkillsDir(sessionDir, destSkillsRootRelative, skillSlugs, backendId, processKey, wikiWorkspaceName);
         // Read profile and safety separately so renderCliInstructionFile can
         // place safety at the top level for prominence (instead of burying it
         // inside the profile section). For custom bang commands the dispatcher
         // passes a `profileBodyOverride` that replaces the persona body; the
-        // safety + character + skills sections still wrap around it via
+        // safety + character + skill index sections still wrap around it via
         // `renderCliInstructionFile`.
         let profileContent = profileBodyOverride !== null
             ? profileBodyOverride.trim()
@@ -721,6 +817,18 @@ export class SkillsCompiler {
         // prose duplicates intent so the agent doesn't waste tokens drafting
         // calls that will be denied at the policy layer.
         const sameBackendDenyBlock = buildSameBackendDenyBlock(this.integrations, backendId);
+        // docs/design/appendices/skills-unification.md Phase 1 §"Skill preamble" — render the
+        // universal preamble + `<skill-index>` block. The index is derived
+        // from the **materialised** SKILL.md frontmatter on disk so curation /
+        // mode-filter / deny passes are reflected. Reading post-materialisation
+        // also keeps user-authored slugs synced by `syncAllUserSkills` (which
+        // runs LATER from the workdir layer) out of the index — those land in
+        // the same dir but are appended after this render. The
+        // `refreshSkillIndexBlock` helper (called by workdir.ts post-sync) is
+        // responsible for splicing user-authored slugs into the block.
+        const skillPreamble = loadSkillIndexPreamble(this.workspaceDir);
+        const destSkillsRootAbs = join(sessionDir, destSkillsRootRelative);
+        const skillIndexBlock = renderSkillIndexBlock(destSkillsRootAbs, destSkillsRootRelative);
         const rawInstruction = renderCliInstructionFile({
             backendId,
             processKey,
@@ -728,680 +836,17 @@ export class SkillsCompiler {
             profileContent,
             safetyContent,
             characterBlock,
-            skillSlugs,
-            skillContents,
+            skillSlugs: materialisedSlugs,
+            skillPreamble,
+            skillIndexBlock,
             sameBackendDenyBlock,
         });
         // INTEGRATION_NATIVE_MODE_DESIGN.md §7.3 — substitute the
         // `<integration-routing-table>` placeholder in the rendered
         // instruction file. Runs after the whole document is assembled so
-        // placeholders anywhere (profile body, inlined skill bodies,
-        // safety preamble) all resolve in one pass. No-op when neither
-        // placeholder string is present.
+        // placeholders anywhere (profile body, preamble, index) all resolve
+        // in one pass.
         const instruction = substituteWikiWorkspaceTokens(substituteIntegrationRoutingTables(rawInstruction, this.integrations), processKey, wikiWorkspaceName);
-        writeFileSync(join(sessionDir, backendId === "codex" ? "AGENTS.md" : "GEMINI.md"), instruction, "utf-8");
-        // Copy skills to the backend-specific skill directory for native CLI
-        // discovery:  .codex/skills/<slug>/  or  .gemini/skills/<slug>/
-        const cliSkillsDir = cliSkillsDirName(backendId);
-        const destSkillsRoot = join(sessionDir, cliSkillsDir, "skills");
-        mkdirSync(destSkillsRoot, { recursive: true });
-        // See `materializeClaudeSession` — same prune contract for CLI workdirs.
-        pruneStaleBuiltinSkillDirs(destSkillsRoot, skillsRoot, skillSlugs);
-        for (const skillSlug of skillSlugs) {
-            const src = resolveBuiltinSkillDir(skillsRoot, skillSlug);
-            const variantFile = this.resolveSkillVariantFile(skillSlug, backendId);
-            const destDir = join(destSkillsRoot, skillSlug);
-            // §4.1.2 same-backend short-circuit: no SKILL.md / .codex/skills/<slug>
-            // / .gemini/skills/<slug> directory written. The connector ships its
-            // own descriptions; injecting prose only confuses the dispatch.
-            // Remove any prior-materialization leftovers so a mode flip doesn't
-            // leak stale prose into the workdir.
-            if (variantFile === null) {
-                if (existsSync(destDir)) {
-                    rmSync(destDir, { recursive: true, force: true });
-                }
-                continue;
-            }
-            const variantPath = join(src, variantFile);
-            if (!existsSync(variantPath)) {
-                continue;
-            }
-            // Copy the whole skill directory (scripts/, references/, etc.)
-            cpSync(src, destDir, { recursive: true });
-            // Resolve `{APP_NAME}` brand tokens in the verbatim copy before any
-            // downstream transform reads them. Source-of-truth: branding.ts.
-            substituteBrandTokensInDir(destDir);
-            substituteWikiWorkspaceTokensInDir(destDir, processKey, wikiWorkspaceName);
-            // Render variant (resolving partials), adapt frontmatter for CLI, and
-            // write as SKILL.md in the dest dir.
-            let adapted = substituteBrandTokens(readFileSync(variantPath, "utf-8"));
-            // SKILL.base.md and references/*.md are read directly from src by these
-            // inliners; wrap the results so future tokens added to those files still
-            // reach single-point-of-change. Idempotent.
-            adapted = substituteBrandTokens(renderPartialIncludes(adapted, join(src, "SKILL.base.md")));
-            // Resolve `{{> ref:<name> }}` directives — keeps the
-            // `.codex/skills/<slug>/SKILL.md` and `.gemini/skills/<slug>/SKILL.md`
-            // bodies byte-identical to the inline-into-AGENTS.md / GEMINI.md
-            // copy emitted above (modulo CLI frontmatter strip), preserving the
-            // "guaranteed availability" contract that motivated this resolver.
-            adapted = substituteBrandTokens(renderReferenceIncludes(adapted, src));
-            adapted = substituteWikiWorkspaceTokens(adapted, processKey, wikiWorkspaceName);
-            if (skillSlug === "external-services" && this.configuredServices.size > 0) {
-                adapted = stripUnconfiguredServices(adapted, this.configuredServices);
-            }
-            // Mode-conditional filter — keep this dest-dir copy byte-aligned with
-            // the inline copy emitted into AGENTS.md / GEMINI.md (modulo
-            // adaptSkillForCli's frontmatter strip). The filter is idempotent so
-            // running it on both copies independently is safe.
-            adapted = applyIntegrationModeFilter(adapted, this.integrations, backendId);
-            // §7.7 — apply tool-deny policy BEFORE adaptSkillForCli strips
-            // frontmatter so the soft-enforcement prose block lands in body
-            // content (CLI skills carry only `name` + `description` in
-            // frontmatter, no `allowed-tools` to filter).
-            adapted = applyAllDeniedToolsForSkill(adapted, skillSlug, backendId, this.integrations);
-            adapted = adaptSkillForCli(adapted);
-            writeFileSync(join(destDir, "SKILL.md"), adapted, "utf-8");
-            // P22 — splice CURATION anchors against overlay/seed JSON so the
-            // CLI-side .codex/.gemini skill copy stays byte-equivalent to the
-            // Claude-side copy after curation. No-op when no curation context.
-            this.spliceCurationAnchorsInSkill(destDir, skillSlug);
-            if (skillSlug === "mail") {
-                writeFileSync(join(destDir, "accounts.md"), this.mailAccounts.length > 0
-                    ? renderMailAccountsMd(this.mailAccounts)
-                    : EMPTY_MAIL_ACCOUNTS_MD, "utf-8");
-            }
-        }
-    }
-}
-export const EMPTY_MAIL_ACCOUNTS_MD = [
-    "# Mail accounts",
-    "",
-    "No active mail accounts are configured right now. The `mail` skill's API",
-    "calls will fail without an `accountId` — do NOT guess account ids. If no",
-    "account matches, tell the user no active mail account is configured and",
-    "stop — account setup is outside this skill's scope.",
-    "",
-].join("\n");
-export function renderMailAccountsMd(accounts) {
-    const rows = accounts.map((a) => {
-        const label = a.label ? ` (${a.label})` : "";
-        return `| \`${a.id}\` | ${a.kind} | ${a.email}${label} | ${a.idleEnabled ? "IDLE" : "poll"} |`;
-    });
-    return [
-        "# Mail accounts",
-        "",
-        "Active mail accounts this session can use. Resolve `accountId` from this",
-        "table before calling `/api/mail/:accountId/*`. Inactive / unhealthy",
-        "accounts are omitted by design — no global \"primary\" default exists;",
-        "pick the account from conversation context (reply thread, user mention,",
-        "or a single active row) and ask when ambiguous.",
-        "",
-        "| accountId | kind | email | transport |",
-        "|---|---|---|---|",
-        ...rows,
-        "",
-    ].join("\n");
-}
-/**
- * Return the backend-specific skills directory name for a given backend.
- * Returns null for Claude (which uses `.claude/skills/` managed separately).
- */
-export function cliSkillsDirName(backendId) {
-    switch (backendId) {
-        case "codex": return ".codex";
-        case "gemini": return ".gemini";
-        default: return null;
-    }
-}
-/**
- * Session instruction files the live-overwrite path (design §15.6.1 /
- * §15.9) walks when the owner PATCHes `character` mid-session. Each file
- * corresponds to a backend (CLAUDE.md = Claude Code SDK, AGENTS.md =
- * Codex CLI, GEMINI.md = Gemini CLI). A workdir that has already seen a
- * heavy-tier fallback can contain two of these side-by-side — see
- * CLAUDE.md "Fallback re-materialization".
- */
-const CHARACTER_INSTRUCTION_FILES = [
-    "CLAUDE.md",
-    "AGENTS.md",
-    "GEMINI.md",
-];
-/**
- * Rewrite the `## Character (user-defined)` block inside every backend
- * instruction file that currently lives in `workdir`. Used by the
- * `PATCH /api/config` live-overwrite path (§15.6.1) so an owner editing
- * character on the dashboard doesn't have to wait for the next session
- * spawn for the change to land.
- *
- * Multi-backend aware: a workdir that has seen a Claude→Codex fallback
- * contains both CLAUDE.md and AGENTS.md, and both must end up byte-
- * identical in their character block. Each write is atomic (tmp +
- * rename, both on the same filesystem so rename stays cheap) and
- * per-file errors are logged without failing the whole call.
- *
- * Returns a summary of how many files were rewritten. Useful for
- * instrumentation and for the dashboard PATCH handler to log.
- *
- * The helper is an FS wrapper: its pure parse/compose half lives in
- * `character-block.ts` and is covered 100% there. This side is excluded
- * from coverage along with the rest of `skills-compiler.ts`.
- */
-export function rewriteCharacterBlock(workdir, character) {
-    const summary = { rewritten: 0, skipped: 0, failed: 0 };
-    for (const name of CHARACTER_INSTRUCTION_FILES) {
-        const target = join(workdir, name);
-        if (!existsSync(target)) {
-            summary.skipped++;
-            continue;
-        }
-        try {
-            const current = readFileSync(target, "utf-8");
-            const next = applyCharacterBlockRewrite(current, character);
-            if (next === current) {
-                summary.skipped++;
-                continue;
-            }
-            // `.tmp` lives next to the target so the rename stays on one
-            // filesystem (design R1 mitigation).
-            const tmp = `${target}.tmp`;
-            writeFileSync(tmp, next, "utf-8");
-            renameSync(tmp, target);
-            summary.rewritten++;
-        }
-        catch (err) {
-            // Per-file logging so a partial failure (e.g. CLAUDE.md written,
-            // AGENTS.md EACCES) is recoverable post-hoc — the outer PATCH
-            // handler only sees aggregate totals.
-            logger.warn({ err, target }, "rewriteCharacterBlock failed to update instruction file");
-            summary.failed++;
-        }
-    }
-    return summary;
-}
-function renderCliInstructionFile(params) {
-    const toolName = params.backendId === "codex" ? "AGENTS.md" : "GEMINI.md";
-    const parts = [
-        `# ${APP_NAME} ${toolName}`,
-        "",
-        `Process key: \`${params.processKey}\``,
-        `Profile: \`${params.profileName}\``,
-        "",
-    ];
-    // Safety invariants at top level for prominence — CLI backends don't
-    // have a separate project-instruction layer, so burying safety inside
-    // the profile section risks it being overlooked by weaker models.
-    if (params.safetyContent) {
-        parts.push(params.safetyContent, "");
-    }
-    // User-defined character sits immediately after safety so it strictly
-    // outranks every profile / skill / task-flow layer below it, and
-    // strictly below safety (design §15.4.2 / §15.5).
-    if (params.characterBlock) {
-        parts.push(params.characterBlock, "");
-    }
-    // DELEGATED-MODE-V2-DESIGN.md §4.3.4 — same-backend integration deny block.
-    // Sits right after character / safety (above behavioral rules + skills) so
-    // weak models cannot miss it. For Codex this is the only enforcement
-    // surface; for Gemini it duplicates the admin-policy hard-deny.
-    if (params.sameBackendDenyBlock) {
-        parts.push(params.sameBackendDenyBlock, "");
-    }
-    // Output-language pointer paragraph (design `output-language-policy.md`
-    // §13.3). Identical byte-for-byte across CLAUDE.md / AGENTS.md /
-    // GEMINI.md — declarative only, never inlines the current
-    // `primaryLanguage` (that lives in the per-turn XML and would go
-    // stale here on a PATCH /api/config mid-session).
-    parts.push(renderOutputLanguagePolicyPointer(), "");
-    // Behavioral rules that Claude Code receives via system prompt append but
-    // CLI backends don't have a system prompt layer for.
-    parts.push("## Behavioral rules", "", "- WhatsApp outbound messages are prefixed by the daemon. Do not add that prefix yourself unless the user explicitly asks.", "");
-    // Daemon-API usage hoisted ABOVE the skills (was: appended at the end
-    // of the file). Skill bodies inline below carry hundreds of `curl
-    // http://localhost:8321/api/...` examples; for Codex specifically those
-    // examples target endpoints that return 401 because Codex does not
-    // hold the read-sensitive token. Surfacing the constraint up-front
-    // gives the agent the routing rule before it reads the first skill.
-    // For Gemini / Claude the section is informational; the position is
-    // kept consistent so the rendered file shape is uniform.
-    parts.push(renderDaemonApiUsageSection(params.backendId !== "codex"), "");
-    parts.push("## Runtime profile", "", params.profileContent.trim(), "", "## Skills", "");
-    if (params.skillSlugs.length === 0) {
-        parts.push("No process-scoped built-in skills were selected for this turn.");
-    }
-    else {
-        for (const slug of params.skillSlugs) {
-            const content = params.skillContents[slug];
-            if (content) {
-                parts.push(`### ${slug}`, "", content.trim(), "");
-            }
-            else {
-                parts.push(`### ${slug}`, "", `See \`skills/${slug}/SKILL.md\` for details.`, "");
-            }
-        }
-    }
-    parts.push("", "User-authored skills may also exist under `skills/<name>/SKILL.md`.");
-    return parts.join("\n");
-}
-function renderDaemonApiUsageSection(readSensitiveAvailable) {
-    const lines = [
-        "## Daemon API Usage",
-        "",
-        "- Use plain `curl` for daemon API calls. The daemon prepends a session-local wrapper on PATH.",
-        "- Never use absolute curl paths, alternative HTTP clients, connection overrides, or custom auth headers.",
-    ];
-    if (readSensitiveAvailable) {
-        lines.push("- The wrapper auto-attaches session auth for read-sensitive endpoints.");
-    }
-    else {
-        lines.push("", "### Read-sensitive endpoints are UNAVAILABLE on this backend", "", "Codex sessions do not receive the read-sensitive daemon token. The", "wrapper still prepends headers it can supply, but the daemon answers", "personal-data reads with `401 Unauthorized` regardless. Endpoints", "below are affected; the skill bodies in `## Skills` describe them", "as if they were available — treat the section as a contract you", "cannot satisfy on this backend.", "", "- Context vault: `GET /api/context/*`, `GET /api/context/list/*`", "- Mail (multi-provider): `GET /api/mail/*` (read), search, providers", "- Calendar (direct mode): `GET /api/calendar/*`", "- Notion (direct mode): `GET /api/notion/{query,search,pages}`", "- Obsidian: `GET /api/obsidian/*`", "- Observations: `GET /api/observations`", "- Reading list / receipts / travel bookings", "", "If a skill body directs you at one of these reads, stop and tell", "the user the task needs a different backend (Claude or Gemini).", "Do not hammer the endpoint — the 401 is permanent for this", "session, not transient. Writes and autonomous-tier endpoints", "stay reachable; the gate is read-sensitive scope only.");
-    }
-    return lines.join("\n");
-}
-/**
- * Strip service sections from external-services/SKILL.md that correspond to
- * unconfigured integrations. Sections are delimited by HTML comments:
- *   <!-- service:calendar --> ... <!-- /service:calendar -->
- * When `configuredServices` is empty the content is returned unchanged — the
- * "no services configured yet" case keeps every section so the agent can see
- * the full menu. Only strips once the user has configured at least one
- * service (and therefore expressed an intent to narrow the surface).
- */
-export function stripUnconfiguredServices(content, configuredServices) {
-    if (configuredServices.size === 0)
-        return content;
-    const servicePattern = /<!-- service:(\w+) -->\n([\s\S]*?)<!-- \/service:\1 -->\n?/g;
-    return content.replace(servicePattern, (match, service) => configuredServices.has(service) ? match : "");
-}
-/** Strip YAML frontmatter (--- ... ---) from markdown content. */
-function stripFrontmatter(content) {
-    if (!content.startsWith("---"))
-        return content;
-    const endIdx = content.indexOf("\n---", 3);
-    if (endIdx < 0)
-        return content;
-    return content.slice(endIdx + 4).replace(/^\n+/, "");
-}
-/**
- * Adapt a SKILL.md for CLI backends (Codex / Gemini): retain only `name`,
- * `description`, and `when_to_use` frontmatter fields, stripping
- * Claude-specific fields like `allowed-tools`. The body content is
- * preserved unchanged.
- *
- * `when_to_use` is the secondary trigger-shape clarification documented
- * in `SKILLS-PHASE-2-PLAN.md` §3.2 / §5; the Claude Agent SDK reads it
- * verbatim from `q.when_to_use` (verified against
- * `claude-agent-sdk@0.2.98/cli.js`). Preserving it on the CLI side keeps
- * the per-backend skill frontmatter aligned even though Codex / Gemini
- * do not currently consume the field — drift would surface as a missing
- * activation hint when they eventually do.
- *
- * Assumes `name`, `description`, and `when_to_use` are each single-line
- * YAML scalars (no `|` / `>` block forms). A multi-line `when_to_use:`
- * is matched only by its first line — the `.+` regex stops at the
- * newline — but since YAML block scalars start with the line that
- * contains only `|` or `>`, the captured value would be the empty
- * indicator and the inlined value would be useless. Phase 2 v1 keeps
- * this conservative: callers must use single-line scalars (NG5).
- */
-export function adaptSkillForCli(content) {
-    if (!content.startsWith("---"))
-        return content;
-    const endIdx = content.indexOf("\n---", 3);
-    if (endIdx < 0)
-        return content;
-    const frontmatter = content.slice(4, endIdx);
-    const body = content.slice(endIdx + 4);
-    const nameMatch = frontmatter.match(/^name:\s*(.+)$/m);
-    const descMatch = frontmatter.match(/^description:\s*(.+)$/m);
-    const whenMatch = frontmatter.match(/^when_to_use:\s*(.+)$/m);
-    // Reject multi-line block scalars (`when_to_use: |` / `when_to_use: >`):
-    // their first-line capture would just be the indicator. Falling through
-    // to "no when_to_use" matches the documented contract (§3.4.2 #9).
-    const whenIsBlockScalar = whenMatch !== null && /^[|>][-+]?\s*$/.test(whenMatch[1].trim());
-    const parts = ["---"];
-    if (nameMatch)
-        parts.push(`name: ${nameMatch[1].trim()}`);
-    if (descMatch)
-        parts.push(`description: ${descMatch[1].trim()}`);
-    if (whenMatch && !whenIsBlockScalar) {
-        parts.push(`when_to_use: ${whenMatch[1].trim()}`);
-    }
-    parts.push("---");
-    return parts.join("\n") + body;
-}
-/**
- * Resolve `{{> base }}` include directives in a skill/task-flow variant file.
- * Reads `SKILL.base.md` (or `<key>.base.md` for task flows) from `basePath`
- * and replaces every occurrence of `{{> base }}` with the base file's content
- * (frontmatter stripped). A missing or empty base file is silently ignored.
- *
- * Only `{{> base }}` is supported — this is intentionally minimal (§4.7
- * design note: "~40 lines of pure TS").
- *
- * @deprecated DELEGATED-PROXY-API-DESIGN.md §11 — after Phase D no in-tree
- * skill uses `{{> base }}`: mail / external-services unified their bodies
- * during Phase D, and the lone surviving `notion/SKILL.base.md` was
- * removed in Phase 9 (its hourly-check read-only constraint moved to
- * `routine.hourly_check.md` task-flow where the rule applies in every
- * integration mode, including same-backend delegated where the skill
- * body is dropped). The helper is retained for future composition needs;
- * remove the call sites in `materializeClaudeSession` /
- * `materializeCliSession` when no consumer reappears.
- */
-export function renderPartialIncludes(content, basePath) {
-    if (!content.includes("{{> base }}"))
-        return content;
-    if (!existsSync(basePath))
-        return content.replace(/\{\{> base \}\}/g, "");
-    const baseRaw = readFileSync(basePath, "utf-8");
-    const baseContent = stripFrontmatter(baseRaw).trim();
-    return content.replace(/\{\{> base \}\}/g, baseContent);
-}
-/**
- * Resolve `{{> ref:<name> }}` directives in a skill body by inlining
- * `references/<name>.md` (frontmatter stripped) from the skill's source dir.
- *
- * Mirrors `renderPartialIncludes` but is intra-skill, not cross-skill: each
- * skill carries its own `references/` dir. Used by progressive-disclosure
- * skills (planned for `mail`, `roadmap`, `reading`, `user-interview` after
- * Phase 2-B) so heavy reference tables can live next to the skill body
- * without bloating the navigation overview.
- *
- * Behaviour:
- *  - Missing `references/<name>.md` → directive replaced with empty string;
- *    logged at WARN. (Mirrors the deprecated helper's missing-base behaviour.)
- *  - The directive matches `{{> ref:<name> }}` with the strict-kebab name
- *    pattern `[a-z][a-z0-9-]*`. Path-traversal (`../`, leading underscore,
- *    uppercase) is rejected at the regex level — `existsSync` is never
- *    consulted for invalid names.
- *  - Multiple occurrences each inline the same file's content (re-read per
- *    occurrence — pinned by the unit tests so a later caching refactor must
- *    surface as a deliberate change).
- *  - Frontmatter on the reference file (if present) is stripped before
- *    inline, so reference files can carry `---\nkind: reference\n---`
- *    headers for tooling without leaking YAML into skill bodies.
- *  - The resolver is NOT fence-aware; a directive inside a triple-backtick
- *    fence is still expanded. This matches `renderPartialIncludes` and is
- *    deliberate for v1 — fence-aware resolution would be a separate refactor.
- *
- * Phase 2-A ships compiler-only; no in-tree skill carries a directive yet
- * (`skills-manifest.test.ts` pins `0` as the lockstep count). Phase 2-B
- * starts emitting them per the migration map in `SKILLS-PHASE-2-PLAN.md`.
- */
-export function renderReferenceIncludes(content, skillSrcDir) {
-    return content.replace(/\{\{> ref:([a-z][a-z0-9-]*) \}\}/g, (_match, name) => {
-        const refPath = join(skillSrcDir, "references", `${name}.md`);
-        if (!existsSync(refPath)) {
-            logger.warn({ skillSrcDir, name }, "renderReferenceIncludes: missing reference file");
-            return "";
-        }
-        return stripFrontmatter(readFileSync(refPath, "utf-8")).trim();
-    });
-}
-/**
- * §7.7 — apply the per-integration tool-deny policy to a delegated skill
- * body. Two enforcement modes:
- *
- *  - **Claude (hard enforcement):** parse the YAML frontmatter and remove
- *    every `allowed-tools` entry whose unsuffixed name (after the
- *    descriptor's `toolNamespace`) is in `deniedTools`. The Claude Agent
- *    SDK refuses to invoke any tool not present in `allowed-tools`, so
- *    this is hard enforcement at the SDK boundary.
- *
- *  - **Codex / Gemini (soft enforcement):** append a "Denied tools (do
- *    not invoke)" prose block at the end of the skill body listing the
- *    full namespaced tool names. The CLI surfaces have no per-tool deny
- *    mechanism comparable to Claude's `allowed-tools`; the prose is the
- *    only guard. Documented soft-enforcement gap.
- *
- * Stale entries (a deniedTools name that doesn't match any tool in the
- * active backend's `capabilityTools`) are silently ignored — the API
- * already rejects them at PATCH time, but a delegatedBackend swap can
- * leave Claude-namespaced names in a list now active for Codex.
- *
- * Run AFTER `renderPartialIncludes` and `stripUnconfiguredServices` so
- * partial includes and service-section gating land first.
- */
-export function applyDeniedTools(content, integrationKey, backendId, deniedTools) {
-    if (deniedTools.length === 0)
-        return content;
-    const descriptor = INTEGRATION_DESCRIPTORS[integrationKey];
-    const connector = descriptor.backendConnectors[backendId];
-    if (!connector)
-        return content;
-    const { active } = filterDeniedToolsForBackend(integrationKey, backendId, deniedTools);
-    if (active.length === 0)
-        return content;
-    const namespacedDenied = active.map((t) => `${connector.toolNamespace}${t}`);
-    if (backendId === "claude") {
-        return filterClaudeAllowedTools(content, new Set(namespacedDenied));
-    }
-    return appendCliDenyBlock(content, namespacedDenied);
-}
-/**
- * Strip every `allowed-tools` frontmatter entry whose name appears in
- * `deniedSet`. Preserves frontmatter ordering, line breaks, and any other
- * fields. Tolerates two YAML shapes:
- *
- *   allowed-tools:
- *     - name1
- *     - name2
- *
- *   allowed-tools: [name1, name2]
- *
- * The first form is what every skill in `agent-assets/skills/` uses today;
- * the inline form is supported because it's valid YAML and the API + UI
- * have no way to prevent a hand-edited skill from using it.
- */
-function filterClaudeAllowedTools(content, deniedSet) {
-    if (!content.startsWith("---"))
-        return content;
-    const endIdx = content.indexOf("\n---", 3);
-    if (endIdx < 0)
-        return content;
-    const frontmatter = content.slice(4, endIdx);
-    const body = content.slice(endIdx + 4);
-    const lines = frontmatter.split("\n");
-    const out = [];
-    let inAllowedTools = false;
-    for (const line of lines) {
-        if (/^allowed-tools:\s*\[/.test(line)) {
-            // Inline-array form: parse, filter, re-emit on one line.
-            const m = /^(allowed-tools:\s*)\[([^\]]*)\]/.exec(line);
-            if (m) {
-                const items = m[2]
-                    .split(",")
-                    .map((s) => s.trim().replace(/^["']|["']$/g, ""))
-                    .filter((s) => s.length > 0 && !deniedSet.has(s));
-                out.push(`${m[1]}[${items.join(", ")}]`);
-                continue;
-            }
-        }
-        if (/^allowed-tools:\s*$/.test(line)) {
-            inAllowedTools = true;
-            out.push(line);
-            continue;
-        }
-        if (inAllowedTools) {
-            // Block-list form continuation. A block-list item is `  - <name>`;
-            // anything else (next top-level key, blank, or end of frontmatter)
-            // ends the section.
-            const itemMatch = /^\s*-\s*(.+?)\s*$/.exec(line);
-            if (itemMatch) {
-                const name = itemMatch[1].replace(/^["']|["']$/g, "");
-                if (!deniedSet.has(name))
-                    out.push(line);
-                continue;
-            }
-            // Anything else closes the block.
-            inAllowedTools = false;
-        }
-        out.push(line);
-    }
-    return `---\n${out.join("\n")}\n---${body}`;
-}
-/**
- * DELEGATED-MODE-V2-DESIGN.md §4.3.3-§4.3.4 — render a top-level prose
- * deny block listing every same-backend integration tool the user has
- * denied. Returns `null` when no integration is in same-backend mode for
- * this backend or the deny lists are empty.
- *
- * Codex (γ outcome): this prose is the ONLY enforcement surface — the
- * Codex CLI's connector apps have no admin-policy or per-tool deny config.
- * The agent profile (`AGENTS.md`) inlines this block above the behavioral
- * rules so it is impossible to miss.
- *
- * Gemini: duplicate intent — admin-policy already hard-denies these tools
- * (§4.3.3 hard enforcement), but echoing the deny in prose saves tokens
- * the model would otherwise spend drafting a doomed call.
- */
-export function buildSameBackendDenyBlock(integrations, sessionBackend) {
-    const map = collectSessionDeniedTools(integrations, sessionBackend);
-    if (map.size === 0)
-        return null;
-    const lines = [
-        "## Denied tools (per-integration)",
-        "",
-        "The user has restricted the following connector tools for this session.",
-        "Do NOT invoke them in any flow — including hourly check, morning routine,",
-        "or DM responses. If a workflow appears to require one, stop and tell the",
-        "user the tool is denied.",
-    ];
-    for (const [key, names] of map.entries()) {
-        lines.push("", `### ${key}`, "");
-        for (const n of names)
-            lines.push(`- \`${n}\``);
-    }
-    return lines.join("\n");
-}
-/**
- * Append a soft-enforcement deny block to a CLI skill body. The block is
- * idempotent — re-running with the same denied set produces identical
- * output.
- */
-function appendCliDenyBlock(content, namespacedDenied) {
-    // Strip any prior deny block we wrote, so re-materialization with a
-    // changed list doesn't accumulate stale ones. The block starts with
-    // `\n## Denied tools (do not invoke)` (one preceding newline, the join
-    // contributes the second) and runs until either the next `## ` heading
-    // or end of file.
-    const stripped = content.replace(/\n+## Denied tools \(do not invoke\)[\s\S]*?(?=\n## (?!Denied tools)|$)/, "");
-    const items = namespacedDenied.map((n) => `- \`${n}\``).join("\n");
-    // Two leading empty strings → block begins with "\n\n## " so the heading
-    // sits on its own paragraph (markdown convention) regardless of what
-    // trailing whitespace the body carried.
-    const block = [
-        "",
-        "",
-        "## Denied tools (do not invoke)",
-        "",
-        "The user has restricted these connector tools for this integration. Do",
-        "NOT invoke them in any flow — including hourly check, morning routine,",
-        "or DM responses. If a workflow appears to require one, stop and tell",
-        "the user the tool is denied.",
-        "",
-        items,
-        "",
-    ].join("\n");
-    return stripped.replace(/\s*$/, "") + block;
-}
-/**
- * Apply the deny pass for every integration whose `skillsTouched` OR
- * `deniedToolsAppliesToSkills` includes the given skill slug. A skill that
- * touches no integration leaves content unchanged. Touching multiple
- * integrations runs the pass once per integration so each contributes its
- * own deny list.
- *
- * Hard enforcement of the same deny list for cross-backend delegated
- * calls lives at the `POST /api/integrations/:key/invoke` chokepoint
- * (DELEGATED-MODE-V2-DESIGN.md §4.3.2). For same-backend native MCP it
- * is enforced via SDK `disallowedTools` (Claude) / admin policy
- * (Gemini); see `collectSessionDeniedTools` (§4.3.3).
- */
-export function applyAllDeniedToolsForSkill(content, skillSlug, backendId, integrations) {
-    let result = content;
-    for (const key of INTEGRATION_KEYS) {
-        const descriptor = INTEGRATION_DESCRIPTORS[key];
-        const touched = descriptor.skillsTouched.includes(skillSlug)
-            || (descriptor.deniedToolsAppliesToSkills?.includes(skillSlug) ?? false);
-        if (!touched)
-            continue;
-        const state = integrations[key];
-        if (!state)
-            continue;
-        if (state.mode !== "delegated")
-            continue;
-        if (!state.delegatedBackend || state.delegatedBackend !== backendId)
-            continue;
-        const denied = state.deniedTools ?? [];
-        if (denied.length === 0)
-            continue;
-        result = applyDeniedTools(result, key, backendId, denied);
-    }
-    return result;
-}
-/**
- * Remove any built-in skill directory under `destRoot` whose slug is not
- * in `keep`. Recognises a directory as a built-in by its presence under
- * the source `agent-assets/skills/` tree — anything else (user-authored
- * skill, accounts.md, etc.) is left alone, since `syncAllUserSkills` is
- * the canonical writer for those.
- *
- * Idempotent and side-effect-free when there is nothing to prune.
- * Exported for unit testing only.
- */
-export function pruneStaleBuiltinSkillDirs(destRoot, sourceSkillsRoot, keep) {
-    if (!existsSync(destRoot))
-        return;
-    if (!existsSync(sourceSkillsRoot))
-        return;
-    const keepSet = new Set(keep);
-    // `listBuiltinSlugs` recurses one level into category subdirs (e.g.
-    // WIKI_BUILDER_DESIGN.md §9.1 `wiki/`) so wiki slugs are recognised
-    // as built-ins for prune purposes even though their source dir is
-    // nested. Destination layout stays flat — `<destRoot>/<slug>/` for
-    // every slug regardless of source category.
-    const builtinSlugs = new Set(listBuiltinSlugs(sourceSkillsRoot));
-    for (const entry of readdirSync(destRoot, { withFileTypes: true })) {
-        if (!entry.isDirectory())
-            continue;
-        if (!builtinSlugs.has(entry.name))
-            continue;
-        if (keepSet.has(entry.name))
-            continue;
-        rmSync(join(destRoot, entry.name), { recursive: true, force: true });
-    }
-}
-function readTreeFiles(root) {
-    if (!existsSync(root)) {
-        return [];
-    }
-    const files = [];
-    for (const relPath of walkTree(root)) {
-        const absPath = join(root, relPath);
-        const stat = statSync(absPath);
-        files.push({
-            path: relPath,
-            content: readFileSync(absPath, "utf-8"),
-            updatedAt: stat.mtime.toISOString(),
-        });
-    }
-    return files;
-}
-function walkTree(root, current = root) {
-    if (!existsSync(current)) {
-        return [];
-    }
-    const entries = readdirSync(current, { withFileTypes: true });
-    const files = [];
-    for (const entry of entries) {
-        const absPath = join(current, entry.name);
-        if (entry.isDirectory()) {
-            files.push(...walkTree(root, absPath));
-            continue;
-        }
-        files.push(relative(root, absPath));
+        writeFileSync(join(sessionDir, cliInstructionFileName(backendId)), instruction, "utf-8");
     }
-    return files.sort();
 }
-//# sourceMappingURL=skills-compiler.js.map