@bastani/atomic 0.9.10 → 0.9.11-alpha.10

package/dist/builtin/subagents/src/agents/agent-overrides.ts

@@ -1,13 +1,13 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { getProjectAgentSettingsPath, getUserAgentSettingsPath } from "./agent-paths.ts";
 import {
-	EMPTY_SUBAGENT_SETTINGS,
 	type AgentConfig,
 	type BuiltinAgentOverrideBase,
 	type BuiltinAgentOverrideConfig,
+	EMPTY_SUBAGENT_SETTINGS,
 	type SubagentSettings,
 } from "./agent-types.ts";
-import { getProjectAgentSettingsPath, getUserAgentSettingsPath } from "./agent-paths.ts";
 
 export function splitToolList(rawTools: string[] | undefined): { tools?: string[]; mcpDirectTools?: string[] } {
 	const mcpDirectTools: string[] = [];
@@ -26,10 +26,7 @@ export function splitToolList(rawTools: string[] | undefined): { tools?: string[
 }
 
 function joinToolList(config: Pick<AgentConfig, "tools" | "mcpDirectTools">): string[] | undefined {
-	const joined = [
-		...(config.tools ?? []),
-		...(config.mcpDirectTools ?? []).map((tool) => `mcp:${tool}`),
-	];
+	const joined = [...(config.tools ?? []), ...(config.mcpDirectTools ?? []).map((tool) => `mcp:${tool}`)];
 	return joined.length > 0 ? joined : undefined;
 }
 
@@ -68,11 +65,16 @@ function cloneOverrideValue(override: BuiltinAgentOverrideConfig): BuiltinAgentO
 			? { fallbackModels: override.fallbackModels === false ? false : [...override.fallbackModels] }
 			: {}),
 		...(override.fallbackThinkingLevels !== undefined
-			? { fallbackThinkingLevels: override.fallbackThinkingLevels === false ? false : [...override.fallbackThinkingLevels] }
+			? {
+					fallbackThinkingLevels:
+						override.fallbackThinkingLevels === false ? false : [...override.fallbackThinkingLevels],
+				}
 			: {}),
 		...(override.thinking !== undefined ? { thinking: override.thinking } : {}),
 		...(override.systemPromptMode !== undefined ? { systemPromptMode: override.systemPromptMode } : {}),
-		...(override.inheritProjectContext !== undefined ? { inheritProjectContext: override.inheritProjectContext } : {}),
+		...(override.inheritProjectContext !== undefined
+			? { inheritProjectContext: override.inheritProjectContext }
+			: {}),
 		...(override.inheritSkills !== undefined ? { inheritSkills: override.inheritSkills } : {}),
 		...(override.defaultContext !== undefined ? { defaultContext: override.defaultContext } : {}),
 		...(override.disabled !== undefined ? { disabled: override.disabled } : {}),
@@ -107,7 +109,7 @@ function readSettingsFileStrict(filePath: string): Record<string, unknown> {
 
 function writeSettingsFile(filePath: string, settings: Record<string, unknown>): void {
 	fs.mkdirSync(path.dirname(filePath), { recursive: true });
-	fs.writeFileSync(filePath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+	fs.writeFileSync(filePath, `${JSON.stringify(settings, null, 2)}\n`, "utf-8");
 }
 
 function parseOverrideStringArrayOrFalse(
@@ -117,13 +119,17 @@ function parseOverrideStringArrayOrFalse(
 	if (value === undefined) return undefined;
 	if (value === false) return false;
 	if (!Array.isArray(value)) {
-		throw new Error(`Builtin override '${meta.name}' in '${meta.filePath}' has invalid '${meta.field}'; expected an array of strings or false.`);
+		throw new Error(
+			`Builtin override '${meta.name}' in '${meta.filePath}' has invalid '${meta.field}'; expected an array of strings or false.`,
+		);
 	}
 
 	const items: string[] = [];
 	for (const item of value) {
 		if (typeof item !== "string") {
-			throw new Error(`Builtin override '${meta.name}' in '${meta.filePath}' has invalid '${meta.field}'; expected an array of strings or false.`);
+			throw new Error(
+				`Builtin override '${meta.name}' in '${meta.filePath}' has invalid '${meta.field}'; expected an array of strings or false.`,
+			);
 		}
 		const trimmed = item.trim();
 		if (trimmed) items.push(trimmed);
@@ -145,19 +151,27 @@ function parseBuiltinOverrideEntry(
 
 	if ("model" in input) {
 		if (typeof input.model === "string" || input.model === false) override.model = input.model;
-		else throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'model'; expected a string or false.`);
+		else
+			throw new Error(
+				`Builtin override '${name}' in '${filePath}' has invalid 'model'; expected a string or false.`,
+			);
 	}
 
 	if ("thinking" in input) {
 		if (typeof input.thinking === "string" || input.thinking === false) override.thinking = input.thinking;
-		else throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'thinking'; expected a string or false.`);
+		else
+			throw new Error(
+				`Builtin override '${name}' in '${filePath}' has invalid 'thinking'; expected a string or false.`,
+			);
 	}
 
 	if ("systemPromptMode" in input) {
 		if (input.systemPromptMode === "append" || input.systemPromptMode === "replace") {
 			override.systemPromptMode = input.systemPromptMode;
 		} else {
-			throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'systemPromptMode'; expected 'append' or 'replace'.`);
+			throw new Error(
+				`Builtin override '${name}' in '${filePath}' has invalid 'systemPromptMode'; expected 'append' or 'replace'.`,
+			);
 		}
 	}
 
@@ -165,7 +179,9 @@ function parseBuiltinOverrideEntry(
 		if (typeof input.inheritProjectContext === "boolean") {
 			override.inheritProjectContext = input.inheritProjectContext;
 		} else {
-			throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'inheritProjectContext'; expected a boolean.`);
+			throw new Error(
+				`Builtin override '${name}' in '${filePath}' has invalid 'inheritProjectContext'; expected a boolean.`,
+			);
 		}
 	}
 
@@ -173,7 +189,9 @@ function parseBuiltinOverrideEntry(
 		if (typeof input.inheritSkills === "boolean") {
 			override.inheritSkills = input.inheritSkills;
 		} else {
-			throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'inheritSkills'; expected a boolean.`);
+			throw new Error(
+				`Builtin override '${name}' in '${filePath}' has invalid 'inheritSkills'; expected a boolean.`,
+			);
 		}
 	}
 
@@ -181,7 +199,9 @@ function parseBuiltinOverrideEntry(
 		if (input.defaultContext === "fresh" || input.defaultContext === "fork" || input.defaultContext === false) {
 			override.defaultContext = input.defaultContext;
 		} else {
-			throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'defaultContext'; expected 'fresh', 'fork', or false.`);
+			throw new Error(
+				`Builtin override '${name}' in '${filePath}' has invalid 'defaultContext'; expected 'fresh', 'fork', or false.`,
+			);
 		}
 	}
 
@@ -195,13 +215,22 @@ function parseBuiltinOverrideEntry(
 
 	if ("systemPrompt" in input) {
 		if (typeof input.systemPrompt === "string") override.systemPrompt = input.systemPrompt;
-		else throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'systemPrompt'; expected a string.`);
+		else
+			throw new Error(`Builtin override '${name}' in '${filePath}' has invalid 'systemPrompt'; expected a string.`);
 	}
 
-	const fallbackModels = parseOverrideStringArrayOrFalse(input.fallbackModels, { filePath, name, field: "fallbackModels" });
+	const fallbackModels = parseOverrideStringArrayOrFalse(input.fallbackModels, {
+		filePath,
+		name,
+		field: "fallbackModels",
+	});
 	if (fallbackModels !== undefined) override.fallbackModels = fallbackModels;
 
-	const fallbackThinkingLevels = parseOverrideStringArrayOrFalse(input.fallbackThinkingLevels, { filePath, name, field: "fallbackThinkingLevels" });
+	const fallbackThinkingLevels = parseOverrideStringArrayOrFalse(input.fallbackThinkingLevels, {
+		filePath,
+		name,
+		field: "fallbackThinkingLevels",
+	});
 	if (fallbackThinkingLevels !== undefined) override.fallbackThinkingLevels = fallbackThinkingLevels;
 
 	const skills = parseOverrideStringArrayOrFalse(input.skills, { filePath, name, field: "skills" });
@@ -272,13 +301,15 @@ function applyBuiltinOverride(
 		next.fallbackModels = override.fallbackModels === false ? undefined : [...override.fallbackModels];
 	}
 	if (override.fallbackThinkingLevels !== undefined) {
-		next.fallbackThinkingLevels = override.fallbackThinkingLevels === false ? undefined : [...override.fallbackThinkingLevels];
+		next.fallbackThinkingLevels =
+			override.fallbackThinkingLevels === false ? undefined : [...override.fallbackThinkingLevels];
 	}
 	if (override.thinking !== undefined) next.thinking = override.thinking === false ? undefined : override.thinking;
 	if (override.systemPromptMode !== undefined) next.systemPromptMode = override.systemPromptMode;
 	if (override.inheritProjectContext !== undefined) next.inheritProjectContext = override.inheritProjectContext;
 	if (override.inheritSkills !== undefined) next.inheritSkills = override.inheritSkills;
-	if (override.defaultContext !== undefined) next.defaultContext = override.defaultContext === false ? undefined : override.defaultContext;
+	if (override.defaultContext !== undefined)
+		next.defaultContext = override.defaultContext === false ? undefined : override.defaultContext;
 	if (override.disabled !== undefined) next.disabled = override.disabled;
 	if (override.systemPrompt !== undefined) next.systemPrompt = override.systemPrompt;
 	if (override.skills !== undefined) next.skills = override.skills === false ? undefined : [...override.skills];
@@ -326,16 +357,34 @@ export function applyBuiltinOverrides(
 
 export function buildBuiltinOverrideConfig(
 	base: BuiltinAgentOverrideBase,
-	draft: Pick<AgentConfig, "model" | "fallbackModels" | "fallbackThinkingLevels" | "thinking" | "systemPromptMode" | "inheritProjectContext" | "inheritSkills" | "defaultContext" | "disabled" | "systemPrompt" | "skills" | "tools" | "mcpDirectTools">,
+	draft: Pick<
+		AgentConfig,
+		| "model"
+		| "fallbackModels"
+		| "fallbackThinkingLevels"
+		| "thinking"
+		| "systemPromptMode"
+		| "inheritProjectContext"
+		| "inheritSkills"
+		| "defaultContext"
+		| "disabled"
+		| "systemPrompt"
+		| "skills"
+		| "tools"
+		| "mcpDirectTools"
+	>,
 ): BuiltinAgentOverrideConfig | undefined {
 	const override: BuiltinAgentOverrideConfig = {};
 
 	if (draft.model !== base.model) override.model = draft.model ?? false;
-	if (!arraysEqual(draft.fallbackModels, base.fallbackModels)) override.fallbackModels = draft.fallbackModels ? [...draft.fallbackModels] : false;
-	if (!arraysEqual(draft.fallbackThinkingLevels, base.fallbackThinkingLevels)) override.fallbackThinkingLevels = draft.fallbackThinkingLevels ? [...draft.fallbackThinkingLevels] : false;
+	if (!arraysEqual(draft.fallbackModels, base.fallbackModels))
+		override.fallbackModels = draft.fallbackModels ? [...draft.fallbackModels] : false;
+	if (!arraysEqual(draft.fallbackThinkingLevels, base.fallbackThinkingLevels))
+		override.fallbackThinkingLevels = draft.fallbackThinkingLevels ? [...draft.fallbackThinkingLevels] : false;
 	if (draft.thinking !== base.thinking) override.thinking = draft.thinking ?? false;
 	if (draft.systemPromptMode !== base.systemPromptMode) override.systemPromptMode = draft.systemPromptMode;
-	if (draft.inheritProjectContext !== base.inheritProjectContext) override.inheritProjectContext = draft.inheritProjectContext;
+	if (draft.inheritProjectContext !== base.inheritProjectContext)
+		override.inheritProjectContext = draft.inheritProjectContext;
 	if (draft.inheritSkills !== base.inheritSkills) override.inheritSkills = draft.inheritSkills;
 	if (draft.defaultContext !== base.defaultContext) override.defaultContext = draft.defaultContext ?? false;
 	if (draft.disabled !== base.disabled) override.disabled = draft.disabled ?? false;
@@ -358,12 +407,16 @@ export function saveBuiltinAgentOverride(
 	if (!filePath) throw new Error("Project override is not available here. No project config root was found.");
 
 	const settings = readSettingsFileStrict(filePath);
-	const subagents = settings.subagents && typeof settings.subagents === "object" && !Array.isArray(settings.subagents)
-		? { ...(settings.subagents as Record<string, unknown>) }
-		: {};
-	const agentOverrides = subagents.agentOverrides && typeof subagents.agentOverrides === "object" && !Array.isArray(subagents.agentOverrides)
-		? { ...(subagents.agentOverrides as Record<string, unknown>) }
-		: {};
+	const subagents =
+		settings.subagents && typeof settings.subagents === "object" && !Array.isArray(settings.subagents)
+			? { ...(settings.subagents as Record<string, unknown>) }
+			: {};
+	const agentOverrides =
+		subagents.agentOverrides &&
+		typeof subagents.agentOverrides === "object" &&
+		!Array.isArray(subagents.agentOverrides)
+			? { ...(subagents.agentOverrides as Record<string, unknown>) }
+			: {};
 
 	agentOverrides[name] = cloneOverrideValue(override);
 	subagents.agentOverrides = agentOverrides;

package/dist/builtin/subagents/src/agents/agent-paths.ts

@@ -80,7 +80,10 @@ export function resolveNearestProjectChainDirs(cwd: string): { readDirs: string[
 
 	const preferredDir = path.join(getProjectConfigDirs(projectRoot)[0]!, "chains");
 	return {
-		readDirs: getProjectConfigDirs(projectRoot).reverse().map((configDir) => path.join(configDir, "chains")).filter(isDirectory),
+		readDirs: getProjectConfigDirs(projectRoot)
+			.reverse()
+			.map((configDir) => path.join(configDir, "chains"))
+			.filter(isDirectory),
 		preferredDir,
 	};
 }

package/dist/builtin/subagents/src/agents/agent-selection.ts

@@ -1,4 +1,4 @@
-import type { AgentScope, AgentConfig } from "./agents.ts";
+import type { AgentConfig, AgentScope } from "./agents.ts";
 
 export function mergeAgentsForScope(
 	scope: AgentScope,

package/dist/builtin/subagents/src/agents/agent-serializer.ts

@@ -42,10 +42,7 @@ export function serializeAgent(config: AgentConfig): string {
 	if (config.packageName) lines.push(`package: ${config.packageName}`);
 	lines.push(`description: ${config.description}`);
 
-	const tools = [
-		...(config.tools ?? []),
-		...(config.mcpDirectTools ?? []).map((tool) => `mcp:${tool}`),
-	];
+	const tools = [...(config.tools ?? []), ...(config.mcpDirectTools ?? []).map((tool) => `mcp:${tool}`)];
 	const toolsValue = joinComma(tools);
 	if (toolsValue) lines.push(`tools: ${toolsValue}`);
 

package/dist/builtin/subagents/src/agents/agents.ts

@@ -2,11 +2,12 @@
  * Agent discovery and configuration public surface.
  */
 
+export { discoverAgents, discoverAgentsAll } from "./agent-discovery.ts";
 export {
-	defaultInheritProjectContext,
-	defaultInheritSkills,
-	defaultSystemPromptMode,
-} from "./agent-types.ts";
+	buildBuiltinOverrideConfig,
+	removeBuiltinAgentOverride,
+	saveBuiltinAgentOverride,
+} from "./agent-overrides.ts";
 export type {
 	AgentConfig,
 	AgentDefaultContext,
@@ -18,9 +19,8 @@ export type {
 	ChainStepConfig,
 } from "./agent-types.ts";
 export {
-	buildBuiltinOverrideConfig,
-	removeBuiltinAgentOverride,
-	saveBuiltinAgentOverride,
-} from "./agent-overrides.ts";
-export { discoverAgents, discoverAgentsAll } from "./agent-discovery.ts";
+	defaultInheritProjectContext,
+	defaultInheritSkills,
+	defaultSystemPromptMode,
+} from "./agent-types.ts";
 export { buildRuntimeName, frontmatterNameForConfig, parsePackageName } from "./identity.ts";

package/dist/builtin/subagents/src/agents/chain-serializer.ts

@@ -1,8 +1,8 @@
-import type { ChainConfig, ChainStepConfig } from "./agents.ts";
-import { buildRuntimeName, frontmatterNameForConfig, parsePackageName } from "./identity.ts";
-import { parseFrontmatter } from "./frontmatter.ts";
 import { ChainOutputValidationError, validateChainOutputBindings } from "../runs/shared/chain-outputs.ts";
 import type { ChainStep } from "../shared/settings.ts";
+import type { ChainConfig, ChainStepConfig } from "./agents.ts";
+import { parseFrontmatter } from "./frontmatter.ts";
+import { buildRuntimeName, frontmatterNameForConfig, parsePackageName } from "./identity.ts";
 
 const REMOVED_CHAIN_CONFIG_FIELDS = new Set(["acceptance"]);
 
@@ -177,10 +177,14 @@ export function parseJsonChain(content: string, source: "user" | "project", file
 	try {
 		validateChainOutputBindings(chainSteps as ChainStep[], { maxItems: Number.MAX_SAFE_INTEGER });
 	} catch (error) {
-		if (error instanceof ChainOutputValidationError) throw new Error(`Invalid JSON chain '${filePath}': ${error.message}`);
+		if (error instanceof ChainOutputValidationError)
+			throw new Error(`Invalid JSON chain '${filePath}': ${error.message}`);
 		throw error;
 	}
-	const parsedPackage = parsePackageName(typeof input.package === "string" ? input.package : undefined, `Chain '${input.name}' package`);
+	const parsedPackage = parsePackageName(
+		typeof input.package === "string" ? input.package : undefined,
+		`Chain '${input.name}' package`,
+	);
 	if (parsedPackage.error) throw new Error(parsedPackage.error);
 	const extraFields: Record<string, string> = {};
 	for (const [key, value] of Object.entries(input)) {

package/dist/builtin/subagents/src/agents/identity.ts

@@ -5,14 +5,21 @@ const IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)*$/;
 function normalizePackageName(value: string | undefined): string | undefined {
 	const trimmed = value?.trim();
 	if (!trimmed) return undefined;
-	return trimmed.toLowerCase().replace(/\s+/g, "-").replace(/[^a-z0-9.-]/g, "").replace(/-+/g, "-").replace(/\.+/g, ".").replace(/(?:^[-.]+|[-.]+$)/g, "");
+	return trimmed
+		.toLowerCase()
+		.replace(/\s+/g, "-")
+		.replace(/[^a-z0-9.-]/g, "")
+		.replace(/-+/g, "-")
+		.replace(/\.+/g, ".")
+		.replace(/(?:^[-.]+|[-.]+$)/g, "");
 }
 
 export function parsePackageName(value: unknown, label = "package"): { packageName?: string; error?: string } {
 	if (value === undefined || value === false || value === "") return { packageName: undefined };
 	if (typeof value !== "string") return { error: `${label} must be a string or false when provided.` };
 	const packageName = normalizePackageName(value);
-	if (!packageName || !IDENTIFIER_PATTERN.test(packageName)) return { error: `${label} is invalid after sanitization.` };
+	if (!packageName || !IDENTIFIER_PATTERN.test(packageName))
+		return { error: `${label} is invalid after sanitization.` };
 	return { packageName };
 }
 
@@ -21,7 +28,9 @@ export function buildRuntimeName(localName: string, packageName?: string): strin
 	return trimmedPackage ? `${trimmedPackage}.${localName}` : localName;
 }
 
-export function frontmatterNameForConfig(config: Pick<AgentConfig | ChainConfig, "name" | "localName" | "packageName">): string {
+export function frontmatterNameForConfig(
+	config: Pick<AgentConfig | ChainConfig, "name" | "localName" | "packageName">,
+): string {
 	if (config.localName) return config.localName;
 	if (config.packageName && config.name.startsWith(`${config.packageName}.`)) {
 		return config.name.slice(config.packageName.length + 1);

package/dist/builtin/subagents/src/agents/skills-paths.ts

@@ -19,9 +19,10 @@ function readOptionalJsonFile(filePath: string, label: string): unknown {
 	try {
 		return JSON.parse(fs.readFileSync(filePath, "utf-8"));
 	} catch (error) {
-		const code = typeof error === "object" && error !== null && "code" in error
-			? (error as { code?: unknown }).code
-			: undefined;
+		const code =
+			typeof error === "object" && error !== null && "code" in error
+				? (error as { code?: unknown }).code
+				: undefined;
 		if (code === "ENOENT") return null;
 		const message = error instanceof Error ? error.message : String(error);
 		throw new Error(`Failed to read ${label} '${filePath}': ${message}`, {
@@ -39,7 +40,11 @@ function readJsonFileBestEffort(filePath: string): unknown {
 	}
 }
 
-function extractSkillPathsFromPackageRoot(packageRoot: string, source: SkillSource, bestEffort = false): SkillSearchPath[] {
+function extractSkillPathsFromPackageRoot(
+	packageRoot: string,
+	source: SkillSource,
+	bestEffort = false,
+): SkillSearchPath[] {
 	const packageJsonPath = path.join(packageRoot, "package.json");
 	const pkg = bestEffort
 		? readJsonFileBestEffort(packageJsonPath)
@@ -79,7 +84,10 @@ function getGlobalNpmRoot(): string | null {
 
 function collectInstalledPackageSkillPaths(cwd: string): SkillSearchPath[] {
 	const dirs: SkillSearchPath[] = [
-		...getProjectConfigDirs(cwd).map((configDir) => ({ path: path.join(configDir, "npm", "node_modules"), source: "project-package" as const })),
+		...getProjectConfigDirs(cwd).map((configDir) => ({
+			path: path.join(configDir, "npm", "node_modules"),
+			source: "project-package" as const,
+		})),
 		...getAgentConfigPaths("npm", "node_modules").map((dir) => ({ path: dir, source: "user-package" as const })),
 	];
 
@@ -131,8 +139,16 @@ function collectInstalledPackageSkillPaths(cwd: string): SkillSearchPath[] {
 function collectSettingsSkillPaths(cwd: string): SkillSearchPath[] {
 	const results: SkillSearchPath[] = [];
 	const settingsFiles = [
-		...getProjectConfigDirs(cwd).map((configDir) => ({ file: path.join(configDir, "settings.json"), base: configDir, source: "project-settings" as const })),
-		...getAgentConfigPaths("settings.json").map((file) => ({ file, base: path.dirname(file), source: "user-settings" as const })),
+		...getProjectConfigDirs(cwd).map((configDir) => ({
+			file: path.join(configDir, "settings.json"),
+			base: configDir,
+			source: "project-settings" as const,
+		})),
+		...getAgentConfigPaths("settings.json").map((file) => ({
+			file,
+			base: path.dirname(file),
+			source: "user-settings" as const,
+		})),
 	];
 
 	for (const { file, base, source } of settingsFiles) {
@@ -156,9 +172,11 @@ function collectSettingsSkillPaths(cwd: string): SkillSearchPath[] {
 }
 
 function isSafePackagePath(value: string): boolean {
-	return value.length > 0
-		&& !path.isAbsolute(value)
-		&& value.split(/[\\/]/).every((part) => part.length > 0 && part !== "." && part !== "..");
+	return (
+		value.length > 0 &&
+		!path.isAbsolute(value) &&
+		value.split(/[\\/]/).every((part) => part.length > 0 && part !== "." && part !== "..")
+	);
 }
 
 function parseNpmPackageName(source: string): string | undefined {
@@ -201,8 +219,15 @@ function parseGitPackagePath(source: string): { host: string; repoPath: string }
 		repoPath = spec.slice(slashIndex + 1);
 	}
 
-	const normalizedPath = stripGitRef(repoPath).replace(/\.git$/, "").replace(/^\/+/, "");
-	if (!host || !isSafePackagePath(host) || !isSafePackagePath(normalizedPath) || normalizedPath.split(/[\\/]/).length < 2) {
+	const normalizedPath = stripGitRef(repoPath)
+		.replace(/\.git$/, "")
+		.replace(/^\/+/, "");
+	if (
+		!host ||
+		!isSafePackagePath(host) ||
+		!isSafePackagePath(normalizedPath) ||
+		normalizedPath.split(/[\\/]/).length < 2
+	) {
 		return undefined;
 	}
 	return { host, repoPath: normalizedPath };
@@ -231,8 +256,16 @@ function resolveSettingsPackageRoot(source: string, baseDir: string): string | u
 
 function collectSettingsPackageSkillPaths(cwd: string): SkillSearchPath[] {
 	const settingsFiles = [
-		...getProjectConfigDirs(cwd).map((configDir) => ({ file: path.join(configDir, "settings.json"), base: configDir, source: "project-package" as const })),
-		...getAgentConfigPaths("settings.json").map((file) => ({ file, base: path.dirname(file), source: "user-package" as const })),
+		...getProjectConfigDirs(cwd).map((configDir) => ({
+			file: path.join(configDir, "settings.json"),
+			base: configDir,
+			source: "project-package" as const,
+		})),
+		...getAgentConfigPaths("settings.json").map((file) => ({
+			file,
+			base: path.dirname(file),
+			source: "user-package" as const,
+		})),
 	];
 	const results: SkillSearchPath[] = [];
 
@@ -243,11 +276,14 @@ function collectSettingsPackageSkillPaths(cwd: string): SkillSearchPath[] {
 		if (!Array.isArray(packages)) continue;
 
 		for (const entry of packages) {
-			const packageSource = typeof entry === "string"
-				? entry
-				: typeof entry === "object" && entry !== null && typeof (entry as { source?: unknown }).source === "string"
-					? (entry as { source: string }).source
-					: undefined;
+			const packageSource =
+				typeof entry === "string"
+					? entry
+					: typeof entry === "object" &&
+							entry !== null &&
+							typeof (entry as { source?: unknown }).source === "string"
+						? (entry as { source: string }).source
+						: undefined;
 			if (!packageSource) continue;
 
 			const packageRoot = resolveSettingsPackageRoot(packageSource, base);
@@ -262,7 +298,7 @@ function collectSettingsPackageSkillPaths(cwd: string): SkillSearchPath[] {
 function collectBuiltinPackageSkillPaths(): SkillSearchPath[] {
 	try {
 		return getBuiltinPackagePaths().flatMap((packageRoot) =>
-			extractSkillPathsFromPackageRoot(packageRoot, "builtin", true)
+			extractSkillPathsFromPackageRoot(packageRoot, "builtin", true),
 		);
 	} catch {
 		// Builtin package discovery is additive; keep project/user/settings skill resolution working if unavailable.
@@ -272,7 +308,10 @@ function collectBuiltinPackageSkillPaths(): SkillSearchPath[] {
 
 export function buildSkillPaths(cwd: string): SkillSearchPath[] {
 	const skillPaths: SkillSearchPath[] = [
-		...getProjectConfigDirs(cwd).map((configDir) => ({ path: path.join(configDir, "skills"), source: "project" as const })),
+		...getProjectConfigDirs(cwd).map((configDir) => ({
+			path: path.join(configDir, "skills"),
+			source: "project" as const,
+		})),
 		{ path: path.join(cwd, ".agents", "skills"), source: "project" },
 		...getAgentConfigPaths("skills").map((dir) => ({ path: dir, source: "user" as const })),
 		{ path: path.join(os.homedir(), ".agents", "skills"), source: "user" },
@@ -306,11 +345,13 @@ export function inferSkillSource(filePath: string, cwd: string, sourceHint?: Ski
 	const userAgentsRoot = path.resolve(os.homedir(), ".agents");
 
 	if (projectPackagesRoots.some((root) => isWithinPath(filePath, root))) return "project-package";
-	if (projectSkillsRoots.some((root) => isWithinPath(filePath, root)) || isWithinPath(filePath, projectAgentsRoot)) return "project";
+	if (projectSkillsRoots.some((root) => isWithinPath(filePath, root)) || isWithinPath(filePath, projectAgentsRoot))
+		return "project";
 	if (projectConfigRoots.some((root) => isWithinPath(filePath, root))) return "project-settings";
 
 	if (userPackagesRoots.some((root) => isWithinPath(filePath, root))) return "user-package";
-	if (userSkillsRoots.some((root) => isWithinPath(filePath, root)) || isWithinPath(filePath, userAgentsRoot)) return "user";
+	if (userSkillsRoots.some((root) => isWithinPath(filePath, root)) || isWithinPath(filePath, userAgentsRoot))
+		return "user";
 	if (userAgentRoots.some((root) => isWithinPath(filePath, root))) return "user-settings";
 
 	const globalRoot = getGlobalNpmRoot();
@@ -319,7 +360,6 @@ export function inferSkillSource(filePath: string, cwd: string, sourceHint?: Ski
 	return "unknown";
 }
 
-
 export function clearSkillPathDiscoveryCache(): void {
 	cachedGlobalNpmRoot = null;
 }

package/dist/builtin/subagents/src/agents/skills.ts

@@ -4,7 +4,13 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { buildSkillPaths, clearSkillPathDiscoveryCache, inferSkillSource, type SkillSearchPath } from "./skills-paths.ts";
+import {
+	buildSkillPaths,
+	clearSkillPathDiscoveryCache,
+	inferSkillSource,
+	type SkillSearchPath,
+} from "./skills-paths.ts";
+
 export { __setGlobalNpmRootExecSyncForTest } from "./skills-paths.ts";
 
 export type SkillSource =
@@ -68,7 +74,10 @@ function stripSkillFrontmatter(content: string): string {
 	return normalized.slice(endIndex + 4).trim();
 }
 
-function chooseHigherPrioritySkill(existing: CachedSkillEntry | undefined, candidate: CachedSkillEntry): CachedSkillEntry {
+function chooseHigherPrioritySkill(
+	existing: CachedSkillEntry | undefined,
+	candidate: CachedSkillEntry,
+): CachedSkillEntry {
 	if (!existing) return candidate;
 	const existingPriority = SOURCE_PRIORITY[existing.source] ?? 0;
 	const candidatePriority = SOURCE_PRIORITY[candidate.source] ?? 0;
@@ -89,7 +98,7 @@ function maybeReadSkillDescription(filePath: string): string | undefined {
 		const frontmatter = normalized.slice(3, endIndex).trim();
 		const match = frontmatter.match(/^description:\s*(.+)$/m);
 		if (!match) return undefined;
-		return match[1]?.trim().replace(/^['\"]|['\"]$/g, "");
+		return match[1]?.trim().replace(/^['"]|['"]$/g, "");
 	} catch {
 		// Description parsing is best-effort metadata extraction.
 		return undefined;
@@ -128,9 +137,10 @@ function collectFilesystemSkills(cwd: string, skillPaths: SkillSearchPath[]): Ca
 		if (stat.isFile()) {
 			const fileName = path.basename(skillPath.path);
 			if (!fileName.toLowerCase().endsWith(".md")) continue;
-			const skillName = fileName.toLowerCase() === "skill.md"
-				? path.basename(path.dirname(skillPath.path))
-				: path.basename(fileName, path.extname(fileName));
+			const skillName =
+				fileName.toLowerCase() === "skill.md"
+					? path.basename(path.dirname(skillPath.path))
+					: path.basename(fileName, path.extname(fileName));
 			pushEntry(skillName, skillPath.path, skillPath.source);
 			continue;
 		}
@@ -188,21 +198,14 @@ function getCachedSkills(cwd: string): CachedSkillEntry[] {
 	return skills;
 }
 
-export function resolveSkillPath(
-	skillName: string,
-	cwd: string,
-): { path: string; source: SkillSource } | undefined {
+export function resolveSkillPath(skillName: string, cwd: string): { path: string; source: SkillSource } | undefined {
 	const skills = getCachedSkills(cwd);
 	const skill = skills.find((s) => s.name === skillName);
 	if (!skill) return undefined;
 	return { path: skill.filePath, source: skill.source };
 }
 
-function readSkill(
-	skillName: string,
-	skillPath: string,
-	source: SkillSource,
-): ResolvedSkill | undefined {
+function readSkill(skillName: string, skillPath: string, source: SkillSource): ResolvedSkill | undefined {
 	try {
 		const stat = fs.statSync(skillPath);
 		const cached = skillCache.get(skillPath);
@@ -232,10 +235,7 @@ function readSkill(
 	}
 }
 
-export function resolveSkills(
-	skillNames: string[],
-	cwd: string,
-): { resolved: ResolvedSkill[]; missing: string[] } {
+export function resolveSkills(skillNames: string[], cwd: string): { resolved: ResolvedSkill[]; missing: string[] } {
 	const resolved: ResolvedSkill[] = [];
 	const missing: string[] = [];
 
@@ -283,14 +283,10 @@ export function resolveSkillsWithFallback(
 export function buildSkillInjection(skills: ResolvedSkill[]): string {
 	if (skills.length === 0) return "";
 
-	return skills
-		.map((s) => `<skill name="${s.name}">\n${s.content}\n</skill>`)
-		.join("\n\n");
+	return skills.map((s) => `<skill name="${s.name}">\n${s.content}\n</skill>`).join("\n\n");
 }
 
-export function normalizeSkillInput(
-	input: string | string[] | boolean | undefined,
-): string[] | false | undefined {
+export function normalizeSkillInput(input: string | string[] | boolean | undefined): string[] | false | undefined {
 	if (input === false) return false;
 	if (input === true || input === undefined) return undefined;
 	if (Array.isArray(input)) {
@@ -311,7 +307,14 @@ export function normalizeSkillInput(
 			// Not valid JSON – fall through to comma-split
 		}
 	}
-	return [...new Set(input.split(",").map((s) => s.trim()).filter((s) => s.length > 0))];
+	return [
+		...new Set(
+			input
+				.split(",")
+				.map((s) => s.trim())
+				.filter((s) => s.length > 0),
+		),
+	];
 }
 
 export function discoverAvailableSkills(cwd: string): Array<{