@aiwg/cli 2026.10.11 → 2026.10.12

package/dist/src/sessions/normalization.js

@@ -0,0 +1,251 @@
+// Shared event normalization, image extraction, redaction, and lifecycle derivation.
+import { SESSION_CONTRACT_VERSION, SessionEventSchema, SessionSchema, sha256, stableEventId, stableSessionId, } from './contracts.js';
+import { redactSessionValue, sanitizeSessionEvent, sanitizeNativeExtensions } from './policy.js';
+import { extractEventImages } from './image-blobs.js';
+import { DEFAULT_INACTIVITY_THRESHOLD_MS } from './lifecycle.js';
+import { classifySessionEventOrigin, deriveSessionIntent } from './origin.js';
+export function normalizeSessionBatch(request, records, digests, importRunId, sourceObservedAt) {
+    const sessions = new Map();
+    // Extract inline images before sanitization: provider image blocks in
+    // extensions are redacted to markers below, so bytes must be lifted out
+    // first while the raw record is still intact (#3265).
+    const imageBlobs = new Map();
+    const events = records.map((record, index) => {
+        const sessionId = stableSessionId(request.source.provider, request.source.sourceId, record.nativeSessionId);
+        const native = sanitizeNativeExtensions(record.extensions ?? {});
+        const lineage = request.source.provider === 'codex' && native.value.lineage
+            ? { lineage: native.value.lineage } : {};
+        const images = extractEventImages({
+            searchableText: record.text,
+            extensions: record.extensions,
+            rawReference: record.rawReference,
+        });
+        for (const image of images.images) {
+            if (!imageBlobs.has(image.digest))
+                imageBlobs.set(image.digest, image);
+        }
+        const digest = digests[index];
+        const origin = classifySessionEventOrigin(request.source.provider, record);
+        const lifecycle = sessionLifecycle(request, record, sourceObservedAt);
+        const lifecycleEvidence = sessionLifecycleEvidence(request, record, sourceObservedAt);
+        const extensions = {
+            [`native.${request.source.provider}`]: images.extensions,
+        };
+        const event = sanitizeSessionEvent(SessionEventSchema.parse({
+            contractVersion: SESSION_CONTRACT_VERSION,
+            eventId: stableEventId(request.source.provider, request.source.sourceId, record, digest),
+            sessionId, sourceId: request.source.sourceId, importRunId,
+            nativeId: record.nativeEventId ?? null, sequence: record.sequence,
+            kind: record.kind, role: record.role ?? null, occurredAt: record.occurredAt ?? null,
+            activityBoundary: record.activityBoundary ?? null,
+            activityBoundaryBasis: record.activityBoundaryBasis ?? null,
+            activityBoundaryConfidence: record.activityBoundaryConfidence ?? null,
+            origin: origin.origin,
+            originRule: origin.rule,
+            originClassifierVersion: origin.classifierVersion,
+            participant: record.participant ?? null,
+            toolName: record.toolName ?? null,
+            toolCallId: record.toolCallId ?? null,
+            model: record.model ?? null,
+            entities: record.entities ?? [],
+            extractionState: record.extractionState ?? null,
+            searchableText: images.searchableText, imageRefs: images.imageRefs,
+            digest, rawReference: record.rawReference,
+            adapterVersion: request.adapter.adapterVersion,
+            consistency: request.source.consistency,
+            sensitivity: { classification: 'none', classes: [] },
+            opaque: !isKnownEventKind(record.kind),
+            extensions,
+        }));
+        if (!sessions.has(sessionId)) {
+            sessions.set(sessionId, SessionSchema.parse({
+                contractVersion: SESSION_CONTRACT_VERSION,
+                sessionId, sourceId: request.source.sourceId, provider: request.source.provider,
+                nativeSessionId: record.nativeSessionId, workspaceId: request.workspaceId,
+                startedAt: record.occurredAt ?? null, updatedAt: record.occurredAt ?? null,
+                consistency: request.source.consistency,
+                lifecycle,
+                sourceDigest: sha256(`${sourceGenerationDigest(request)}\0${record.nativeSessionId}`),
+                extensions: {
+                    [`native.${request.source.provider}`]: {
+                        ...lineage,
+                        lifecycleEvidence,
+                    },
+                },
+            }));
+        }
+        else {
+            const session = sessions.get(sessionId);
+            session.startedAt = earlierTimestamp(session.startedAt, record.occurredAt ?? null);
+            session.updatedAt = laterTimestamp(session.updatedAt, record.occurredAt ?? null);
+            session.consistency = strongerConsistency(session.consistency, request.source.consistency);
+            const nativeKey = `native.${request.source.provider}`;
+            const nativeEnvelope = session.extensions[nativeKey];
+            const nativeRecord = nativeEnvelope && typeof nativeEnvelope === 'object' && !Array.isArray(nativeEnvelope)
+                ? nativeEnvelope
+                : {};
+            const selected = selectLifecycleTransition(session.lifecycle, nativeRecord.lifecycleEvidence, lifecycle, lifecycleEvidence);
+            session.lifecycle = selected.lifecycle;
+            session.extensions[nativeKey] = {
+                ...nativeRecord,
+                ...lineage,
+                lifecycleEvidence: selected.evidence,
+            };
+        }
+        return event;
+    });
+    for (const session of sessions.values()) {
+        session.intent = deriveSessionIntent(events.filter((event) => event.sessionId === session.sessionId));
+    }
+    return {
+        sessions: redactSessionValue([...sessions.values()]).value,
+        events,
+        imageBlobs: [...imageBlobs.values()],
+    };
+}
+const KNOWN_EVENT_KINDS = new Set(['message', 'tool-call', 'tool-result', 'artifact', 'attachment', 'summary']);
+function isKnownEventKind(kind) {
+    const normalized = kind.toLowerCase();
+    return KNOWN_EVENT_KINDS.has(normalized)
+        || /^(?:tool-call|tool-result)(?:[._-]|$)/.test(normalized)
+        || /^(?:sandbox|permission|approval|hitl|human|lifecycle)(?:[._-]|$)/.test(normalized);
+}
+function earlierTimestamp(left, right) {
+    if (!left)
+        return right;
+    if (!right)
+        return left;
+    return Date.parse(left) <= Date.parse(right) ? left : right;
+}
+function laterTimestamp(left, right) {
+    if (!left)
+        return right;
+    if (!right)
+        return left;
+    return Date.parse(left) >= Date.parse(right) ? left : right;
+}
+function strongerConsistency(left, right) {
+    const rank = {
+        provisional: 0,
+        'consistent-snapshot': 1,
+        complete: 2,
+    };
+    return rank[left] >= rank[right] ? left : right;
+}
+function sessionLifecycle(request, record, sourceObservedAt) {
+    const explicit = nativeLifecycle(record.extensions);
+    if (explicit)
+        return explicit;
+    if (request.source.consistency === 'complete')
+        return 'complete';
+    const observedAt = record.occurredAt ?? sourceObservedAt;
+    if (observedAt && isStaleHistoricalTimestamp(observedAt, inactivityThresholdMs(request)))
+        return 'inactive';
+    return 'active';
+}
+function sessionLifecycleEvidence(request, record, sourceObservedAt) {
+    const observedAt = record.occurredAt ?? sourceObservedAt;
+    const explicit = nativeLifecycle(record.extensions);
+    if (explicit) {
+        return {
+            basis: 'provider-explicit-event',
+            state: explicit,
+            observedAt: observedAt ?? request.source.authorizedAt,
+            confidence: 'high',
+        };
+    }
+    if (request.source.consistency === 'complete') {
+        return {
+            basis: 'complete-source',
+            state: 'complete',
+            observedAt: observedAt ?? request.source.authorizedAt,
+            confidence: 'high',
+        };
+    }
+    const thresholdMs = inactivityThresholdMs(request);
+    if (observedAt && isStaleHistoricalTimestamp(observedAt, thresholdMs)) {
+        return {
+            basis: 'inactivity-threshold',
+            state: 'inactive',
+            observedAt,
+            confidence: 'medium',
+            thresholdMs,
+        };
+    }
+    return {
+        basis: 'open-provisional-source',
+        state: 'active',
+        observedAt: observedAt ?? request.source.authorizedAt,
+        confidence: 'provisional',
+        thresholdMs,
+    };
+}
+function nativeLifecycle(extensions) {
+    const raw = typeof extensions?.lifecycle === 'string' ? extensions.lifecycle : undefined;
+    if (!raw)
+        return null;
+    const normalized = {
+        active: 'active',
+        inactive: 'inactive',
+        paused: 'paused',
+        complete: 'complete',
+        completed: 'complete',
+        archived: 'archived',
+        deleted: 'tombstoned',
+        cancelled: 'interrupted',
+        canceled: 'interrupted',
+        failed: 'interrupted',
+        interrupted: 'interrupted',
+        unknown: 'unknown',
+        'unknown-at-import': 'unknown',
+        'completed-at-import': 'complete',
+    };
+    return normalized[raw] ?? null;
+}
+function selectLifecycleTransition(leftLifecycle, left, rightLifecycle, right) {
+    const leftEvidence = asLifecycleEvidence(left);
+    if (leftLifecycle === 'tombstoned') {
+        return { lifecycle: leftLifecycle, evidence: leftEvidence ?? right };
+    }
+    if (!leftEvidence)
+        return { lifecycle: rightLifecycle, evidence: right };
+    const rank = {
+        'open-provisional-source': 1,
+        'inactivity-threshold': 1,
+        'complete-source': 2,
+        'provider-explicit-event': 3,
+    };
+    const leftRank = rank[String(leftEvidence.basis)] ?? 0;
+    const rightRank = rank[String(right.basis)] ?? 0;
+    const rightIsNewer = evidenceTimestamp(right) > evidenceTimestamp(leftEvidence);
+    return rightRank > leftRank || (rightRank === leftRank && rightIsNewer)
+        ? { lifecycle: rightLifecycle, evidence: right }
+        : { lifecycle: leftLifecycle, evidence: leftEvidence };
+}
+function asLifecycleEvidence(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function evidenceTimestamp(value) {
+    const parsed = Date.parse(String(value.observedAt ?? ''));
+    return Number.isFinite(parsed) ? parsed : Number.NEGATIVE_INFINITY;
+}
+function inactivityThresholdMs(request) {
+    return request.inactivityThresholdMs ?? DEFAULT_INACTIVITY_THRESHOLD_MS;
+}
+function isStaleHistoricalTimestamp(value, thresholdMs) {
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp)
+        && Date.now() - timestamp > thresholdMs;
+}
+export function sourceGenerationDigest(request) {
+    return sha256([
+        request.source.sourceId,
+        request.source.provider,
+        request.selectedSource.locatorClass,
+        request.source.sourceSchemaVersion,
+        request.adapter.adapterVersion,
+    ].join('\0'));
+}
+//# sourceMappingURL=normalization.js.map

package/dist/src/sessions/tail.js

@@ -0,0 +1,91 @@
+// Follow a native source through the importer's normalization and checkpoint rules.
+import { setTimeout } from 'node:timers/promises';
+import { SessionContractError, assertSessionResourceLimit, assertSupportedSchemaMajor, sha256 } from './contracts.js';
+import { IncrementalSessionImporter } from './importer.js';
+import { normalizeSessionBatch } from './normalization.js';
+import { assertImportByteLimit, DEFAULT_IMPORT_BYTE_LIMITS } from './import-limits.js';
+export function assertTailSupported(adapter) {
+    if (typeof adapter.stream !== 'function' || !adapter.supportedOperations.includes('stream')) {
+        throw new SessionContractError('UNSUPPORTED_PROVIDER', `sessions tail is unsupported for provider ${adapter.provider}: adapter has no stream operation`);
+    }
+}
+export async function tailSession(options) {
+    assertTailSupported(options.adapter);
+    assertSupportedSchemaMajor(options.source.sourceSchemaVersion, options.adapter.sourceSchemaMajor ?? 1);
+    if (options.workspaceId !== options.selectedSource.authorizedScope.workspaceId) {
+        throw new SessionContractError('SOURCE_NOT_AUTHORIZED', 'tail workspace is outside the authorized source scope');
+    }
+    const pollMs = options.pollMs ?? 500;
+    if (!Number.isInteger(pollMs) || pollMs < 1 || pollMs > 500) {
+        throw new SessionContractError('INVALID_ARGUMENT', 'tail poll interval must be between 1 and 500 ms');
+    }
+    let checkpoint = options.repository.getCheckpoint(options.source.sourceId, options.adapter.adapterVersion);
+    const port = {
+        getCheckpoint: () => checkpoint,
+        getBatchCheckpoint: () => null,
+        commitStagedImports: () => 0,
+        applyImport: (batch, next) => {
+            // Publish through the existing import transaction only with explicit opt-in.
+            const receipt = options.repository.applyImport(batch, next, true);
+            checkpoint = { ...next };
+            for (const event of batch.events) {
+                if (event.sessionId === options.sessionId)
+                    options.onEvent(event);
+            }
+            return receipt;
+        },
+    };
+    const importer = new IncrementalSessionImporter(port);
+    while (!options.signal?.aborted) {
+        try {
+            if (options.import) {
+                await importer.import({
+                    ...options, publish: true, batchRunId: undefined,
+                    limits: { ...options.limits, batchSize: 1 },
+                });
+            }
+            else {
+                // Do not fingerprint or persist snapshots: export adapters may rewrite
+                // a JSON document as it grows. Each adapter owns its resume semantics.
+                for await (const record of options.adapter.stream(options.selectedSource, checkpoint ? { value: checkpoint.cursor } : undefined)) {
+                    if (options.signal?.aborted)
+                        return;
+                    const serialized = JSON.stringify(record);
+                    const limits = { ...DEFAULT_IMPORT_BYTE_LIMITS, ...options.limits };
+                    assertImportByteLimit('maxRecordBytes', limits, Buffer.byteLength(serialized));
+                    const count = (checkpoint?.recordsRead ?? 0) + 1;
+                    assertSessionResourceLimit('maxRecords', options.limits?.maxRecords ?? 1_000_000, count);
+                    const digest = sha256(serialized);
+                    const runId = sha256([options.source.sourceId, options.adapter.adapterVersion,
+                        count - 1, count, digest].join('\0'));
+                    const { events } = normalizeSessionBatch(options, [record], [digest], runId);
+                    checkpoint = { ...checkpoint, cursor: record.sourceCursor ?? String(count),
+                        recordsRead: count, bytesRead: (checkpoint?.bytesRead ?? 0) + Buffer.byteLength(serialized) };
+                    for (const event of events) {
+                        if (event.sessionId === options.sessionId)
+                            options.onEvent(event);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                return;
+            // Some native JSONL adapters report an in-progress final line explicitly.
+            if (!(options.follow && error instanceof SessionContractError
+                && error.code === 'TRUNCATED_SOURCE'))
+                throw error;
+        }
+        await options.onPoll?.();
+        if (!options.follow || options.signal?.aborted)
+            return;
+        try {
+            await setTimeout(pollMs, undefined, { signal: options.signal });
+        }
+        catch (error) {
+            if (!options.signal?.aborted)
+                throw error;
+        }
+    }
+}
+//# sourceMappingURL=tail.js.map

package/dist/src/sessions/workspace-discovery.js

@@ -4,6 +4,8 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { inspectMuseNativeWorkspace } from './adapters/muse.js';
 import { readOmpSessionHeader } from './adapters/omp.js';
 import { grokbotConversationIdFromLocator } from './adapters/grokbot-locator.js';
+import { GROK_BUILD_ACTIVE_FRESHNESS_MS, grokBuildLiveState, grokBuildSourceWorkspaceMatch, readGrokBuildActiveRegistry, } from './adapters/grok-build-native.js';
+import { hermesSnapshotStagingDir } from './adapters/hermes-state-db.js';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { readAiwgConfig } from '../config/aiwg-config.js';
 import { SessionCoveragePreflightSchema, SessionContractError, sha256, } from './contracts.js';
@@ -15,7 +17,7 @@ import { matchSessionWorkspace } from './workspace-matching.js';
 import { matchImportExclusion, nativeSessionIdFromLocator, resolveImportExclusions } from './import-exclusions.js';
 export const DISCOVERY_MANIFEST_VERSION = '1.0.0';
 const MANUAL_EXPORT_PROVIDERS = new Set([
-    'copilot', 'hermes', 'opencode', 'openclaw', 'openhuman', 'grok-build',
+    'copilot', 'opencode', 'openclaw', 'openhuman',
     'warp', 'devin-desktop', 'generic',
 ]);
 export async function discoverWorkspaceHistories(options) {
@@ -31,6 +33,8 @@ export async function discoverWorkspaceHistories(options) {
         ...(options.museRoot ? ['muse'] : []),
         ...(options.dshRoot ? ['deepseek-harness'] : []),
         ...(options.grokbotRoot ? ['grokbot'] : []),
+        ...(options.grokRoot ? ['grok-build'] : []),
+        ...(options.hermesRoot ? ['hermes'] : []),
     ];
     const savedRoots = options.authorizedRoots ?? options.refreshFrom?.authorizedRoots;
     const authorizedProviders = options.refreshFrom
@@ -68,6 +72,15 @@ export async function discoverWorkspaceHistories(options) {
         // no-filtering behavior already used for `pi`/`deepseek-harness`).
         { provider: 'grokbot', roots: options.grokbotRoot
                 ? [resolve(options.grokbotRoot)] : [] },
+        // Grok Build authorizes the sessions directory itself, never Grok home:
+        // `<root>/<url-encoded cwd>/<id>/chat_history.jsonl`. No fallback through
+        // $HOME, GROK_HOME, or --provider-home grants access.
+        { provider: 'grok-build', roots: options.grokRoot
+                ? [resolve(options.grokRoot)] : [] },
+        // Hermes authorizes `<root>/state.db` for a read-only backup snapshot.
+        // Staging joins the scope below; nothing else under the root is read.
+        { provider: 'hermes', roots: options.hermesRoot
+                ? [resolve(options.hermesRoot)] : [] },
         {
             provider: 'claude',
             // Same scope rule as codex: configured providers keep their root grant
@@ -155,14 +168,17 @@ export async function discoverWorkspaceHistories(options) {
             }
         }
         if (availableRoots.length === 0) {
-            const codexNeedsAuthorization = (entry.provider === 'codex' || entry.provider === 'omp'
+            const needsExplicitRoot = (entry.provider === 'codex' || entry.provider === 'omp'
                 || entry.provider === 'deepseek-harness' || entry.provider === 'muse'
-                || entry.provider === 'grokbot')
+                || entry.provider === 'grokbot' || entry.provider === 'grok-build'
+                || entry.provider === 'hermes')
                 && entry.roots.length === 0;
-            reports.set(entry.provider, providerReport(entry.provider, codexNeedsAuthorization ? 'export-required' : 'unavailable', codexNeedsAuthorization ? 'manual-export' : 'discoverable', [], codexNeedsAuthorization
+            const expectedFlag = entry.provider === 'deepseek-harness' ? 'dsh' : entry.provider;
+            const rootKind = entry.provider === 'hermes' ? 'Hermes home (state.db is snapshotted read-only)' : 'sessions root';
+            reports.set(entry.provider, providerReport(entry.provider, needsExplicitRoot ? 'export-required' : 'unavailable', needsExplicitRoot ? 'manual-export' : 'discoverable', [], needsExplicitRoot
                 ? 'SHARED_ROOT_AUTHORIZATION_REQUIRED'
-                : 'PROVIDER_ROOT_UNAVAILABLE', codexNeedsAuthorization
-                ? `Pass --${entry.provider === 'deepseek-harness' ? 'dsh' : entry.provider}-root with an explicitly authorized sessions root.`
+                : 'PROVIDER_ROOT_UNAVAILABLE', needsExplicitRoot
+                ? `Pass --${expectedFlag}-root with an explicitly authorized ${rootKind}.`
                 : `No authorized ${entry.provider} workspace history root was found.`));
             if (entry.provider === 'codex')
                 reports.get(entry.provider).rootCounts = [...rootCounts.values()];
@@ -173,13 +189,48 @@ export async function discoverWorkspaceHistories(options) {
             workspaceId,
             allowedRoots: availableRoots,
         };
+        if (entry.provider === 'hermes') {
+            // The consistent snapshot is staged under owned workspace staging (the
+            // provider home stays read-only); staged locators need scope cover, and
+            // refresh must retain both the origin grant and the staging grant.
+            const staging = hermesSnapshotStagingDir(workspacePath);
+            if (!scope.allowedRoots.includes(staging))
+                scope.allowedRoots.push(staging);
+            authorizedRoots[entry.provider] = [...new Set([...availableRoots, staging])];
+            if (!rootCounts.has(staging)) {
+                rootCounts.set(staging, {
+                    root: redactSourceLocator(staging), rootId: sha256(staging),
+                    status: 'checked', sourceCount: 0, duplicateCount: 0,
+                });
+            }
+        }
         const providerSources = [];
         let matchedBySubfolder = 0;
         let matchedByWorktree = 0;
         const museSourceInspections = [];
+        // Grok Build live detection reads exactly one explicitly authorized file
+        // (never the sessions root's parent implicitly); absence means unknown.
+        let grokActiveRegistry = null;
+        let grokActiveRegistryLoaded = false;
+        const grokActiveEvidence = async () => {
+            if (grokActiveRegistryLoaded || entry.provider !== 'grok-build' || !options.grokActiveSessions)
+                return grokActiveRegistry;
+            grokActiveRegistryLoaded = true;
+            try {
+                grokActiveRegistry = await readGrokBuildActiveRegistry(resolve(options.grokActiveSessions), [resolve(options.grokActiveSessions)].map((file) => dirname(file)));
+            }
+            catch {
+                grokActiveRegistry = null;
+            }
+            return grokActiveRegistry;
+        };
         for await (const descriptor of adapter.discover(scope)) {
             const known = options.knownSources?.find(source => source.provider === descriptor.provider && source.locator === descriptor.locator);
-            const nativeSessionId = known?.nativeSessionId ?? descriptor.nativeSessionId ?? nativeSessionIdFromLocator(descriptor);
+            // A Hermes projection holds many sessions, so its locator basename is
+            // never a session identity.
+            const nativeSessionId = entry.provider === 'hermes'
+                ? (known?.nativeSessionId ?? descriptor.nativeSessionId)
+                : (known?.nativeSessionId ?? descriptor.nativeSessionId ?? nativeSessionIdFromLocator(descriptor));
             const exclusion = matchImportExclusion({ ...descriptor, nativeSessionId }, exclusions);
             if (exclusion) {
                 const locator = resolve(descriptor.locator);
@@ -224,6 +275,13 @@ export async function discoverWorkspaceHistories(options) {
                 if (!workspaceMatch)
                     continue;
             }
+            if (entry.provider === 'grok-build') {
+                // The url-encoded cwd directory is the only workspace evidence; an
+                // unresolvable or conflicting value never attaches to the caller.
+                workspaceMatch = await grokBuildSourceWorkspaceMatch(locator, workspacePath);
+                if (!workspaceMatch)
+                    continue;
+            }
             const ompHeader = entry.provider === 'omp' ? await readOmpSessionHeader({ ...descriptor, sourceId: 'discovery', authorizedScope: scope }) : undefined;
             if (ompHeader) {
                 workspaceMatch = await matchSessionWorkspace(ompHeader.cwd, workspacePath);
@@ -262,6 +320,24 @@ export async function discoverWorkspaceHistories(options) {
             rootCount.sourceCount += 1;
             const source = sourceFromDescriptor(descriptor, locator, authorizedRoot, details, fingerprint.digest);
             source.nativeSessionId = rolloutId ?? ompHeader?.id ?? nativeSessionId;
+            if (entry.provider === 'hermes') {
+                // A state.db projection holds many sessions; the locator basename is
+                // not a session identity.
+                delete source.nativeSessionId;
+            }
+            if (entry.provider === 'grok-build' && source.nativeSessionId) {
+                // Provider-reported activity only; histories stay usable without it.
+                const observedAt = options.createdAt ?? new Date().toISOString();
+                const registry = await grokActiveEvidence();
+                const evidence = grokBuildLiveState(registry, source.nativeSessionId);
+                source.liveEvidence = {
+                    ...evidence,
+                    observedAt,
+                    expiresAt: evidence.state === 'active'
+                        ? new Date(Date.parse(observedAt) + GROK_BUILD_ACTIVE_FRESHNESS_MS).toISOString()
+                        : null,
+                };
+            }
             if (ompHeader)
                 source.sourceId = sha256(['omp-native-source-v1', workspaceId, ompHeader.id].join('\0'));
             if (entry.provider === 'grokbot') {

package/dist/src/skills/agent-skill-sidecar.js

@@ -0,0 +1,28 @@
+// Preserve non-portable skill metadata across the portable boundary.
+import { AGENT_SKILLS_SIDECAR_SCHEMA } from './agent-skills.js';
+export function createAgentSkillSidecar(document, provenance, validationProfile, trust) {
+    return {
+        $schema: AGENT_SKILLS_SIDECAR_SCHEMA,
+        schemaVersion: 1,
+        aiwg: structuredClone(document.aiwg),
+        ...(document.providers ? { providers: structuredClone(document.providers) } : {}),
+        provenance: structuredClone(provenance),
+        validationProfile,
+        trust: { ...trust },
+    };
+}
+/**
+ * Restore AIWG metadata omitted at a strict portability boundary. Portable
+ * content remains authoritative for standard fields, body, and resources.
+ */
+export function restoreAgentSkillFromSidecar(standard, body, resources, sidecar) {
+    return {
+        standard: structuredClone(standard),
+        body,
+        resources: resources.map((resource) => ({ ...resource })),
+        aiwg: structuredClone(sidecar.aiwg),
+        ...(sidecar.providers ? { providers: structuredClone(sidecar.providers) } : {}),
+        unknownFields: [],
+    };
+}
+//# sourceMappingURL=agent-skill-sidecar.js.map

package/dist/src/skills/agent-skills.js

@@ -6,6 +6,9 @@
  *
  * @implements #1875
  */
+import { CLAUDE_SKILL_FIELDS } from './provider-extensions.js';
+export { CLAUDE_SKILL_FIELDS } from './provider-extensions.js';
+export { createAgentSkillSidecar, restoreAgentSkillFromSidecar } from './agent-skill-sidecar.js';
 export const AGENT_SKILLS_BASELINE = {
     repository: 'agentskills/agentskills',
     revision: '38a2ff82958afee88dadf4831509e6f7e9d8ef4e',
@@ -174,6 +177,7 @@ export function validateCompatibleAgentSkillMetadata(frontmatter, directoryName,
     const recognizedFields = new Set([
         ...STANDARD_SKILL_FIELDS,
         ...AIWG_SKILL_CONTROL_FIELDS,
+        ...CLAUDE_SKILL_FIELDS,
     ]);
     for (const key of Object.keys(frontmatter).sort()) {
         if (!recognizedFields.has(key)) {
@@ -223,27 +227,4 @@ export function equivalentPortableAllowedTools(aiwg) {
     }
     return aiwg.allowedTools.join(' ');
 }
-export function createAgentSkillSidecar(document, provenance, validationProfile, trust) {
-    return {
-        $schema: AGENT_SKILLS_SIDECAR_SCHEMA,
-        schemaVersion: 1,
-        aiwg: structuredClone(document.aiwg),
-        provenance: structuredClone(provenance),
-        validationProfile,
-        trust: { ...trust },
-    };
-}
-/**
- * Restore AIWG metadata omitted at a strict portability boundary. Portable
- * content remains authoritative for standard fields, body, and resources.
- */
-export function restoreAgentSkillFromSidecar(standard, body, resources, sidecar) {
-    return {
-        standard: structuredClone(standard),
-        body,
-        resources: resources.map((resource) => ({ ...resource })),
-        aiwg: structuredClone(sidecar.aiwg),
-        unknownFields: [],
-    };
-}
 //# sourceMappingURL=agent-skills.js.map

package/dist/src/skills/claude-surface-projection.js

@@ -0,0 +1,25 @@
+/** Inspection only: account-enabled skills are a separate delivery mechanism. */
+export function projectClaudeSkillSurfaces(body) {
+    const shell = /!`[^`]+`/.test(body);
+    return ['cli', 'desktop-code', 'cowork', 'cloud'].map((surface) => {
+        const local = surface === 'cli' || surface === 'desktop-code';
+        const shellStatus = local ? 'native' : surface === 'cowork' ? 'degraded' : 'unsupported';
+        return {
+            provider: 'claude',
+            surface,
+            status: local ? 'native' : 'unsupported',
+            ...(shell ? { shellInterpolation: shellStatus } : {}),
+            reasons: [
+                local
+                    ? 'Reads filesystem SKILL.md bundles from .claude/skills.'
+                    : 'Does not read local .claude/skills; requires skills enabled on the claude.ai account.',
+                ...(shell ? [local
+                        ? '! shell interpolation is native; AIWG does not execute it during validation or deploy.'
+                        : surface === 'cowork'
+                            ? '! shell interpolation is degraded to a policy notice for account-enabled Cowork skills.'
+                            : '! shell interpolation from a local skill is unsupported on cloud.'] : []),
+            ],
+        };
+    });
+}
+//# sourceMappingURL=claude-surface-projection.js.map