@aliyunrds/ctxdb 1.0.9-beta.1 → 1.0.10-beta.0

package/dist/cli/main.js

@@ -1,4 +1,9 @@
 #!/usr/bin/env node
+import {
+  beginUpdateNotification,
+  completeUpdateNotification,
+  runSelfUpdate
+} from "../chunk-QUPLZ7KF.js";
 import {
   DEFAULT_FILE_INGEST_TIMEOUT_MS,
   DEFAULT_FILE_UPLOAD_TIMEOUT_MS,
@@ -31,13 +36,14 @@ import {
   uploadFile,
   uploadText,
   validateLocalFile
-} from "../chunk-T5ZJEPR4.js";
+} from "../chunk-SZ3AZDMU.js";
 import {
   AGENT_CHOICES,
   CtxdbError,
   DEFAULT_BASE_URL,
   DEFAULT_USER_ID,
   HttpClient,
+  MAX_ZIP,
   PACKAGE_NAME,
   PACKAGE_VERSION,
   SUPPORTED_AGENTS,
@@ -46,36 +52,61 @@ import {
   agentHomeDir,
   agentHomeDirs,
   agentPlatformSupport,
+  autoCollectAllowed,
+  bindSession,
+  bindingPath,
+  businessEvents,
+  catalogContext,
+  configFileName,
   configuredAgents,
   defaultConfigPath,
   detectInstalledAgents,
+  expireSessionEvidence,
+  getBinding,
   hasConfiguredAgent,
   inspectAgentHomes,
   inspectConfig,
+  inspectZip,
   isAgentSlug,
   isBuiltinAgent,
   isDataApiReady,
   load,
+  loadSkill,
+  privatePath,
+  publishPackage,
+  readPackage,
+  readPrivate,
+  readSpool,
+  readState,
+  refreshManifest,
   removeAgent,
+  requireUuid,
   resolveDataApiCredential,
+  resumeSubmission,
+  retryFeedback,
   save,
+  sha256,
+  skillRoot,
+  spoolDirectory,
+  threshold,
+  unbox,
+  updateAutoSkillEvolution,
   updateConfiguredDebug,
-  writeInstalledPkgVersion
-} from "../chunk-2U7G6UXE.js";
-import {
-  beginUpdateNotification,
-  completeUpdateNotification,
-  runSelfUpdate
-} from "../chunk-3MEBQDGU.js";
+  validateEvidence,
+  verifiedClient,
+  withStateLock,
+  writeInstalledPkgVersion,
+  writeState
+} from "../chunk-TZFDXKLJ.js";
 import {
   DISTRIBUTION_MANIFEST
 } from "../chunk-5ITT5GSP.js";
 import "../chunk-PI2SUS3M.js";
 
 // src/cli/main.ts
-import { realpathSync } from "fs";
-import { basename as basename3, resolve as resolve3 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { realpathSync } from "node:fs";
+import { basename as basename3, resolve as resolve4 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/cli/util.ts
 var REPEATABLE_FLAGS = /* @__PURE__ */ new Set([
@@ -100,6 +131,13 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "purge-config",
   "purge-logs",
   "purge-all",
+  // skills
+  "local",
+  "editable",
+  "remote",
+  "resume",
+  "apply",
+  "cache",
   // memory
   "no-infer",
   // memory add
@@ -155,10 +193,10 @@ function parseArgs(argv, booleanFlags = BOOLEAN_FLAGS) {
   const positional2 = [];
   const flags = {};
   const repeatedFlags = {};
-  const setFlag = (name, value) => {
-    flags[name] = value;
+  const setFlag = (name, value2) => {
+    flags[name] = value2;
     if (REPEATABLE_FLAGS.has(name)) {
-      (repeatedFlags[name] ??= []).push(value);
+      (repeatedFlags[name] ??= []).push(value2);
     }
   };
   let separatorSeen = false;
@@ -231,8 +269,8 @@ function isUpgradeResult(v) {
 }
 function isMultiAgentResult(v) {
   if (typeof v !== "object" || v === null) return false;
-  const value = v;
-  return value.mode === "all" && (value.operation === "setup" || value.operation === "status") && typeof value.agents === "object" && value.agents !== null && Array.isArray(value.skipped) && typeof value.summary === "object" && value.summary !== null;
+  const value2 = v;
+  return value2.mode === "all" && (value2.operation === "setup" || value2.operation === "status") && typeof value2.agents === "object" && value2.agents !== null && Array.isArray(value2.skipped) && typeof value2.summary === "object" && value2.summary !== null;
 }
 function isStatusResult(v) {
   if (typeof v !== "object" || v === null) return false;
@@ -257,6 +295,7 @@ function formatUpgradeResult(r) {
   for (const [name, result] of Object.entries(r.agents)) {
     const icon = result.ok ? CHECK : CROSS;
     lines.push(`  ${icon} ${BOLD}${name}${RESET}`);
+    if (result.hook_activation) lines.push(`      ${highlightInlineCode(result.hook_activation.next_action)}`);
     for (const s of result.steps) {
       const sIcon = s.ok ? CHECK : CROSS;
       const detail = s.detail ? `  ${dim(s.detail)}` : "";
@@ -293,6 +332,7 @@ function formatMultiAgentResult(r) {
     if (result.hooks_node !== void 0) {
       lines.push(`      ${DIM}hooks${RESET}      ${result.hooks_node}`);
     }
+    if (result.hook_activation) lines.push(`      ${highlightInlineCode(result.hook_activation.next_action)}`);
     if (result.ping_error) {
       lines.push(`      ${DIM}ping_error${RESET} ${result.ping_error}`);
     }
@@ -316,6 +356,7 @@ function formatStatusResult(r) {
     ["base_url", r.base_url],
     ["user_id", r.user_id],
     ["api_key", r.api_key_set ? "set" : "not set"],
+    ["auto_skill_evolution", r.auto_skill_evolution],
     ["access_token", r.access_token_set ? "set" : "not set"],
     ["credential_type", r.credential_type ?? "none"],
     ["auto_capture", r.auto_capture],
@@ -334,6 +375,12 @@ function formatStatusResult(r) {
     display.push(["hooks_node", r.hooks_node]);
     display.push(["hooks_node_ok", r.hooks_node_ok]);
   }
+  if (r.hook_activation) {
+    const activation = r.hook_activation;
+    display.push(["hook_trust", activation.trust], ["runtime_ready", "\u5F85\u786E\u8BA4"], ["hook_config", activation.config_path]);
+    lines.push(`${BOLD}${highlightInlineCode(String(activation.next_action))}${RESET}
+`);
+  }
   if (r.ping_error) display.push(["ping_error", r.ping_error]);
   const maxKey = Math.max(...display.map(([k]) => k.length));
   for (const [k, v] of display) {
@@ -342,19 +389,19 @@ function formatStatusResult(r) {
   }
   return lines.join("\n");
 }
-function printResult(value, json, command) {
+function printResult(value2, json, command) {
   if (json) {
-    process.stdout.write(JSON.stringify(value, null, 2) + "\n");
-  } else if (isMultiAgentResult(value)) {
-    process.stdout.write(formatMultiAgentResult(value) + "\n");
-  } else if (isUpgradeResult(value)) {
-    process.stdout.write(formatUpgradeResult(value) + "\n");
-  } else if (isSetupResult(value)) {
-    process.stdout.write(formatSetupResult(value, command ?? "setup") + "\n");
-  } else if (isStatusResult(value)) {
-    process.stdout.write(formatStatusResult(value) + "\n");
+    process.stdout.write(JSON.stringify(value2, null, 2) + "\n");
+  } else if (isMultiAgentResult(value2)) {
+    process.stdout.write(formatMultiAgentResult(value2) + "\n");
+  } else if (isUpgradeResult(value2)) {
+    process.stdout.write(formatUpgradeResult(value2) + "\n");
+  } else if (isSetupResult(value2)) {
+    process.stdout.write(formatSetupResult(value2, command ?? "setup") + "\n");
+  } else if (isStatusResult(value2)) {
+    process.stdout.write(formatStatusResult(value2) + "\n");
   } else {
-    process.stdout.write(summarize(value) + "\n");
+    process.stdout.write(summarize(value2) + "\n");
   }
 }
 function agentFromFlags(flags) {
@@ -395,11 +442,11 @@ import {
   rmdirSync,
   unlinkSync,
   statSync
-} from "fs";
-import { homedir } from "os";
-import { join, dirname, resolve } from "path";
-import { fileURLToPath } from "url";
-import { execFileSync } from "child_process";
+} from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { execFileSync } from "node:child_process";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { setupAuthentication, oauthProfileStatus, validateDataBaseUrl } from "@aliyunrds/ctxdb-shared";
 
@@ -440,7 +487,7 @@ function skillInstallRoot(agent) {
       return join(homedir(), ".workbuddy-ai", "skills");
   }
 }
-var SKILL_DIRS = ["contextdb-memory", "contextdb-knowledge"];
+var SKILL_DIRS = ["contextdb-memory", "contextdb-knowledge", "contextdb-skills"];
 var LEGACY_SKILL_DIRS = ["ctxdb"];
 function agentSupportsHooks(agent) {
   if (agent === "opencode" || agent === "hermes") return false;
@@ -470,7 +517,23 @@ var LEGACY_QODER_SKILL_DIRS = [
   "rds-ctxdb-qoder",
   "qoder-ctxdb"
 ];
-var HOOK_EVENTS = ["UserPromptSubmit", "Stop", "SessionStart"];
+var HOOK_EVENTS = ["UserPromptSubmit", "Stop", "SessionStart", "SessionEnd"];
+var CODEX_HOOKS_TRUST_HINT = "\u5F85\u786E\u8BA4\uFF1ACodex Hook \u4FE1\u4EFB\u5C1A\u672A\u6838\u5B9E\uFF0C\u5B89\u88C5\u6210\u529F\u548C\u8FDE\u63A5\u6210\u529F\u4E0D\u4EE3\u8868\u81EA\u52A8\u63D0\u70BC\u5DF2\u5C31\u7EEA\u3002CLI \u8F93\u5165 `/hooks`\uFF1B\u684C\u9762\u7248\u8FDB\u5165 \u8BBE\u7F6E \u2192 `Hooks\uFF08\u94A9\u5B50\uFF09` \u2192 `\u7528\u6237\u914D\u7F6E`\uFF0C\u4EC5\u68C0\u67E5\u5E76\u4FE1\u4EFB `@aliyunrds/ctxdb` \u7684 `SessionStart`\u3001`UserPromptSubmit`\u3001`Stop`\u3001`SessionEnd`\u3002\u91CD\u542F\u5BA2\u6237\u7AEF\u540E\u65B0\u5EFA\u4F1A\u8BDD\u5E76\u53D1\u9001\u666E\u901A\u6D88\u606F\uFF0C\u518D\u8FD0\u884C `ctxdb skill status --agent codex --json` \u6838\u5BF9\u8BE5\u4F1A\u8BDD\u7684\u91C7\u96C6\u8BB0\u5F55\u3002";
+function codexHookActivation() {
+  return {
+    trust: "unverified",
+    runtime_ready: null,
+    config_path: hookConfigPath("codex"),
+    required_events: [...HOOK_EVENTS],
+    next_action: CODEX_HOOKS_TRUST_HINT
+  };
+}
+function codexHookDefinitions() {
+  const file = hookConfigPath("codex");
+  if (!existsSync(file)) return "[]";
+  const data = JSON.parse(readFileSync(file, "utf8"));
+  return JSON.stringify(Object.entries(data.hooks ?? {}).sort(([a], [b]) => a.localeCompare(b)).flatMap(([event, entries]) => Array.isArray(entries) ? entries.filter(entryIsCtxdb).map((entry) => [event, entry]) : []));
+}
 var MIN_NODE_MAJOR = 20;
 function parseNodeMajor(version) {
   const match = /^v?(\d+)/.exec(version.trim());
@@ -501,6 +564,7 @@ async function runSetup(options) {
     return { ok: false, steps };
   }
   const agent = options.agent;
+  let codexDefinitionsChanged;
   const installSkill = options.installSkill !== false;
   const validate = options.validate !== false;
   const nodeVersionCheck = checkCurrentNodeVersion();
@@ -629,6 +693,7 @@ async function runSetup(options) {
     if (!nodeCheck.ok) return { ok: false, steps };
     if (primaryHomeExists) {
       try {
+        const before = agent === "codex" ? codexHookDefinitions() : void 0;
         backupSettingsJson(agent);
         steps.push({ step: "backup-settings", ok: true });
         const removed = stripCtxdbHooks(agent);
@@ -640,6 +705,7 @@ async function runSetup(options) {
           });
         }
         appendHooks(agent, hookPaths);
+        if (agent === "codex") codexDefinitionsChanged = before !== codexHookDefinitions();
         steps.push({ step: "append-hooks", ok: true });
       } catch (err) {
         steps.push({
@@ -654,6 +720,7 @@ async function runSetup(options) {
       chmodSync(hookPaths.userPromptSubmit, 493);
       chmodSync(hookPaths.stop, 493);
       chmodSync(hookPaths.sessionStart, 493);
+      if (hookPaths.sessionEnd) chmodSync(hookPaths.sessionEnd, 493);
       if (hookPaths.preToolUse && existsSync(hookPaths.preToolUse)) {
         chmodSync(hookPaths.preToolUse, 493);
       }
@@ -816,11 +883,14 @@ async function runSetup(options) {
   }
   const failedSteps = steps.filter((s) => !s.ok);
   const ok = failedSteps.length === 0;
-  const actionRequired = agent === "hermes" && failedSteps.length === 1 && failedSteps[0]?.step === "check-hermes-hook-allowlist" ? "hermes-hook-allowlist" : void 0;
+  const actionRequired = agent === "hermes" && failedSteps.length === 1 && failedSteps[0]?.step === "check-hermes-hook-allowlist" ? "hermes-hook-allowlist" : agent === "codex" && failedSteps.length === 0 && codexDefinitionsChanged !== void 0 ? "review-codex-hook-trust" : void 0;
   const hints = ok ? [UNINSTALL_ORDER_HINT] : [];
-  if (actionRequired) {
+  if (actionRequired === "hermes-hook-allowlist") {
     hints.unshift(HERMES_ALLOWLIST_ACTION_HINT, HERMES_WEBUI_GATEWAY_HINT);
   }
+  if (actionRequired === "review-codex-hook-trust") {
+    hints.unshift(CODEX_HOOKS_TRUST_HINT, codexDefinitionsChanged ? "ContextDB Hook \u5B9A\u4E49\u5DF2\u65B0\u589E\u6216\u53D8\u66F4\uFF1BCodex \u6309\u5B9A\u4E49\u54C8\u5E0C\u8BB0\u5F55\u4FE1\u4EFB\uFF0C\u8BF7\u91CD\u65B0\u68C0\u67E5\u6388\u6743\u3002" : "ContextDB Hook \u5B9A\u4E49\u672A\u53D8\u5316\uFF1B\u8FD9\u4E0D\u8BC1\u660E\u5DF2\u6388\u6743\uFF0C\u4E5F\u4E0D\u4F1A\u4FEE\u6539\u5BBF\u4E3B\u7684\u4FE1\u4EFB\u8BB0\u5F55\u3002");
+  }
   if (ok && agent === "opencode") {
     hints.unshift(
       `OpenCode plugin shim: ${opencodeShimPath()}`,
@@ -838,6 +908,7 @@ async function runSetup(options) {
     ok,
     steps,
     actionRequired,
+    ...actionRequired === "review-codex-hook-trust" ? { hook_activation: { ...codexHookActivation(), definitions_changed: codexDefinitionsChanged } } : {},
     hints: hints.length > 0 ? hints : void 0
   };
 }
@@ -1500,6 +1571,7 @@ function hookPathsFromDir(dir, ext) {
       userPromptSubmit: ups,
       stop: stp,
       sessionStart: ss,
+      sessionEnd: existsSync(join(dir, `session-end.${ext}`)) ? join(dir, `session-end.${ext}`) : void 0,
       preToolUse: existsSync(ptu) ? ptu : void 0,
       hermesPreLlmCall: existsSync(hpl) ? hpl : void 0,
       hermesPostLlmCall: existsSync(hpost) ? hpost : void 0
@@ -1616,6 +1688,7 @@ function appendHooksToFile(path, agent, hookPaths) {
   appendOne(data.hooks, "UserPromptSubmit", hookPaths.userPromptSubmit, agent);
   appendOne(data.hooks, "Stop", hookPaths.stop, agent);
   appendOne(data.hooks, "SessionStart", hookPaths.sessionStart, agent);
+  if ((agent === "codex" || agent === "claude" || agent === "workbuddy") && hookPaths.sessionEnd) appendOne(data.hooks, "SessionEnd", hookPaths.sessionEnd, agent);
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, JSON.stringify(data, null, 2) + "\n", "utf-8");
 }
@@ -1684,7 +1757,7 @@ function appendOne(hooks, event, command, agent) {
     )
   );
   if (dup) return;
-  const inner = useExecForm ? { type: "command", command: process.execPath, args: [command, `--agent=${agent}`], timeout: 60 } : { type: "command", command: shellCmd, timeout: 60 };
+  const inner = useExecForm ? { type: "command", command: process.execPath, args: [command, `--agent=${agent}`], timeout: 60 } : { type: "command", command: shellCmd, timeout: event === "SessionEnd" ? 3 : 60 };
   const entry = {
     hooks: [inner],
     [ENTRY_MARKER_KEY]: ENTRY_MARKER_VALUE,
@@ -1753,8 +1826,8 @@ function hermesHooksMap(data) {
   }
   return data.hooks;
 }
-function quoteHermesCommandPart(value) {
-  return `'${value.replace(/'/g, `'\\''`)}'`;
+function quoteHermesCommandPart(value2) {
+  return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
 function hermesHookCommand(scriptPath, nodePath) {
   return `${quoteHermesCommandPart(nodePath)} ${quoteHermesCommandPart(scriptPath)} --agent=hermes`;
@@ -1960,11 +2033,11 @@ function inspectCodexHooksFeature(rawContent) {
       };
     }
     if (/^features\.hooks\s*=/.test(stripped)) {
-      const value = stripped.split("=", 2)[1]?.trim();
-      if (value === "true") return { kind: "already-enabled" };
+      const value2 = stripped.split("=", 2)[1]?.trim();
+      if (value2 === "true") return { kind: "already-enabled" };
       return {
         kind: "ambiguous",
-        reason: `features.hooks already set to '${value}' via dotted-key \u2014 please set it to true manually`
+        reason: `features.hooks already set to '${value2}' via dotted-key \u2014 please set it to true manually`
       };
     }
   }
@@ -1989,12 +2062,12 @@ function inspectCodexHooksFeature(rawContent) {
     if (!inFeatures) continue;
     const kv = stripped.match(/^hooks\s*=\s*(.+)$/);
     if (kv) {
-      const value = kv[1].trim();
-      if (value === "true") return { kind: "already-enabled" };
-      if (value === "false") return { kind: "features-with-hooks-false" };
+      const value2 = kv[1].trim();
+      if (value2 === "true") return { kind: "already-enabled" };
+      if (value2 === "false") return { kind: "features-with-hooks-false" };
       return {
         kind: "ambiguous",
-        reason: `[features].hooks already set to '${value}' \u2014 please set it to true manually`
+        reason: `[features].hooks already set to '${value2}' \u2014 please set it to true manually`
       };
     }
   }
@@ -2210,10 +2283,6 @@ FLAGS
   --no-validate         Skip connectivity ping after setup
   --json                Machine-readable JSON output
 `;
-var CODEX_HOOKS_TRUST_REMINDER = [
-  "codex hooks \u914D\u7F6E\u540E\uFF0C\u9700\u8981\u91CD\u542F Codex \u5BF9\u8BDD\uFF0C\u5728\u5F39\u51FA\u7684 hooks \u786E\u8BA4\u754C\u9762\u9009\u62E9`\u63A5\u6536\u6240\u6709 hooks(\u94A9\u5B50)`\u9009\u9879\u3002",
-  "\u5982\u679C\u4F7F\u7528\u7684\u662F Codex App \u684C\u9762\u7248\uFF0C\u64CD\u4F5C\u8DEF\u5F84\u662F\uFF1A\u5DE6\u4E0B\u89D2\u70B9\u51FB\u7528\u6237\u540D \u2192 \u70B9\u51FB\u8BBE\u7F6E \u2192 \u70B9\u51FB\u4FA7\u8FB9\u680F\u7684 `Hooks\uFF08\u94A9\u5B50\uFF09`\u2192 \u70B9\u51FB`\u7528\u6237\u914D\u7F6E`\uFF0C\u4FE1\u4EFB `UserPromptSubmit`\u3001`SessionStart` \u548C `Stop` \u91CC\u7684 `aliyunrds/ctxdb` \u94A9\u5B50\u3002"
-].join("\n");
 var FULL_APP_RESTART_REMINDERS = {
   qoder: "Next action: \u8BF7\u5B8C\u5168\u9000\u51FA\u5E76\u91CD\u65B0\u542F\u52A8 Qoder\uFF08\u4E0D\u662F\u53EA\u5173\u95ED\u5F53\u524D\u5BF9\u8BDD\uFF09\uFF0C\u4F7F\u65B0\u7684 hooks \u548C skill \u751F\u6548\u3002",
   qoderwork: "Next action: \u8BF7\u5B8C\u5168\u9000\u51FA\u5E76\u91CD\u65B0\u542F\u52A8 QoderWork\uFF08\u4E0D\u662F\u53EA\u5173\u95ED\u5F53\u524D\u5BF9\u8BDD\uFF09\uFF0C\u4F7F\u65B0\u7684 hooks \u548C skill \u751F\u6548\u3002",
@@ -2221,7 +2290,7 @@ var FULL_APP_RESTART_REMINDERS = {
 };
 function postSetupReminders(agent) {
   const reminder = FULL_APP_RESTART_REMINDERS[agent];
-  return [...reminder ? [reminder] : [], ...agent === "codex" ? [CODEX_HOOKS_TRUST_REMINDER] : []];
+  return [...reminder ? [reminder] : [], ...agent === "codex" ? [CODEX_HOOKS_TRUST_HINT] : []];
 }
 function printPostSetupReminder(agent) {
   for (const reminder of postSetupReminders(agent)) process.stderr.write(`
@@ -2387,6 +2456,8 @@ async function inspectStatus(agent) {
       base_url: cfg.baseUrl,
       user_id: cfg.userId,
       api_key_set: Boolean(cfg.apiKey),
+      auto_skill_evolution: cfg.autoSkillEvolution,
+      ...agent === "codex" ? { hook_activation: codexHookActivation() } : {},
       access_token_set: credential?.type === "access-token",
       credential_type: credential?.type ?? null,
       auto_capture: cfg.autoCapture,
@@ -2665,7 +2736,7 @@ FLAGS
   --json            Machine-readable JSON output
 
 Note: This command only installs skill files (contextdb, contextdb-memory,
-contextdb-knowledge). It does not write config or install hooks.
+contextdb-knowledge, contextdb-skills). It does not write config or install hooks.
 To configure server connection, run: ctxdb setup --api-key=<key> --base-url=<url>
 `;
 function skillInstall(args) {
@@ -2719,6 +2790,603 @@ function skillInstall(args) {
   return ok ? 0 : 1;
 }
 
+// src/skills/session-selector.ts
+import { homedir as homedir2 } from "node:os";
+import { join as join3, win32 } from "node:path";
+import { existsSync as existsSync3 } from "node:fs";
+
+// src/skills/status.ts
+import { existsSync as existsSync2, readdirSync as readdirSync2, lstatSync } from "node:fs";
+import "node:path";
+function statusBindings(root, agent) {
+  const dir = privatePath(root, "sessions", "bindings");
+  if (!existsSync2(dir)) return [];
+  return readdirSync2(dir).filter((name) => /^[a-f0-9-]{36}\.json$/.test(name)).map((name) => getBinding(name.slice(0, -5), root)).filter((bound) => !agent || bound.agent === agent).sort((a, b) => Number(b.active === true) - Number(a.active === true));
+}
+function localSkillStatus(bound, root) {
+  const spool = readSpool(bound, root), business = businessEvents(spool);
+  const calls = new Set(business.filter((e) => e.type === "tool_call").map((e) => e.tool_call_id));
+  const results = new Set(spool.events.filter((e) => e.type === "tool_result").map((e) => e.tool_call_id));
+  const unpaired = spool.events.filter((e) => e.type === "tool_call" && !results.has(e.tool_call_id)).map((e) => e.tool_call_id);
+  const path = (...parts) => privatePath(root, ...parts);
+  const skills = path("skills", bound.scope_key), evolution = path("skill-evolution", bound.scope_key);
+  const directory = path(spoolDirectory(bound));
+  const list = (dir) => existsSync2(dir) ? readdirSync2(dir) : [];
+  const dispositions = list(path(directory, "dispositions")).filter((n) => /^\d+-\d+\.json$/.test(n)).map((name) => {
+    const file = path(directory, "dispositions", name);
+    const d = readState(root, file);
+    return {
+      path: file,
+      status: d.status,
+      reason: d.reason,
+      from_sequence: d.from_sequence,
+      through_sequence: d.through_sequence,
+      event_count: d.event_count,
+      buffer_bytes: d.buffer_bytes,
+      created_at: d.created_at
+    };
+  });
+  const publications = [], evaluations = [];
+  for (const name of list(path(evolution, "artifacts"))) {
+    if (/^upload-[a-f0-9-]{36}$/.test(name)) {
+      const file = path(evolution, "artifacts", name, "publication.json");
+      const p = readState(root, file);
+      if (p.binding_id !== bound.id) continue;
+      publications.push({
+        evaluation_id: p.evaluation_id,
+        request_id: p.input.client_request_id,
+        source: p.input.source,
+        result: p.result,
+        verified: p.verified ?? false,
+        manifest_refreshed: p.manifest_refreshed,
+        active_advanced: p.active_advanced,
+        receipt_path: file,
+        bundle_path: path(evolution, "artifacts", name, "bundle.zip")
+      });
+    } else if (/^evaluation-[a-f0-9-]{36}\.json$/.test(name)) {
+      const file = path(evolution, "artifacts", name), e = readState(root, file);
+      if (e.binding_id === bound.id) evaluations.push({ request_id: e.evidence.client_request_id, result: e.result, path: file });
+    }
+  }
+  const handoffs = list(path(directory, "handoffs")).filter((n) => /^[a-zA-Z0-9_-]{1,128}\.json$/.test(n)).map((name) => {
+    const file = path(directory, "handoffs", name), h = readState(root, file);
+    const related = publications.filter((p) => p.evaluation_id === h.event_id);
+    return {
+      event_id: h.event_id,
+      delivery: h.delivery,
+      recorded_at: h.recorded_at,
+      completion: related.some((p) => p.verified) ? "published" : related.length ? "publication_unconfirmed" : "unconfirmed",
+      automatic_redelivery: false,
+      path: file
+    };
+  });
+  const loaded = (bound.loaded_versions ?? []).map((ref) => ({
+    ...ref,
+    path: path(skills, "cache", ref.skill_id, ref.version_id, "bundle", "SKILL.md")
+  }));
+  const manifestPath = path(skills, "manifest.json");
+  const snapshot = existsSync2(manifestPath) ? readState(root, manifestPath) : void 0;
+  const drafts = list(path(skills, "drafts")).flatMap((name) => {
+    if (!lstatSync(path(skills, "drafts", name)).isDirectory()) return [];
+    const direct = path(skills, "drafts", name, "SKILL.md"), bundle = path(skills, "drafts", name, "bundle", "SKILL.md");
+    return [direct, bundle].filter((file) => existsSync2(file));
+  });
+  const submissions = list(path(directory, "submissions")).filter((n) => /^[a-f0-9-]{36}\.json$/.test(n)).map((name) => {
+    const file = path(directory, "submissions", name);
+    const bytes = readPrivate(root, file, 65536), e = JSON.parse(bytes.toString("utf8"));
+    return {
+      path: file,
+      request_id: e.client_request_id,
+      trigger: e.trigger,
+      request_bytes: bytes.length,
+      distinct_tool_calls: new Set(e.events.filter((event) => event.type === "tool_call").map((event) => event.tool_call_id)).size,
+      event_count: e.events.length,
+      goal_characters: Array.from(e.goal ?? "").length,
+      max_summary_characters: Math.max(0, ...e.events.map((event) => Array.from(event.summary ?? "").length))
+    };
+  });
+  const trigger = threshold(spool);
+  const waiting = bound.active === false ? "inactive_session" : spool.maintenance?.active ? "agent_maintenance" : spool.current ? "evaluation_in_progress_or_awaiting_delivery" : !autoCollectAllowed(bound, root) ? "automatic_capture_disabled" : !trigger ? "below_threshold" : "awaiting_complete_host_checkpoint";
+  return {
+    binding_id: bound.id,
+    session_id: bound.session_id,
+    agent: bound.agent,
+    endpoint: bound.endpoint,
+    auth_scope: bound.auth_scope,
+    scope_key: bound.scope_key,
+    active: bound.active,
+    verified: bound.verified,
+    auto_evolution_allowed: bound.auto_evolution_allowed,
+    current: spool.current,
+    error: spool.error,
+    maintenance: spool.maintenance,
+    buffered_events: spool.events.length,
+    buffer_bytes: spool.buffer_bytes,
+    buffer: {
+      business_events: business.length,
+      distinct_tool_calls: calls.size,
+      bytes: spool.buffer_bytes,
+      threshold_reached: !!trigger,
+      trigger,
+      tool_call_threshold: 10,
+      bytes_threshold: 40960,
+      max_request_bytes: 65536,
+      max_events: 200,
+      max_summary_characters: 2e3,
+      unpaired_call_ids: unpaired,
+      has_final_answer_hash: !!spool.last_answer_hash,
+      waiting_reason: waiting
+    },
+    ...bound.agent === "codex" ? { hook_activation: {
+      trust: "unverified",
+      runtime_ready: null,
+      binding_record: "present",
+      transcript_checkpoint: spool.cursor > 0 ? "present" : "not_observed",
+      evidence_capture: spool.events.length > 0 || submissions.some((s) => s.event_count > 0) || dispositions.some((d) => Number(d.event_count) > 0) ? "present" : "not_observed",
+      evaluation_submission: spool.current?.event_id ? "accepted" : submissions.length ? "prepared" : "not_observed",
+      last_checkpoint_at: spool.updated_at ?? null,
+      note: "Local records are not Codex trust receipts. A binding can be created by CLI; historical capture or submission does not prove current hooks are trusted. Match this session to your new conversation. Missing records can mean no event yet, an unloaded hook, missing trust, or execution failure."
+    } } : {},
+    state_exists: existsSync2(path(directory, "state.json")),
+    cursor: spool.cursor,
+    submitted_through_sequence: spool.submitted_through_sequence,
+    processed_through_sequence: spool.processed_through_sequence,
+    updated_at: spool.updated_at,
+    dispositions,
+    submissions,
+    publications,
+    evaluations,
+    handoffs,
+    scope_drafts: drafts,
+    loaded_versions: loaded,
+    manifest: {
+      path: manifestPath,
+      exists: !!snapshot,
+      status: bound.manifest_status,
+      fetched_at: snapshot?.fetched_at,
+      skills: snapshot?.manifest.skills ?? []
+    },
+    paths: {
+      binding: path(bindingPath(bound)),
+      state: path(directory, "state.json"),
+      skills,
+      drafts: path(skills, "drafts"),
+      cache: path(skills, "cache"),
+      evolution,
+      submissions: path(directory, "submissions"),
+      dispositions: path(directory, "dispositions"),
+      current_submission: spool.current ? path(directory, "submissions", `${spool.current.request_id}.json`) : null
+    },
+    notes: [
+      "Buffer counts only unsubmitted evidence and clears after accepted submission; submissions retain the submitted call/event/byte counts.",
+      "Inactive sessions may be host initialization sessions; match session_id to the actual conversation before interpreting counters.",
+      "A delivered handoff is not completion. Unconfirmed includes ignored, interrupted or permission-blocked work; absence of a receipt cannot identify the reason. No automatic redelivery.",
+      "Drafts and manifest are scope-wide; draft ownership is not inferred from directory existence.",
+      "Loaded versions may come from publication verification or manual Load; they do not prove business reuse.",
+      "Local current is a checkpoint snapshot; use --remote for server status. A final-answer hash alone does not certify a complete boundary."
+    ]
+  };
+}
+
+// src/skills/session-selector.ts
+function qoderWorkDatabase(platform2 = process.platform, home = homedir2(), appData = process.env.APPDATA) {
+  if (platform2 === "darwin") return join3(home, "Library", "Application Support", "QoderWork", "data", "agents.db");
+  if (platform2 === "win32") return win32.join(appData || win32.join(home, "AppData", "Roaming"), "QoderWork", "data", "agents.db");
+  throw new Error("qoderwork_chat_lookup_platform_unsupported_use_binding_id");
+}
+async function selectSkillSessions(id, agent, root) {
+  if (!id.trim() || id.length > 256) throw new Error("invalid_session_id");
+  const bindings = statusBindings(root, agent);
+  const direct = bindings.filter((b) => b.session_id === id);
+  if (direct.length) return { bindings: direct, host_chat_id: void 0, unbound_session_ids: [] };
+  if (agent !== "qoderwork") throw new Error("session_binding_not_found");
+  const database = qoderWorkDatabase();
+  if (!existsSync3(database)) throw new Error("qoderwork_database_not_found");
+  const [major, minor] = process.versions.node.split(".").map(Number);
+  if (major < 22 || major === 22 && minor < 13 || major === 23 && minor < 4) {
+    throw new Error("qoderwork_chat_lookup_requires_node_22_13_or_newer_use_binding_id");
+  }
+  let sqlite;
+  try {
+    sqlite = await import("node:sqlite");
+  } catch {
+    throw new Error("qoderwork_chat_lookup_requires_node_22_13_or_newer_use_binding_id");
+  }
+  let rows;
+  try {
+    const db = new sqlite.DatabaseSync(database, { readOnly: true });
+    try {
+      rows = db.prepare("SELECT s.session_id FROM chats c LEFT JOIN sub_chats s ON s.chat_id=c.id WHERE c.id=? ORDER BY s.session_id").all(id);
+      if (rows.some((r) => !(r.session_id === null || typeof r.session_id === "string"))) throw new Error();
+    } finally {
+      db.close();
+    }
+  } catch {
+    throw new Error("qoderwork_database_unreadable_or_schema_unsupported_use_binding_id");
+  }
+  if (!rows.length) throw new Error("qoderwork_chat_not_found");
+  const ids = [...new Set(rows.map((r) => r.session_id).filter((s) => !!s))];
+  if (!ids.length) throw new Error("qoderwork_session_not_started");
+  const matched = bindings.filter((b) => ids.includes(b.session_id));
+  const unbound = ids.filter((id2) => !matched.some((b) => b.session_id === id2));
+  return { bindings: matched, host_chat_id: id, unbound_session_ids: unbound };
+}
+
+// src/skills/evaluation.ts
+import { randomUUID } from "node:crypto";
+import { existsSync as existsSync4 } from "node:fs";
+import { join as join4 } from "node:path";
+async function submitManualEvaluation(binding2, client, input, source, requestId, root = skillRoot()) {
+  const { client_request_id: ignored, ...rest } = input;
+  const body = { ...rest, submission_mode: "manual", trigger: "manual" };
+  const artifacts = join4("skill-evolution", binding2.scope_key, "artifacts");
+  const index = join4(artifacts, `manual-${sha256(JSON.stringify([source, body]))}.json`);
+  const id = requestId ? requireUuid(requestId) : await withStateLock(root, index, async () => {
+    if (existsSync4(privatePath(root, index))) return requireUuid(readState(root, index).request_id);
+    const request_id = randomUUID();
+    writeState(root, index, { request_id });
+    return request_id;
+  });
+  const evidence = { ...body, client_request_id: id };
+  validateEvidence(evidence);
+  const path = join4(artifacts, `evaluation-${id}.json`);
+  return withStateLock(root, path, async () => {
+    let state;
+    if (existsSync4(privatePath(root, path))) {
+      state = readState(root, path);
+      if (JSON.stringify(state.evidence) !== JSON.stringify(evidence)) throw new Error("idempotency_payload_mismatch");
+    } else {
+      state = { binding_id: binding2.id, evidence };
+      writeState(root, path, state);
+    }
+    if (!state.result) {
+      const result = unbox(await client.postJson("/v1/skill-evolution/evaluations", evidence));
+      if (!result || !/^[a-zA-Z0-9_-]{1,128}$/.test(result.event_id) || typeof result.status !== "string") throw new Error("invalid_evaluation_response");
+      state.result = result;
+      writeState(root, path, state);
+    }
+    return state.result;
+  });
+}
+
+// src/cli/skill-storage-cli.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { join as join5, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync5, readdirSync as readdirSync3, rmSync as rmSync2 } from "node:fs";
+function value(args, name) {
+  const item = args.flags[name];
+  if (item === true) throw new Error(`--${name} requires a value`);
+  return item;
+}
+async function binding(args) {
+  const id = value(args, "session");
+  if (id) return getBinding(id);
+  if (process.env.CODEX_THREAD_ID || process.env.CODEX_SESSION_ID || process.env.CLAUDE_CODE_ENTRYPOINT || process.env.CTXDB_SKILL_REQUIRE_SESSION === "1") throw new Error("session_binding_required");
+  return bindSession(agentFromFlags(args.flags), `terminal-${randomUUID2()}`, skillRoot(), 3e4);
+}
+var skillBind = async (args) => {
+  const session = value(args, "session-id");
+  if (!session) throw new Error("--session-id is required");
+  const result = await bindSession(agentFromFlags(args.flags), session, skillRoot(), 3e4);
+  const client = await verifiedClient(result);
+  await refreshManifest(result, client);
+  printResult({ binding_id: result.id, auth_scope: result.auth_scope }, !!args.flags.json);
+  return 0;
+};
+var skillManifest = async (args) => {
+  const bound = await binding(args), client = await verifiedClient(bound);
+  const snapshot = await refreshManifest(bound, client);
+  printResult({ ...snapshot, catalog_context: catalogContext(bound) }, !!args.flags.json);
+  return 0;
+};
+var skillList = async (args) => {
+  const bound = await binding(args), client = await verifiedClient(bound);
+  const snapshot = await refreshManifest(bound, client);
+  const result = {
+    fetched_at: snapshot.fetched_at,
+    auth_scope: snapshot.manifest.auth_scope,
+    skills: [...snapshot.manifest.skills].sort((left, right) => left.display_name.localeCompare(right.display_name) || left.skill_id.localeCompare(right.skill_id))
+  };
+  if (args.flags.json) printResult(result, true);
+  else if (result.skills.length === 0) process.stdout.write("No active Skills.\n");
+  else process.stdout.write(`${result.skills.length} active Skill${result.skills.length === 1 ? "" : "s"}:
+${result.skills.map((entry) => `- ${entry.display_name} (${entry.category})
+  skill_id: ${entry.skill_id}
+  active_version_id: ${entry.active_version_id}
+  updated_at: ${entry.updated_at}`).join("\n")}
+`);
+  return 0;
+};
+async function effectiveSkillConfig(args) {
+  const bound = await binding(args), client = await verifiedClient(bound);
+  const remote = unbox(await client.get("/v1/skill-evolution/config"));
+  const localEnabled = load({ agent: bound.agent, path: join5(skillRoot(), configFileName()) }).autoSkillEvolution !== false;
+  return {
+    ...remote,
+    local_auto_evolution_enabled: localEnabled,
+    effective_auto_evolution_enabled: localEnabled && remote.auto_evolution_enabled === true
+  };
+}
+function localConfigAgent(args, requireExplicit = false) {
+  const session = value(args, "session");
+  if (session) {
+    if (requireExplicit) throw new Error("--session cannot be used for local config changes");
+    const bound = getBinding(session);
+    const requested = args.flags.agent === void 0 ? void 0 : agentFromFlags(args.flags);
+    if (requested && requested !== bound.agent) throw new Error("session_agent_mismatch");
+    return bound.agent;
+  }
+  if (requireExplicit && typeof args.flags.agent !== "string") throw new Error("--agent is required for local config changes");
+  return agentFromFlags(args.flags);
+}
+function localAutoEvolution(agent) {
+  return load({ agent, path: join5(skillRoot(), configFileName()) }).autoSkillEvolution !== false;
+}
+var skillConfig = async (args) => {
+  const [action, key, rawValue, ...extra] = args.positional;
+  if (!action || action === "get" && !key) {
+    if (rawValue || extra.length) throw new Error("invalid_skill_config_command");
+    printResult(await effectiveSkillConfig(args), !!args.flags.json);
+    return 0;
+  }
+  if (!["get", "set", "unset"].includes(action) || key !== "auto-skill-evolution" || extra.length) {
+    throw new Error("invalid_skill_config_command");
+  }
+  if (action === "get") {
+    if (rawValue) throw new Error("invalid_skill_config_command");
+    const agent2 = localConfigAgent(args);
+    printResult({ key, agent: agent2, value: localAutoEvolution(agent2), source: "local" }, !!args.flags.json);
+    return 0;
+  }
+  const agent = localConfigAgent(args, true);
+  let enabled;
+  if (action === "set") {
+    if (rawValue !== "on" && rawValue !== "off") throw new Error("auto-skill-evolution value must be on or off");
+    enabled = rawValue === "on";
+  } else if (rawValue) throw new Error("invalid_skill_config_command");
+  if (!updateAutoSkillEvolution(agent, enabled, join5(skillRoot(), configFileName()))) throw new Error("agent_config_not_found");
+  printResult({ key, agent, value: localAutoEvolution(agent), source: enabled === void 0 ? "default" : "local" }, !!args.flags.json);
+  return 0;
+};
+var skillSearch = async (args) => {
+  const query = args.positional.join(" ");
+  const topK = Number(value(args, "top-k") ?? 5);
+  if (!query || Array.from(query).length > 512 || !Number.isInteger(topK) || topK < 1 || topK > 10) throw new Error("invalid_search");
+  if (args.flags.local) throw new Error("local_search_removed_use_manifest_or_remote_search");
+  const bound = await binding(args);
+  const result = unbox(await (await verifiedClient(bound)).get("/v1/skills/search", { query, top_k: topK }));
+  printResult(result, !!args.flags.json);
+  return 0;
+};
+var skillLoad = async (args) => {
+  const id = value(args, "skill-id");
+  if (!id) throw new Error("--skill-id is required");
+  const bound = await binding(args), client = await verifiedClient(bound);
+  printResult(await loadSkill(bound, client, id, value(args, "version-id"), !!args.flags.editable), !!args.flags.json);
+  return 0;
+};
+var skillDelete = (args) => skillDisable(args, true);
+var skillDisable = async (args, deleteHistory = false) => {
+  const id = value(args, "skill-id");
+  if (!id) throw new Error("--skill-id is required");
+  requireUuid(id);
+  const bound = await binding(args);
+  if (readSpool(bound).maintenance?.active) throw new Error("management_requires_user_instruction");
+  const client = await verifiedClient(bound);
+  const result = unbox(await client.delete("/v1/skills", {
+    skill_id: id,
+    ...deleteHistory ? { delete_history: true } : {}
+  }));
+  if (result.skill_id !== id || result.deleted !== true) throw new Error("invalid_disable_response");
+  await refreshManifest(bound, client);
+  printResult(result, !!args.flags.json);
+  return 0;
+};
+var skillRollback = async (args) => {
+  const id = value(args, "skill-id"), version = value(args, "version-id"), base = value(args, "base-version-id");
+  if (!id || !version || !base) throw new Error("rollback_requires_skill_version_and_base");
+  [id, version, base].forEach(requireUuid);
+  const reason = value(args, "revoke-reason");
+  if (reason !== void 0 && (!reason.trim() || reason.length > 1e3)) throw new Error("invalid_revoke_reason");
+  const bound = await binding(args);
+  if (readSpool(bound).maintenance?.active) throw new Error("management_requires_user_instruction");
+  const client = await verifiedClient(bound);
+  const result = unbox(await client.postJson("/v1/skills/rollback", {
+    skill_id: id,
+    version_id: version,
+    base_version_id: base,
+    ...reason ? { revoke_reason: reason } : {}
+  }));
+  if (result.skill_id !== id || result.version_id !== version || result.action !== "rollback") throw new Error("invalid_rollback_response");
+  await refreshManifest(bound, client);
+  printResult(result, !!args.flags.json);
+  return 0;
+};
+var skillValidate = async (args) => {
+  const path = args.positional[0];
+  if (!path) throw new Error("package path is required");
+  const pkg = await readPackage(resolve2(path));
+  printResult({
+    valid: true,
+    validation_scope: "static_package",
+    scripts_executed: false,
+    bundle_hash: pkg.hash,
+    bundle_size_bytes: pkg.zip.length,
+    file_count: pkg.files.size,
+    name: pkg.metadata.name,
+    version: pkg.metadata.version
+  }, !!args.flags.json);
+  return 0;
+};
+var skillUpload = async (args) => {
+  const path = args.positional[0];
+  if (!path) throw new Error("package path is required");
+  const skillId = value(args, "skill-id"), base = value(args, "base-version-id");
+  if (!!skillId !== !!base) throw new Error("update_requires_skill_and_base_version");
+  if (skillId) {
+    requireUuid(skillId);
+    requireUuid(base);
+  }
+  const pkg = await readPackage(resolve2(path));
+  const bound = await binding(args), client = await verifiedClient(bound), root = skillRoot();
+  const source = value(args, "source") ?? "import";
+  if (source !== "import" && source !== "evolution") throw new Error("invalid_upload_source");
+  if (readSpool(bound, root).maintenance?.active && source !== "evolution") throw new Error("maintenance_upload_requires_evolution_source");
+  const body = {
+    operation: skillId ? "update" : "create",
+    bundle_hash: pkg.hash,
+    bundle_size_bytes: pkg.zip.length,
+    source,
+    ...skillId ? { skill_id: skillId, base_version_id: base } : {}
+  };
+  const index = join5("skill-evolution", bound.scope_key, "artifacts", `draft-${sha256(resolve2(path))}.json`);
+  const result = await withStateLock(root, index, async () => {
+    const previous = existsSync5(privatePath(root, index)) ? readState(root, index) : void 0;
+    const same = previous && JSON.stringify(previous.body) === JSON.stringify(body);
+    if (previous && !same) {
+      const publicationPath = join5("skill-evolution", bound.scope_key, "artifacts", `upload-${previous.request_id}`, "publication.json");
+      if (existsSync5(privatePath(root, publicationPath)) && !readState(root, publicationPath).result)
+        throw new Error("previous_upload_unresolved_run_status_resume_before_changing_draft");
+    }
+    const requested = value(args, "request-id");
+    if (same && requested && requested !== previous.request_id) throw new Error("retry_requires_original_request_id");
+    const requestId = same ? previous.request_id : requested ?? randomUUID2();
+    requireUuid(requestId);
+    const receipt = join5("skill-evolution", bound.scope_key, "artifacts", `upload-${requestId}`, "publication.json");
+    if (existsSync5(privatePath(root, receipt))) {
+      const original = readState(root, receipt).input;
+      if (JSON.stringify(original) !== JSON.stringify({ ...body, client_request_id: requestId })) throw new Error("idempotency_payload_mismatch");
+    }
+    writeState(root, index, { request_id: requestId, body });
+    return publishPackage(bound, client, pkg, { ...body, client_request_id: requestId }, root);
+  });
+  printResult(result, !!args.flags.json);
+  return 0;
+};
+var skillEvaluate = async (args) => {
+  const file = args.positional[0];
+  if (!file) throw new Error("evidence JSON path is required");
+  const root = skillRoot(), bytes = readPrivate(resolve2(file, ".."), resolve2(file), 65536);
+  const evidence = JSON.parse(bytes.toString("utf8"));
+  if (!evidence || typeof evidence !== "object" || Array.isArray(evidence)) throw new Error("invalid_evidence");
+  const bound = await binding(args), client = await verifiedClient(bound);
+  const result = await submitManualEvaluation(bound, client, evidence, resolve2(file), value(args, "request-id"), root);
+  printResult(result, !!args.flags.json);
+  return 0;
+};
+var skillStatus = async (args) => {
+  const root = skillRoot();
+  let selected = value(args, "session");
+  const sessionId = value(args, "session-id");
+  if (sessionId !== void 0 && selected) throw new Error("session_and_session_id_are_mutually_exclusive");
+  if (sessionId !== void 0 && !value(args, "agent")) throw new Error("--session-id requires --agent");
+  const selection = sessionId !== void 0 ? await selectSkillSessions(sessionId, agentFromFlags(args.flags), root) : void 0;
+  if (selection && (args.flags.remote || args.flags.resume || args.flags["event-id"])) {
+    if (selection.bindings.length !== 1 || selection.unbound_session_ids.length) throw new Error("session_id_requires_unique_binding_use_session");
+    selected = selection.bindings[0].id;
+    args = { ...args, flags: { ...args.flags, session: selected } };
+  }
+  const event = value(args, "event-id");
+  if (args.flags.remote && args.flags.resume) throw new Error("remote_and_resume_are_mutually_exclusive");
+  if (!args.flags.resume && !event) {
+    if (args.flags.remote && !selected) throw new Error("--remote requires --session");
+    const bounds = selection?.bindings ?? (selected ? [getBinding(selected, root)] : statusBindings(root, value(args, "agent")));
+    const sessions = bounds.map((bound2) => ({ ...localSkillStatus(bound2, root), ...selection?.host_chat_id ? { host_chat_id: selection.host_chat_id } : {} }));
+    if (args.flags.remote) {
+      const id = sessions[0]?.current?.event_id;
+      if (id) Object.assign(sessions[0], { evaluation: unbox(await (await verifiedClient(bounds[0])).get("/v1/skill-evolution/evaluations", { event_id: id })) });
+      else if (sessions[0]) Object.assign(sessions[0], { remote_status: "no_event_id" });
+    }
+    const result = { auth_scope: selected ? bounds[0].auth_scope : void 0, sessions, ...selection ? { requested_session_id: sessionId, unbound_session_ids: selection.unbound_session_ids } : {} };
+    if (args.flags.json) printResult(result, true);
+    else {
+      if (!sessions.length) console.log("No Skill sessions found. Start a bound Agent conversation first.");
+      if (selection?.host_chat_id) console.log(`QoderWork chat: ${selection.host_chat_id}`);
+      for (const id of selection?.unbound_session_ids ?? []) console.log(`No ContextDB binding observed for session: ${id}`);
+      for (const s of sessions) {
+        console.log(`${s.binding_id}  ${s.agent}  session=${s.session_id}`);
+        console.log(`  Session: ${s.active === false ? "inactive" : s.active === true ? "active" : "unknown"}`);
+        console.log(`  Workspace: ${s.auth_scope.workspace_id}  Member: ${s.auth_scope.member_id}`);
+        console.log(`  Pending buffer (clears after submission): ${s.buffer.distinct_tool_calls}/10 calls, ${s.buffer.bytes}/40960 bytes, ${s.buffered_events} events; ${s.buffer.waiting_reason}`);
+        console.log(`  Evaluate: ${s.current?.event_id ?? "no_event_id"}; request=${s.current?.request_id ?? "none"}; delivery=${s.current?.delivery ?? "none"}`);
+        if ("evaluation" in s) console.log(`  Server: ${JSON.stringify(s.evaluation)}`);
+        for (const h of s.handoffs) console.log(`  Handoff: ${h.event_id}; delivery=${h.delivery}; completion=${h.completion}; automatic_redelivery=false`);
+        if (s.error) console.log(`  Error: ${s.error}`);
+        for (const d of s.dispositions) console.log(`  Not evaluated: ${d.reason}; events=${d.event_count}, bytes=${d.buffer_bytes}; ${d.path}`);
+        for (const p of s.publications) console.log(`  Publication: ${p.request_id}; verified=${p.verified}; ${JSON.stringify(p.result ?? null)}; ${p.receipt_path}`);
+        console.log(`  Drafts (scope-wide): ${s.paths.drafts}`);
+        for (const file of s.scope_drafts) console.log(`  Scope draft: ${file}`);
+        for (const e of s.submissions) console.log(`  Frozen request: ${e.request_id}; ${e.distinct_tool_calls} calls, ${e.request_bytes} bytes, ${e.event_count} events; ${e.path}`);
+        console.log(`  Manifest: ${s.manifest.path} (${s.manifest.status})`);
+        for (const v of s.loaded_versions) console.log(`  Loaded: ${v.skill_id}@${v.version_id}; ${v.path}`);
+        console.log(`  State: ${s.paths.state}`);
+      }
+    }
+    return 0;
+  }
+  if (args.flags.resume && !selected && !event) throw new Error("--resume requires --session");
+  const bound = await binding(args);
+  if (event) {
+    if (!/^[a-zA-Z0-9_-]{1,128}$/.test(event)) throw new Error("invalid_event_id");
+    printResult(unbox(await (await verifiedClient(bound)).get("/v1/skill-evolution/evaluations", { event_id: event })), !!args.flags.json);
+    return 0;
+  }
+  const artifacts = join5("skill-evolution", bound.scope_key, "artifacts");
+  if (existsSync5(privatePath(root, artifacts))) for (const name of readdirSync3(privatePath(root, artifacts))) {
+    if (/^evaluation-[a-f0-9-]{36}\.json$/.test(name)) {
+      const state = readState(root, join5(artifacts, name));
+      if (state.binding_id === bound.id && !state.result) await submitManualEvaluation(
+        bound,
+        await verifiedClient(bound),
+        state.evidence,
+        "",
+        state.evidence.client_request_id,
+        root
+      );
+    } else if (/^upload-[a-f0-9-]{36}$/.test(name)) {
+      const dir = join5(artifacts, name), state = readState(root, join5(dir, "publication.json"));
+      if (state.binding_id !== bound.id || state.verified) continue;
+      const client = await verifiedClient(bound);
+      const pkg = await inspectZip(readPrivate(root, join5(dir, "bundle.zip"), MAX_ZIP), state.input.bundle_hash, state.input.bundle_size_bytes);
+      await publishPackage(bound, client, pkg, state.input, root);
+    }
+  }
+  await expireSessionEvidence(bound, root);
+  await resumeSubmission(bound, root);
+  return skillStatus({ positional: [], flags: { session: bound.id, ...args.flags.json ? { json: true } : {} } });
+};
+var skillPurge = async (args) => {
+  const bound = await binding(args), root = skillRoot();
+  if (args.flags.cache) {
+    const cache = join5("skills", bound.scope_key, "cache");
+    const eligible2 = existsSync5(privatePath(root, cache)) ? [cache] : [];
+    if (args.flags.apply) await withStateLock(root, cache, async () => {
+      rmSync2(privatePath(root, cache), { recursive: true, force: true });
+    });
+    printResult({ applied: !!args.flags.apply, eligible: eligible2, prerequisite: "Stop related sessions and transfers before --apply; drafts are preserved." }, !!args.flags.json);
+    return 0;
+  }
+  const artifacts = join5("skill-evolution", bound.scope_key, "artifacts"), eligible = [];
+  if (existsSync5(privatePath(root, artifacts))) for (const name of readdirSync3(privatePath(root, artifacts))) {
+    if (!/^upload-[a-f0-9-]{36}$/.test(name)) continue;
+    const dir = join5(artifacts, name), state = readState(root, join5(dir, "publication.json"));
+    if (state.verified && existsSync5(privatePath(root, dir, "bundle.zip"))) eligible.push(name);
+  }
+  if (args.flags.apply) for (const name of eligible) await withStateLock(root, join5(artifacts, name), async () => {
+    if (readState(root, join5(artifacts, name, "publication.json")).verified)
+      rmSync2(privatePath(root, artifacts, name, "bundle.zip"), { force: true });
+  });
+  printResult({ applied: !!args.flags.apply, scope_key: bound.scope_key, eligible }, !!args.flags.json);
+  return 0;
+};
+var skillRetryFeedback = async (args) => {
+  const id = value(args, "session"), event = value(args, "event-id");
+  if (!id || !event) throw new Error("retry-feedback requires --session and --event-id");
+  await retryFeedback(getBinding(id), event);
+  printResult({ event_id: event, queued_for_next_user_prompt: true, published: false }, !!args.flags.json);
+  return 0;
+};
+
 // src/cli/debug-cli.ts
 import {
   readRecallTraces
@@ -2880,12 +3548,12 @@ async function debugRecall(args) {
 import {
   accessSync,
   constants as fsConstants,
-  existsSync as existsSync2,
+  existsSync as existsSync6,
   openAsBlob,
   statSync as statSync2
-} from "fs";
-import { homedir as homedir2 } from "os";
-import { basename, extname, resolve as resolve2 } from "path";
+} from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { basename, extname, resolve as resolve3 } from "node:path";
 
 // src/lib/review.ts
 function unwrapReviewData(response, operation) {
@@ -2901,31 +3569,31 @@ function unwrapReviewData(response, operation) {
   }
   return box.data ?? null;
 }
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+function asRecord(value2) {
+  return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : void 0;
 }
 function pickString(record, field) {
-  const value = record[field];
-  return typeof value === "string" ? value : "";
+  const value2 = record[field];
+  return typeof value2 === "string" ? value2 : "";
 }
 function pickNumber(record, field) {
-  const value = record[field];
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+  const value2 = record[field];
+  return typeof value2 === "number" && Number.isFinite(value2) ? value2 : void 0;
 }
 function pickBoolean(record, field) {
-  const value = record[field];
-  return typeof value === "boolean" ? value : void 0;
+  const value2 = record[field];
+  return typeof value2 === "boolean" ? value2 : void 0;
 }
-function parseEmbeddedJson(value) {
-  if (typeof value !== "string" || value.trim() === "") return void 0;
+function parseEmbeddedJson(value2) {
+  if (typeof value2 !== "string" || value2.trim() === "") return void 0;
   try {
-    return JSON.parse(value);
+    return JSON.parse(value2);
   } catch {
     return void 0;
   }
 }
-function countArrayEntries(value) {
-  return Array.isArray(value) ? value.length : void 0;
+function countArrayEntries(value2) {
+  return Array.isArray(value2) ? value2.length : void 0;
 }
 function readReviewListData(data) {
   const record = asRecord(data);
@@ -3000,8 +3668,8 @@ function minimalReviewDetail(raw) {
     "human_action",
     "created_at"
   ]) {
-    const value = pickString(r, field);
-    if (value) out[field] = value;
+    const value2 = pickString(r, field);
+    if (value2) out[field] = value2;
   }
   for (const field of [
     "confidence_score",
@@ -3009,12 +3677,12 @@ function minimalReviewDetail(raw) {
     "noise_score",
     "contradiction_score"
   ]) {
-    const value = pickNumber(r, field);
-    if (value !== void 0) out[field] = value;
+    const value2 = pickNumber(r, field);
+    if (value2 !== void 0) out[field] = value2;
   }
   for (const field of ["has_contradictions", "rewrite_needed"]) {
-    const value = pickBoolean(r, field);
-    if (value !== void 0) out[field] = value;
+    const value2 = pickBoolean(r, field);
+    if (value2 !== void 0) out[field] = value2;
   }
   const conflictCount = countArrayEntries(parseEmbeddedJson(r.conflicts));
   if (conflictCount !== void 0) out.conflict_count = conflictCount;
@@ -3174,7 +3842,7 @@ async function memoryAdd(args) {
     fail(`memory add cannot use --image with --no-infer; image memory requires inference
 ${usage2}`, 2);
   }
-  const images = imageFlags.length > 0 ? await Promise.all(imageFlags.map((value) => loadImagePart(value, usage2))) : [];
+  const images = imageFlags.length > 0 ? await Promise.all(imageFlags.map((value2) => loadImagePart(value2, usage2))) : [];
   const ctx = buildContext(args);
   const userId = args.flags["user-id"] ?? ctx.cfg.userId;
   const metadata = parseMetadataFlags(args.flags["metadata"]);
@@ -3225,12 +3893,12 @@ async function memorySearch(args) {
   const ctx = buildContext(args);
   const userId = args.flags["user-id"] ?? ctx.cfg.userId;
   const topK = numFlag(args.flags["top-k"], ctx.cfg.topK);
-  const threshold = numFlag(args.flags["threshold"], ctx.cfg.threshold);
+  const threshold2 = numFlag(args.flags["threshold"], ctx.cfg.threshold);
   const body = {
     query,
     user_id: userId,
     top_k: topK,
-    threshold
+    threshold: threshold2
   };
   if (args.flags.knowledge) {
     body.knowledge = { enable: true, top_k: ctx.cfg.knowledgeTopK };
@@ -3352,7 +4020,7 @@ async function memoryEntityCreate(args) {
   };
   addOptionalEntityFields(body, args);
   const ctx = buildContext(args);
-  if (![body.user_id, body.agent_id, body.app_id, body.run_id].some((value) => typeof value === "string" && value.trim() !== "")) {
+  if (![body.user_id, body.agent_id, body.app_id, body.run_id].some((value2) => typeof value2 === "string" && value2.trim() !== "")) {
     body.user_id = ctx.cfg.userId;
   }
   const resp = await ctx.client.postJson("/v1/memories/entities", body);
@@ -3417,18 +4085,18 @@ function parseMetadataFlags(raw) {
   }
   return out;
 }
-function stringFlag(value) {
-  return typeof value === "string" ? value : void 0;
+function stringFlag(value2) {
+  return typeof value2 === "string" ? value2 : void 0;
 }
-function csvFlag(value) {
-  return typeof value === "string" ? value.split(",").map((item) => item.trim()).filter(Boolean) : [];
+function csvFlag(value2) {
+  return typeof value2 === "string" ? value2.split(",").map((item) => item.trim()).filter(Boolean) : [];
 }
-function jsonStringArray(value, name) {
-  if (value === void 0) return [];
-  if (typeof value !== "string") fail(`--${name} must be a JSON array of strings`, 2);
+function jsonStringArray(value2, name) {
+  if (value2 === void 0) return [];
+  if (typeof value2 !== "string") fail(`--${name} must be a JSON array of strings`, 2);
   let parsed;
   try {
-    parsed = JSON.parse(value);
+    parsed = JSON.parse(value2);
   } catch {
     fail(`--${name} must be a JSON array of strings`, 2);
   }
@@ -3439,8 +4107,8 @@ function jsonStringArray(value, name) {
 }
 function addOptionalScopeFields(body, args) {
   for (const [flag, field] of [["user-id", "user_id"], ["agent-id", "agent_id"], ["app-id", "app_id"], ["run-id", "run_id"]]) {
-    const value = stringFlag(args.flags[flag]);
-    if (value !== void 0) body[field] = value;
+    const value2 = stringFlag(args.flags[flag]);
+    if (value2 !== void 0) body[field] = value2;
   }
 }
 function addOptionalEntityFields(body, args) {
@@ -3452,8 +4120,8 @@ function addOptionalEntityFields(body, args) {
 function repeatedFlagValues(args, name) {
   const repeated = args.repeatedFlags?.[name];
   if (repeated) return repeated;
-  const value = args.flags[name];
-  return value === void 0 ? [] : [value];
+  const value2 = args.flags[name];
+  return value2 === void 0 ? [] : [value2];
 }
 async function loadImagePart(rawPath, usage2) {
   if (typeof rawPath !== "string" || rawPath.trim() === "") {
@@ -3461,7 +4129,7 @@ async function loadImagePart(rawPath, usage2) {
 ${usage2}`, 2);
   }
   const path = expandLocalPath(rawPath);
-  if (!existsSync2(path)) fail(`image file not found: ${path}`, 2);
+  if (!existsSync6(path)) fail(`image file not found: ${path}`, 2);
   const stat = statSync2(path);
   if (!stat.isFile()) fail(`image path is not a file: ${path}`, 2);
   try {
@@ -3482,9 +4150,9 @@ ${usage2}`, 2);
 }
 function expandLocalPath(path) {
   if (path === "~" || path.startsWith("~/")) {
-    return resolve2(homedir2(), path === "~" ? "" : path.slice(2));
+    return resolve3(homedir3(), path === "~" ? "" : path.slice(2));
   }
-  return resolve2(path);
+  return resolve3(path);
 }
 function imageMimeType(path) {
   switch (extname(path).toLowerCase()) {
@@ -3501,7 +4169,7 @@ function imageMimeType(path) {
 }
 
 // src/cli/kb-cli.ts
-import { basename as basename2 } from "path";
+import { basename as basename2 } from "node:path";
 var UPLOAD_TEXT_USAGE = "usage: ctxdb kb upload-text <kb-name> <doc-name> --text=<body> [--file-path=<server-logical-path>] [--review-enabled|--no-review-enabled] [--wait|--no-wait]";
 var UPLOAD_FILE_USAGE = "usage: ctxdb kb upload-file <kb-name> <local-path> [--doc-name=...] [--file-path=<server-logical-path>] [--review-enabled|--no-review-enabled] [--wait|--no-wait]";
 var UPDATE_TEXT_USAGE = "usage: ctxdb kb update-text <document-id> --text=<body> [--wait|--no-wait]\n   or: ctxdb kb update-text --kb-name=<kb-name> --doc-name=<logical-name> --text=<body> [--file-path=<server-logical-path>] [--wait|--no-wait]";
@@ -3521,17 +4189,17 @@ var ENTITY_CHUNKS_USAGE = "usage: ctxdb kb entity-chunks --kb=<kb-id> --entity-i
 var RELATIONS_USAGE = "usage: ctxdb kb relations [--kb=<kb-id>] [--entity-id=<id> | --entity-ids=<a,b>]\n                          [--relation-type=<t>] [--page=N] [--page-size=N]\n                          [--max-nodes=N] [--max-edges=N] [--verbose] [--raw] [--json]";
 var UPDATE_LOCATOR_FLAGS = ["kb-name", "doc-name", "file-path"];
 function nonEmptyFlag(args, name) {
-  const value = args.flags[name];
-  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+  const value2 = args.flags[name];
+  return typeof value2 === "string" && value2.trim() !== "" ? value2 : void 0;
 }
 function optionalNonEmptyFlag(args, name, usage2) {
   if (!Object.hasOwn(args.flags, name)) return void 0;
-  const value = nonEmptyFlag(args, name);
-  if (value === void 0) {
+  const value2 = nonEmptyFlag(args, name);
+  if (value2 === void 0) {
     fail(`--${name} must have a non-empty value
 ${usage2}`, 2);
   }
-  return value;
+  return value2;
 }
 function hasAnyLocatorFlag(args) {
   return UPDATE_LOCATOR_FLAGS.some((name) => Object.hasOwn(args.flags, name));
@@ -3603,10 +4271,10 @@ function parseKbLocator(args, usage2) {
 function optionalNonNegativeInteger(args, name, usage2) {
   const raw = args.flags[name];
   if (raw === void 0) return void 0;
-  const value = typeof raw === "string" ? Number(raw) : Number.NaN;
-  if (!Number.isInteger(value) || value < 0) fail(`--${name} must be a non-negative integer
+  const value2 = typeof raw === "string" ? Number(raw) : Number.NaN;
+  if (!Number.isInteger(value2) || value2 < 0) fail(`--${name} must be a non-negative integer
 ${usage2}`, 2);
-  return value;
+  return value2;
 }
 function requiredIds(args, usage2) {
   const raw = args.flags.ids;
@@ -3916,10 +4584,10 @@ function limitGraphRelations(result, maxNodes, maxEdges) {
   if (!Array.isArray(graph.relations)) return result;
   const nodeIds = /* @__PURE__ */ new Set();
   const relations = [];
-  for (const value of graph.relations) {
+  for (const value2 of graph.relations) {
     if (maxEdges !== void 0 && relations.length >= maxEdges) break;
-    if (!value || typeof value !== "object") continue;
-    const relation = value;
+    if (!value2 || typeof value2 !== "object") continue;
+    const relation = value2;
     const source = relation.source_entity_id;
     const target = relation.target_entity_id;
     if (typeof source !== "string" || typeof target !== "string") continue;
@@ -3927,7 +4595,7 @@ function limitGraphRelations(result, maxNodes, maxEdges) {
     nextNodes.add(source);
     nextNodes.add(target);
     if (maxNodes !== void 0 && nextNodes.size > maxNodes) continue;
-    relations.push(value);
+    relations.push(value2);
     nodeIds.add(source);
     nodeIds.add(target);
   }
@@ -3987,10 +4655,10 @@ async function kbSearch(args) {
   return 0;
 }
 function positiveIntFlag(args, flagName, usage2) {
-  const value = args.flags[flagName];
-  if (value === void 0) return void 0;
-  if (typeof value !== "string") fail(usage2, 2);
-  const parsed = Number(value);
+  const value2 = args.flags[flagName];
+  if (value2 === void 0) return void 0;
+  if (typeof value2 !== "string") fail(usage2, 2);
+  const parsed = Number(value2);
   if (!Number.isInteger(parsed) || parsed < 1) {
     fail(`${flagName} must be a positive integer
 ${usage2}`, 2);
@@ -4109,11 +4777,11 @@ async function kbAcl(operation, args) {
       throw new Error(`exactly one ${operation === "delete" ? "ACL" : "KB"} ID is required`);
     }
     const allowed = /* @__PURE__ */ new Set([...FLAGS[operation], "agent", "json", "raw"]);
-    for (const [flag, value] of Object.entries(args.flags)) {
+    for (const [flag, value2] of Object.entries(args.flags)) {
       if (!allowed.has(flag)) throw new Error(`unknown --${flag}`);
       if (flag === "agent" || flag === "json" || flag === "raw") continue;
-      if (typeof value !== "string" || !value.trim()) throw new Error(`--${flag} requires a value`);
-      values[flag.replaceAll("-", "_")] = value.trim();
+      if (typeof value2 !== "string" || !value2.trim()) throw new Error(`--${flag} requires a value`);
+      values[flag.replaceAll("-", "_")] = value2.trim();
     }
     for (const [field, choices] of Object.entries({
       principal_type: ["member", "group"],
@@ -4164,6 +4832,139 @@ var kbAclSubjects = (args) => kbAcl("subjects", args);
 var kbAclSet = (args) => kbAcl("set", args);
 var kbAclDelete = (args) => kbAcl("delete", args);
 
+// src/cli/kb-graph-cli.ts
+var GRAPH_MUTATION_USAGE = {
+  "entity-create": "ctxdb kb entity-create --kb=<kb-id> --name=<name> --type=<type> --description=<text> --aliases-json='<json-array>'",
+  "entity-update": "ctxdb kb entity-update --kb=<kb-id> --entity-id=<id> --name=<name> --type=<type> --description=<text> --aliases-json='<json-array>'",
+  "entity-delete": "ctxdb kb entity-delete --kb=<kb-id> --entity-id=<id> --yes",
+  "relation-create": "ctxdb kb relation-create --kb=<kb-id> --source-entity-id=<id> --target-entity-id=<id> --relation-type=<type> --description=<text> --keywords-json='<json-array>' --weight=<number>",
+  "relation-update": "ctxdb kb relation-update --kb=<kb-id> --relation-id=<id> --relation-type=<type> --description=<text> --keywords-json='<json-array>' --weight=<number>",
+  "relation-delete": "ctxdb kb relation-delete --kb=<kb-id> --relation-id=<id> --yes"
+};
+var ENTITY_FIELDS = ["name", "type", "description", "aliases-json"];
+var RELATION_FIELDS = ["relation-type", "description", "keywords-json", "weight"];
+function stringFlag2(args, name, allowEmpty = false) {
+  const value2 = args.flags[name];
+  if (typeof value2 !== "string" || !allowEmpty && !value2.trim()) {
+    throw new Error(`--${name} requires ${allowEmpty ? "a string value (use --description='' to clear)" : "a non-empty value"}`);
+  }
+  return value2;
+}
+function stringArrayFlag(args, name) {
+  const text = stringFlag2(args, name);
+  let value2;
+  try {
+    value2 = JSON.parse(text);
+  } catch {
+    throw new Error(`--${name} must be a JSON array of strings (use '[]' to clear)`);
+  }
+  if (!Array.isArray(value2) || !value2.every((item) => typeof item === "string")) {
+    throw new Error(`--${name} must be a JSON array of strings (use '[]' to clear)`);
+  }
+  return value2;
+}
+function parseMutation(args, resource, action) {
+  const idFlag = `${resource}-id`;
+  const allowed = /* @__PURE__ */ new Set([
+    "kb",
+    "agent",
+    "json",
+    "raw",
+    ...action === "delete" ? [idFlag, "yes"] : [
+      ...resource === "entity" ? ENTITY_FIELDS : RELATION_FIELDS,
+      ...action === "update" ? [idFlag] : resource === "relation" ? ["source-entity-id", "target-entity-id"] : []
+    ]
+  ]);
+  if (args.positional.length) throw new Error("use explicit ID flags; positional locators are not supported");
+  for (const [flag, value2] of Object.entries(args.flags)) {
+    if (!allowed.has(flag)) throw new Error(`unknown --${flag}`);
+    if (["yes", "json", "raw"].includes(flag) && value2 !== true) {
+      throw new Error(`--${flag} is a boolean switch; do not supply a value`);
+    }
+  }
+  if (args.flags.agent !== void 0) stringFlag2(args, "agent");
+  const knowledge_base_id = stringFlag2(args, "kb").trim();
+  const locator = action === "create" ? {} : { [`${resource}_id`]: stringFlag2(args, idFlag).trim() };
+  if (action === "delete") {
+    if (args.flags.yes !== true) {
+      throw new Error(`deletion is irreversible${resource === "entity" ? " and deletes all incoming/outgoing relations" : ""}; pass --yes to confirm`);
+    }
+    return { knowledge_base_id, ...locator };
+  }
+  if (resource === "entity") {
+    return {
+      knowledge_base_id,
+      ...locator,
+      entity_name: stringFlag2(args, "name"),
+      entity_type: stringFlag2(args, "type"),
+      description: stringFlag2(args, "description", true),
+      aliases: stringArrayFlag(args, "aliases-json")
+    };
+  }
+  const weight = Number(stringFlag2(args, "weight"));
+  if (!Number.isFinite(weight)) throw new Error("--weight must be a finite number");
+  return {
+    knowledge_base_id,
+    ...locator,
+    ...action === "create" ? {
+      source_entity_id: stringFlag2(args, "source-entity-id").trim(),
+      target_entity_id: stringFlag2(args, "target-entity-id").trim()
+    } : {},
+    relation_type: stringFlag2(args, "relation-type"),
+    description: stringFlag2(args, "description", true),
+    keywords: stringArrayFlag(args, "keywords-json"),
+    weight
+  };
+}
+async function mutateGraph(args, resource, action) {
+  const command = `${resource}-${action}`;
+  const usage2 = `usage: ${GRAPH_MUTATION_USAGE[command]} [--agent=<name>] [--raw] [--json]
+`;
+  if (args.flags.help || args.flags.h) {
+    process.stdout.write(usage2);
+    return 0;
+  }
+  let payload;
+  try {
+    payload = parseMutation(args, resource, action);
+  } catch (error) {
+    process.stderr.write(`${error.message}
+${usage2}`);
+    return 2;
+  }
+  const { client } = buildContext(args);
+  const path = resource === "entity" ? "/v1/knowledge/entities" : "/v1/knowledge/entity-relations";
+  const response = action === "create" ? await client.postJson(path, payload) : action === "update" ? await client.putJson(path, payload) : await client.delete(path, payload);
+  let data;
+  try {
+    data = unwrapReviewData(response, `kb ${command}`);
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+      throw new CtxdbError(`kb ${command} returned no mutation result`);
+    }
+    const result = data;
+    if (typeof result[`${resource}_id`] !== "string" || !result[`${resource}_id`] || result.knowledge_base_id !== payload.knowledge_base_id || action !== "create" && result[`${resource}_id`] !== payload[`${resource}_id`]) {
+      throw new CtxdbError(`kb ${command} returned an invalid mutation locator`);
+    }
+    if (action === "delete") {
+      if (typeof result.deleted !== "boolean") throw new CtxdbError(`kb ${command} returned no deletion status`);
+      if (resource === "entity" && ["deleted_entity_count", "deleted_relation_count"].some(
+        (key) => !Number.isSafeInteger(result[key]) || result[key] < 0
+      )) throw new CtxdbError(`kb ${command} returned invalid deletion counts`);
+    }
+  } catch (error) {
+    const requestId = response?.requestId;
+    throw new CtxdbError(`${error.message}${typeof requestId === "string" ? ` (RequestId: ${requestId})` : ""}`);
+  }
+  printResult(args.flags.raw ? response : data, !!args.flags.json);
+  return action === "delete" && data.deleted !== true ? 1 : 0;
+}
+var kbEntityCreate = (args) => mutateGraph(args, "entity", "create");
+var kbEntityUpdate = (args) => mutateGraph(args, "entity", "update");
+var kbEntityDelete = (args) => mutateGraph(args, "entity", "delete");
+var kbRelationCreate = (args) => mutateGraph(args, "relation", "create");
+var kbRelationUpdate = (args) => mutateGraph(args, "relation", "update");
+var kbRelationDelete = (args) => mutateGraph(args, "relation", "delete");
+
 // src/cli/promotion-cli.ts
 var GENERATE_USAGE = "usage: ctxdb memory promotion generate <topic> [--knowledge-base-id=<kb-id>] [--wait|--no-wait] [--agent=<name>] [--json]";
 var LIST_USAGE = "usage: ctxdb memory promotion list [--status=<generating|pending_review|approving|approved|rejected|generation_failed>] [--page=N] [--page-size=N] [--sort-by=quality_score] [--sort-order=asc|desc] [--raw] [--agent=<name>] [--json]";
@@ -4244,7 +5045,7 @@ ${GENERATE_USAGE}`, 2);
   if (!topic || topic.trim() === "") fail(GENERATE_USAGE, 2);
   const ctx = buildContext(args);
   const body = { topic };
-  const kbId = stringFlag2(args, "knowledge-base-id");
+  const kbId = stringFlag3(args, "knowledge-base-id");
   if (kbId !== void 0) body.knowledge_base_id = kbId;
   const resp = await ctx.client.postJson("/v1/memory_promotions/generate", body);
   let data = unwrapBox(resp, "memory promotion generate");
@@ -4260,7 +5061,7 @@ ${GENERATE_USAGE}`, 2);
     }) + "\n");
     const deadline = Date.now() + 3e5;
     while (data.status === "generating" && Date.now() < deadline) {
-      await new Promise((resolve4) => setTimeout(resolve4, 1500));
+      await new Promise((resolve5) => setTimeout(resolve5, 1500));
       data = unwrapBox(
         await ctx.client.get("/v1/memory_promotions/detail", { promotion_id: promotionId }),
         "memory promotion get"
@@ -4277,7 +5078,7 @@ ${GENERATE_USAGE}`, 2);
 async function promotionList(args) {
   if (showHelp(args, LIST_USAGE)) return 0;
   const params = {};
-  const status2 = stringFlag2(args, "status");
+  const status2 = stringFlag3(args, "status");
   if (status2 !== void 0) {
     if (!PROMOTION_STATUSES.includes(status2)) {
       fail(`invalid --status: ${status2} (expected one of ${PROMOTION_STATUSES.join("|")})
@@ -4289,7 +5090,7 @@ ${LIST_USAGE}`, 2);
   if (page !== void 0) params.page = page;
   const pageSize = intFlag(args, "page-size", LIST_USAGE);
   if (pageSize !== void 0) params.page_size = pageSize;
-  const sortBy = stringFlag2(args, "sort-by");
+  const sortBy = stringFlag3(args, "sort-by");
   if (sortBy !== void 0) {
     if (sortBy !== "quality_score") {
       fail(`invalid --sort-by: ${sortBy} (expected quality_score)
@@ -4297,7 +5098,7 @@ ${LIST_USAGE}`, 2);
     }
     params.sort_by = sortBy;
   }
-  const sortOrder = stringFlag2(args, "sort-order");
+  const sortOrder = stringFlag3(args, "sort-order");
   if (sortOrder !== void 0) {
     if (sortOrder !== "asc" && sortOrder !== "desc") {
       fail(`invalid --sort-order: ${sortOrder} (expected asc|desc)
@@ -4339,7 +5140,7 @@ async function promotionReject(args) {
   const promotionId = requireIdFlag(args, "promotion-id", REJECT_USAGE);
   const ctx = buildContext(args);
   const body = { promotion_id: promotionId };
-  const reason = stringFlag2(args, "reason");
+  const reason = stringFlag3(args, "reason");
   if (reason !== void 0) body.reason = reason;
   const resp = await ctx.client.postJson("/v1/memory_promotions/reject", body);
   emit(args, resp, "memory promotion reject", (data) => data);
@@ -4347,17 +5148,17 @@ async function promotionReject(args) {
 }
 async function promotionBatchAction(args) {
   if (showHelp(args, BATCH_ACTION_USAGE)) return 0;
-  const action = stringFlag2(args, "action");
+  const action = stringFlag3(args, "action");
   if (action === void 0 || !BATCH_ACTIONS.includes(action)) {
     fail(`--action is required and must be one of ${BATCH_ACTIONS.join("|")}
 ${BATCH_ACTION_USAGE}`, 2);
   }
   const ids = parseIdsFlag(args, BATCH_ACTION_USAGE);
-  const kbId = action === "approve" ? requireIdFlag(args, "knowledge-base-id", BATCH_ACTION_USAGE) : stringFlag2(args, "knowledge-base-id");
+  const kbId = action === "approve" ? requireIdFlag(args, "knowledge-base-id", BATCH_ACTION_USAGE) : stringFlag3(args, "knowledge-base-id");
   const ctx = buildContext(args);
   const body = { action, ids };
   if (kbId !== void 0) body.knowledge_base_id = kbId;
-  const reason = stringFlag2(args, "reason");
+  const reason = stringFlag3(args, "reason");
   if (reason !== void 0) body.reason = reason;
   const resp = await ctx.client.postJson("/v1/memory_promotions/batch", body);
   const data = emit(args, resp, "memory promotion batch-action", (data2) => data2);
@@ -4383,8 +5184,8 @@ async function promotionResolveDoubts(args) {
 ${RESOLVE_DOUBTS_USAGE}`, 2);
   }
   const resolutions = parseResolutions(resolutionsRaw, RESOLVE_DOUBTS_USAGE);
-  const title = stringFlag2(args, "title");
-  const content = stringFlag2(args, "content");
+  const title = stringFlag3(args, "title");
+  const content = stringFlag3(args, "content");
   if (resolutions.length === 0 && title === void 0 && content === void 0) {
     fail(`provide a resolution or a non-empty --title/--content edit
 ${RESOLVE_DOUBTS_USAGE}`, 2);
@@ -4478,7 +5279,7 @@ async function promotionSettingsGet(args) {
 async function promotionSettingsUpdate(args) {
   if (showHelp(args, SETTINGS_UPDATE_USAGE)) return 0;
   const body = {};
-  const enabled = stringFlag2(args, "auto-ingest-enabled");
+  const enabled = stringFlag3(args, "auto-ingest-enabled");
   if (enabled !== void 0) {
     if (enabled !== "true" && enabled !== "false") {
       fail(`invalid --auto-ingest-enabled: ${enabled} (expected true|false)
@@ -4486,16 +5287,16 @@ ${SETTINGS_UPDATE_USAGE}`, 2);
     }
     body.auto_ingest_enabled = enabled === "true";
   }
-  const threshold = stringFlag2(args, "auto-ingest-threshold");
-  if (threshold !== void 0) {
-    const n = Number(threshold);
+  const threshold2 = stringFlag3(args, "auto-ingest-threshold");
+  if (threshold2 !== void 0) {
+    const n = Number(threshold2);
     if (!Number.isFinite(n) || n < 0 || n > 1) {
-      fail(`invalid --auto-ingest-threshold: ${threshold} (expected a number in [0,1])
+      fail(`invalid --auto-ingest-threshold: ${threshold2} (expected a number in [0,1])
 ${SETTINGS_UPDATE_USAGE}`, 2);
     }
     body.auto_ingest_threshold = n;
   }
-  const defaultKbId = stringFlag2(args, "default-kb-id");
+  const defaultKbId = stringFlag3(args, "default-kb-id");
   const clearDefaultKb = args.flags["clear-default-kb"] === true;
   if (defaultKbId !== void 0 && clearDefaultKb) {
     fail(`cannot use --default-kb-id and --clear-default-kb together
@@ -4512,15 +5313,15 @@ ${SETTINGS_UPDATE_USAGE}`, 2);
   emit(args, resp, "memory promotion settings update", (data) => data);
   return 0;
 }
-function stringFlag2(args, name) {
-  const value = args.flags[name];
-  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+function stringFlag3(args, name) {
+  const value2 = args.flags[name];
+  return typeof value2 === "string" && value2.trim() !== "" ? value2 : void 0;
 }
 function requireIdFlag(args, name, usage2) {
-  const value = stringFlag2(args, name);
-  if (value === void 0) fail(`--${name} is required
+  const value2 = stringFlag3(args, name);
+  if (value2 === void 0) fail(`--${name} is required
 ${usage2}`, 2);
-  return value;
+  return value2;
 }
 function requireTemplateIdPositional(args, usage2) {
   const templateId = args.positional[0];
@@ -4528,7 +5329,7 @@ function requireTemplateIdPositional(args, usage2) {
   return templateId;
 }
 function intFlag(args, name, usage2) {
-  const raw = stringFlag2(args, name);
+  const raw = stringFlag3(args, name);
   if (raw === void 0) return void 0;
   const n = Number(raw);
   if (!Number.isInteger(n) || n < 1) {
@@ -4538,7 +5339,7 @@ ${usage2}`, 2);
   return n;
 }
 function parseIdsFlag(args, usage2) {
-  const raw = stringFlag2(args, "ids");
+  const raw = stringFlag3(args, "ids");
   if (raw === void 0) fail(`--ids is required (comma-separated)
 ${usage2}`, 2);
   const ids = raw.split(",").map((s) => s.trim()).filter(Boolean);
@@ -4588,7 +5389,7 @@ ${usage2}`, 2);
   });
 }
 function buildTemplateUpsertBody(args, usage2) {
-  const name = stringFlag2(args, "name");
+  const name = stringFlag3(args, "name");
   if (name === void 0) fail(`--name is required
 ${usage2}`, 2);
   const sectionsRaw = args.flags["sections-json"];
@@ -4673,8 +5474,8 @@ function batchExitCode(data) {
 function pickFields(source, fields) {
   const out = {};
   for (const key of fields) {
-    const value = source[key];
-    if (value !== void 0 && value !== null) out[key] = value;
+    const value2 = source[key];
+    if (value2 !== void 0 && value2 !== null) out[key] = value2;
   }
   return out;
 }
@@ -4714,7 +5515,7 @@ function compactTemplateList(data) {
 }
 
 // src/cli/review-cli.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 var REVIEW_LIST_USAGE = "usage: ctxdb kb review list [--knowledge-base-id=<id>] [--decision=<d>]\n                           [--review-status=<pending|reviewed|rejected>]\n                           [--page=N] [--page-size=N] [--sort-by=confidence_score]\n                           [--sort-order=asc|desc] [--verbose] [--raw] [--json]";
 var REVIEW_GET_USAGE = "usage: ctxdb kb review get <review-id> [--content-page=N] [--verbose] [--raw] [--json]";
 var REVIEW_ACTION_USAGE = `usage: ctxdb kb review action <review-id> --action=<${REVIEW_ACTIONS.join("|")}>
@@ -4734,29 +5535,29 @@ var TEMPLATE_CLEAR_DEFAULT_USAGE2 = "usage: ctxdb kb review template clear-defau
 var SETTINGS_GET_USAGE2 = "usage: ctxdb kb review settings get <knowledge-base-id> [--json]";
 var SETTINGS_UPDATE_USAGE2 = "usage: ctxdb kb review settings update <knowledge-base-id>\n                                      [--review-enabled | --no-review-enabled]\n                                      [--high-threshold=F] [--logic-rewrite-threshold=F]\n                                      [--noise-rewrite-threshold=F] [--max-rewrite-iterations=N]\n                                      [--rewrite-enabled | --no-rewrite-enabled]\n                                      [--conflict-detection-enabled | --no-conflict-detection-enabled]\n                                      [--rewrite-auto-ingest-enabled | --no-rewrite-auto-ingest-enabled] [--json]";
 function stringValue(args, name) {
-  const value = args.flags[name];
-  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+  const value2 = args.flags[name];
+  return typeof value2 === "string" && value2.trim() !== "" ? value2 : void 0;
 }
 function requireId(args, flagName, positionalIndex, usage2) {
   const positional2 = args.positional[positionalIndex]?.trim();
-  const value = positional2 !== void 0 && positional2 !== "" ? positional2 : stringValue(args, flagName);
-  if (value === void 0) fail(usage2, 2);
-  return value.trim();
+  const value2 = positional2 !== void 0 && positional2 !== "" ? positional2 : stringValue(args, flagName);
+  if (value2 === void 0) fail(usage2, 2);
+  return value2.trim();
 }
 function requireEnumFlag(args, flagName, allowed, usage2) {
-  const value = stringValue(args, flagName);
-  if (value === void 0) fail(usage2, 2);
-  if (!allowed.includes(value)) {
+  const value2 = stringValue(args, flagName);
+  if (value2 === void 0) fail(usage2, 2);
+  if (!allowed.includes(value2)) {
     fail(`${flagName} must be one of ${allowed.join("|")}
 ${usage2}`, 2);
   }
-  return value;
+  return value2;
 }
 function positiveIntFlag2(args, flagName, usage2) {
-  const value = args.flags[flagName];
-  if (value === void 0) return void 0;
-  if (typeof value !== "string") fail(usage2, 2);
-  const parsed = Number(value);
+  const value2 = args.flags[flagName];
+  if (value2 === void 0) return void 0;
+  if (typeof value2 !== "string") fail(usage2, 2);
+  const parsed = Number(value2);
   if (!Number.isInteger(parsed) || parsed < 1) {
     fail(`${flagName} must be a positive integer
 ${usage2}`, 2);
@@ -5111,10 +5912,10 @@ ${SETTINGS_UPDATE_USAGE2}`, 2);
     else if (off) body[field] = false;
   }
   for (const [flag, field, integer] of SETTINGS_NUMBER_FLAG_FIELDS) {
-    const value = args.flags[flag];
-    if (value === void 0) continue;
-    if (typeof value !== "string") fail(SETTINGS_UPDATE_USAGE2, 2);
-    const parsed = Number(value);
+    const value2 = args.flags[flag];
+    if (value2 === void 0) continue;
+    if (typeof value2 !== "string") fail(SETTINGS_UPDATE_USAGE2, 2);
+    const parsed = Number(value2);
     if (!Number.isFinite(parsed) || integer && !Number.isInteger(parsed)) {
       fail(`--${flag} must be ${integer ? "an integer" : "a number"}
 ${SETTINGS_UPDATE_USAGE2}`, 2);
@@ -5169,20 +5970,20 @@ function outputs(...extra) {
     ...extra
   ];
 }
-function details(value) {
+function details(value2) {
   return {
-    usage: value.usage,
-    positionals: value.positionals ?? [],
-    options: value.options ?? [],
-    constraints: value.constraints ?? [],
-    outputModes: value.outputModes ?? outputs(),
-    warnings: value.warnings ?? [],
-    examples: value.examples,
-    notes: value.notes ?? []
+    usage: value2.usage,
+    positionals: value2.positionals ?? [],
+    options: value2.options ?? [],
+    constraints: value2.constraints ?? [],
+    outputModes: value2.outputModes ?? outputs(),
+    warnings: value2.warnings ?? [],
+    examples: value2.examples,
+    notes: value2.notes ?? []
   };
 }
-function leaf(name, summary, handler, value, aliases = []) {
-  return { kind: "command", name, aliases, summary, handler, ...value };
+function leaf(name, summary, handler, value2, aliases = []) {
+  return { kind: "command", name, aliases, summary, handler, ...value2 };
 }
 function group(name, summary, children, aliases = []) {
   return { kind: "group", name, aliases, summary, children };
@@ -5239,12 +6040,14 @@ function publicSetupSpec(managedCredentials) {
       notes: managedCredentials ? [
         "Without --agent, setup writes the CLI-only default profile and installs no Hooks or Skills.",
         "Run ctxdb login before setup to create managed credentials.",
+        "Codex setup does not grant hook trust: review only ContextDB hooks with /hooks or App Settings > Hooks. JSON includes the pending review action.",
         "Hermes requires approval of pre_llm_call and post_llm_call with: hermes --accept-hooks chat"
       ] : [
         "Without --agent, setup writes the CLI-only default profile and installs no Hooks or Skills.",
         "Ordinary setup preserves existing authentication; a profile with no authentication may bind the default login.",
         "Explicitly unbound, invalid, or conflicting authentication is not automatically replaced; use --login or --api-key to switch.",
         "A shared login keeps its Core origin; --base-url cannot redirect its tokens to another origin.",
+        "Codex setup does not grant hook trust: review only ContextDB hooks with /hooks or App Settings > Hooks. JSON includes the pending review action.",
         "Hermes requires approval of pre_llm_call and post_llm_call with: hermes --accept-hooks chat"
       ],
       examples: managedCredentials ? [
@@ -5403,7 +6206,116 @@ var debugGroup = group("debug", "Control and inspect local recall traces.", [
     })
   )
 ]);
-var skillGroup = group("skill", "Install ContextDB Skill files without configuring Hooks.", [
+var SKILL_SCOPE_OPTIONS = [
+  option("--session", "Use an existing Skill session binding.", { valueName: "binding-id" }),
+  AGENT_OPTION,
+  JSON_OPTION
+];
+var SKILL_ID_OPTION = option("--skill-id", "Skill UUID.", { valueName: "id", required: true });
+var skillGroup = group("skill", "Install, discover, publish, and manage ContextDB Skills.", [
+  leaf("bind", "Bind a session to the current member and refresh its Skill manifest.", skillBind, details({
+    usage: ["ctxdb skill bind --session-id=<id> [--agent=<name>] [--json]"],
+    options: [option("--session-id", "Agent session identifier.", { valueName: "id", required: true }), AGENT_OPTION, JSON_OPTION],
+    examples: [{ command: "ctxdb skill bind --session-id=<session-id> --agent=codex --json" }]
+  })),
+  leaf("manifest", "Refresh the visible Skill manifest for this subject.", skillManifest, details({
+    usage: ["ctxdb skill manifest [--session=<binding-id>] [--agent=<name>] [--json]"],
+    options: SKILL_SCOPE_OPTIONS,
+    examples: [{ command: "ctxdb skill manifest --session=<binding-id> --json" }]
+  }), ["sync"]),
+  leaf("list", "List active Skills visible to the current subject.", skillList, details({
+    usage: ["ctxdb skill list [--session=<binding-id>] [--agent=<name>] [--json]"],
+    options: SKILL_SCOPE_OPTIONS,
+    notes: ["Refreshes the authoritative remote manifest; it does not fall back to stale cached permissions."],
+    examples: [{ command: "ctxdb skill list --agent=qwenwork --json" }]
+  })),
+  leaf("config", "Read effective Skill configuration or change an Agent-local setting.", skillConfig, details({
+    usage: [
+      "ctxdb skill config [get [auto-skill-evolution]] [--session=<binding-id>] [--agent=<name>] [--json]",
+      "ctxdb skill config set auto-skill-evolution <on|off> --agent=<name> [--json]",
+      "ctxdb skill config unset auto-skill-evolution --agent=<name> [--json]"
+    ],
+    positionals: [
+      positional("action", "Optional operation: get, set, or unset.", false),
+      positional("key", "Agent-local configuration key.", false),
+      positional("value", "Configuration value; auto-skill-evolution accepts on or off.", false)
+    ],
+    options: SKILL_SCOPE_OPTIONS,
+    constraints: ["set and unset require --agent and cannot be combined with --session."],
+    notes: ["Only auto-skill-evolution is locally writable. Service policy and thresholds remain read-only."],
+    examples: [
+      { command: "ctxdb skill config --session=<binding-id> --json" },
+      { command: "ctxdb skill config set auto-skill-evolution off --agent=qwenwork --json" }
+    ]
+  })),
+  leaf("search", "Search remote Skills visible to the current subject.", skillSearch, details({
+    usage: ["ctxdb skill search <query> [--top-k=<n>] [--session=<binding-id>] [--agent=<name>] [--json]"],
+    positionals: [positional("query", "Search text, at most 512 Unicode code points.")],
+    options: [option("--top-k", "Number of results, from 1 to 10.", { valueName: "n", type: "integer", default: 5 }), ...SKILL_SCOPE_OPTIONS],
+    examples: [{ command: "ctxdb skill search 'validate JSONL' --top-k=5 --json" }]
+  })),
+  leaf("load", "Download and verify a Skill version, optionally creating an editable copy.", skillLoad, details({
+    usage: ["ctxdb skill load --skill-id=<id> [--version-id=<id>] [--editable] [--session=<binding-id>] [--agent=<name>] [--json]"],
+    options: [SKILL_ID_OPTION, option("--version-id", "Exact version UUID; omit to select the active version.", { valueName: "id" }), option("--editable", "Create an editable draft from the verified package.", { type: "boolean" }), ...SKILL_SCOPE_OPTIONS],
+    examples: [{ command: "ctxdb skill load --skill-id=<skill-id> --version-id=<version-id> --json" }]
+  })),
+  leaf("disable", "Disable a private Skill while retaining its history.", skillDisable, details({
+    usage: ["ctxdb skill disable --skill-id=<id> [--session=<binding-id>] [--agent=<name>] [--json]"],
+    options: [SKILL_ID_OPTION, ...SKILL_SCOPE_OPTIONS],
+    warnings: ["Requires an explicit user instruction; unavailable during automatic maintenance."],
+    examples: [{ command: "ctxdb skill disable --skill-id=<skill-id> --json" }]
+  })),
+  leaf("delete", "Delete a private Skill and clean up its history and packages.", skillDelete, details({
+    usage: ["ctxdb skill delete --skill-id=<id> [--session=<binding-id>] [--agent=<name>] [--json]"],
+    options: [SKILL_ID_OPTION, ...SKILL_SCOPE_OPTIONS],
+    warnings: ["Deletes historical packages. Requires an explicit user instruction; unavailable during automatic maintenance."],
+    examples: [{ command: "ctxdb skill delete --skill-id=<skill-id> --json" }]
+  })),
+  leaf("rollback", "Activate a retained version using the expected current version.", skillRollback, details({
+    usage: ["ctxdb skill rollback --skill-id=<id> --version-id=<target> --base-version-id=<current> [--revoke-reason=<reason>] [--session=<binding-id>] [--agent=<name>] [--json]"],
+    options: [SKILL_ID_OPTION, option("--version-id", "Target version UUID.", { valueName: "target", required: true }), option("--base-version-id", "Expected active version UUID.", { valueName: "current", required: true }), option("--revoke-reason", "Optional nonblank reason, at most 1000 UTF-16 code units.", { valueName: "reason" }), ...SKILL_SCOPE_OPTIONS],
+    warnings: ["Requires an explicit user instruction; unavailable during automatic maintenance."],
+    examples: [{ command: "ctxdb skill rollback --skill-id=<skill-id> --version-id=<target> --base-version-id=<current> --json" }]
+  })),
+  leaf("validate", "Check local Skill package structure without executing scripts.", skillValidate, details({
+    usage: ["ctxdb skill validate <path> [--json]"],
+    positionals: [positional("path", "Skill package directory or ZIP path.", true, "path")],
+    options: [JSON_OPTION],
+    notes: ["Reports validation_scope=static_package and scripts_executed=false; does not establish semantic correctness."],
+    examples: [{ command: "ctxdb skill validate ./my-skill --json" }]
+  })),
+  leaf("upload", "Publish a new Skill or update an existing Skill with Base validation.", skillUpload, details({
+    usage: ["ctxdb skill upload <path> [--source=<import|evolution>] [--skill-id=<id> --base-version-id=<id>] [--request-id=<id>] [--session=<binding-id>] [--agent=<name>] [--json]"],
+    positionals: [positional("path", "Skill package directory or ZIP path.", true, "path")],
+    options: [option("--source", "Publication source.", { valueName: "source", choices: ["import", "evolution"], default: "import" }), option("--skill-id", "Existing Skill UUID for an update.", { valueName: "id" }), option("--base-version-id", "Expected active version UUID for an update.", { valueName: "id" }), option("--request-id", "Idempotency UUID; retries retain the original identifier.", { valueName: "id" }), ...SKILL_SCOPE_OPTIONS],
+    constraints: ["Supply --skill-id and --base-version-id together, or omit both to create a Skill."],
+    notes: ["Resolve unfinished uploads with skill status --resume before changing the draft."],
+    examples: [{ command: "ctxdb skill upload ./my-skill --source=import --json" }]
+  })),
+  leaf("evaluate", "Submit an evidence JSON file for Skill evaluation.", skillEvaluate, details({
+    usage: ["ctxdb skill evaluate <evidence.json> [--request-id=<id>] [--session=<binding-id>] [--agent=<name>] [--json]"],
+    positionals: [positional("evidence.json", "Evidence JSON object file, at most 65536 bytes.", true, "path")],
+    options: [option("--request-id", "Idempotency UUID for this evaluation.", { valueName: "id" }), ...SKILL_SCOPE_OPTIONS],
+    examples: [{ command: "ctxdb skill evaluate ./evidence.json --session=<binding-id> --json" }]
+  })),
+  leaf("status", "Inspect Skill evaluation and publication state or resume unfinished work.", skillStatus, details({
+    usage: ["ctxdb skill status [--remote | --resume] [--event-id=<id>] [--session=<binding-id> | --session-id=<agent-session-id>] [--agent=<name>] [--json]"],
+    options: [option("--session-id", "Agent session ID; QoderWork on macOS/Windows also accepts its UI chat ID. Requires --agent; mutually exclusive with --session. Multiple matches require an explicit Binding ID for remote/recovery operations.", { valueName: "id" }), option("--remote", "Query the selected session current server event without resuming work.", { type: "boolean" }), option("--resume", "Resume unfinished evaluations and publications; --session restricts recovery to that binding.", { type: "boolean" }), option("--event-id", "Query one server evaluation event.", { valueName: "id" }), ...SKILL_SCOPE_OPTIONS],
+    notes: ["Default is local read-only status; without a session selector lists bindings, optionally filtered by --agent. --session filters precisely.", "--remote and --resume require --session or a uniquely resolved --session-id and cannot be combined. With --event-id, queries that event only; --resume has no effect.", "--session-id resolves existing bindings only. QoderWork UI lookup requires Node 22.13+, 23.4+, or 24+ and reads its local SQLite database read-only; missing bindings are listed separately. It never creates a binding.", "Drafts are scope-wide. Local Load records do not prove Agent business reuse."],
+    examples: [{ command: "ctxdb skill status --resume --session=<binding-id> --json" }]
+  })),
+  leaf("retry-feedback", "Explicitly re-deliver a retained evaluation on the next user prompt.", skillRetryFeedback, details({
+    usage: ["ctxdb skill retry-feedback --session=<binding-id> --event-id=<id> [--json]"],
+    options: [option("--event-id", "Retained evaluation ID.", { valueName: "id", required: true }), ...SKILL_SCOPE_OPTIONS],
+    notes: ["Use only after explicit user authorization; stop related Agent activity first. Does not author, upload, or re-submit evidence.", "Refuses pending evaluations and existing or uncertain publications. Check status and permissions first; resume frozen uploads separately."],
+    examples: [{ command: "ctxdb skill retry-feedback --session=<binding-id> --event-id=<id> --json" }]
+  })),
+  leaf("purge", "Preview or remove verified publication payloads or the Skill cache.", skillPurge, details({
+    usage: ["ctxdb skill purge [--cache] [--apply] [--session=<binding-id>] [--agent=<name>] [--json]"],
+    options: [option("--cache", "Select the downloaded Skill cache instead of verified upload payloads.", { type: "boolean" }), option("--apply", "Perform deletion; otherwise only preview eligible data.", { type: "boolean" }), ...SKILL_SCOPE_OPTIONS],
+    warnings: ["Stop related sessions and transfers before applying cache deletion. Drafts and unfinished upload payloads are preserved."],
+    examples: [{ command: "ctxdb skill purge --json" }, { command: "ctxdb skill purge --cache --apply --session=<binding-id> --json" }]
+  })),
   leaf(
     "install",
     "Install ContextDB Skills to a built-in Agent or custom directory.",
@@ -6013,6 +6925,70 @@ var kbAclGroup = group("acl", "Manage direct knowledge-base grants and inspect e
     examples: [{ command: "ctxdb kb acl delete <acl-id> --json" }]
   }))
 ]);
+var graphKbOption = option("--kb", "Knowledge-base ID (not a name).", { valueName: "kb-id", required: true });
+var graphEntityIdOption = option("--entity-id", "Exact entity ID within the knowledge base.", { valueName: "id", required: true });
+var graphRelationIdOption = option("--relation-id", "Exact relation ID within the knowledge base.", { valueName: "id", required: true });
+var graphEntityFields = [
+  option("--name", "Complete entity name.", { valueName: "name", required: true }),
+  option("--type", "Complete entity type.", { valueName: "type", required: true }),
+  option("--description", "Complete description; use --description='' for empty text.", { valueName: "text", required: true }),
+  option("--aliases-json", "Complete string array; use '[]' for no aliases.", { valueName: "json-array", type: "json", required: true })
+];
+var graphRelationFields = [
+  option("--relation-type", "Complete relation type.", { valueName: "type", required: true }),
+  option("--description", "Complete description; use --description='' for empty text.", { valueName: "text", required: true }),
+  option("--keywords-json", "Complete string array; use '[]' for no keywords.", { valueName: "json-array", type: "json", required: true }),
+  option("--weight", "Relation weight between 0 and 1; range checked by the server.", { valueName: "number", type: "number", required: true })
+];
+var graphMutationOutput = [AGENT_OPTION, RAW_OPTION, JSON_OPTION];
+var graphDeleteConfirmation = option("--yes", "Explicitly confirm irreversible deletion; required in terminals and scripts.", { type: "boolean", required: true });
+var graphMutationUsage = (command) => [`${GRAPH_MUTATION_USAGE[command]} [--agent=<name>] [--raw] [--json]`];
+var graphMutationCommands = [
+  leaf("entity-create", "Create one knowledge-graph entity.", kbEntityCreate, details({
+    usage: graphMutationUsage("entity-create"),
+    options: [graphKbOption, ...graphEntityFields, ...graphMutationOutput],
+    notes: ["Returns the server-assigned entity ID and editable fields. This operates on the KB graph, independently of memory entities."],
+    examples: [{ command: "ctxdb kb entity-create --kb=<kb-id> --name=ContextDB --type=Product --description='Context database' --aliases-json='[]' --json" }]
+  })),
+  leaf("entity-update", "Replace the editable fields of one knowledge-graph entity.", kbEntityUpdate, details({
+    usage: graphMutationUsage("entity-update"),
+    options: [graphKbOption, graphEntityIdOption, ...graphEntityFields, ...graphMutationOutput],
+    warnings: ["Full replacement: read entity-get first and supply all editable fields. Empty description/aliases explicitly clear them.", "Renaming preserves the entity ID and updates incident relation names. The server rejects renames exceeding its incident-relation limit."],
+    examples: [{ command: "ctxdb kb entity-update --kb=<kb-id> --entity-id=<id> --name=ContextDB --type=Product --description='' --aliases-json='[]' --json" }]
+  })),
+  leaf("entity-delete", "Irreversibly delete an entity and all incoming/outgoing relations.", kbEntityDelete, details({
+    usage: graphMutationUsage("entity-delete"),
+    options: [graphKbOption, graphEntityIdOption, graphDeleteConfirmation, ...graphMutationOutput],
+    warnings: ["Irreversible: deletes the selected entity and every incident relation. No delete request is sent without --yes."],
+    notes: ["Only exact IDs are accepted; names and bulk deletion are unsupported.", "Returns deleted, deleted_entity_count and deleted_relation_count from the server. A false deleted result exits 1."],
+    examples: [{ command: "ctxdb kb entity-delete --kb=<kb-id> --entity-id=<id> --yes --json" }]
+  })),
+  leaf("relation-create", "Create one relation between knowledge-graph entity IDs.", kbRelationCreate, details({
+    usage: graphMutationUsage("relation-create"),
+    options: [
+      graphKbOption,
+      option("--source-entity-id", "Existing source entity ID.", { valueName: "id", required: true }),
+      option("--target-entity-id", "Existing target entity ID.", { valueName: "id", required: true }),
+      ...graphRelationFields,
+      ...graphMutationOutput
+    ],
+    examples: [{ command: "ctxdb kb relation-create --kb=<kb-id> --source-entity-id=<a> --target-entity-id=<b> --relation-type=USES --description='' --keywords-json='[]' --weight=1 --json" }]
+  })),
+  leaf("relation-update", "Replace the editable fields of one knowledge-graph relation.", kbRelationUpdate, details({
+    usage: graphMutationUsage("relation-update"),
+    options: [graphKbOption, graphRelationIdOption, ...graphRelationFields, ...graphMutationOutput],
+    warnings: ["Full replacement: read relations --verbose first and supply all editable fields. Empty description/keywords explicitly clear them."],
+    constraints: ["Relation ID and source/target entity IDs cannot be changed."],
+    examples: [{ command: "ctxdb kb relation-update --kb=<kb-id> --relation-id=<id> --relation-type=USES --description='' --keywords-json='[]' --weight=1 --json" }]
+  })),
+  leaf("relation-delete", "Irreversibly delete one knowledge-graph relation.", kbRelationDelete, details({
+    usage: graphMutationUsage("relation-delete"),
+    options: [graphKbOption, graphRelationIdOption, graphDeleteConfirmation, ...graphMutationOutput],
+    warnings: ["Irreversible: deletes only this relation; both endpoint entities remain. No delete request is sent without --yes."],
+    notes: ["Only exact relation IDs are accepted. Returns deleted from the server; a false result exits 1. The relation API does not return deletion counts."],
+    examples: [{ command: "ctxdb kb relation-delete --kb=<kb-id> --relation-id=<id> --yes --json" }]
+  }))
+];
 var kbGroup = group("kb", "Manage knowledge bases, documents, retrieval, graph, and review.", [
   leaf("create", "Create a knowledge base.", kbCreate, details({
     usage: ["ctxdb kb create <kb-name> [--description=<text>] [--graph-enabled|--no-graph-enabled] [--review-enabled|--no-review-enabled] [--agent=<name>] [--json]"],
@@ -6277,6 +7253,7 @@ var kbGroup = group("kb", "Manage knowledge bases, documents, retrieval, graph,
     notes: ["--entity-id matches either endpoint; --entity-ids requires both endpoints in the supplied set."],
     examples: [{ command: "ctxdb kb relations --kb=<kb-id> --entity-id=<id> --verbose --json" }]
   })),
+  ...graphMutationCommands,
   reviewGroup
 ]);
 function createCommandTree(options = {}) {
@@ -6339,8 +7316,8 @@ function findChild(parent, name) {
 
 // src/cli/device-auth-cli.ts
 import { AuthorizationService, publicAuthorizationTarget, oauthSessionCandidate, oauthSessionFromCredential } from "@aliyunrds/ctxdb-shared";
-import { dirname as dirname2, join as join2 } from "path";
-import { createInterface } from "readline/promises";
+import { dirname as dirname2, join as join6 } from "node:path";
+import { createInterface } from "node:readline/promises";
 import {
   CoreDeviceClient,
   normalizeCoreOrigin as normalizeCoreOrigin2,
@@ -6361,12 +7338,12 @@ import {
 } from "@aliyunrds/ctxdb-shared";
 
 // src/lib/oauth-login-config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync3 } from "node:fs";
 import { isOfficialProductionUrl, normalizeCoreOrigin } from "@aliyunrds/ctxdb-shared";
 var PRODUCTION_AUTHORIZATION_URL = "https://rdsnext.console.aliyun.com/contextDbCliAuthorization/cn-hangzhou";
-function authorizationPage(value) {
-  if (typeof value !== "string" || !value.trim()) throw new Error();
-  const url = new URL(value);
+function authorizationPage(value2) {
+  if (typeof value2 !== "string" || !value2.trim()) throw new Error();
+  const url = new URL(value2);
   if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) throw new Error();
   return url.toString();
 }
@@ -6379,7 +7356,7 @@ function consoleAuthorizationBase(path, core, loginUrl) {
     }
   }
   const fallback = isOfficialProductionUrl(core) ? PRODUCTION_AUTHORIZATION_URL : void 0;
-  if (!existsSync3(path)) return fallback;
+  if (!existsSync7(path)) return fallback;
   try {
     const raw = JSON.parse(readFileSync3(path, "utf8"));
     if (raw.version !== 1 || !Array.isArray(raw.environments) || raw.environments.length > 32) throw new Error();
@@ -6393,8 +7370,8 @@ function consoleAuthorizationBase(path, core, loginUrl) {
 }
 
 // src/lib/open-browser.ts
-import { spawn } from "child_process";
-import { platform } from "os";
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
 function openBrowser(url) {
   try {
     const parsed = new URL(url);
@@ -6404,19 +7381,19 @@ function openBrowser(url) {
   }
   const os = platform();
   const command = os === "darwin" ? { file: "open", args: [url] } : os === "win32" ? { file: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] } : { file: "xdg-open", args: [url] };
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     try {
       const child = spawn(command.file, command.args, { detached: true, stdio: "ignore", windowsHide: true, shell: false });
-      const timer = setTimeout(() => resolve4(true), 2e3);
+      const timer = setTimeout(() => resolve5(true), 2e3);
       const finish = (opened) => {
         clearTimeout(timer);
-        resolve4(opened);
+        resolve5(opened);
       };
       child.once("error", () => finish(false));
       child.once("exit", (code) => finish(code === 0));
       child.unref();
     } catch {
-      resolve4(false);
+      resolve5(false);
     }
   });
 }
@@ -6433,7 +7410,7 @@ function createPublicAuthCommands(dependencies = {}) {
   });
   const client = dependencies.client ?? ((url) => new CoreDeviceClient(url));
   const launchBrowser = dependencies.openBrowser ?? openBrowser;
-  const output = (value, json) => stdout(json ? JSON.stringify(value) + "\n" : String(value) + "\n");
+  const output = (value2, json) => stdout(json ? JSON.stringify(value2) + "\n" : String(value2) + "\n");
   function options(args, command) {
     const allowed = ["agent", "json", "help", "h", ...command === "login" ? ["base-url", "login-url", "server", "device-code", "no-browser", "login", "yes"] : command === "logout" ? ["login", "yes"] : command === "status" ? ["all"] : []];
     if (args.positional.length || Object.keys(args.flags).some((k) => !allowed.includes(k))) throw new Error("Unsupported authentication option.");
@@ -6479,7 +7456,7 @@ function createPublicAuthCommands(dependencies = {}) {
       const pending = beginLogin(path, agent, name);
       await confirmImpact(name ? pending.users[0] ?? agent : agent, pending.users, args, "Reauthorizing this login");
       const baseUrl = normalizeCoreOrigin2(explicitBase ?? DEFAULT_BASE_URL);
-      const consoleBase = consoleAuthorizationBase(join2(dirname2(path), "device-environments.json"), baseUrl, args.flags["login-url"]);
+      const consoleBase = consoleAuthorizationBase(join6(dirname2(path), "device-environments.json"), baseUrl, args.flags["login-url"]);
       const connection = client(baseUrl), controller = new AbortController();
       let browserOpening = Promise.resolve();
       const interrupt = () => controller.abort();
@@ -6788,23 +7765,23 @@ function renderRows(rows, indent = "  ") {
   return rows.map(([label, description]) => `${indent}${label.padEnd(width)}  ${description}
 `).join("");
 }
-function optionLabel(value) {
-  const valuePart = value.valueName ? ` <${value.valueName}>` : "";
+function optionLabel(value2) {
+  const valuePart = value2.valueName ? ` <${value2.valueName}>` : "";
   const annotations = [
-    value.required ? "required" : "",
-    value.repeatable ? "repeatable" : ""
+    value2.required ? "required" : "",
+    value2.repeatable ? "repeatable" : ""
   ].filter(Boolean);
-  return `${value.name}${valuePart}${annotations.length ? ` (${annotations.join("; ")})` : ""}`;
+  return `${value2.name}${valuePart}${annotations.length ? ` (${annotations.join("; ")})` : ""}`;
 }
-function optionDescription(value) {
+function optionDescription(value2) {
   const details2 = [
-    value.default !== void 0 ? `Default: ${String(value.default)}.` : "",
-    value.choices?.length ? `Choices: ${value.choices.join("|")}.` : ""
+    value2.default !== void 0 ? `Default: ${String(value2.default)}.` : "",
+    value2.choices?.length ? `Choices: ${value2.choices.join("|")}.` : ""
   ].filter(Boolean);
-  return `${value.description}${details2.length ? ` ${details2.join(" ")}` : ""}`;
+  return `${value2.description}${details2.length ? ` ${details2.join(" ")}` : ""}`;
 }
-function positionalLabel(value) {
-  return `${value.name} <${value.type}> (${value.required ? "required" : "optional"})`;
+function positionalLabel(value2) {
+  return `${value2.name} <${value2.type}> (${value2.required ? "required" : "optional"})`;
 }
 function renderExamples(examples) {
   return examples.map(
@@ -6854,7 +7831,7 @@ function renderListSection(title, values) {
   if (values.length === 0) return "";
   return `
 ${title}
-${values.map((value) => `  ${value}
+${values.map((value2) => `  ${value2}
 `).join("")}`;
 }
 function renderLeaf(leaf2, path) {
@@ -6864,11 +7841,11 @@ USAGE
 ${leaf2.usage.map((usage2) => `  ${usage2}
 `).join("")}
 ARGUMENTS
-${renderRows(leaf2.positionals.map((value) => [positionalLabel(value), value.description]))}
+${renderRows(leaf2.positionals.map((value2) => [positionalLabel(value2), value2.description]))}
 OPTIONS
-${renderRows(leaf2.options.map((value) => [optionLabel(value), optionDescription(value)]))}` + renderListSection("CONSTRAINTS", leaf2.constraints) + `
+${renderRows(leaf2.options.map((value2) => [optionLabel(value2), optionDescription(value2)]))}` + renderListSection("CONSTRAINTS", leaf2.constraints) + `
 OUTPUT
-${renderRows(leaf2.outputModes.map((value) => [value.name, value.description]))}` + renderListSection("NOTES", leaf2.notes) + renderListSection("WARNINGS", leaf2.warnings) + `
+${renderRows(leaf2.outputModes.map((value2) => [value2.name, value2.description]))}` + renderListSection("NOTES", leaf2.notes) + renderListSection("WARNINGS", leaf2.warnings) + `
 EXAMPLES
 ${renderExamples(leaf2.examples)}`;
 }
@@ -6900,15 +7877,15 @@ function serializeNode(command, path, recursive) {
   return {
     ...base,
     usage: [...serializable.usage],
-    positionals: serializable.positionals.map((value) => ({ ...value })),
-    options: serializable.options.map((value) => ({
-      ...value,
-      ...value.choices ? { choices: [...value.choices] } : {}
+    positionals: serializable.positionals.map((value2) => ({ ...value2 })),
+    options: serializable.options.map((value2) => ({
+      ...value2,
+      ...value2.choices ? { choices: [...value2.choices] } : {}
     })),
     constraints: [...serializable.constraints],
-    outputModes: serializable.outputModes.map((value) => ({ ...value })),
+    outputModes: serializable.outputModes.map((value2) => ({ ...value2 })),
     warnings: [...serializable.warnings],
-    examples: serializable.examples.map((value) => ({ ...value })),
+    examples: serializable.examples.map((value2) => ({ ...value2 })),
     notes: [...serializable.notes]
   };
 }
@@ -6967,8 +7944,8 @@ function resolvePath(root, tokens) {
   }
   return { node, path, consumed, parent };
 }
-function isUnknown(value) {
-  return "group" in value;
+function isUnknown(value2) {
+  return "group" in value2;
 }
 function writeUnknown(unknown, root, version) {
   const scope = unknown.path.length === 1 ? "command" : "subcommand";
@@ -7097,8 +8074,8 @@ function runMain(root = COMMAND_TREE) {
 }
 var directEntry = (() => {
   try {
-    const modulePath = resolve3(fileURLToPath2(import.meta.url));
-    const argvPath = resolve3(process.argv[1] ?? "");
+    const modulePath = resolve4(fileURLToPath2(import.meta.url));
+    const argvPath = resolve4(process.argv[1] ?? "");
     return modulePath === argvPath || realpathSync(modulePath) === realpathSync(argvPath);
   } catch {
     return false;