@c4a/context-cli 0.7.29 → 0.7.34

package/cli.js

@@ -42637,7 +42637,7 @@ function parseDocumentResourceMaterialization(value, field) {
       ...reason !== undefined ? { reason } : {}
     };
   });
-  const expectedStatus = items.some((item) => item.status === "failed" && item.required && !isNonBlockingDocumentResourceFailureReasonCode(item.reason_code)) ? "error" : items.some((item) => item.status === "failed") || items.some((item) => item.status === "reference-only" && item.kind === "poll" && item.reason?.includes("absent") === true) ? "warning" : "complete";
+  const expectedStatus = items.some((item) => item.status === "failed" && item.required && !isNonBlockingDocumentResourceFailureReasonCode(item.reason_code)) ? "error" : items.some((item) => item.status === "failed" || item.reason_code === "document.resource.preview") || items.some((item) => item.status === "reference-only" && item.kind === "poll" && item.reason?.includes("absent") === true) ? "warning" : "complete";
   if (value.status !== expectedStatus)
     throw new TypeError(`${field}.status must be ${expectedStatus} for its items`);
   const expected = (status) => {
@@ -90705,7 +90705,7 @@ function documentSnapshotFidelityState(manifest, captureReport) {
     ],
     warnings: [
       ...report === undefined ? [] : render((issue) => issue.impact === "projection" || issue.severity === "warning"),
-      ...(resources?.items ?? []).filter((item) => item.status === "failed" && (!item.required || isNonBlockingDocumentResourceFailureReasonCode(item.reason_code))).map((item) => `${item.reason_code ?? "lark.capture.resource-materialization-warning"}: ${item.kind}: ${item.reason ?? item.locator}`)
+      ...(resources?.items ?? []).filter((item) => item.reason_code === "document.resource.preview" || item.status === "failed" && (!item.required || isNonBlockingDocumentResourceFailureReasonCode(item.reason_code))).map((item) => `${item.reason_code ?? "lark.capture.resource-materialization-warning"}: ${item.kind}: ${item.reason ?? item.locator}`)
     ]
   };
 }
@@ -97826,32 +97826,6 @@ var init_larkDocxXml = __esm(() => {
   ]);
 });
 
-// src/lib/larkImagePolicy.ts
-function omitLarkImage(resource, policy, items, replacements, mediaType, failure2) {
-  if (resource.kind !== "image" && !mediaType?.startsWith("image/"))
-    return false;
-  const gif = mediaType === "image/gif" || /\.gif$/iu.test(resource.title ?? "") || Object.entries(resource.attributes).some(([key, value]) => ["mime_type", "content_type"].includes(key) && value === "image/gif");
-  if (!failure2 && policy.images !== "reference-only" && !(gif && policy.gifs === "reference-only"))
-    return false;
-  const title2 = (resource.title ?? "image").replace(/[\r\n<>]/gu, " ");
-  replacements.set(resource.locator, `> Image omitted: ${title2}. ${failure2 ? "Resource size limit exceeded." : "Excluded by selected policy."} See the source document. <!-- ${resource.locator} -->`);
-  items.push({
-    kind: resource.kind,
-    locator: resource.locator,
-    status: "reference-only",
-    required: false,
-    asset_paths: [],
-    reason_code: failure2 ? "image-budget-exceeded" : "image-excluded-by-policy",
-    reason: failure2 ?? "Image bytes were not retained; the selected image policy preserves a placeholder and source reference"
-  });
-  return true;
-}
-var LarkResourceBudgetError;
-var init_larkImagePolicy = __esm(() => {
-  LarkResourceBudgetError = class LarkResourceBudgetError extends Error {
-  };
-});
-
 // src/lib/larkResourceCommand.ts
 function stableJson(value) {
   if (value === undefined)
@@ -97880,13 +97854,13 @@ function commandError(fallback, detail) {
   if (detail === undefined)
     return new LarkResourceCommandError(fallback);
   const message = [detail.message, detail.hint, detail.code].filter((value) => typeof value === "string" || typeof value === "number").map(String).join("; ");
-  return new LarkResourceCommandError(message.length > 0 ? message : stableJson(detail), typeof detail.type === "string" ? detail.type : undefined, typeof detail.subtype === "string" ? detail.subtype : undefined);
+  return new LarkResourceCommandError(message.length > 0 ? message : stableJson(detail), typeof detail.type === "string" ? detail.type : undefined, typeof detail.subtype === "string" ? detail.subtype : undefined, typeof detail.code === "string" || typeof detail.code === "number" ? detail.code : undefined, typeof detail.log_id === "string" ? detail.log_id : undefined);
 }
 async function runLarkResourceCommand(runner2, args, options) {
   const result = await runner2(args, options);
   if (result.exitCode !== 0) {
     const fallback = result.stderr.trim() || `lark-cli ${args.slice(0, 2).join(" ")} failed with exit code ${result.exitCode ?? "unknown"}`;
-    throw commandError(fallback, errorDetail(result.stderr));
+    throw commandError(fallback, errorDetail(result.stderr) ?? errorDetail(result.stdout));
   }
   const trimmed = result.stdout.trim();
   if (!trimmed.startsWith("{"))
@@ -97906,24 +97880,78 @@ async function runLarkResourceCommand(runner2, args, options) {
   }
   return result.stdout;
 }
+function isLarkResourcePermissionDenied(error) {
+  return error instanceof LarkResourceCommandError && (String(error.code) === "403" || error.errorType === "authorization" && ["permission_denied", "access_denied", "missing_scope"].includes(error.errorSubtype ?? ""));
+}
 var LarkResourceCommandError;
 var init_larkResourceCommand = __esm(() => {
   LarkResourceCommandError = class LarkResourceCommandError extends Error {
     errorType;
     errorSubtype;
-    constructor(message, errorType, errorSubtype) {
+    code;
+    logId;
+    constructor(message, errorType, errorSubtype, code3, logId) {
       super(message);
       this.errorType = errorType;
       this.errorSubtype = errorSubtype;
+      this.code = code3;
+      this.logId = logId;
       this.name = "LarkResourceCommandError";
     }
   };
 });
 
+// src/lib/larkMediaDownload.ts
+import { readdir as readdir21, rm as rm20 } from "node:fs/promises";
+import { join as join94 } from "node:path";
+async function downloadLarkMedia(input) {
+  const shared = ["--as", input.identity, "--token", input.token, "--output", "./resource", "--format", "json"];
+  try {
+    await runLarkResourceCommand(input.runner, ["docs", "+media-download", ...shared, "--type", input.type, "--overwrite"], { cwd: input.cwd });
+    return "original";
+  } catch (error) {
+    if (!input.allowPreview || !isLarkResourcePermissionDenied(error))
+      throw error;
+    for (const entry of await readdir21(input.cwd))
+      await rm20(join94(input.cwd, entry), { recursive: true, force: true });
+    await runLarkResourceCommand(input.runner, ["docs", "+media-preview", ...shared], { cwd: input.cwd });
+    return "preview";
+  }
+}
+var init_larkMediaDownload = __esm(() => {
+  init_larkResourceCommand();
+});
+
+// src/lib/larkImagePolicy.ts
+function omitLarkImage(resource, policy, items, replacements, mediaType, failure2) {
+  if (resource.kind !== "image" && !mediaType?.startsWith("image/"))
+    return false;
+  const gif = mediaType === "image/gif" || /\.gif$/iu.test(resource.title ?? "") || Object.entries(resource.attributes).some(([key, value]) => ["mime_type", "content_type"].includes(key) && value === "image/gif");
+  if (!failure2 && policy.images !== "reference-only" && !(gif && policy.gifs === "reference-only"))
+    return false;
+  const title2 = (resource.title ?? "image").replace(/[\r\n<>]/gu, " ");
+  replacements.set(resource.locator, `> Image omitted: ${title2}. ${failure2 ? "Resource size limit exceeded." : "Excluded by selected policy."} See the source document. <!-- ${resource.locator} -->`);
+  items.push({
+    kind: resource.kind,
+    locator: resource.locator,
+    status: "reference-only",
+    required: false,
+    asset_paths: [],
+    reason_code: failure2 ? "image-budget-exceeded" : "image-excluded-by-policy",
+    reason: failure2 ?? "Image bytes were not retained; the selected image policy preserves a placeholder and source reference"
+  });
+  return true;
+}
+var LarkResourceBudgetError;
+var init_larkImagePolicy = __esm(() => {
+  LarkResourceBudgetError = class LarkResourceBudgetError extends Error {
+  };
+});
+
 // src/lib/larkResourceMaterialization.ts
 import { createHash as createHash28 } from "node:crypto";
-import { mkdtemp as mkdtemp4, readFile as readFile74, readdir as readdir21, rm as rm20 } from "node:fs/promises";
-import { extname as extname13, join as join94 } from "node:path";
+import { mkdtemp as mkdtemp4, readFile as readFile74, readdir as readdir22, rm as rm21 } from "node:fs/promises";
+import { extname as extname13, join as join95 } from "node:path";
 import { tmpdir } from "node:os";
 function countByKind(items, status) {
   const counts2 = new Map;
@@ -98029,33 +98057,19 @@ function findBooleanField(value, name3) {
 async function downloadedFile(input) {
   if (input.localPath !== undefined) {
     const bytes = await readFile74(input.localPath);
-    return { path: input.localPath, bytes, mediaType: mediaTypeFor(input.localPath, bytes) };
+    return { path: input.localPath, bytes, mediaType: mediaTypeFor(input.localPath, bytes), representation: "original" };
   }
-  const tempRoot = await mkdtemp4(join94(tmpdir(), "context-lark-resource-"));
+  const tempRoot = await mkdtemp4(join95(tmpdir(), "context-lark-resource-"));
   try {
-    await runLarkResourceCommand(input.runner, [
-      "docs",
-      "+media-download",
-      "--as",
-      input.identity,
-      "--token",
-      input.token,
-      "--type",
-      input.type,
-      "--output",
-      "./resource",
-      "--overwrite",
-      "--format",
-      "json"
-    ], { cwd: tempRoot });
-    const entries2 = (await readdir21(tempRoot, { withFileTypes: true })).filter((entry) => entry.isFile());
+    const representation = await downloadLarkMedia({ ...input, cwd: tempRoot });
+    const entries2 = (await readdir22(tempRoot, { withFileTypes: true })).filter((entry) => entry.isFile());
     if (entries2.length !== 1)
       throw new Error(`media download produced ${entries2.length} files, expected exactly one`);
     const path3 = entries2[0]?.name ?? "resource.bin";
-    const bytes = await readFile74(join94(tempRoot, path3));
-    return { path: path3, bytes, mediaType: mediaTypeFor(path3, bytes) };
+    const bytes = await readFile74(join95(tempRoot, path3));
+    return { path: path3, bytes, mediaType: mediaTypeFor(path3, bytes), representation };
   } finally {
-    await rm20(tempRoot, { recursive: true, force: true });
+    await rm21(tempRoot, { recursive: true, force: true });
   }
 }
 function parseCsv(value) {
@@ -98143,9 +98157,9 @@ async function sheetMaterialization(resource, runner2, identity2) {
   const sheetId = resource.attributes["sheet-id"];
   if (token === undefined || sheetId === undefined)
     throw new Error("embedded Sheet requires token and sheet-id");
-  const tempRoot = await mkdtemp4(join94(tmpdir(), "context-lark-sheet-"));
+  const tempRoot = await mkdtemp4(join95(tmpdir(), "context-lark-sheet-"));
   try {
-    const outputPath = join94(tempRoot, "sheet.json");
+    const outputPath = join95(tempRoot, "sheet.json");
     const stdout = await runLarkResourceCommand(runner2, [
       "sheets",
       "+csv-get",
@@ -98187,7 +98201,7 @@ ${markdownTable2(parseCsv(csv))}
 [CSV snapshot](${sourceAssetTarget(path3)}) <!-- ${resource.locator} -->`
     };
   } finally {
-    await rm20(tempRoot, { recursive: true, force: true });
+    await rm21(tempRoot, { recursive: true, force: true });
   }
 }
 function basePageRecords(value) {
@@ -98301,7 +98315,7 @@ async function whiteboardMaterialization(resource, runner2, identity2) {
   if (token === undefined)
     throw new Error(`${resource.kind} has no whiteboard token`);
   const preview = await downloadedFile({ runner: runner2, identity: identity2, token, type: "whiteboard" });
-  const tempRoot = await mkdtemp4(join94(tmpdir(), "context-lark-whiteboard-"));
+  const tempRoot = await mkdtemp4(join95(tmpdir(), "context-lark-whiteboard-"));
   let rawPayload;
   try {
     await runLarkResourceCommand(runner2, [
@@ -98319,9 +98333,9 @@ async function whiteboardMaterialization(resource, runner2, identity2) {
       "--format",
       "json"
     ], { cwd: tempRoot });
-    rawPayload = JSON.parse(await readFile74(join94(tempRoot, "raw.json"), "utf8"));
+    rawPayload = JSON.parse(await readFile74(join95(tempRoot, "raw.json"), "utf8"));
   } finally {
-    await rm20(tempRoot, { recursive: true, force: true });
+    await rm21(tempRoot, { recursive: true, force: true });
   }
   const digest6 = resourceDigest(resource);
   const previewPath = `materialized/${resource.kind}/${digest6}${extensionFor2(preview.mediaType, preview.path)}`;
@@ -98380,7 +98394,7 @@ function referenceOnlyReason(resource) {
 }
 function materializationReport(items) {
   const hasRequiredFailure = items.some((item) => item.status === "failed" && item.required && !isNonBlockingDocumentResourceFailureReasonCode(item.reason_code));
-  const hasOptionalFailure = items.some((item) => item.status === "failed" || item.reason_code === "image-budget-exceeded") || items.some((item) => item.status === "reference-only" && item.kind === "poll" && item.reason?.includes("absent") === true);
+  const hasOptionalFailure = items.some((item) => item.status === "failed" || item.reason_code === "image-budget-exceeded" || item.reason_code === "document.resource.preview") || items.some((item) => item.status === "reference-only" && item.kind === "poll" && item.reason?.includes("absent") === true);
   return {
     status: hasRequiredFailure ? "error" : hasOptionalFailure ? "warning" : "complete",
     discovered: countByKind(items),
@@ -98391,7 +98405,7 @@ function materializationReport(items) {
   };
 }
 function resourceFailureReasonCode(resource, error) {
-  if (error instanceof LarkResourceCommandError && error.errorType === "authorization" && error.errorSubtype === "permission_denied") {
+  if (isLarkResourcePermissionDenied(error)) {
     return DOCUMENT_RESOURCE_PERMISSION_DENIED_REASON_CODE;
   }
   if (resource.kind !== "diagram" && resource.kind !== "whiteboard")
@@ -98511,6 +98525,7 @@ async function materializeLarkResources(input) {
         identity: identity2,
         token,
         type: "media",
+        allowPreview: resource.kind === "image",
         ...input.mediaFiles?.[token] === undefined ? {} : { localPath: input.mediaFiles[token] }
       });
       if (omitLarkImage(resource, input.policy, items, replacements, downloaded.mediaType))
@@ -98522,7 +98537,7 @@ async function materializeLarkResources(input) {
         bytes: downloaded.bytes,
         mediaType: downloaded.mediaType,
         role: "evidence",
-        source: { kind: resource.kind, locator: resource.locator }
+        source: { kind: resource.kind, locator: resource.locator, identity: identity2, representation: downloaded.representation }
       };
       assertBudget(asset, input.policy, totalBytes);
       totalBytes += asset.bytes.byteLength;
@@ -98530,8 +98545,17 @@ async function materializeLarkResources(input) {
       const title2 = markdownLabel(safeLabel(resource.title, resource.kind));
       const target = sourceAssetTarget(asset.path);
       const replacement = downloaded.mediaType.startsWith("image/") ? `![${title2}](${target}) <!-- ${resource.locator} -->` : `[${title2}](${target}) <!-- ${resource.locator} -->`;
-      replacements.set(resource.locator, replacement);
-      items.push({ kind: resource.kind, locator: resource.locator, status: "materialized", required, asset_paths: [asset.path] });
+      replacements.set(resource.locator, downloaded.representation === "preview" ? `${replacement}
+
+> Image preview captured; the original could not be downloaded.` : replacement);
+      items.push({
+        kind: resource.kind,
+        locator: resource.locator,
+        status: "materialized",
+        required,
+        asset_paths: [asset.path],
+        ...downloaded.representation === "preview" ? { reason_code: "document.resource.preview", reason: "Same-identity preview captured; original download permission denied" } : {}
+      });
     } catch (error) {
       if (error instanceof LarkResourceBudgetError && omitLarkImage(resource, input.policy, items, replacements, undefined, error.message))
         return;
@@ -98579,6 +98603,7 @@ function applyLarkResourceReplacements(markdown, resources, replacements) {
 }
 var REQUIRED_KINDS, MEDIA_TYPES_BY_EXTENSION;
 var init_larkResourceMaterialization = __esm(() => {
+  init_larkMediaDownload();
   init_larkImagePolicy();
   init_src3();
   init_larkResourceCommand();
@@ -98654,6 +98679,89 @@ var init_larkMarkdownImages = __esm(() => {
   init_markdownLinks();
 });
 
+// src/lib/larkReadIdentity.ts
+function resolveLarkReadIdentity() {
+  const value = process.env.CONTEXT_LARK_IDENTITY?.trim() || "user";
+  if (value === "user" || value === "bot")
+    return value;
+  throw new ContextError(ExitCode.UserError, "CONTEXT_LARK_IDENTITY must be user or bot", {
+    reason_code: "lark.invalid-read-identity",
+    valid_values: ["user", "bot"],
+    next: "Set CONTEXT_LARK_IDENTITY to user or bot and rerun the same command"
+  });
+}
+function credentialFailure(result) {
+  for (const output of [result.stdout, result.stderr]) {
+    const start2 = output.indexOf("{");
+    if (start2 < 0)
+      continue;
+    try {
+      const parsed = JSON.parse(output.slice(start2));
+      if (!parsed || typeof parsed !== "object" || !("error" in parsed))
+        continue;
+      if (result.exitCode === 0 && (!("ok" in parsed) || parsed.ok !== false))
+        continue;
+      const error = parsed.error;
+      if (!error || typeof error !== "object")
+        continue;
+      const type = "type" in error ? error.type : undefined;
+      const subtype = "subtype" in error ? error.subtype : undefined;
+      if (type === "authorization" || type === "authentication" || ["missing_scope", "permission_denied", "access_denied", "need_user_authorization"].includes(String(subtype))) {
+        return true;
+      }
+    } catch {}
+  }
+  return result.exitCode !== 0 && /reason=(?:bot_unavailable|not_authorized)\b|\b(?:missing_scope|permission_denied|access_denied)\b/iu.test(result.stderr);
+}
+function createLarkReadSession(runner2, initial, fallback = initial === "bot") {
+  let identity2 = initial;
+  let usedFallback = false;
+  let readingDocument = false;
+  let locked = false;
+  const restart = new Error("Restart document with user identity");
+  const run = async (args, options) => {
+    const explicit = args.indexOf("--as");
+    const requested = explicit >= 0 ? args[explicit + 1] : identity2;
+    const selected = locked || usedFallback ? identity2 : requested === "bot" ? "bot" : "user";
+    const withIdentity = [...args];
+    if (explicit >= 0)
+      withIdentity[explicit + 1] = selected;
+    else
+      withIdentity.push("--as", selected);
+    const result = await runner2(withIdentity, options);
+    identity2 = selected;
+    if (readingDocument && identity2 === "bot" && fallback && !usedFallback && !args.includes("--help") && credentialFailure(result))
+      throw restart;
+    return result;
+  };
+  async function readDocument(read) {
+    readingDocument = true;
+    try {
+      try {
+        return await read();
+      } catch (error) {
+        if (error !== restart)
+          throw error;
+        usedFallback = true;
+        identity2 = "user";
+        return await read();
+      }
+    } finally {
+      readingDocument = false;
+      locked = true;
+    }
+  }
+  return { run, readDocument, get identity() {
+    return identity2;
+  }, get usedFallback() {
+    return usedFallback;
+  } };
+}
+var init_larkReadIdentity = __esm(() => {
+  init_errors3();
+  init_exitCode();
+});
+
 // src/lib/feishu.ts
 import { spawn as spawn4 } from "node:child_process";
 async function detectDocsFetchCapabilities(runner2) {
@@ -98670,14 +98778,19 @@ ${result.stderr}`;
     supportsDocFormat: result.exitCode === 0 && /\s--doc-format\b/u.test(help)
   };
 }
-function resolveDocsFetchPlan(requested, runner2) {
+function resolveDocsFetchPlan(requested, runner2, cacheKey = runner2, identity2 = "user") {
   if (requested === "v1" || requested === "v2") {
     return Promise.resolve({ apiVersion: requested, docFormat: "xml" });
   }
-  let capabilitiesPromise = docsFetchCapabilitiesCache.get(runner2);
+  let cached = docsFetchCapabilitiesCache.get(cacheKey);
+  if (!cached) {
+    cached = new Map;
+    docsFetchCapabilitiesCache.set(cacheKey, cached);
+  }
+  let capabilitiesPromise = cached.get(identity2);
   if (capabilitiesPromise === undefined) {
     capabilitiesPromise = detectDocsFetchCapabilities(runner2);
-    docsFetchCapabilitiesCache.set(runner2, capabilitiesPromise);
+    cached.set(identity2, capabilitiesPromise);
   }
   return capabilitiesPromise.then((capabilities) => {
     if (!capabilities.supportsDocFormat) {
@@ -98974,20 +99087,25 @@ function hasEmptySubPageList(projection) {
   return projection.fidelity.issues.some((issue) => issue.code === LARK_EMPTY_SUB_PAGE_LIST_CODE);
 }
 async function fetchFeishuDocSnapshot(input, runner2 = defaultRunner) {
-  const docsFetchPlan = input.prefetched ? { apiVersion: "v2", docFormat: "xml" } : await resolveDocsFetchPlan(input.docsApiVersion ?? "auto", runner2);
+  const preference = input.prefetched?.identity ?? input.identity ?? resolveLarkReadIdentity();
+  const cacheKey = runner2;
+  const session = createLarkReadSession(runner2, input.prefetched?.identity ?? (preference === "bot" ? "bot" : "user"), !input.prefetched && preference === "bot");
+  runner2 = session.run;
+  const docsFetchPlan = input.prefetched ? { apiVersion: "v2", docFormat: "xml" } : await resolveDocsFetchPlan(input.docsApiVersion ?? "auto", runner2, cacheKey, preference);
   const identityFetch = input.prefetched ? {
     fetched: await fetchDocsResponse(input, docsFetchPlan, runner2, input.prefetched.identity),
     identity: input.prefetched.identity,
     fallback: false
-  } : await fetchWithIdentity(input, docsFetchPlan, runner2);
+  } : await session.readDocument(() => fetchWithIdentity({ ...input, identity: preference }, docsFetchPlan, runner2));
   let fetched = identityFetch.fetched;
-  const accessIdentity = identityFetch.identity;
+  let accessIdentity = input.prefetched?.identity ?? session.identity;
   let projection;
   for (let attempt = 0;attempt < MAX_STRUCTURAL_FETCH_ATTEMPTS && fetched.contentFormat === "xml"; attempt++) {
     projection = projectLarkDocxXml({ xml: fetched.body, sourceUrl: input.url });
     if (input.prefetched || !hasEmptySubPageList(projection) || attempt === MAX_STRUCTURAL_FETCH_ATTEMPTS - 1)
       break;
     fetched = await fetchDocsResponse(input, docsFetchPlan, runner2, accessIdentity);
+    accessIdentity = session.identity;
   }
   let body2 = fetched.body;
   let title2 = fetched.title;
@@ -99073,7 +99191,7 @@ ${body2}`,
       fidelity,
       resourceMaterialization,
       accessIdentity,
-      identityFallback: identityFetch.fallback
+      identityFallback: identityFetch.fallback || session.usedFallback
     };
   }
   return {
@@ -99084,7 +99202,7 @@ ${body2}`,
     fidelity,
     resourceMaterialization,
     accessIdentity,
-    identityFallback: identityFetch.fallback
+    identityFallback: identityFetch.fallback || session.usedFallback
   };
 }
 var LARK_BIN = "lark-cli", MAX_FETCH_PAGES = 50, MAX_STRUCTURAL_FETCH_ATTEMPTS = 2, LarkCliNotInstalledError, LarkCliError, defaultRunner = (args, options) => new Promise((resolve8, reject) => {
@@ -99116,6 +99234,7 @@ var init_feishu = __esm(() => {
   init_larkResourceMaterialization();
   init_larkCaptureReport();
   init_larkMarkdownImages();
+  init_larkReadIdentity();
   LarkCliNotInstalledError = class LarkCliNotInstalledError extends Error {
     constructor() {
       super(`${LARK_BIN} not installed — see https://github.com/larksuite/cli for install instructions`);
@@ -99168,8 +99287,8 @@ var init_sensitiveSourceLiteral = __esm(() => {
 });
 
 // src/project/documentCaptureLark.ts
-import { readdir as readdir22, readFile as readFile75 } from "node:fs/promises";
-import { basename as basename10, extname as extname14, join as join95 } from "node:path";
+import { readdir as readdir23, readFile as readFile75 } from "node:fs/promises";
+import { basename as basename10, extname as extname14, join as join96 } from "node:path";
 function titleFromMarkdown2(markdown, fallbackPath) {
   const heading2 = markdown.split(`
 `).find((line) => /^#\s+\S/u.test(line));
@@ -99196,7 +99315,7 @@ async function fileContentMatches(path3, content3) {
   }
 }
 function sourceManifestPath2(entry) {
-  return entry.snapshot?.manifest ?? join95(entry.materializedAt, "manifest.json");
+  return entry.snapshot?.manifest ?? join96(entry.materializedAt, "manifest.json");
 }
 function larkRuntimeError(message, detail) {
   return new ContextError(ExitCode.ExternalToolError, message, {
@@ -99276,7 +99395,7 @@ function larkErrorRecovery(error, sourceName) {
   if (/auth|login|permission|forbidden|unauthori[sz]ed|scope/iu.test(message)) {
     return {
       reasonCode: "external.authorization-required",
-      next: "Run lark-cli auth login with an account that can read the document, then rerun capture"
+      next: "Check the selected Lark identity and document access. For host-managed credentials use the host authorization flow; use lark-cli auth login only for a locally managed user login, then rerun capture"
     };
   }
   return {
@@ -99323,12 +99442,12 @@ function assetManifestEntry(asset, assetRoot) {
   };
 }
 async function listSnapshotAssetFiles(root2, assetRoot) {
-  const assetsRoot = join95(root2, assetRoot);
+  const assetsRoot = join96(root2, assetRoot);
   const files = [];
   const visit4 = async (dir, prefix = assetRoot) => {
     let entries2;
     try {
-      entries2 = await readdir22(dir, { withFileTypes: true });
+      entries2 = await readdir23(dir, { withFileTypes: true });
     } catch (error) {
       if (error instanceof Error && "code" in error && error.code === "ENOENT")
         return;
@@ -99336,7 +99455,7 @@ async function listSnapshotAssetFiles(root2, assetRoot) {
     }
     for (const entry of entries2) {
       const relPath = `${prefix}/${entry.name}`;
-      const absolutePath = join95(dir, entry.name);
+      const absolutePath = join96(dir, entry.name);
       if (entry.isDirectory()) {
         await visit4(absolutePath, relPath);
         continue;
@@ -99351,7 +99470,7 @@ async function listSnapshotAssetFiles(root2, assetRoot) {
 }
 async function staleSnapshotAssetPaths(input) {
   const existingPaths = await listSnapshotAssetFiles(input.materializedAtAbsPath, input.assetRoot);
-  return existingPaths.filter((path3) => !input.currentPaths.has(path3)).map((path3) => join95(input.materializedAtAbsPath, path3));
+  return existingPaths.filter((path3) => !input.currentPaths.has(path3)).map((path3) => join96(input.materializedAtAbsPath, path3));
 }
 function normalizeLarkError(error, sourceName) {
   if (error instanceof ContextError)
@@ -99421,6 +99540,8 @@ async function runCaptureLarkPhaseUnlocked(input) {
       ...input.prefetched === undefined ? {} : { prefetched: input.prefetched }
     }, input.larkRunner);
   } catch (error) {
+    if (error instanceof ContextError)
+      throw error;
     const failure2 = normalizeLarkError(error, resolved.sourceName);
     if (failure2.detail?.reason_code === "external.authorization-required" || failure2.detail?.reason_code === "external.tool-failed" && error instanceof LarkCliError && error.exitCode !== 0) {
       throw new ContextError(failure2.code, failure2.message, { ...failure2.detail, reason_code: DOCUMENT_ACQUISITION_UNAVAILABLE, acquisition_cause: failure2.detail?.reason_code });
@@ -99463,9 +99584,9 @@ async function runCaptureLarkPhaseUnlocked(input) {
     locator
   }];
   const manifestPath = sourceManifestPath2(entry);
-  const manifestAbsPath = join95(input.projectRoot, manifestPath);
+  const manifestAbsPath = join96(input.projectRoot, manifestPath);
   const materializedAt = entry.materializedAt;
-  const materializedAtAbsPath = join95(input.projectRoot, materializedAt);
+  const materializedAtAbsPath = join96(input.projectRoot, materializedAt);
   const manifest = createDocumentSnapshotManifest({
     sourceType: "lark",
     sourceName: resolved.sourceName,
@@ -99499,13 +99620,13 @@ async function runCaptureLarkPhaseUnlocked(input) {
   }));
   try {
     const requestedWrites = [{
-      path: join95(materializedAtAbsPath, documentPath),
+      path: join96(materializedAtAbsPath, documentPath),
       bytes: normalized
     }];
     for (const asset of assets) {
       if (asset.bytes !== undefined) {
         requestedWrites.push({
-          path: join95(materializedAtAbsPath, asset.entry.path),
+          path: join96(materializedAtAbsPath, asset.entry.path),
           bytes: asset.bytes
         });
       }
@@ -99522,7 +99643,7 @@ async function runCaptureLarkPhaseUnlocked(input) {
       currentPaths: new Set(assets.filter((asset) => asset.bytes !== undefined).map((asset) => asset.entry.path))
     });
     await applyAtomicFileBatch({
-      transactionRoot: join95(input.projectRoot, ".tmp", "context-runtime", "capture-transactions"),
+      transactionRoot: join96(input.projectRoot, ".tmp", "context-runtime", "capture-transactions"),
       writes,
       removals
     });
@@ -99594,7 +99715,7 @@ async function runCaptureLarkPhaseUnlocked(input) {
     resource_materialization: fetched.resourceMaterialization,
     diagnostics: [
       ...recovery === undefined ? [] : [recovery.diagnostic],
-      ...fetched.identityFallback ? [`info: lark.capture.identity-fallback: user credentials unavailable; captured with ${fetched.accessIdentity} identity`] : [],
+      ...fetched.identityFallback ? [`info: lark.capture.identity-fallback: capture used an identity fallback; document identity: ${fetched.accessIdentity}; embedded reads may use the fallback identity`] : [],
       ...fetched.fidelity.issues.map((issue) => `${issue.severity}: ${issue.code}: ${issue.block_type} × ${issue.count}: ${issue.reason}`),
       ...fetched.resourceMaterialization.items.filter((item) => item.status === "failed" || item.kind === "poll" && item.reason?.includes("absent") === true).map((item) => `${item.status}: lark.capture.resource-${item.status}: ${item.kind}: ${item.reason ?? item.locator}`)
     ],
@@ -99668,7 +99789,7 @@ __export(exports_articleRetirement, {
   retireArticles: () => retireArticles,
   articleRetirementSchema: () => articleRetirementSchema
 });
-import { readFile as readFile81, readdir as readdir23 } from "node:fs/promises";
+import { readFile as readFile81, readdir as readdir24 } from "node:fs/promises";
 import { posix as posix10 } from "node:path";
 function rebuildInput(revision) {
   return JSON.stringify({ id: `retirement-${revision.slice(7)}`, operation: "rebuild", timing: "priority", targets: [] });
@@ -99801,7 +99922,7 @@ async function retireArticles(input) {
     }
     async function inspectTemplates(directory2) {
       const absolute = await safeProjectTarget(input.projectRoot, directory2);
-      const entries2 = await readdir23(absolute, { withFileTypes: true }).catch((error) => {
+      const entries2 = await readdir24(absolute, { withFileTypes: true }).catch((error) => {
         if (error.code === "ENOENT")
           return [];
         throw error;
@@ -99951,8 +100072,8 @@ __export(exports_writeLockRecovery, {
   recoverWriterLock: () => recoverWriterLock,
   inspectWriterLock: () => inspectWriterLock
 });
-import { lstat as lstat10, mkdir as mkdir34, readFile as readFile82, readdir as readdir24, rename as rename8, rmdir as rmdir2 } from "node:fs/promises";
-import { join as join100 } from "node:path";
+import { lstat as lstat10, mkdir as mkdir34, readFile as readFile82, readdir as readdir25, rename as rename8, rmdir as rmdir2 } from "node:fs/promises";
+import { join as join101 } from "node:path";
 import { createHash as createHash30, randomUUID as randomUUID7 } from "node:crypto";
 async function inspectWriterLock(root2) {
   const path3 = await safeProjectTarget(root2, lockRelative);
@@ -99999,19 +100120,19 @@ async function recoverWriterLock(input) {
     };
   if (input.plan_digest !== before.digest)
     throw new Error("Writer lock changed; preview recovery again.");
-  const path3 = join100(input.projectRoot, lockRelative);
-  const guard = join100(path3, ".recovery");
+  const path3 = join101(input.projectRoot, lockRelative);
+  const guard = join101(path3, ".recovery");
   await mkdir34(guard);
   let archived = false;
   try {
     const current2 = await inspectWriterLock(input.projectRoot);
     if (current2?.digest !== before.digest || current2.process_state !== "not-running")
       throw new Error("Writer lock changed or owner resumed; keep the lock.");
-    const names = await readdir24(path3);
+    const names = await readdir25(path3);
     if (names.some((name3) => name3 !== "owner.json" && name3 !== ".recovery"))
       throw new Error("Unexpected lock contents; preserve for diagnosis.");
     const archive = `.tmp/context-runtime/locks/recovered-write-${randomUUID7()}.lock`;
-    await rename8(path3, join100(input.projectRoot, archive));
+    await rename8(path3, join101(input.projectRoot, archive));
     archived = true;
     return { action: "writer-lock-recovered", archived_lock: archive, next: "context task recover --format json" };
   } finally {
@@ -100035,8 +100156,8 @@ __export(exports_taskRecovery, {
   RECOVERY_COMMAND: () => RECOVERY_COMMAND
 });
 import { existsSync as existsSync26 } from "node:fs";
-import { dirname as dirname41, join as join101 } from "node:path";
-import { lstat as lstat11, readdir as readdir25, readFile as readFile83 } from "node:fs/promises";
+import { dirname as dirname41, join as join102 } from "node:path";
+import { lstat as lstat11, readdir as readdir26, readFile as readFile83 } from "node:fs/promises";
 async function recoveryText(root2, path3) {
   const target = await safeProjectTarget(root2, path3);
   try {
@@ -100053,7 +100174,7 @@ async function recoveryJournals(root2) {
     await safeProjectTarget(root2, path3);
     let stat11;
     try {
-      stat11 = await lstat11(join101(root2, path3));
+      stat11 = await lstat11(join102(root2, path3));
     } catch (error) {
       if (error.code === "ENOENT")
         return;
@@ -100064,7 +100185,7 @@ async function recoveryJournals(root2) {
     if (stat11.isDirectory()) {
       if (depth > 3)
         throw new TypeError("Unexpected transaction directory depth; preserve it for diagnosis.");
-      for (const name3 of (await readdir25(join101(root2, path3))).sort())
+      for (const name3 of (await readdir26(join102(root2, path3))).sort())
         await visit4(`${path3}/${name3}`, depth + 1);
     } else if (stat11.isFile())
       entries2.push({ path: path3, digest: indexerProtocolDigest(await recoveryText(root2, path3)) });
@@ -100076,8 +100197,8 @@ function recoveryResources() {
   try {
     const root2 = dirname41(contextWorkflowProviderPath());
     const resources = {
-      skill: join101(root2, "skills/recover-workspace/SKILL.md"),
-      issue_template: join101(root2, "resources/templates/recovery-issue.md")
+      skill: join102(root2, "skills/recover-workspace/SKILL.md"),
+      issue_template: join102(root2, "resources/templates/recovery-issue.md")
     };
     if (!Object.values(resources).every((path3) => existsSync26(path3)))
       throw new Error("Recovery resources are absent from this Provider.");
@@ -100163,7 +100284,7 @@ __export(exports_taskLocalSourceAdjustment, {
   adjustLocalRevisionSources: () => adjustLocalRevisionSources
 });
 import { readFile as readFile84 } from "node:fs/promises";
-import { join as join102 } from "node:path";
+import { join as join103 } from "node:path";
 async function adjustLocalRevisionSources(root2, input) {
   const { readMaintenance: readMaintenance2 } = await Promise.resolve().then(() => (init_maintenanceStorage(), exports_maintenanceStorage));
   if ((await readMaintenance2(root2)).active && await readProductionStage(root2))
@@ -100206,7 +100327,7 @@ async function adjustLocalRevisionSources(root2, input) {
   if (input.refresh && (!current2.refresh_sources || indexerProtocolDigest([...current2.refresh_sources].sort()) !== indexerProtocolDigest([...selected].sort()))) {
     throw new TypeError("No matching acquisition adjustment exists. Run task adjust without refresh first.");
   }
-  const raw = await readFile84(join102(root2, await revisionStoragePath(root2)), "utf8");
+  const raw = await readFile84(join103(root2, await revisionStoragePath(root2)), "utf8");
   let next2;
   const discardIds = new Set;
   if (!input.refresh) {
@@ -100309,7 +100430,7 @@ ${input.instruction}` : revision.instruction
     content: content3
   }];
   if (discardIds.size > 0) {
-    const ledger = await readFile84(join102(root2, CANDIDATE_LEDGER_FILE), "utf8").catch((error) => {
+    const ledger = await readFile84(join103(root2, CANDIDATE_LEDGER_FILE), "utf8").catch((error) => {
       if (error.code === "ENOENT")
         return;
       throw error;
@@ -100566,7 +100687,7 @@ __export(exports_managedDocumentRename, {
   renameManagedDocument: () => renameManagedDocument
 });
 import { readFile as readFile92 } from "node:fs/promises";
-import { join as join110, posix as posix11 } from "node:path";
+import { join as join111, posix as posix11 } from "node:path";
 async function optionalText2(path3) {
   try {
     return await readFile92(path3, "utf8");
@@ -100653,7 +100774,7 @@ async function renameManagedDocument(input) {
       if (path3.split("/").includes("..") || path3.startsWith("/"))
         throw new TypeError("Source references contain an unsafe knowledge path; repair it before renaming.");
       await safeProjectTarget(input.projectRoot, path3);
-      const before = await optionalText2(join110(input.projectRoot, path3));
+      const before = await optionalText2(join111(input.projectRoot, path3));
       if (before === undefined)
         continue;
       let after;
@@ -100742,7 +100863,7 @@ var init_managedDocumentRename = __esm(() => {
 
 // src/cli.ts
 import { existsSync as existsSync36, realpathSync as realpathSync3 } from "node:fs";
-import { dirname as dirname49, join as join116 } from "node:path";
+import { dirname as dirname49, join as join117 } from "node:path";
 import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL3 } from "node:url";
 
 // ../../node_modules/.bun/commander@11.1.0/node_modules/commander/esm.mjs
@@ -106025,14 +106146,14 @@ function compactJsonResult(result, verbose) {
 // src/project/runLog.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { mkdir as mkdir33, writeFile as writeFile26 } from "node:fs/promises";
-import { dirname as dirname39, join as join96 } from "node:path";
+import { dirname as dirname39, join as join97 } from "node:path";
 var createPhaseRunId = () => {
   const timestamp = new Date().toISOString().replace(/[-:.TZ]/gu, "");
   return `run_${timestamp}_${randomUUID5().slice(0, 8)}`;
 };
 async function writePhaseRunLog(input) {
-  const relPath = join96(".tmp", "context-runtime", "runs", `${input.runId}.json`);
-  const absPath = join96(input.projectRoot, relPath);
+  const relPath = join97(".tmp", "context-runtime", "runs", `${input.runId}.json`);
+  const absPath = join97(input.projectRoot, relPath);
   await mkdir33(dirname39(absPath), { recursive: true });
   await writeFile26(absPath, `${JSON.stringify({
     run_id: input.runId,
@@ -107132,7 +107253,7 @@ init_reviewApplyIndexer();
 init_approvedKnowledgeSnapshots();
 import { existsSync as existsSync25 } from "node:fs";
 import { readFile as readFile76 } from "node:fs/promises";
-import { join as join97 } from "node:path";
+import { join as join98 } from "node:path";
 
 // src/project/reviewCandidateAuthority.ts
 init_src2();
@@ -107195,7 +107316,7 @@ async function prepareApprovedPage(input) {
       next: "Refresh the current production or article revision, then reopen Review before approval."
     });
   }
-  const relPath = join97("knowledge", input.record.path);
+  const relPath = join98("knowledge", input.record.path);
   const existingView = findApprovedPageForArticleId(input.record.indexer_candidate.artifact_ref, input.approvedPageIndex);
   const previousPath = input.record.approved_revision?.previous_path;
   if (previousPath !== undefined && (!isSafeKnowledgeTargetPath(previousPath.split("/")[0], previousPath) || previousPath.includes("\\")))
@@ -107210,13 +107331,13 @@ async function prepareApprovedPage(input) {
       next: "Resolve the approved page path migration explicitly before approving this candidate."
     });
   }
-  const absPath = join97(input.projectRoot, relPath);
+  const absPath = join98(input.projectRoot, relPath);
   const existing = existsSync25(absPath) ? await readFile76(absPath, "utf8") : undefined;
   let previous3;
   if (previousPath !== undefined) {
     if (existing !== undefined || existingView?.relPath !== `knowledge/${previousPath}`)
       throw new TypeError("Page move destination or original identity changed; refresh its revision.");
-    previous3 = { path: `knowledge/${previousPath}`, content: await readFile76(join97(input.projectRoot, "knowledge", previousPath), "utf8") };
+    previous3 = { path: `knowledge/${previousPath}`, content: await readFile76(join98(input.projectRoot, "knowledge", previousPath), "utf8") };
   }
   if (input.record.approved_revision !== undefined) {
     const base = previous3?.content ?? existing;
@@ -107263,7 +107384,7 @@ async function prepareApprovedPage(input) {
 }
 async function readProjectFileMaybe(projectRoot, relPath) {
   try {
-    return await readFile76(join97(projectRoot, relPath), "utf8");
+    return await readFile76(join98(projectRoot, relPath), "utf8");
   } catch (error) {
     if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") {
       return;
@@ -107486,7 +107607,7 @@ async function applyReviewDecisions(input) {
           });
         }
         seenApprovedIds.set(approvedRef, row.candidate_id);
-        const approvedPath = join97("knowledge", row.path);
+        const approvedPath = join98("knowledge", row.path);
         const previousPathCandidate = seenApprovedPaths.get(knowledgeTargetPathKey(approvedPath));
         if (previousPathCandidate !== undefined) {
           throw new ContextError(ExitCode.UserError, `multiple approved review decisions target the same knowledge path: ${approvedPath}`, {
@@ -107536,7 +107657,7 @@ async function applyReviewDecisions(input) {
       for (const path3 of approvedPageIndex.byRelPath.keys()) {
         if (pagesToWrite.some((page) => page.relPath === path3 || page.previous?.path === path3))
           continue;
-        const before = await readFile76(join97(input.projectRoot, path3), "utf8");
+        const before = await readFile76(join98(input.projectRoot, path3), "utf8");
         const local = path3.replace(/^knowledge\//u, "");
         const after = moveKnowledgeLinkTargets2(before, local, local, moved);
         navigationTargets.push(reviewFileTarget({ path: path3, baseContent: before, targetContent: after }));
@@ -107620,12 +107741,12 @@ init_candidateLedger();
 
 // src/project/localHtmlReport.ts
 import { execFile as execFile11 } from "node:child_process";
-import { isAbsolute as isAbsolute17, join as join98 } from "node:path";
+import { isAbsolute as isAbsolute17, join as join99 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { promisify as promisify11 } from "node:util";
 var execFileAsync5 = promisify11(execFile11);
 function htmlReportReference(input) {
-  const absolutePath = isAbsolute17(input.path) ? input.path : join98(input.projectRoot, input.path);
+  const absolutePath = isAbsolute17(input.path) ? input.path : join99(input.projectRoot, input.path);
   return {
     format: "html",
     path: input.path,
@@ -108649,7 +108770,7 @@ init_maintenanceStorage();
 init_productionFeedback();
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { readFile as readFile79 } from "node:fs/promises";
-import { join as join99 } from "node:path";
+import { join as join100 } from "node:path";
 async function beginProductionRevision(input) {
   return withProductionFeedback({ operation: "revision" }, () => withProjectWriteLock(input.projectRoot, "production-revision", async () => {
     await recoverDurableMultiFileTransactions(input.projectRoot);
@@ -108688,7 +108809,7 @@ async function beginProductionRevision(input) {
       const formal = approved.byPath.get(path3);
       if (!prior && !formal)
         throw invalid2("Write the current task first; there is no article draft to revise yet.");
-      const markdown = prior?.body ?? await readFile79(await safeProjectTarget(input.projectRoot, join99("knowledge", path3)), "utf8");
+      const markdown = prior?.body ?? await readFile79(await safeProjectTarget(input.projectRoot, join100("knowledge", path3)), "utf8");
       const sections = prior?.indexer_candidate.sections.map((section) => ({ id: section.section_key, references: section.references })) ?? formal?.sections;
       const sources = [];
       for (const source2 of owner.sources) {
@@ -109328,7 +109449,7 @@ init_atomicWrite();
 var import_yaml44 = __toESM(require_dist(), 1);
 import { Buffer as Buffer4 } from "node:buffer";
 import { createHash as createHash31 } from "node:crypto";
-import { join as join103 } from "node:path";
+import { join as join104 } from "node:path";
 var INLINE_LIMIT = 16 * 1024;
 function record4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
@@ -109354,8 +109475,8 @@ async function prepareActionCompletionOutput(input) {
   if (production && Buffer4.byteLength(full) <= INLINE_LIMIT)
     return input.result;
   const digest6 = createHash31("sha256").update(full).digest("hex");
-  const root2 = join103(input.projectRoot, ".tmp/context-runtime/action-results");
-  const resultFile = join103(root2, `${digest6}.json`);
+  const root2 = join104(input.projectRoot, ".tmp/context-runtime/action-results");
+  const resultFile = join104(root2, `${digest6}.json`);
   await atomicWriteFile(resultFile, full);
   if (production)
     return {
@@ -109366,7 +109487,7 @@ async function prepareActionCompletionOutput(input) {
       ...pick(result, ["next", "next_preparation"])
     };
   const next2 = record4(result.next) ?? record4(record4(result.workflow)?.current) ?? record4(record4(result.continuation)?.next);
-  const nextFile = next2 === undefined ? undefined : join103(root2, `${digest6}.next.json`);
+  const nextFile = next2 === undefined ? undefined : join104(root2, `${digest6}.next.json`);
   if (nextFile !== undefined)
     await atomicWriteFile(nextFile, serializeActionCompletion(next2, "json"));
   const outcomes = (Array.isArray(result.outcomes) ? result.outcomes : []).map(record4).filter((item) => item !== undefined);
@@ -109771,9 +109892,9 @@ function registerProjectActionCommands(program2) {
 // src/commands/cleanClaudePluginCache.ts
 init_cliFeedback();
 import { existsSync as existsSync27 } from "node:fs";
-import { readdir as readdir26, rm as rm21 } from "node:fs/promises";
+import { readdir as readdir27, rm as rm22 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join as join104 } from "node:path";
+import { join as join105 } from "node:path";
 var ORPHAN_MARKER = ".orphaned_at";
 var CLAUDE_PLUGIN_CACHE_ROOT_ENV = "C4A_CLAUDE_PLUGIN_CACHE_ROOT";
 var CLAUDE_PLUGIN_CACHE_HOME_ENV = "C4A_CLAUDE_PLUGIN_CACHE_HOME";
@@ -109786,40 +109907,40 @@ async function cleanClaudePluginCache(opts = {}) {
     lines.push("· claude plugin cache: missing — nothing to clean");
     return { lines, removed, scanned };
   }
-  const marketplaces = await readdir26(cacheRoot, { withFileTypes: true });
+  const marketplaces = await readdir27(cacheRoot, { withFileTypes: true });
   for (const mp of marketplaces) {
     if (!mp.isDirectory())
       continue;
-    const mpDir = join104(cacheRoot, mp.name);
-    const plugins = await readdir26(mpDir, { withFileTypes: true });
+    const mpDir = join105(cacheRoot, mp.name);
+    const plugins = await readdir27(mpDir, { withFileTypes: true });
     for (const pl of plugins) {
       if (!pl.isDirectory())
         continue;
-      const plDir = join104(mpDir, pl.name);
-      const versions = await readdir26(plDir, { withFileTypes: true });
+      const plDir = join105(mpDir, pl.name);
+      const versions = await readdir27(plDir, { withFileTypes: true });
       for (const ver of versions) {
         if (!ver.isDirectory())
           continue;
         scanned += 1;
-        const verDir = join104(plDir, ver.name);
-        const markerPath = join104(verDir, ORPHAN_MARKER);
+        const verDir = join105(plDir, ver.name);
+        const markerPath = join105(verDir, ORPHAN_MARKER);
         if (!existsSync27(markerPath))
           continue;
         const label2 = `${mp.name}/${pl.name}/${ver.name}`;
         if (opts.dryRun) {
           lines.push(`  - would remove: ${label2}`);
         } else {
-          await rm21(verDir, { recursive: true, force: true });
+          await rm22(verDir, { recursive: true, force: true });
           removed += 1;
           lines.push(`  ✓ removed: ${label2}`);
         }
       }
       if (!opts.dryRun && await isEmptyDir(plDir)) {
-        await rm21(plDir, { recursive: true, force: true });
+        await rm22(plDir, { recursive: true, force: true });
       }
     }
     if (!opts.dryRun && await isEmptyDir(mpDir)) {
-      await rm21(mpDir, { recursive: true, force: true });
+      await rm22(mpDir, { recursive: true, force: true });
     }
   }
   if (scanned === 0) {
@@ -109834,11 +109955,11 @@ function resolveClaudePluginCacheRoot(opts) {
   if (explicitRoot)
     return explicitRoot;
   const home = opts.home ?? process.env[CLAUDE_PLUGIN_CACHE_HOME_ENV] ?? homedir();
-  return join104(home, ".claude", "plugins", "cache");
+  return join105(home, ".claude", "plugins", "cache");
 }
 async function isEmptyDir(dir) {
   try {
-    const entries2 = await readdir26(dir);
+    const entries2 = await readdir27(dir);
     return entries2.length === 0;
   } catch {
     return false;
@@ -109866,13 +109987,13 @@ init_exitCode();
 
 // src/lib/packageVersion.ts
 import { existsSync as existsSync28, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname42, join as join105 } from "node:path";
+import { dirname as dirname42, join as join106 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 function readPackageVersion() {
   try {
     let dir = dirname42(fileURLToPath8(import.meta.url));
     for (let depth = 0;depth < 8; depth += 1) {
-      const packagePath = join105(dir, "package.json");
+      const packagePath = join106(dir, "package.json");
       if (existsSync28(packagePath)) {
         const parsed = JSON.parse(readFileSync9(packagePath, "utf8"));
         if (typeof parsed.version === "string" && parsed.version.length > 0) {
@@ -109912,7 +110033,7 @@ init_repoSourceRegistry();
 init_writeLock();
 import { execFile as execFile12 } from "node:child_process";
 import { existsSync as existsSync29 } from "node:fs";
-import { lstat as lstat12, mkdir as mkdir35, readlink as readlink2, realpath as realpath10, rm as rm22, symlink as symlink4 } from "node:fs/promises";
+import { lstat as lstat12, mkdir as mkdir35, readlink as readlink2, realpath as realpath10, rm as rm23, symlink as symlink4 } from "node:fs/promises";
 import { basename as basename11, dirname as dirname43, isAbsolute as isAbsolute19, relative as relative26, resolve as resolve34 } from "node:path";
 import { promisify as promisify12 } from "node:util";
 var execFileAsync6 = promisify12(execFile12);
@@ -110102,14 +110223,14 @@ async function cloneCheckout(input) {
   try {
     await execFileAsync6("git", cloneArgs, { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
   } catch {
-    await rm22(target, { recursive: true, force: true });
+    await rm23(target, { recursive: true, force: true });
     try {
       await execFileAsync6("git", ["clone", "--no-checkout", "--depth=1", input.remote, target], {
         encoding: "utf8",
         maxBuffer: 4 * 1024 * 1024
       });
     } catch (error) {
-      await rm22(target, { recursive: true, force: true });
+      await rm23(target, { recursive: true, force: true });
       const detail = error !== null && typeof error === "object" && "stderr" in error ? String(error.stderr ?? "").trim() : error instanceof Error ? error.message : String(error);
       throw new ContextError(ExitCode.ExternalToolError, `cannot clone registered repository: ${input.remote}`, {
         category: ErrorCategory.ExternalToolFailed,
@@ -110134,7 +110255,7 @@ async function cloneCheckout(input) {
     await verifyCheckout({ checkout: target, remote: input.remote, ref: input.ref, subpaths: input.subpaths });
     return target;
   } catch (error) {
-    await rm22(target, { recursive: true, force: true });
+    await rm23(target, { recursive: true, force: true });
     throw error;
   }
 }
@@ -110150,7 +110271,7 @@ async function bindLocalAlias(input) {
       const actualReal = await realpath10(actual).catch(() => null);
       if (actualReal !== null && actualReal === await realpath10(input.checkout))
         return;
-      await rm22(alias);
+      await rm23(alias);
     } else {
       const actual = await realpath10(alias);
       if (actual === await realpath10(input.checkout))
@@ -110259,14 +110380,14 @@ init_src2();
 init_documentCapture();
 import { existsSync as existsSync30 } from "node:fs";
 import { readFile as readFile86 } from "node:fs/promises";
-import { join as join107 } from "node:path";
+import { join as join108 } from "node:path";
 
 // src/project/sourceCommandViews.ts
 init_documentSiteDetection();
 init_workspace();
 init_documentBatchManifest();
 import { readFile as readFile85 } from "node:fs/promises";
-import { join as join106 } from "node:path";
+import { join as join107 } from "node:path";
 function repoSourceAgentView(source2) {
   return {
     id: source2.id ?? source2.name,
@@ -110327,7 +110448,7 @@ async function fileSourceAgentViewWithNextAction(input) {
   };
 }
 function documentSourceManifestPath(source2) {
-  return source2.snapshot?.manifest ?? join106(source2.materializedAt, "manifest.json");
+  return source2.snapshot?.manifest ?? join107(source2.materializedAt, "manifest.json");
 }
 async function fileSourceDocumentSiteHint(input) {
   const detection = await detectDocumentSiteFiles({
@@ -110337,7 +110458,7 @@ async function fileSourceDocumentSiteHint(input) {
   let snapshotConfigured = false;
   const manifest = documentSourceManifestPath(input.source);
   try {
-    const parsed = parseDocumentSnapshotForSource(JSON.parse(await readFile85(join106(input.projectRoot, manifest), "utf8")), input.source.name);
+    const parsed = parseDocumentSnapshotForSource(JSON.parse(await readFile85(join107(input.projectRoot, manifest), "utf8")), input.source.name);
     snapshotConfigured = manifestUsesMdxJsonDocs(parsed);
   } catch {
     snapshotConfigured = false;
@@ -110370,11 +110491,11 @@ async function larkSourceAgentViewWithNextAction(input) {
 init_documentBatchManifest();
 init_documentSnapshotFidelity();
 function documentSourceManifestPath2(source2) {
-  return source2.snapshot?.manifest ?? join107(source2.materializedAt, "manifest.json");
+  return source2.snapshot?.manifest ?? join108(source2.materializedAt, "manifest.json");
 }
 async function documentSnapshotState(input) {
   const manifest = documentSourceManifestPath2(input.source);
-  const manifestPath = join107(input.projectRoot, manifest);
+  const manifestPath = join108(input.projectRoot, manifest);
   if (!existsSync30(manifestPath)) {
     return {
       snapshotReady: false,
@@ -110453,7 +110574,7 @@ async function documentSnapshotState(input) {
     const missing = [
       ...parsed.files.map((file) => file.path),
       ...(parsed.assets ?? []).filter((asset) => asset.content_hash !== undefined).map((asset) => asset.path)
-    ].find((path3) => !existsSync30(join107(input.projectRoot, input.source.materializedAt, path3)));
+    ].find((path3) => !existsSync30(join108(input.projectRoot, input.source.materializedAt, path3)));
     if (missing !== undefined) {
       return {
         snapshotReady: false,
@@ -110555,7 +110676,7 @@ init_exitCode();
 var import_yaml47 = __toESM(require_dist(), 1);
 import { createHash as createHash32 } from "node:crypto";
 import { readFile as readFile87, realpath as realpath11 } from "node:fs/promises";
-import { basename as basename12, extname as extname15, isAbsolute as isAbsolute20, join as join108, relative as relative27, resolve as resolve35 } from "node:path";
+import { basename as basename12, extname as extname15, isAbsolute as isAbsolute20, join as join109, relative as relative27, resolve as resolve35 } from "node:path";
 init_writeLock();
 var SOURCE_NAME_PATTERN3 = /^[a-z0-9][a-z0-9._-]*$/u;
 function isDateSourceNamespace(value) {
@@ -110651,7 +110772,7 @@ function assertSafeFileInclude(value) {
 }
 async function readRegistryDocument(projectRoot, registryPath2) {
   try {
-    const content3 = await readFile87(join108(projectRoot, registryPath2), "utf8");
+    const content3 = await readFile87(join109(projectRoot, registryPath2), "utf8");
     return content3.trim().length === 0 ? { sources: [] } : import_yaml47.default.parse(content3);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT")
@@ -110769,7 +110890,7 @@ async function addFileSourceUnlocked(input) {
     const record6 = entry2;
     return record6.name !== input.name && record6.id !== input.name;
   }), nextEntry];
-  await atomicWriteFile(join108(input.projectRoot, DEFAULT_FILE_SOURCES_REGISTRY_PATH), import_yaml47.default.stringify({ sources: nextSources }));
+  await atomicWriteFile(join109(input.projectRoot, DEFAULT_FILE_SOURCES_REGISTRY_PATH), import_yaml47.default.stringify({ sources: nextSources }));
   const updated = await loadSourcesRegistry({ rootDir: input.projectRoot });
   const entry = updated.files.find((source2) => source2.name === input.name || source2.id === input.name);
   if (entry === undefined) {
@@ -110825,7 +110946,7 @@ async function addLarkSourceUnlocked(input) {
     const record6 = entry2;
     return record6.name !== input.name && record6.id !== input.name;
   }), nextEntry];
-  await atomicWriteFile(join108(input.projectRoot, DEFAULT_LARK_SOURCES_REGISTRY_PATH), import_yaml47.default.stringify({ sources: nextSources }));
+  await atomicWriteFile(join109(input.projectRoot, DEFAULT_LARK_SOURCES_REGISTRY_PATH), import_yaml47.default.stringify({ sources: nextSources }));
   const updated = await loadSourcesRegistry({ rootDir: input.projectRoot });
   const entry = updated.larks.find((source2) => source2.name === input.name || source2.id === input.name);
   if (entry === undefined) {
@@ -111029,8 +111150,8 @@ init_writeLock();
 var import_yaml48 = __toESM(require_dist(), 1);
 import { existsSync as existsSync31 } from "node:fs";
 import { createHash as createHash33 } from "node:crypto";
-import { readFile as readFile88, readdir as readdir27, rm as rm23 } from "node:fs/promises";
-import { isAbsolute as isAbsolute21, join as join109, relative as relative28, resolve as resolve36, sep as sep8 } from "node:path";
+import { readFile as readFile88, readdir as readdir28, rm as rm24 } from "node:fs/promises";
+import { isAbsolute as isAbsolute21, join as join110, relative as relative28, resolve as resolve36, sep as sep8 } from "node:path";
 function sourceIdentity(source2) {
   if (source2.kind === "source.collection")
     return;
@@ -111062,7 +111183,7 @@ function collectStrings(value, output) {
   }
 }
 async function yamlReferences(input) {
-  const absolutePath = join109(input.projectRoot, input.path);
+  const absolutePath = join110(input.projectRoot, input.path);
   if (!existsSync31(absolutePath))
     return false;
   const parsed = import_yaml48.default.parse(await readFile88(absolutePath, "utf8"));
@@ -111191,7 +111312,7 @@ async function registryRemovalWrite(projectRoot, source2) {
   const path3 = registryPath2(source2.type);
   if (path3 === null)
     return;
-  const absolutePath = join109(projectRoot, path3);
+  const absolutePath = join110(projectRoot, path3);
   const document4 = existsSync31(absolutePath) ? import_yaml48.default.parse(await readFile88(absolutePath, "utf8")) : { sources: [] };
   return {
     path: absolutePath,
@@ -111210,7 +111331,7 @@ function safeManagedMaterializedPath(projectRoot, source2) {
   return absolute;
 }
 function safeManagedManifestPath(projectRoot, source2) {
-  const manifest = source2.manifest ?? join109(source2.materializedAt, "manifest.json");
+  const manifest = source2.manifest ?? join110(source2.materializedAt, "manifest.json");
   if (isAbsolute21(manifest))
     throw unsafeOwnership(source2, manifest);
   const absolute = resolve36(projectRoot, manifest);
@@ -111372,7 +111493,7 @@ function publicRemovalResult(plan, action) {
   };
 }
 async function pruneExtractRuntime(projectRoot, source2) {
-  const fingerprintPath = join109(projectRoot, ".tmp/context-runtime/extract/source-fingerprints.json");
+  const fingerprintPath = join110(projectRoot, ".tmp/context-runtime/extract/source-fingerprints.json");
   const removedPhaseIds = new Set;
   if (existsSync31(fingerprintPath)) {
     const parsed = JSON.parse(await readFile88(fingerprintPath, "utf8"));
@@ -111389,14 +111510,14 @@ async function pruneExtractRuntime(projectRoot, source2) {
     await atomicWriteFile(fingerprintPath, `${JSON.stringify({ ...parsed, phases: next2 }, null, 2)}
 `);
   }
-  const phaseOwnershipPath = join109(projectRoot, ".tmp/context-runtime/extract/custom-phase-candidates.json");
+  const phaseOwnershipPath = join110(projectRoot, ".tmp/context-runtime/extract/custom-phase-candidates.json");
   if (existsSync31(phaseOwnershipPath) && removedPhaseIds.size > 0) {
     const parsed = JSON.parse(await readFile88(phaseOwnershipPath, "utf8"));
     const phases = Object.fromEntries(Object.entries(parsed.phases ?? {}).filter(([phaseId]) => !removedPhaseIds.has(phaseId)));
     await atomicWriteFile(phaseOwnershipPath, `${JSON.stringify({ ...parsed, phases }, null, 2)}
 `);
   }
-  const symbolPath = join109(projectRoot, ".tmp/context-runtime/extract/source-symbols.json");
+  const symbolPath = join110(projectRoot, ".tmp/context-runtime/extract/source-symbols.json");
   if (existsSync31(symbolPath)) {
     const parsed = JSON.parse(await readFile88(symbolPath, "utf8"));
     const symbols = Array.isArray(parsed.symbols) ? parsed.symbols.filter((entry) => entry === null || typeof entry !== "object" || Array.isArray(entry) || entry.source !== source2.name) : [];
@@ -111404,12 +111525,12 @@ async function pruneExtractRuntime(projectRoot, source2) {
     await atomicWriteFile(symbolPath, `${JSON.stringify({ ...parsed, phaseFingerprints, symbols }, null, 2)}
 `);
   }
-  const snapshotRoot = join109(projectRoot, ".tmp/context-runtime/extract/candidates");
+  const snapshotRoot = join110(projectRoot, ".tmp/context-runtime/extract/candidates");
   const visit4 = async (directory) => {
     if (!existsSync31(directory))
       return;
-    for (const entry of await readdir27(directory, { withFileTypes: true })) {
-      const path3 = join109(directory, entry.name);
+    for (const entry of await readdir28(directory, { withFileTypes: true })) {
+      const path3 = join110(directory, entry.name);
       if (entry.isDirectory()) {
         await visit4(path3);
         continue;
@@ -111420,7 +111541,7 @@ async function pruneExtractRuntime(projectRoot, source2) {
         const parsed = JSON.parse(await readFile88(path3, "utf8"));
         const refs = Array.isArray(parsed.source_refs) ? parsed.source_refs : [];
         if (parsed.source === source2.name || refs.some((ref2) => typeof ref2 === "string" && stringReferencesSource(ref2, source2))) {
-          await rm23(path3, { force: true });
+          await rm24(path3, { force: true });
         }
       } catch {}
     }
@@ -111459,7 +111580,7 @@ async function removeProjectSource(input) {
       });
     }
     await applyAtomicFileBatch({
-      transactionRoot: join109(input.projectRoot, ".tmp", "context-runtime", "source-remove-transactions"),
+      transactionRoot: join110(input.projectRoot, ".tmp", "context-runtime", "source-remove-transactions"),
       writes: [...plan.registryWrite === undefined ? [] : [plan.registryWrite], ...plan.manifestWrite !== undefined ? [plan.manifestWrite] : []],
       removals: plan.absoluteRemovals
     });
@@ -112101,8 +112222,8 @@ init_cliFeedback();
 init_exitCode();
 var import_yaml51 = __toESM(require_dist(), 1);
 import { constants as constants6, existsSync as existsSync32 } from "node:fs";
-import { lstat as lstat13, open as open5, readdir as readdir28 } from "node:fs/promises";
-import { dirname as dirname44, join as join111, resolve as resolve38 } from "node:path";
+import { lstat as lstat13, open as open5, readdir as readdir29 } from "node:fs/promises";
+import { dirname as dirname44, join as join112, resolve as resolve38 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 function bundledSkillRoot() {
   const directory = dirname44(fileURLToPath9(import.meta.url));
@@ -112129,10 +112250,10 @@ async function listProductionSkills(root2) {
   }
 }
 async function readProductionSkills(root2) {
-  const entries2 = (await readdir28(root2, { withFileTypes: true })).filter((entry) => entry.isDirectory()).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const entries2 = (await readdir29(root2, { withFileTypes: true })).filter((entry) => entry.isDirectory()).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
   const skills = [];
   for (const directory of entries2) {
-    const entry = join111(root2, directory.name, "SKILL.md");
+    const entry = join112(root2, directory.name, "SKILL.md");
     if (!(await lstat13(entry)).isFile())
       throw new TypeError(`Skill entry must be a regular file: ${entry}`);
     const handle2 = await open5(entry, constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
@@ -112540,8 +112661,8 @@ init_cliFeedback();
 init_errors3();
 init_exitCode();
 import { createHash as createHash34 } from "node:crypto";
-import { cp as cp2, lstat as lstat14, mkdir as mkdir36, mkdtemp as mkdtemp5, readFile as readFile94, readdir as readdir29, rename as rename9, rm as rm24, writeFile as writeFile28 } from "node:fs/promises";
-import { dirname as dirname46, join as join112, resolve as resolve40 } from "node:path";
+import { cp as cp2, lstat as lstat14, mkdir as mkdir36, mkdtemp as mkdtemp5, readFile as readFile94, readdir as readdir30, rename as rename9, rm as rm25, writeFile as writeFile28 } from "node:fs/promises";
+import { dirname as dirname46, join as join113, resolve as resolve40 } from "node:path";
 var MARKER = ".context-skill-install.json";
 function conflict(path3) {
   throw new ContextError(ExitCode.UserError, `Local skill install conflict: ${path3}`, {
@@ -112569,10 +112690,10 @@ async function checkParents(path3) {
 async function digest7(root2) {
   const hash4 = createHash34("sha256");
   async function visit4(dir, prefix) {
-    for (const name3 of (await readdir29(dir)).sort()) {
+    for (const name3 of (await readdir30(dir)).sort()) {
       if (!prefix && name3 === MARKER)
         continue;
-      const path3 = join112(dir, name3);
+      const path3 = join113(dir, name3);
       const entry = await lstat14(path3);
       if (entry.isSymbolicLink())
         conflict(path3);
@@ -112592,31 +112713,31 @@ async function installLocalSkills(root2, path3, dryRun, agent) {
   if (!path3.trim())
     conflict("--local requires a non-empty path");
   const targetRoot = resolve40(path3);
-  const skillsRoot = join112(targetRoot, "skills");
+  const skillsRoot = join113(targetRoot, "skills");
   await checkParents(skillsRoot);
-  const sourceRoot2 = join112(root2, "skills");
+  const sourceRoot2 = join113(root2, "skills");
   const commandPlans = [];
   const commandEntries = new Set;
   if (agent === "claude" || agent === "cursor") {
-    for (const name3 of await readdir29(join112(root2, "claude", "commands"))) {
+    for (const name3 of await readdir30(join113(root2, "claude", "commands"))) {
       if (name3.endsWith(".md"))
         commandEntries.add(name3.slice(0, -3));
     }
-    const commandsRoot = join112(targetRoot, "commands");
+    const commandsRoot = join113(targetRoot, "commands");
     await checkParents(commandsRoot);
-    for (const entry of await readdir29(join112(root2, agent, "commands"), { withFileTypes: true })) {
+    for (const entry of await readdir30(join113(root2, agent, "commands"), { withFileTypes: true })) {
       if (!entry.isFile() || !entry.name.endsWith(".md"))
         continue;
-      let content3 = await readFile94(join112(root2, agent, "commands", entry.name), "utf8");
+      let content3 = await readFile94(join113(root2, agent, "commands", entry.name), "utf8");
       if (agent === "claude") {
         const frontmatter2 = /^(---\r?\n)([\s\S]*?)(\r?\n---(?:\r?\n|$))/.exec(content3);
         if (!frontmatter2)
-          conflict(join112(root2, agent, "commands", entry.name));
+          conflict(join113(root2, agent, "commands", entry.name));
         content3 = `${frontmatter2[1]}disable-model-invocation: true
 ${frontmatter2[2].replace(/^disable-model-invocation:.*\r?\n?/mu, "")}${frontmatter2[3]}${content3.slice(frontmatter2[0].length)}`;
       }
-      const target = join112(commandsRoot, entry.name);
-      const marker = join112(commandsRoot, `.context-${entry.name}.json`);
+      const target = join113(commandsRoot, entry.name);
+      const marker = join113(commandsRoot, `.context-${entry.name}.json`);
       for (const file of [target, marker]) {
         const existing = await stat11(file);
         if (existing && (!existing.isFile() || existing.isSymbolicLink()))
@@ -112637,14 +112758,14 @@ ${frontmatter2[2].replace(/^disable-model-invocation:.*\r?\n?/mu, "")}${frontmat
       commandPlans.push({ name: entry.name, target, marker, content: content3, hash: createHash34("sha256").update(content3).digest("hex") });
     }
     if (!commandPlans.length)
-      conflict(join112(root2, agent, "commands"));
+      conflict(join113(root2, agent, "commands"));
   }
   const plans = [];
-  for (const entry of (await readdir29(sourceRoot2, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
-    if (!entry.isDirectory() || !await stat11(join112(sourceRoot2, entry.name, "SKILL.md")))
+  for (const entry of (await readdir30(sourceRoot2, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+    if (!entry.isDirectory() || !await stat11(join113(sourceRoot2, entry.name, "SKILL.md")))
       continue;
-    const source2 = join112(sourceRoot2, entry.name);
-    const target = join112(skillsRoot, entry.name);
+    const source2 = join113(sourceRoot2, entry.name);
+    const target = join113(skillsRoot, entry.name);
     if (commandEntries.has(entry.name)) {
       if (await stat11(target))
         conflict(`${target} (use a fresh host directory to avoid duplicate command/skill entries)`);
@@ -112654,7 +112775,7 @@ ${frontmatter2[2].replace(/^disable-model-invocation:.*\r?\n?/mu, "")}${frontmat
     if (existing) {
       if (!existing.isDirectory() || existing.isSymbolicLink())
         conflict(target);
-      const markerPath = join112(target, MARKER);
+      const markerPath = join113(target, MARKER);
       if (!(await stat11(markerPath))?.isFile())
         conflict(target);
       let marker;
@@ -112673,14 +112794,14 @@ ${frontmatter2[2].replace(/^disable-model-invocation:.*\r?\n?/mu, "")}${frontmat
   if (!dryRun) {
     await mkdir36(skillsRoot, { recursive: true });
     for (const plan of plans) {
-      const staging = await mkdtemp5(join112(skillsRoot, ".context-install-"));
-      const candidate = join112(staging, "candidate");
-      const previous3 = join112(staging, "previous");
+      const staging = await mkdtemp5(join113(skillsRoot, ".context-install-"));
+      const candidate = join113(staging, "candidate");
+      const previous3 = join113(staging, "previous");
       let moved = false;
       try {
         await cp2(plan.source, candidate, { recursive: true });
         if (agent === "claude") {
-          const skillFile = join112(candidate, "SKILL.md");
+          const skillFile = join113(candidate, "SKILL.md");
           const content3 = await readFile94(skillFile, "utf8");
           const parts = /^(---\r?\n)([\s\S]*?)(\r?\n---(?:\r?\n|$))/.exec(content3);
           if (parts && /^\s*context-public-entry:\s*["']?false["']?\s*$/mu.test(parts[2])) {
@@ -112689,7 +112810,7 @@ ${frontmatter2[2].replace(/^disable-model-invocation:.*\r?\n?/mu, "")}${frontmat
 ${frontmatter2}${parts[3]}${content3.slice(parts[0].length)}`);
           }
         }
-        await writeFile28(join112(candidate, MARKER), JSON.stringify({ owner: "context-plugin-local", digest: await digest7(candidate) }) + `
+        await writeFile28(join113(candidate, MARKER), JSON.stringify({ owner: "context-plugin-local", digest: await digest7(candidate) }) + `
 `);
         if (plan.exists) {
           await rename9(plan.target, previous3);
@@ -112702,7 +112823,7 @@ ${frontmatter2}${parts[3]}${content3.slice(parts[0].length)}`);
             await rename9(previous3, plan.target);
           throw error;
         }
-        await rm24(staging, { recursive: true, force: true });
+        await rm25(staging, { recursive: true, force: true });
       } catch (error) {
         throw new ContextError(ExitCode.WorkspaceStateError, `Local skill installation failed: ${plan.target}`, {
           category: ErrorCategory.WorkspaceStateInvalid,
@@ -112713,13 +112834,13 @@ ${frontmatter2}${parts[3]}${content3.slice(parts[0].length)}`);
     }
     for (const command3 of commandPlans) {
       await mkdir36(dirname46(command3.target), { recursive: true });
-      const staging = await mkdtemp5(join112(dirname46(command3.target), ".context-install-"));
-      await writeFile28(join112(staging, "command"), command3.content);
-      await writeFile28(join112(staging, "marker"), JSON.stringify({ owner: "context-plugin-local", digest: command3.hash }) + `
+      const staging = await mkdtemp5(join113(dirname46(command3.target), ".context-install-"));
+      await writeFile28(join113(staging, "command"), command3.content);
+      await writeFile28(join113(staging, "marker"), JSON.stringify({ owner: "context-plugin-local", digest: command3.hash }) + `
 `);
-      await rename9(join112(staging, "command"), command3.target);
-      await rename9(join112(staging, "marker"), command3.marker);
-      await rm24(staging, { recursive: true, force: true });
+      await rename9(join113(staging, "command"), command3.target);
+      await rename9(join113(staging, "marker"), command3.marker);
+      await rm25(staging, { recursive: true, force: true });
     }
   }
   return formatFeedback({
@@ -112742,10 +112863,10 @@ init_cliFeedback();
 init_errors3();
 init_exitCode();
 import { lstat as lstat15 } from "node:fs/promises";
-import { join as join113, resolve as resolve41 } from "node:path";
+import { join as join114, resolve as resolve41 } from "node:path";
 var HOST_DIRS = { claude: ".claude", cursor: ".cursor", codex: ".agents" };
 async function detectLocalAgent(agent, repo) {
-  const path3 = join113(repo, HOST_DIRS[agent]);
+  const path3 = join114(repo, HOST_DIRS[agent]);
   try {
     const entry = await lstat15(path3);
     if (!entry.isDirectory() || entry.isSymbolicLink()) {
@@ -112770,7 +112891,7 @@ async function installAutoLocalSkills(root2, path3, dryRun, detect = detectLocal
     if (selectedAgent ? selectedAgent === "all" || agent === selectedAgent : await detect(agent, repo))
       agents.push(agent);
   }
-  const targets = agents.length ? agents.map((agent) => ({ agent, path: join113(repo, HOST_DIRS[agent]) })) : [{ path: join113(repo, ".agents") }];
+  const targets = agents.length ? agents.map((agent) => ({ agent, path: join114(repo, HOST_DIRS[agent]) })) : [{ path: join114(repo, ".agents") }];
   const previews = [];
   for (const target of targets)
     previews.push(await installLocalSkills(root2, target.path, true, target.agent));
@@ -112803,7 +112924,7 @@ init_cliFeedback();
 init_errors3();
 init_exitCode();
 import { existsSync as existsSync35 } from "node:fs";
-import { dirname as dirname48, join as join115, resolve as resolve42 } from "node:path";
+import { dirname as dirname48, join as join116, resolve as resolve42 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 
 // src/project/pluginInstallTargets.ts
@@ -112812,9 +112933,9 @@ init_errors3();
 init_exitCode();
 import { execFile as execFile13 } from "node:child_process";
 import { existsSync as existsSync34 } from "node:fs";
-import { cp as cp3, mkdir as mkdir37, readdir as readdir30, readFile as readFile95, rename as rename10, rm as rm25, writeFile as writeFile29 } from "node:fs/promises";
+import { cp as cp3, mkdir as mkdir37, readdir as readdir31, readFile as readFile95, rename as rename10, rm as rm26, writeFile as writeFile29 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname47, join as join114 } from "node:path";
+import { dirname as dirname47, join as join115 } from "node:path";
 import { promisify as promisify13 } from "node:util";
 var execFileAsync7 = promisify13(execFile13);
 var MARKETPLACE_NAME = "c4a";
@@ -112868,23 +112989,23 @@ async function claudePluginInstalled(pluginId) {
   }
 }
 function codexHome() {
-  return process.env.CODEX_HOME?.trim() || join114(homedir2(), ".codex");
+  return process.env.CODEX_HOME?.trim() || join115(homedir2(), ".codex");
 }
 function claudePluginCacheRoot() {
   const explicitRoot = process.env[CLAUDE_PLUGIN_CACHE_ROOT_ENV2]?.trim();
   if (explicitRoot)
     return explicitRoot;
   const home = process.env[CLAUDE_PLUGIN_CACHE_HOME_ENV2]?.trim() || homedir2();
-  return join114(home, ".claude", "plugins", "cache");
+  return join115(home, ".claude", "plugins", "cache");
 }
 function sharedSkillsRoot() {
-  return process.env[SHARED_SKILLS_ROOT_ENV]?.trim() || join114(homedir2(), ".agents", "skills");
+  return process.env[SHARED_SKILLS_ROOT_ENV]?.trim() || join115(homedir2(), ".agents", "skills");
 }
 function claudeSkillsRoot() {
-  return process.env[CLAUDE_SKILLS_ROOT_ENV]?.trim() || join114(homedir2(), ".claude", "skills");
+  return process.env[CLAUDE_SKILLS_ROOT_ENV]?.trim() || join115(homedir2(), ".claude", "skills");
 }
 function cursorPluginRoot() {
-  return process.env[CURSOR_PLUGIN_ROOT_ENV]?.trim() || join114(homedir2(), ".cursor", "plugins", "local", PLUGIN_NAME);
+  return process.env[CURSOR_PLUGIN_ROOT_ENV]?.trim() || join115(homedir2(), ".cursor", "plugins", "local", PLUGIN_NAME);
 }
 function blockHeader(line) {
   const match = line.match(/^\s*\[([^\]]+)\]\s*$/u);
@@ -112935,7 +113056,7 @@ function pruneLegacyCodexConfigContent(content3) {
 `), removed };
 }
 async function pruneLegacyCodexConfig(dryRun, steps) {
-  const configPath = join114(codexHome(), "config.toml");
+  const configPath = join115(codexHome(), "config.toml");
   const current2 = await readFile95(configPath, "utf8").catch(() => "");
   if (!current2)
     return;
@@ -112952,10 +113073,10 @@ async function pruneLegacyCodexConfig(dryRun, steps) {
   }
 }
 async function pruneCodexPluginCacheForName(pluginName, keepVersion, dryRun, steps) {
-  const cacheRoot = join114(codexHome(), "plugins", "cache", MARKETPLACE_NAME, pluginName);
+  const cacheRoot = join115(codexHome(), "plugins", "cache", MARKETPLACE_NAME, pluginName);
   if (!existsSync34(cacheRoot))
     return;
-  const versions = (await readdir30(cacheRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory() && entry.name !== keepVersion).map((entry) => entry.name).sort();
+  const versions = (await readdir31(cacheRoot, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory() && entry.name !== keepVersion).map((entry) => entry.name).sort();
   if (versions.length === 0)
     return;
   steps.push({
@@ -112964,7 +113085,7 @@ async function pruneCodexPluginCacheForName(pluginName, keepVersion, dryRun, ste
     status: dryRun ? "planned" : "ran"
   });
   if (!dryRun)
-    await Promise.all(versions.map((version3) => rm25(join114(cacheRoot, version3), { recursive: true, force: true })));
+    await Promise.all(versions.map((version3) => rm26(join115(cacheRoot, version3), { recursive: true, force: true })));
 }
 async function pruneCodexPluginCache(currentVersion, dryRun, steps) {
   await pruneCodexPluginCacheForName(PLUGIN_NAME, currentVersion, dryRun, steps);
@@ -112974,7 +113095,7 @@ async function pruneCodexPluginCache(currentVersion, dryRun, steps) {
 }
 async function isEmptyDir2(dir) {
   try {
-    return (await readdir30(dir)).length === 0;
+    return (await readdir31(dir)).length === 0;
   } catch {
     return false;
   }
@@ -112984,31 +113105,31 @@ async function pruneClaudeOrphanContextCache(dryRun, steps) {
   if (!existsSync34(cacheRoot))
     return;
   const removed = [];
-  const marketplaces = await readdir30(cacheRoot, { withFileTypes: true }).catch(() => []);
+  const marketplaces = await readdir31(cacheRoot, { withFileTypes: true }).catch(() => []);
   for (const marketplace of marketplaces) {
     if (!marketplace.isDirectory())
       continue;
-    const pluginDir = join114(cacheRoot, marketplace.name, PLUGIN_NAME);
+    const pluginDir = join115(cacheRoot, marketplace.name, PLUGIN_NAME);
     if (!existsSync34(pluginDir))
       continue;
-    const versions = await readdir30(pluginDir, { withFileTypes: true }).catch(() => []);
+    const versions = await readdir31(pluginDir, { withFileTypes: true }).catch(() => []);
     for (const version3 of versions) {
       if (!version3.isDirectory())
         continue;
-      const versionDir = join114(pluginDir, version3.name);
-      if (!existsSync34(join114(versionDir, ORPHAN_MARKER2)))
+      const versionDir = join115(pluginDir, version3.name);
+      if (!existsSync34(join115(versionDir, ORPHAN_MARKER2)))
         continue;
       removed.push(`${marketplace.name}/${PLUGIN_NAME}/${version3.name}`);
       if (!dryRun) {
-        await rm25(versionDir, { recursive: true, force: true });
+        await rm26(versionDir, { recursive: true, force: true });
       }
     }
     if (!dryRun && await isEmptyDir2(pluginDir)) {
-      await rm25(pluginDir, { recursive: true, force: true });
+      await rm26(pluginDir, { recursive: true, force: true });
     }
-    const marketplaceDir = join114(cacheRoot, marketplace.name);
+    const marketplaceDir = join115(cacheRoot, marketplace.name);
     if (!dryRun && await isEmptyDir2(marketplaceDir)) {
-      await rm25(marketplaceDir, { recursive: true, force: true });
+      await rm26(marketplaceDir, { recursive: true, force: true });
     }
   }
   if (removed.length > 0) {
@@ -113027,12 +113148,12 @@ async function pruneClaudeLegacyPluginCache(dryRun, steps) {
     return;
   const removed = [];
   for (const pluginName of LEGACY_PLUGIN_NAMES) {
-    const pluginDir = join114(cacheRoot, MARKETPLACE_NAME, pluginName);
+    const pluginDir = join115(cacheRoot, MARKETPLACE_NAME, pluginName);
     if (!existsSync34(pluginDir))
       continue;
     removed.push(`${MARKETPLACE_NAME}/${pluginName}`);
     if (!dryRun) {
-      await rm25(pluginDir, { recursive: true, force: true });
+      await rm26(pluginDir, { recursive: true, force: true });
     }
   }
   if (removed.length > 0) {
@@ -113044,12 +113165,12 @@ async function pruneClaudeLegacyPluginCache(dryRun, steps) {
   }
 }
 async function pruneClaudeSupersededContextCache(root2, dryRun, steps) {
-  const manifest = await readFile95(join114(root2, "claude", ".claude-plugin", "plugin.json"), "utf8").then((content3) => JSON.parse(content3)).catch(() => null);
+  const manifest = await readFile95(join115(root2, "claude", ".claude-plugin", "plugin.json"), "utf8").then((content3) => JSON.parse(content3)).catch(() => null);
   const currentVersion = typeof manifest?.version === "string" ? manifest.version : null;
   if (!currentVersion)
     return;
-  const pluginDir = join114(claudePluginCacheRoot(), MARKETPLACE_NAME, PLUGIN_NAME);
-  const staleVersions = (await readdir30(pluginDir, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory() && entry.name !== currentVersion).map((entry) => entry.name);
+  const pluginDir = join115(claudePluginCacheRoot(), MARKETPLACE_NAME, PLUGIN_NAME);
+  const staleVersions = (await readdir31(pluginDir, { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory() && entry.name !== currentVersion).map((entry) => entry.name);
   if (staleVersions.length === 0)
     return;
   steps.push({
@@ -113058,7 +113179,7 @@ async function pruneClaudeSupersededContextCache(root2, dryRun, steps) {
     status: dryRun ? "planned" : "ran"
   });
   if (!dryRun) {
-    await Promise.all(staleVersions.map((version3) => rm25(join114(pluginDir, version3), { recursive: true, force: true })));
+    await Promise.all(staleVersions.map((version3) => rm26(join115(pluginDir, version3), { recursive: true, force: true })));
   }
 }
 function enableCodexPluginConfig(content3) {
@@ -113122,7 +113243,7 @@ source = ${JSON.stringify(root2)}
 `;
 }
 async function ensureCodexPluginEnabled() {
-  const configPath = join114(codexHome(), "config.toml");
+  const configPath = join115(codexHome(), "config.toml");
   await mkdir37(dirname47(configPath), { recursive: true });
   const current2 = await readFile95(configPath, "utf8").catch(() => "");
   const next2 = enableCodexPluginConfig(current2);
@@ -113131,7 +113252,7 @@ async function ensureCodexPluginEnabled() {
   }
 }
 async function ensureCodexLocalMarketplace(root2) {
-  const configPath = join114(codexHome(), "config.toml");
+  const configPath = join115(codexHome(), "config.toml");
   await mkdir37(dirname47(configPath), { recursive: true });
   const current2 = await readFile95(configPath, "utf8").catch(() => "");
   const next2 = upsertCodexLocalMarketplaceConfig(current2, root2);
@@ -113140,7 +113261,7 @@ async function ensureCodexLocalMarketplace(root2) {
   }
 }
 async function codexPluginVersion(root2) {
-  const manifestPath = join114(root2, "codex", ".codex-plugin", "plugin.json");
+  const manifestPath = join115(root2, "codex", ".codex-plugin", "plugin.json");
   const manifest = JSON.parse(await readFile95(manifestPath, "utf8"));
   if (typeof manifest.version !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(manifest.version)) {
     throw new Error(`Codex plugin manifest has an invalid version: ${manifestPath}`);
@@ -113148,13 +113269,13 @@ async function codexPluginVersion(root2) {
   return manifest.version;
 }
 function codexPluginCacheDir(version3) {
-  return join114(codexHome(), "plugins", "cache", MARKETPLACE_NAME, PLUGIN_NAME, version3);
+  return join115(codexHome(), "plugins", "cache", MARKETPLACE_NAME, PLUGIN_NAME, version3);
 }
 async function replaceDirectoryFromSource(source2, target) {
   await mkdir37(dirname47(target), { recursive: true });
   const temporary = `${target}.tmp-${process.pid}-${Date.now()}`;
   const previous3 = `${target}.previous-${process.pid}-${Date.now()}`;
-  await rm25(temporary, { recursive: true, force: true });
+  await rm26(temporary, { recursive: true, force: true });
   await cp3(source2, temporary, { recursive: true, force: true });
   const hadPrevious = existsSync34(target);
   try {
@@ -113162,16 +113283,16 @@ async function replaceDirectoryFromSource(source2, target) {
       await rename10(target, previous3);
     await rename10(temporary, target);
     if (hadPrevious)
-      await rm25(previous3, { recursive: true, force: true });
+      await rm26(previous3, { recursive: true, force: true });
   } catch (error) {
-    await rm25(temporary, { recursive: true, force: true });
+    await rm26(temporary, { recursive: true, force: true });
     if (hadPrevious && !existsSync34(target) && existsSync34(previous3))
       await rename10(previous3, target);
     throw error;
   }
 }
 async function materializeCodexPluginCache(root2, version3, dryRun, steps) {
-  const source2 = join114(root2, "codex");
+  const source2 = join115(root2, "codex");
   const target = codexPluginCacheDir(version3);
   steps.push({
     agent: "codex",
@@ -113183,13 +113304,13 @@ async function materializeCodexPluginCache(root2, version3, dryRun, steps) {
   await replaceDirectoryFromSource(source2, target);
 }
 async function bundledProviderSkillNames(root2) {
-  const skillsRoot = join114(root2, "skills");
-  const entries2 = await readdir30(skillsRoot, { withFileTypes: true });
+  const skillsRoot = join115(root2, "skills");
+  const entries2 = await readdir31(skillsRoot, { withFileTypes: true });
   const names = [];
   for (const entry of entries2) {
     if (!entry.isDirectory() || entry.name === "context")
       continue;
-    const skillPath = join114(skillsRoot, entry.name, "SKILL.md");
+    const skillPath = join115(skillsRoot, entry.name, "SKILL.md");
     if (!existsSync34(skillPath))
       continue;
     const skill = await readFile95(skillPath, "utf8");
@@ -113204,10 +113325,10 @@ async function bundledProviderSkillNames(root2) {
   return names;
 }
 async function materializeProviderSkills(root2, targetRoot, agent, dryRun, steps) {
-  const sourceRoot2 = join114(root2, "skills");
+  const sourceRoot2 = join115(root2, "skills");
   for (const name3 of await bundledProviderSkillNames(root2)) {
-    const source2 = join114(sourceRoot2, name3);
-    const target = join114(targetRoot, name3);
+    const source2 = join115(sourceRoot2, name3);
+    const target = join115(targetRoot, name3);
     steps.push({
       agent,
       command: `materialize lifecycle Provider skill: ${shellQuote8(source2)} -> ${shellQuote8(target)}`,
@@ -113218,7 +113339,7 @@ async function materializeProviderSkills(root2, targetRoot, agent, dryRun, steps
   }
 }
 async function installCursor(root2, dryRun, steps) {
-  const source2 = join114(root2, "cursor");
+  const source2 = join115(root2, "cursor");
   const target = cursorPluginRoot();
   steps.push({
     agent: "cursor",
@@ -113273,12 +113394,12 @@ async function installCodex(root2, dryRun, steps) {
   steps.push({ agent: "codex", command: commandLine("codex", addArgs), status: dryRun ? "planned" : "ran" });
   steps.push({
     agent: "codex",
-    command: `ensure ${shellQuote8(join114(codexHome(), "config.toml"))} registers local marketplace ${shellQuote8(MARKETPLACE_NAME)}`,
+    command: `ensure ${shellQuote8(join115(codexHome(), "config.toml"))} registers local marketplace ${shellQuote8(MARKETPLACE_NAME)}`,
     status: dryRun ? "planned" : "ran"
   });
   steps.push({
     agent: "codex",
-    command: `ensure ${shellQuote8(join114(codexHome(), "config.toml"))} enables ${shellQuote8(PLUGIN_ID)}`,
+    command: `ensure ${shellQuote8(join115(codexHome(), "config.toml"))} enables ${shellQuote8(PLUGIN_ID)}`,
     status: dryRun ? "planned" : "ran"
   });
   if (dryRun) {
@@ -113333,13 +113454,13 @@ function pluginRootCandidates() {
     return [resolve42(envRoot)];
   const candidates = [];
   for (const dir of packageCandidateDirs()) {
-    candidates.push(join115(dir, "plugins"));
-    candidates.push(join115(dir, "dist", "plugins"));
+    candidates.push(join116(dir, "plugins"));
+    candidates.push(join116(dir, "dist", "plugins"));
   }
   return [...new Set(candidates)];
 }
 function isInstallablePluginRoot(root2) {
-  return existsSync35(join115(root2, ".claude-plugin", "marketplace.json")) && existsSync35(join115(root2, ".agents", "plugins", "marketplace.json")) && existsSync35(join115(root2, "claude", ".claude-plugin", "plugin.json")) && existsSync35(join115(root2, "codex", ".codex-plugin", "plugin.json")) && existsSync35(join115(root2, "cursor", ".cursor-plugin", "plugin.json")) && existsSync35(join115(root2, "skills"));
+  return existsSync35(join116(root2, ".claude-plugin", "marketplace.json")) && existsSync35(join116(root2, ".agents", "plugins", "marketplace.json")) && existsSync35(join116(root2, "claude", ".claude-plugin", "plugin.json")) && existsSync35(join116(root2, "codex", ".codex-plugin", "plugin.json")) && existsSync35(join116(root2, "cursor", ".cursor-plugin", "plugin.json")) && existsSync35(join116(root2, "skills"));
 }
 function resolveBundledPluginsRoot() {
   const candidates = pluginRootCandidates();
@@ -113586,10 +113707,10 @@ function readQuickstartPath() {
   try {
     let dir = dirname49(fileURLToPath11(import.meta.url));
     for (let i2 = 0;i2 < 8; i2++) {
-      const candidate = join116(dir, "docs", "quickstart.md");
+      const candidate = join117(dir, "docs", "quickstart.md");
       if (existsSync36(candidate))
         return candidate;
-      const pkg = join116(dir, "package.json");
+      const pkg = join117(dir, "package.json");
       if (existsSync36(pkg))
         return candidate;
       const parent = dirname49(dir);
@@ -113598,7 +113719,7 @@ function readQuickstartPath() {
       dir = parent;
     }
   } catch {}
-  return join116(dirname49(fileURLToPath11(import.meta.url)), "docs", "quickstart.md");
+  return join117(dirname49(fileURLToPath11(import.meta.url)), "docs", "quickstart.md");
 }
 var GREEN = "\x1B[32m";
 var RESET = "\x1B[0m";