@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/skill-lint.js

@@ -1,250 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/skill-lint.js — lint SKILL.md frontmatter the way Claude Code's YAML parser reads it.
-//
-// Why (task 1003548): nine of this repo's fifty skills shipped with an unquoted
-// `description:` that contained ": " (e.g. "on it: (re)connect", "HARD RULE: never").
-// YAML reads a colon-space inside a plain scalar as a new mapping key and the whole
-// frontmatter fails to parse; Claude Code then loads the skill with EVERY field
-// dropped — the name falls back to the folder, the description to the body's first
-// line — and nothing warns. Nothing in CI caught it. This linter reproduces the
-// parser's failure modes without a YAML dependency, so it can run in fitness.js
-// (CI), as a PostToolUse hook on SKILL.md edits, and by hand.
-//
-// It also reports the context cost: the skill listing is budgeted at ~1% of the
-// context window, and a description is resident in EVERY session, so long ones
-// crowd the others out and get truncated (skill routing degrades).
-//
-// A HIDDEN skill — frontmatter `disable-model-invocation: true` — is not in that
-// listing at all: Claude Code keeps its description out of the model's context and
-// loads it only when a person types /name (the model cannot invoke it). So the
-// budget counts LISTED skills only, and hidden ones are reported on their own line
-// (task 1004471, owner ruling on blocker 1000139).
-//
-// NOT A YAML PARSER, on purpose. These are targeted regex checks for the hazards that
-// actually bit us (a plain scalar carrying ": " or " #", an unclosed quote or flow
-// collection, a tab, a continuation line), so the repo gains a CI gate with no new
-// dependency. It can therefore under-report an exotic frontmatter shape. The reference
-// parser is `claude plugin validate .claude`, which uses Claude Code's own YAML reader —
-// run it when a file looks fine here but the skill still loads wrong, and treat its
-// verdict as authoritative over this one.
-//
-// Usage:
-//   node scripts/gds/skill-lint.js                 lint every skill Claude Code can load — .claude/skills/*
-//                                                  plus the module-owned modules/*/skills/* that materialize
-//                                                  into it; exit 1 on any error. The listing total counts
-//                                                  only the skills RESIDENT here: a skill owned by a module
-//                                                  this checkout's config leaves off is linted, not counted
-//                                                  (task 1004470)
-//   node scripts/gds/skill-lint.js <file...>       lint specific files
-//   node scripts/gds/skill-lint.js --hook          PostToolUse mode: read the hook JSON on stdin, lint the
-//                                                  edited file if it is a SKILL.md, print findings, exit 0
-//   node scripts/gds/skill-lint.js --json          machine-readable
+// scripts/gds/skill-lint.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/skill-lint.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-const fs = require('node:fs');
-const path = require('node:path');
-
-const DESC_WARN_CHARS = 400;      // longer than this and the listing entry is likely truncated
-const DESC_HARD_CHARS = 1024;     // Claude Code's own cap on a description
-const LISTING_BUDGET_CHARS = 8000; // ~2k tokens ≈ 1% of a 200k window (names + descriptions, all skills)
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-// The YAML plain-scalar hazards that make the WHOLE frontmatter unparseable or
-// silently change a value. Each returns a message or null.
-const PLAIN_SCALAR_CHECKS = [
-  (v) => (/: /.test(v) || /:$/.test(v)) ? 'contains ": " (colon-space) — YAML reads it as a new key and the whole frontmatter fails to parse' : null,
-  (v) => / #/.test(v) ? 'contains " #" — YAML starts a comment there and silently truncates the value' : null,
-  (v) => (/^\[/.test(v) && !/\]$/.test(v)) || (/^\{/.test(v) && !/\}$/.test(v)) ? 'opens a flow sequence/map it never closes on the same line' : null,
-  (v) => /^[\]}>|*&!%@`,]/.test(v) ? `starts with "${v[0]}" — a YAML indicator; the value will not be read as text` : null,
-  (v) => /^-\s/.test(v) ? 'starts with "- " — YAML reads a list, not text' : null,
-];
-
-// Split the leading frontmatter block. Returns null when the file has none.
-function splitFrontmatter(text) {
-  const eol = text.includes('\r\n') ? '\r\n' : '\n';
-  const lines = text.split(eol);
-  if (lines[0] !== '---') return null;
-  const end = lines.indexOf('---', 1);
-  if (end < 0) return null;
-  return { lines: lines.slice(1, end), bodyStart: end + 1, eol };
-}
-
-// Lint one frontmatter block (array of lines). Returns { errors, warnings, fields }.
-// `fields` holds each top-level key's raw value; block scalars are joined.
-function lintFrontmatter(lines) {
-  const errors = [], warnings = [], fields = {};
-  let cur = null, curKind = null; // curKind: 'plain' | 'block' | 'quoted'
-  lines.forEach((ln, i) => {
-    const n = i + 2; // 1-based line number in the file (line 1 is the opening ---)
-    if (!ln.trim()) return;
-    if (/^\t/.test(ln)) { errors.push(`line ${n}: tab indentation — YAML forbids tabs`); return; }
-    const kv = /^([A-Za-z0-9_-]+):(?:\s+(.*))?$/.exec(ln);
-    if (kv && !/^\s/.test(ln)) {
-      cur = kv[1];
-      const v = (kv[2] || '').trim();
-      if (fields[cur] !== undefined) errors.push(`line ${n}: duplicate key "${cur}"`);
-      if (v === '' ) { fields[cur] = ''; curKind = 'nested'; return; }
-      if (/^[>|][+-]?\d*$/.test(v)) { fields[cur] = ''; curKind = 'block'; return; }
-      if (/^(["']).*\1$/.test(v)) { fields[cur] = v.slice(1, -1); curKind = 'quoted'; return; }
-      if (/^["']/.test(v)) { errors.push(`line ${n}: "${cur}" opens a quote it never closes on the same line`); fields[cur] = v; curKind = 'plain'; return; }
-      curKind = 'plain'; fields[cur] = v;
-      for (const chk of PLAIN_SCALAR_CHECKS) { const m = chk(v); if (m) { errors.push(`line ${n}: "${cur}" ${m}. Fix: write it as a block scalar — "${cur}: >-" then the text indented two spaces`); break; } }
-      return;
-    }
-    if (/^\s+\S/.test(ln)) {
-      if (!cur) { errors.push(`line ${n}: indented text before any key`); return; }
-      if (curKind === 'block' || curKind === 'nested') { fields[cur] = (fields[cur] ? fields[cur] + ' ' : '') + ln.trim(); return; }
-      errors.push(`line ${n}: continuation under "${cur}" — a plain value cannot span lines; use "${cur}: >-" with the text indented`);
-      return;
-    }
-    errors.push(`line ${n}: not "key: value" — "${ln.slice(0, 60)}"`);
-  });
-  return { errors, warnings, fields };
-}
-
-// Whether a skill is HIDDEN from the model's listing: `disable-model-invocation: true`
-// (Claude Code: "description not in context"; typeable as /name, never model-invoked).
-// Anything but a literal true — absent, false, a typo — leaves it listed, so a mistake
-// can only ever over-count the budget, never hide a skill nobody meant to hide.
-function isHidden(fields) {
-  return String((fields && fields['disable-model-invocation']) || '').trim().toLowerCase() === 'true';
-}
-
-// Lint one SKILL.md file's text. `file` is used for the name check and messages.
-function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
-  const dirName = path.basename(path.dirname(file));
-  const fm = splitFrontmatter(text);
-  const res = { file, errors: [], warnings: [], name: null, description: '', listingChars: 0, hidden: false };
-  if (!fm) { res.errors.push('no YAML frontmatter (the file must start with --- and carry name + description)'); return res; }
-  const { errors, warnings, fields } = lintFrontmatter(fm.lines);
-  res.errors.push(...errors); res.warnings.push(...warnings);
-  const name = fields.name || '', desc = fields.description || '';
-  if (!name) res.errors.push('missing "name"');
-  else if (name !== dirName && dirName !== 'SKILL.md') res.warnings.push(`name "${name}" differs from its folder "${dirName}" — the folder name wins in listings`);
-  if (!desc) res.errors.push('missing or empty "description" — the skill would match on its body text');
-  res.hidden = isHidden(fields);
-  if (desc.length > DESC_HARD_CHARS) res.errors.push(`description is ${desc.length} chars — over Claude Code's ${DESC_HARD_CHARS}-char cap`);
-  else if (desc.length > DESC_WARN_CHARS && !res.hidden) res.warnings.push(`description is ${desc.length} chars — over the ~${DESC_WARN_CHARS} we aim for; every char is resident in every session`);
-  // listingChars is what the entry WOULD cost if listed; lintSkills leaves hidden ones out of the total.
-  res.name = name || dirName; res.description = desc; res.listingChars = res.name.length + desc.length;
-  return res;
-}
-
-// Every SKILL.md in one skills root (one level deep, plus a `vendor/` tier).
-function skillsIn(dir) {
-  if (!fs.existsSync(dir)) return [];
-  const out = [];
-  for (const d of fs.readdirSync(dir, { withFileTypes: true })) {
-    if (!d.isDirectory()) continue;
-    const own = path.join(dir, d.name, 'SKILL.md');
-    if (fs.existsSync(own)) { out.push(own); continue; }
-    if (d.name === 'vendor') out.push(...skillsIn(path.join(dir, d.name)));
-  }
-  return out;
-}
-
-// Every skill Claude Code can end up loading — the tracked `.claude/skills/` PLUS the
-// module-owned `modules/<key>/skills/`, because claude-materialize.js copies those into
-// `.claude/skills/` as untracked copies (task 1003330) and a defect in one only shows up
-// after materialization. Scanning only the tracked root left 14 ui-design skills unlinted
-// until the copy existed, which is exactly how four unparseable frontmatters shipped
-// (task 1003587). A name already present in `.claude/skills/` wins and its module copy is
-// skipped — the same precedence the materializer applies — so nothing is counted twice.
-function listSkillFiles(root = REPO_ROOT) {
-  const core = skillsIn(path.join(root, '.claude', 'skills'));
-  const seen = new Set(core.map((f) => path.basename(path.dirname(f))));
-  const modulesDir = path.join(root, 'modules');
-  const owned = [];
-  if (fs.existsSync(modulesDir)) {
-    for (const d of fs.readdirSync(modulesDir, { withFileTypes: true })) {
-      if (!d.isDirectory()) continue;
-      for (const f of skillsIn(path.join(modulesDir, d.name, 'skills'))) {
-        if (!seen.has(path.basename(path.dirname(f)))) owned.push(f);
-      }
-    }
-  }
-  return [...core, ...owned];
-}
-
-// The subset of listSkillFiles() that is actually RESIDENT for an instance — what
-// claude-materialize.js would land in its .claude/skills/ (task 1004470). Linting still
-// covers every file (a defect in an opt-in module's skill must not wait for the module
-// to be switched on), but the listing cost is a per-session number, and a skill owned by
-// a module the instance leaves off is never in that session's listing. Enablement is the
-// materialiser's own rule (moduleSkillRoster: the instance's config/modules.json, else the
-// module's `default`), read from there rather than restated. Fails open to the full list
-// if the materialiser cannot load, so the number can only ever over-report.
-function residentSkillFiles(root = REPO_ROOT, { instanceDir = root, files = listSkillFiles(root) } = {}) {
-  let off;
-  try { off = require('./claude-materialize.js').disabledModuleSkills({ coreRoot: root, instanceDir }); } catch (_) { return files; }
-  return files.filter((f) => !off.has(path.basename(path.dirname(f))));
-}
-
-// Lint a set of files; returns per-file results plus the listing total vs budget. The
-// listing counts `resident` (a list of paths) when given, else every linted file — and of
-// those, only the LISTED ones: a hidden skill (isHidden) is resident but costs the model
-// nothing, so it is tallied separately as hiddenSkills / hiddenChars (task 1004471).
-function lintSkills(files, { resident } = {}) {
-  const results = files.map((f) => lintSkillFile(fs.readFileSync(f, 'utf8'), { file: f }));
-  const counted = resident ? new Set(resident.map((f) => path.resolve(f))) : null;
-  const here = counted ? results.filter((r) => counted.has(path.resolve(r.file))) : results;
-  const listed = here.filter((r) => !r.hidden);
-  const hidden = here.filter((r) => r.hidden);
-  const listingChars = listed.reduce((a, r) => a + r.listingChars, 0);
-  const hiddenChars = hidden.reduce((a, r) => a + r.listingChars, 0);
-  return { results, listingChars, listedSkills: listed.length, residentSkills: here.length, hiddenSkills: hidden.length, hiddenChars, hiddenNames: hidden.map((r) => r.name), budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
-}
-
-// The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
-// file a builder actually edits; the `.claude/skills/` copy is generated (task 1003587).
-function isSkillMd(p) {
-  const s = String(p || '');
-  return /[\\/]\.claude[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s)
-    || /[\\/]modules[\\/][^\\/]+[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s);
-}
-
-function format(report, { relTo = REPO_ROOT } = {}) {
-  const out = [];
-  for (const r of report.results) {
-    const rel = path.relative(relTo, r.file).replace(/\\/g, '/');
-    for (const e of r.errors) out.push(`✗ ${rel}: ${e}`);
-    for (const w of r.warnings) out.push(`! ${rel}: ${w}`);
-  }
-  const errs = report.results.reduce((a, r) => a + r.errors.length, 0);
-  const warns = report.results.reduce((a, r) => a + r.warnings.length, 0);
-  const residentN = report.residentSkills !== undefined ? report.residentSkills : report.listedSkills;
-  const resident = residentN !== undefined && residentN !== report.results.length ? ` ${residentN} resident here (the rest belong to modules this instance leaves off);` : '';
-  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s);${resident} listing ${report.listingChars} chars over ${report.listedSkills} listed skill(s) (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
-  if (report.hiddenSkills) out.push(`skill-lint: ${report.hiddenSkills} hidden skill(s) (disable-model-invocation — typeable as /name, not in the model's listing, not counted): ${report.hiddenChars} chars — ${report.hiddenNames.join(', ')}`);
-  return out.join('\n');
-}
-
-function main() {
-  const argv = process.argv.slice(2);
-  const json = argv.includes('--json');
-  if (argv.includes('--hook')) {
-    // PostToolUse: stdin carries {tool_input:{file_path}}. Only speak when a SKILL.md was touched.
-    let raw = '';
-    process.stdin.setEncoding('utf8');
-    process.stdin.on('data', (d) => { raw += d; });
-    process.stdin.on('end', () => {
-      try {
-        const j = JSON.parse(raw || '{}');
-        const fp = (j.tool_input && (j.tool_input.file_path || j.tool_input.path)) || '';
-        if (!isSkillMd(fp) || !fs.existsSync(fp)) return;
-        const report = lintSkills([fp]);
-        const r = report.results[0];
-        if (r.errors.length || r.warnings.length) console.log('[skill-lint] ' + format(report).split('\n').filter((l) => !l.startsWith('skill-lint:')).join('\n[skill-lint] '));
-      } catch (_) { /* a hook never breaks the edit */ }
-      process.exitCode = 0;
-    });
-    return;
-  }
-  const files = argv.filter((a) => !a.startsWith('--'));
-  const all = files.length ? null : listSkillFiles();
-  const report = all ? lintSkills(all, { resident: residentSkillFiles(REPO_ROOT, { files: all }) }) : lintSkills(files.map((f) => path.resolve(f)));
-  if (json) console.log(JSON.stringify(report, null, 1)); else console.log(format(report));
-  process.exitCode = report.results.some((r) => r.errors.length) ? 1 : 0;
-}
-
-module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, residentSkillFiles, splitFrontmatter, isSkillMd, isHidden, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
-if (require.main === module) main();
+require('../bongos/forwarder.js').forward(module, 'skill-lint.js');

package/scripts/gds/skill-preflight.js

@@ -1,361 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/skill-preflight.js — an ops skill declares the machine it needs,
-// and refuses early when this machine is not it (task 1003167 / G03, goal
-// 1000077; criterion guards-skill-declares-machine).
-//
-// THE INCIDENT. /merge-mode states in its own prose that it assumes the Archon's
-// Mac or the droplet. It was run on a machine with no push credential anyway. Worse,
-// ship.js ALREADY knew: strandNextStep() tells such a machine "/merge-mode is NOT
-// available here — it needs gh + a main checkout this machine doesn't have." So the
-// knowledge existed in two places and neither stopped the run, because prose cannot
-// refuse and the one executable copy was on a different code path. A capability a
-// procedure needs must be a declaration the machine can CHECK, not a sentence a
-// reader can skim.
-//
-// THREE PARTS, matching that diagnosis:
-//   1. `requires:` in the skill's own YAML frontmatter — the declaration.
-//   2. this preflight — the check, naming the MISSING capability and nothing else.
-//   3. checkOpsSkillsDeclareMachine() in fitness.js — the assertion that a skill
-//      whose fenced commands touch main/deploy actually carries a declaration.
-//
-// TRI-STATE, deliberately. A probe returns true / false / null, and null means
-// "could not tell" (the context-pack isMainCheckout precedent). We REFUSE on
-// false and WARN on null: refusing on unknown would block legitimate machines,
-// and passing on unknown silently would rebuild the hole this closes.
-//
-// The preflight NEVER connects to anything. Proving an SSH key reaches a host
-// means using it, and a preflight with side effects is not a preflight.
-
+// scripts/gds/skill-preflight.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/skill-preflight.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('node:child_process');
-const { resolveWorktreeRoot } = require('./context-pack.js');
-const { depsFinding } = require('./preflight.js');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const runGit = (args) => spawnSync('git', args, { cwd: process.cwd(), encoding: 'utf8' }).stdout || '';
-
-// Memoized for the life of the process. merge-mode declares BOTH `gh` and
-// `push-credential`, and push-credential's probe also consults gh — so without
-// this, one preflight spawned `gh auth status` twice, each with a 15s timeout.
-// A preflight slow enough to be worth skipping is a preflight nobody runs, which
-// would defeat the entire point of this task.
-let _ghAuthed = null;
-function ghAuthed({ fresh = false } = {}) {
-  if (!fresh && _ghAuthed !== null) return _ghAuthed;
-  _ghAuthed = ghAuthedUncached();
-  return _ghAuthed;
-}
-
-function ghAuthedUncached() {
-  try {
-    const a = spawnSync('gh', ['auth', 'status'], {
-      stdio: 'ignore', shell: process.platform === 'win32', windowsHide: true, timeout: 15000,
-    });
-    return !!a && !a.error && a.status === 0;
-  } catch { return false; }
-}
-
-function binaryPresent(name) {
-  try {
-    const probe = process.platform === 'win32' ? ['where', [name]] : ['which', [name]];
-    const r = spawnSync(probe[0], probe[1], { stdio: 'ignore', shell: process.platform === 'win32', timeout: 10000 });
-    return !!r && !r.error && r.status === 0;
-  } catch { return false; }
-}
-
-// The registry. `probe` returns true | false | null. `missing` is the sentence a
-// builder reads when it comes back false — it must name the remedy, because the
-// whole failure mode here was a reader who knew the rule and still had nowhere
-// to go with it.
-const CAPABILITIES = {
-  gh: {
-    what: 'an authenticated GitHub CLI',
-    probe: () => ghAuthed(),
-    missing: 'no authenticated `gh` on this machine. Run `gh auth login`, or use a machine that has it — '
-      + 'a machine with no push credential normally does not, by design (it publishes through the server instead, ADR 0055).',
-  },
-  'main-checkout': {
-    what: 'the main checkout, not a linked worktree',
-    // Tri-state on purpose: resolveWorktreeRoot cannot always tell.
-    probe: () => resolveWorktreeRoot({ runGit, cwd: process.cwd() }).isMainCheckout,
-    missing: 'this is a linked worktree, not the main checkout. Procedures that mutate `main` must run in the '
-      + 'main checkout — a worktree holding the branch has nowhere to merge INTO (task 1002572).',
-  },
-  'push-credential': {
-    // Mirrors ship.js pushVia(): the project's operative definition of "can push"
-    // is an authed gh (or an explicit token), and everything else routes through
-    // the server. Following that rather than inventing a stricter rule keeps one
-    // answer to the question instead of two that can disagree.
-    what: 'a credential that can push to origin',
-    probe: () => ghAuthed() || !!(process.env.GITHUB_TOKEN || process.env.GH_TOKEN),
-    missing: 'no push credential here. This machine lands work through the server-mediated publish '
-      + '(`node scripts/gds/ship.js <id>` resumes it) — it cannot push `main` directly.',
-  },
-  'droplet-ssh': {
-    what: 'SSH access to the deploy host',
-    // false when there is no ssh at all; null when there is, because proving the
-    // key and host actually work would mean connecting.
-    probe: () => (binaryPresent('ssh') ? null : false),
-    missing: 'no `ssh` binary on this machine, so a step that reaches the deploy host cannot run. '
-      + 'In `ci` deploy mode nothing should need it — check config/deploy.json before proceeding.',
-  },
-  tty: {
-    what: 'an interactive terminal',
-    probe: () => !!(process.stdin.isTTY && process.stdout.isTTY),
-    missing: 'no TTY — this procedure prompts, and a prompt with nobody to answer it hangs. '
-      + 'Use the non-interactive form (a --*-file flag or an explicit flag) instead.',
-  },
-  'node-modules': {
-    what: 'resolvable dependencies',
-    // DELEGATES to preflight.js rather than testing repoRoot/node_modules itself.
-    // Writing that test here is exactly the bug idea 1000788 reported against
-    // depsFinding: a worktree has no node_modules of its own, yet every require
-    // resolves fine because node walks up. Two copies of a probe are two chances
-    // to disagree, and this task exists because knowledge lived in two places.
-    probe: () => depsFinding().level === 'ok',
-    missing: 'dependencies are not resolvable from this tree — a step needing pg/express/pino will fail. '
-      + 'Run `npm ci` in the repo root.',
-  },
-};
-
-// EVERY read of a SKILL.md goes through here (task 1003754).
-//
-// These files are CRLF in a Windows checkout — .gitattributes pins *.js, *.json,
-// *.sh and *.sql, but Markdown falls through `* text=auto`. Every regex below is
-// anchored on \n, starting with the frontmatter fence /^---\n/, so on Windows the
-// frontmatter simply did not match and parseRequires returned `declared: false`
-// for EVERY skill.
-//
-// That is worse than one red test. Fitness check G03 compares what a skill's fenced
-// commands imply against what it declares — and with nothing parsed as declared, the
-// check reported '53 skill(s) scanned; 0 declare a machine contract' and had nothing
-// to compare. The guard against a skill's ops commands outrunning its declaration
-// was inert on any Windows box.
-//
-// Normalising once at the boundary is deliberately not 'make each regex CRLF-aware':
-// there are six of them and the next one added would forget.
-function readSkillMd(p) {
-  return String(fs.readFileSync(p, 'utf8')).replace(/\r\n/g, '\n');
-}
-
-// ---- the declaration ------------------------------------------------------
-// Read `requires:` out of a skill's YAML frontmatter. Accepts the inline form
-// (`requires: [gh, main-checkout]`) and the dash-list form. Returns
-// { requires, declared, error }: `declared` distinguishes "declared nothing"
-// from "declared an empty list", which the fitness check needs to tell apart.
-function parseRequires(md) {
-  // Normalised here too, not only in readSkillMd: this is exported and a caller may
-  // hand it raw file text (the fitness check's injected `read` does exactly that).
-  const src = String(md || '').replace(/\r\n/g, '\n');
-  const m = /^---\n([\s\S]*?)\n---/.exec(src);
-  if (!m) return { requires: [], declared: false, error: null };
-  const fm = m[1];
-  const inline = /^requires:[ \t]*\[(.*?)\][ \t]*$/m.exec(fm);
-  if (inline) {
-    const items = inline[1].split(',').map((s) => s.trim().replace(/^['"]|['"]$/g, '')).filter(Boolean);
-    return { requires: items, declared: true, error: null };
-  }
-  const block = /^requires:[ \t]*\n((?:[ \t]*-[ \t]*\S.*\n?)+)/m.exec(fm);
-  if (block) {
-    const items = block[1].split('\n')
-      .map((l) => /^[ \t]*-[ \t]*(.+?)[ \t]*$/.exec(l))
-      .filter(Boolean).map((x) => x[1].replace(/^['"]|['"]$/g, ''));
-    return { requires: items, declared: true, error: null };
-  }
-  if (/^requires:/m.test(fm)) {
-    // Present but unparseable — say so rather than reporting zero requirements,
-    // which would read as "declared, needs nothing" (the docs-entropy lesson: a
-    // scan that finds nothing must not be indistinguishable from a clean pass).
-    return { requires: [], declared: true, error: 'requires: is present but not a list ([a, b] or a dash list)' };
-  }
-  return { requires: [], declared: false, error: null };
-}
-
-// ---- what a skill's fenced commands imply it needs -------------------------
-// FENCED BLOCKS ONLY, and comments stripped. Prose that NAMES a command is
-// discussion — dev/SKILL.md forbids `git push origin main`, and an earlier draft
-// of this scan flagged it for saying so. A fenced line is an instruction to run.
-const SIGNALS = [
-  [/(?:^|[\s|(])node\s+scripts\/gds\/push-main\.js\b/m, 'push-credential'],
-  [/(?:^|[\s|(])git\s+push\s+origin\s+main\b/m, 'push-credential'],
-  [/(?:^|[\s|(])node\s+scripts\/gds\/go-live\.js\b/m, 'push-credential'],
-  [/(?:^|[\s|(])ssh\s+(?:-o\s+\S+\s+)?\S+@/m, 'droplet-ssh'],
-  [/~\/deploy\.sh/m, 'droplet-ssh'],
-  [/(?:^|[\s|(])node\s+scripts\/gds\/merge-lock\.js\b/m, 'main-checkout'],
-  [/(?:^|[\s|(])bash\s+scripts\/gds\/smoke-write\.sh\b/m, 'main-checkout'],
-  [/(?:^|[\s|(])gh\s+(?:auth|pr|secret|api|run|repo|workflow)\b/m, 'gh'],
-];
-
-function fencedCode(md) {
-  const fences = String(md || '').match(/```[a-z]*\n[\s\S]*?```/g) || [];
-  return fences
-    .map((f) => f.replace(/^```[a-z]*\n/, '').replace(/```$/, ''))
-    .join('\n')
-    .split('\n')
-    .map((l) => l.replace(/(^|\s)#.*$/, '$1')) // a shell comment is discussion
-    .join('\n');
-}
-
-function inferRequired(md) {
-  // Same reason as parseRequires: the SIGNALS below are ^-anchored per line.
-  const code = fencedCode(String(md || '').replace(/\r\n/g, '\n'));
-  const out = new Set();
-  for (const [rx, cap] of SIGNALS) if (rx.test(code)) out.add(cap);
-  return [...out].sort();
-}
-
-// ---- the check ------------------------------------------------------------
-// Returns { ok, missing, unknown, checked }. `missing` is what came back FALSE —
-// the only thing the CLI prints, because the task's own wording is that the
-// preflight must name the MISSING capability, not recite the list.
-function preflight(requires, caps = CAPABILITIES) {
-  const missing = [];
-  const unknown = [];
-  const checked = [];
-  for (const name of requires) {
-    const cap = caps[name];
-    if (!cap) {
-      missing.push({ name, why: `unknown capability "${name}" — not in the registry (typo in the skill's requires:?)` });
-      continue;
-    }
-    let verdict;
-    try { verdict = cap.probe(); } catch (err) { verdict = null; }
-    checked.push(name);
-    if (verdict === false) missing.push({ name, why: cap.missing });
-    else if (verdict === null) unknown.push({ name, why: `could not confirm ${cap.what} — proceeding, but verify before a destructive step.` });
-  }
-  return { ok: missing.length === 0, missing, unknown, checked };
-}
-
-// A skill name is one path SEGMENT. Containment is checked rather than assumed:
-// `skill-preflight.js ../../../etc` would otherwise read outside .claude/skills.
-// Harmless today (a local, read-only CLI the caller could equally well `cat`), but
-// this helper is exactly the kind that gets reused somewhere less trusting.
-// Returns null for anything that is not a plain segment.
-function skillPath(name) {
-  const n = String(name || '');
-  if (!n || n !== path.basename(n) || n === '.' || n === '..') return null;
-  const full = path.join(REPO_ROOT, '.claude', 'skills', n, 'SKILL.md');
-  const base = path.join(REPO_ROOT, '.claude', 'skills') + path.sep;
-  return full.startsWith(base) ? full : null;
-}
-
-function preflightSkill(name, caps = CAPABILITIES) {
-  const p = skillPath(name);
-  if (!p) {
-    return { ok: false, requires: [], missing: [{ name: 'skill', why: `"${name}" is not a skill name — it must be a single directory name under .claude/skills/.` }], unknown: [], checked: [] };
-  }
-  let md;
-  try { md = readSkillMd(p); } catch {
-    return { ok: false, missing: [{ name: 'skill', why: `no skill named "${name}" at .claude/skills/${name}/SKILL.md` }], unknown: [], checked: [] };
-  }
-  const { requires, error } = parseRequires(md);
-  if (error) return { ok: false, missing: [{ name: 'requires', why: `${name}: ${error}` }], unknown: [], checked: [] };
-  return { ...preflight(requires, caps), requires };
-}
-
-// ---- the assertion (fitness check 23) --------------------------------------
-// A skill whose FENCED commands need a capability must DECLARE it. This is the
-// part that stops the contract rotting: without it, a new ops step gets added to
-// a skill years from now and the declaration silently falls behind the commands.
-//
-// It compares inferRequired() (what the fenced commands imply) against
-// parseRequires() (what the frontmatter claims) and reds the build on a gap. It
-// does NOT complain about a skill declaring MORE than its fences imply — a human
-// knows things the scan cannot see, and punishing an over-declaration would train
-// people to declare less.
-const SKILLS_DIR = path.join(REPO_ROOT, '.claude', 'skills');
-
-function checkOpsSkillsDeclareMachine({ dir = SKILLS_DIR, read = null, names: injected = null } = {}) {
-  const violations = [];
-  const warnings = [];
-  let names = injected;
-  if (!names) {
-    try {
-      names = fs.readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
-    } catch { names = []; }
-  }
-  // A scan that enumerates nothing must fail, not pass (the docs-entropy lesson).
-  if (!names.length) {
-    return {
-      name: 'ops skills declare the machine they need (G03)',
-      ok: false, hardFail: true,
-      violations: ['scan defect — enumerated 0 skills under .claude/skills/.'],
-      warnings: [], note: 'static scan of skill frontmatter vs the commands each skill actually fences.',
-    };
-  }
-  const readOne = read || ((n) => {
-    try { return readSkillMd(path.join(dir, n, 'SKILL.md')); } catch { return null; }
-  });
-
-  let declaring = 0;
-  for (const n of names) {
-    const md = readOne(n);
-    if (md === null) continue;
-    const { requires, error } = parseRequires(md);
-    if (error) { violations.push(`${n}: ${error}`); continue; }
-    if (requires.length) declaring += 1;
-    for (const r of requires) {
-      if (!CAPABILITIES[r]) {
-        violations.push(`${n} declares an unknown capability "${r}" — it can never be probed, so the declaration is decorative. Registry: ${Object.keys(CAPABILITIES).join(', ')}.`);
-      }
-    }
-    // DECLARING is not ENFORCING. planning-session shipped a `requires:` with no
-    // preflight call, which is the same shape as the original bug: a contract
-    // stated where nothing checks it. If a skill names a machine, it must also
-    // run the check (the grader caught this one on the first pass).
-    if (requires.length && !/skill-preflight\.js\s+\S/.test(md)) {
-      violations.push(
-        `${n} declares requires: [${requires.join(', ')}] but never runs \`node scripts/gds/skill-preflight.js ${n}\`. `
-        + 'A declaration nothing enforces is prose, and prose cannot refuse — the exact failure this check exists for.'
-      );
-    }
-    const inferred = inferRequired(md);
-    const undeclared = inferred.filter((c) => !requires.includes(c));
-    if (undeclared.length) {
-      violations.push(
-        `${n} fences commands needing [${undeclared.join(', ')}] but does not declare them. `
-        + 'Add them to `requires:` in the frontmatter so the preflight can refuse early — '
-        + 'prose cannot refuse, which is how /merge-mode came to be run on a machine that could not run it (task 1003167).'
-      );
-    }
-  }
-  return {
-    name: 'ops skills declare the machine they need (G03)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings,
-    note: `${names.length} skill(s) scanned; ${declaring} declare a machine contract. A skill whose FENCED commands need gh / a main checkout / a push credential / the deploy host must name it in \`requires:\`, so \`node scripts/gds/skill-preflight.js <skill>\` can refuse before the procedure starts. Prose in a skill body cannot refuse.`,
-  };
-}
-
-function main() {
-  const name = process.argv[2];
-  if (!name || name.startsWith('--')) {
-    console.error('usage: node scripts/gds/skill-preflight.js <skill-name>');
-    console.error('  exits 1 naming the capability this machine is MISSING for that skill.');
-    process.exit(2);
-  }
-  const r = preflightSkill(name);
-  for (const u of r.unknown) console.error(`?  ${u.name}: ${u.why}`);
-  if (r.ok) {
-    console.log(`preflight OK — ${name}: ${r.checked.length ? r.checked.join(', ') : 'no machine requirements declared'}.`);
-    process.exit(0);
-  }
-  console.error(`STOP — /${name} cannot run on this machine.`);
-  for (const m of r.missing) console.error(`✗  ${m.name}: ${m.why}`);
-  process.exit(1);
-}
-
-if (require.main === module) main();
-
-module.exports = {
-  CAPABILITIES, SIGNALS,
-  parseRequires, inferRequired, fencedCode,
-  preflight, preflightSkill, skillPath, checkOpsSkillsDeclareMachine,
-  ghAuthed, binaryPresent,
-};
+require('../bongos/forwarder.js').forward(module, 'skill-preflight.js');