@chimix/agentscan 0.4.0 → 0.6.0

package/dist/cli.js

@@ -18,7 +18,7 @@ var __export = (target, all) => {
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/yaml/dist/nodes/identity.js
-var require_identity = __commonJS((exports) => {
+var require_identity = __commonJS(function(exports) {
   var ALIAS = Symbol.for("yaml.alias");
   var DOC = Symbol.for("yaml.document");
   var MAP = Symbol.for("yaml.map");
@@ -72,7 +72,7 @@ var require_identity = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/visit.js
-var require_visit = __commonJS((exports) => {
+var require_visit = __commonJS(function(exports) {
   var identity = require_identity();
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
@@ -227,7 +227,7 @@ var require_visit = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/directives.js
-var require_directives = __commonJS((exports) => {
+var require_directives = __commonJS(function(exports) {
   var identity = require_identity();
   var visit = require_visit();
   var escapeChars = {
@@ -379,7 +379,7 @@ var require_directives = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/anchors.js
-var require_anchors = __commonJS((exports) => {
+var require_anchors = __commonJS(function(exports) {
   var identity = require_identity();
   var visit = require_visit();
   function anchorIsValid(anchor) {
@@ -441,7 +441,7 @@ var require_anchors = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/applyReviver.js
-var require_applyReviver = __commonJS((exports) => {
+var require_applyReviver = __commonJS(function(exports) {
   function applyReviver(reviver, obj, key, val) {
     if (val && typeof val === "object") {
       if (Array.isArray(val)) {
@@ -488,7 +488,7 @@ var require_applyReviver = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/toJS.js
-var require_toJS = __commonJS((exports) => {
+var require_toJS = __commonJS(function(exports) {
   var identity = require_identity();
   function toJS(value, arg, ctx) {
     if (Array.isArray(value))
@@ -515,7 +515,7 @@ var require_toJS = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Node.js
-var require_Node = __commonJS((exports) => {
+var require_Node = __commonJS(function(exports) {
   var applyReviver = require_applyReviver();
   var identity = require_identity();
   var toJS = require_toJS();
@@ -552,7 +552,7 @@ var require_Node = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Alias.js
-var require_Alias = __commonJS((exports) => {
+var require_Alias = __commonJS(function(exports) {
   var anchors = require_anchors();
   var visit = require_visit();
   var identity = require_identity();
@@ -662,7 +662,7 @@ var require_Alias = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Scalar.js
-var require_Scalar = __commonJS((exports) => {
+var require_Scalar = __commonJS(function(exports) {
   var identity = require_identity();
   var Node = require_Node();
   var toJS = require_toJS();
@@ -690,7 +690,7 @@ var require_Scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/createNode.js
-var require_createNode = __commonJS((exports) => {
+var require_createNode = __commonJS(function(exports) {
   var Alias = require_Alias();
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -762,7 +762,7 @@ var require_createNode = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Collection.js
-var require_Collection = __commonJS((exports) => {
+var require_Collection = __commonJS(function(exports) {
   var createNode = require_createNode();
   var identity = require_identity();
   var Node = require_Node();
@@ -877,7 +877,7 @@ var require_Collection = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyComment.js
-var require_stringifyComment = __commonJS((exports) => {
+var require_stringifyComment = __commonJS(function(exports) {
   var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
   function indentComment(comment, indent) {
     if (/^\n+$/.test(comment))
@@ -894,7 +894,7 @@ var require_stringifyComment = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/foldFlowLines.js
-var require_foldFlowLines = __commonJS((exports) => {
+var require_foldFlowLines = __commonJS(function(exports) {
   var FOLD_FLOW = "flow";
   var FOLD_BLOCK = "block";
   var FOLD_QUOTED = "quoted";
@@ -1031,7 +1031,7 @@ ${indent}${text.slice(fold + 1, end2)}`;
 });
 
 // node_modules/yaml/dist/stringify/stringifyString.js
-var require_stringifyString = __commonJS((exports) => {
+var require_stringifyString = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var foldFlowLines = require_foldFlowLines();
   var getFoldOptions = (ctx, isBlock) => ({
@@ -1329,7 +1329,7 @@ ${indent}`);
 });
 
 // node_modules/yaml/dist/stringify/stringify.js
-var require_stringify = __commonJS((exports) => {
+var require_stringify = __commonJS(function(exports) {
   var anchors = require_anchors();
   var identity = require_identity();
   var stringifyComment = require_stringifyComment();
@@ -1450,7 +1450,7 @@ ${ctx.indent}${str}`;
 });
 
 // node_modules/yaml/dist/stringify/stringifyPair.js
-var require_stringifyPair = __commonJS((exports) => {
+var require_stringifyPair = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var stringify = require_stringify();
@@ -1586,7 +1586,7 @@ ${ctx.indent}`;
 });
 
 // node_modules/yaml/dist/log.js
-var require_log = __commonJS((exports) => {
+var require_log = __commonJS(function(exports) {
   var node_process = __require("process");
   function debug(logLevel, ...messages) {
     if (logLevel === "debug")
@@ -1605,7 +1605,7 @@ var require_log = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/merge.js
-var require_merge = __commonJS((exports) => {
+var require_merge = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var MERGE_KEY = "<<";
@@ -1662,7 +1662,7 @@ var require_merge = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/addPairToJSMap.js
-var require_addPairToJSMap = __commonJS((exports) => {
+var require_addPairToJSMap = __commonJS(function(exports) {
   var log = require_log();
   var merge = require_merge();
   var stringify = require_stringify();
@@ -1723,7 +1723,7 @@ var require_addPairToJSMap = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Pair.js
-var require_Pair = __commonJS((exports) => {
+var require_Pair = __commonJS(function(exports) {
   var createNode = require_createNode();
   var stringifyPair = require_stringifyPair();
   var addPairToJSMap = require_addPairToJSMap();
@@ -1761,7 +1761,7 @@ var require_Pair = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyCollection.js
-var require_stringifyCollection = __commonJS((exports) => {
+var require_stringifyCollection = __commonJS(function(exports) {
   var identity = require_identity();
   var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
@@ -1913,7 +1913,7 @@ ${indent}${end}`;
 });
 
 // node_modules/yaml/dist/nodes/YAMLMap.js
-var require_YAMLMap = __commonJS((exports) => {
+var require_YAMLMap = __commonJS(function(exports) {
   var stringifyCollection = require_stringifyCollection();
   var addPairToJSMap = require_addPairToJSMap();
   var Collection = require_Collection();
@@ -2040,7 +2040,7 @@ var require_YAMLMap = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/map.js
-var require_map = __commonJS((exports) => {
+var require_map = __commonJS(function(exports) {
   var identity = require_identity();
   var YAMLMap = require_YAMLMap();
   var map = {
@@ -2059,7 +2059,7 @@ var require_map = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/YAMLSeq.js
-var require_YAMLSeq = __commonJS((exports) => {
+var require_YAMLSeq = __commonJS(function(exports) {
   var createNode = require_createNode();
   var stringifyCollection = require_stringifyCollection();
   var Collection = require_Collection();
@@ -2152,7 +2152,7 @@ var require_YAMLSeq = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/seq.js
-var require_seq = __commonJS((exports) => {
+var require_seq = __commonJS(function(exports) {
   var identity = require_identity();
   var YAMLSeq = require_YAMLSeq();
   var seq = {
@@ -2171,7 +2171,7 @@ var require_seq = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/string.js
-var require_string = __commonJS((exports) => {
+var require_string = __commonJS(function(exports) {
   var stringifyString = require_stringifyString();
   var string = {
     identify: (value) => typeof value === "string",
@@ -2187,7 +2187,7 @@ var require_string = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/null.js
-var require_null = __commonJS((exports) => {
+var require_null = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var nullTag = {
     identify: (value) => value == null,
@@ -2202,7 +2202,7 @@ var require_null = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/bool.js
-var require_bool = __commonJS((exports) => {
+var require_bool = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var boolTag = {
     identify: (value) => typeof value === "boolean",
@@ -2223,7 +2223,7 @@ var require_bool = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyNumber.js
-var require_stringifyNumber = __commonJS((exports) => {
+var require_stringifyNumber = __commonJS(function(exports) {
   function stringifyNumber({ format, minFractionDigits, tag, value }) {
     if (typeof value === "bigint")
       return String(value);
@@ -2247,7 +2247,7 @@ var require_stringifyNumber = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/float.js
-var require_float = __commonJS((exports) => {
+var require_float = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
   var floatNaN = {
@@ -2290,7 +2290,7 @@ var require_float = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/int.js
-var require_int = __commonJS((exports) => {
+var require_int = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
   var intResolve = (str, offset, radix, { intAsBigInt }) => intAsBigInt ? BigInt(str) : parseInt(str.substring(offset), radix);
@@ -2332,7 +2332,7 @@ var require_int = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/schema.js
-var require_schema = __commonJS((exports) => {
+var require_schema = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
   var seq = require_seq();
@@ -2357,7 +2357,7 @@ var require_schema = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/json/schema.js
-var require_schema2 = __commonJS((exports) => {
+var require_schema2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var map = require_map();
   var seq = require_seq();
@@ -2421,7 +2421,7 @@ var require_schema2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/binary.js
-var require_binary = __commonJS((exports) => {
+var require_binary = __commonJS(function(exports) {
   var node_buffer = __require("buffer");
   var Scalar = require_Scalar();
   var stringifyString = require_stringifyString();
@@ -2476,7 +2476,7 @@ var require_binary = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/pairs.js
-var require_pairs = __commonJS((exports) => {
+var require_pairs = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
   var Scalar = require_Scalar();
@@ -2551,7 +2551,7 @@ ${cn.comment}` : item.comment;
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/omap.js
-var require_omap = __commonJS((exports) => {
+var require_omap = __commonJS(function(exports) {
   var identity = require_identity();
   var toJS = require_toJS();
   var YAMLMap = require_YAMLMap();
@@ -2623,7 +2623,7 @@ var require_omap = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/bool.js
-var require_bool2 = __commonJS((exports) => {
+var require_bool2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   function boolStringify({ value, source }, ctx) {
     const boolObj = value ? trueTag : falseTag;
@@ -2652,7 +2652,7 @@ var require_bool2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/float.js
-var require_float2 = __commonJS((exports) => {
+var require_float2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
   var floatNaN = {
@@ -2698,7 +2698,7 @@ var require_float2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/int.js
-var require_int2 = __commonJS((exports) => {
+var require_int2 = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
   function intResolve(str, offset, radix, { intAsBigInt }) {
@@ -2774,7 +2774,7 @@ var require_int2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/set.js
-var require_set = __commonJS((exports) => {
+var require_set = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -2857,7 +2857,7 @@ var require_set = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
-var require_timestamp = __commonJS((exports) => {
+var require_timestamp = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   function parseSexagesimal(str, asBigInt) {
     const sign = str[0];
@@ -2939,7 +2939,7 @@ var require_timestamp = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/schema.js
-var require_schema3 = __commonJS((exports) => {
+var require_schema3 = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
   var seq = require_seq();
@@ -2980,7 +2980,7 @@ var require_schema3 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/tags.js
-var require_tags = __commonJS((exports) => {
+var require_tags = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
   var seq = require_seq();
@@ -3071,7 +3071,7 @@ var require_tags = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/Schema.js
-var require_Schema = __commonJS((exports) => {
+var require_Schema = __commonJS(function(exports) {
   var identity = require_identity();
   var map = require_map();
   var seq = require_seq();
@@ -3101,7 +3101,7 @@ var require_Schema = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyDocument.js
-var require_stringifyDocument = __commonJS((exports) => {
+var require_stringifyDocument = __commonJS(function(exports) {
   var identity = require_identity();
   var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
@@ -3181,7 +3181,7 @@ var require_stringifyDocument = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/Document.js
-var require_Document = __commonJS((exports) => {
+var require_Document = __commonJS(function(exports) {
   var Alias = require_Alias();
   var Collection = require_Collection();
   var identity = require_identity();
@@ -3416,7 +3416,7 @@ var require_Document = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/errors.js
-var require_errors = __commonJS((exports) => {
+var require_errors = __commonJS(function(exports) {
   class YAMLError extends Error {
     constructor(name, pos, code, message) {
       super();
@@ -3481,7 +3481,7 @@ ${pointer}
 });
 
 // node_modules/yaml/dist/compose/resolve-props.js
-var require_resolve_props = __commonJS((exports) => {
+var require_resolve_props = __commonJS(function(exports) {
   function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
     let spaceBefore = false;
     let atNewline = startOnNewline;
@@ -3611,7 +3611,7 @@ var require_resolve_props = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-contains-newline.js
-var require_util_contains_newline = __commonJS((exports) => {
+var require_util_contains_newline = __commonJS(function(exports) {
   function containsNewline(key) {
     if (!key)
       return null;
@@ -3651,7 +3651,7 @@ var require_util_contains_newline = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-flow-indent-check.js
-var require_util_flow_indent_check = __commonJS((exports) => {
+var require_util_flow_indent_check = __commonJS(function(exports) {
   var utilContainsNewline = require_util_contains_newline();
   function flowIndentCheck(indent, fc, onError) {
     if (fc?.type === "flow-collection") {
@@ -3666,7 +3666,7 @@ var require_util_flow_indent_check = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-map-includes.js
-var require_util_map_includes = __commonJS((exports) => {
+var require_util_map_includes = __commonJS(function(exports) {
   var identity = require_identity();
   function mapIncludes(ctx, items, search) {
     const { uniqueKeys } = ctx.options;
@@ -3679,7 +3679,7 @@ var require_util_map_includes = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-block-map.js
-var require_resolve_block_map = __commonJS((exports) => {
+var require_resolve_block_map = __commonJS(function(exports) {
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
   var resolveProps = require_resolve_props();
@@ -3786,7 +3786,7 @@ var require_resolve_block_map = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-block-seq.js
-var require_resolve_block_seq = __commonJS((exports) => {
+var require_resolve_block_seq = __commonJS(function(exports) {
   var YAMLSeq = require_YAMLSeq();
   var resolveProps = require_resolve_props();
   var utilFlowIndentCheck = require_util_flow_indent_check();
@@ -3834,7 +3834,7 @@ var require_resolve_block_seq = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-end.js
-var require_resolve_end = __commonJS((exports) => {
+var require_resolve_end = __commonJS(function(exports) {
   function resolveEnd(end, offset, reqSpace, onError) {
     let comment = "";
     if (end) {
@@ -3874,7 +3874,7 @@ var require_resolve_end = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-flow-collection.js
-var require_resolve_flow_collection = __commonJS((exports) => {
+var require_resolve_flow_collection = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -4065,7 +4065,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-collection.js
-var require_compose_collection = __commonJS((exports) => {
+var require_compose_collection = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var YAMLMap = require_YAMLMap();
@@ -4127,7 +4127,7 @@ var require_compose_collection = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-block-scalar.js
-var require_resolve_block_scalar = __commonJS((exports) => {
+var require_resolve_block_scalar = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   function resolveBlockScalar(ctx, scalar, onError) {
     const start = scalar.offset;
@@ -4320,7 +4320,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-flow-scalar.js
-var require_resolve_flow_scalar = __commonJS((exports) => {
+var require_resolve_flow_scalar = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var resolveEnd = require_resolve_end();
   function resolveFlowScalar(scalar, strict, onError) {
@@ -4537,7 +4537,7 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-scalar.js
-var require_compose_scalar = __commonJS((exports) => {
+var require_compose_scalar = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var resolveBlockScalar = require_resolve_block_scalar();
@@ -4615,7 +4615,7 @@ var require_compose_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-empty-scalar-position.js
-var require_util_empty_scalar_position = __commonJS((exports) => {
+var require_util_empty_scalar_position = __commonJS(function(exports) {
   function emptyScalarPosition(offset, before, pos) {
     if (before) {
       pos ?? (pos = before.length);
@@ -4642,7 +4642,7 @@ var require_util_empty_scalar_position = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-node.js
-var require_compose_node = __commonJS((exports) => {
+var require_compose_node = __commonJS(function(exports) {
   var Alias = require_Alias();
   var identity = require_identity();
   var composeCollection = require_compose_collection();
@@ -4745,7 +4745,7 @@ var require_compose_node = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-doc.js
-var require_compose_doc = __commonJS((exports) => {
+var require_compose_doc = __commonJS(function(exports) {
   var Document = require_Document();
   var composeNode = require_compose_node();
   var resolveEnd = require_resolve_end();
@@ -4785,7 +4785,7 @@ var require_compose_doc = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/composer.js
-var require_composer = __commonJS((exports) => {
+var require_composer = __commonJS(function(exports) {
   var node_process = __require("process");
   var directives = require_directives();
   var Document = require_Document();
@@ -4976,7 +4976,7 @@ ${end.comment}` : end.comment;
 });
 
 // node_modules/yaml/dist/parse/cst-scalar.js
-var require_cst_scalar = __commonJS((exports) => {
+var require_cst_scalar = __commonJS(function(exports) {
   var resolveBlockScalar = require_resolve_block_scalar();
   var resolveFlowScalar = require_resolve_flow_scalar();
   var errors2 = require_errors();
@@ -5166,7 +5166,7 @@ var require_cst_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/cst-stringify.js
-var require_cst_stringify = __commonJS((exports) => {
+var require_cst_stringify = __commonJS(function(exports) {
   var stringify = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
   function stringifyToken(token) {
     switch (token.type) {
@@ -5224,7 +5224,7 @@ var require_cst_stringify = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/cst-visit.js
-var require_cst_visit = __commonJS((exports) => {
+var require_cst_visit = __commonJS(function(exports) {
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
   var REMOVE = Symbol("remove item");
@@ -5283,7 +5283,7 @@ var require_cst_visit = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/cst.js
-var require_cst = __commonJS((exports) => {
+var require_cst = __commonJS(function(exports) {
   var cstScalar = require_cst_scalar();
   var cstStringify = require_cst_stringify();
   var cstVisit = require_cst_visit();
@@ -5384,7 +5384,7 @@ var require_cst = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/lexer.js
-var require_lexer = __commonJS((exports) => {
+var require_lexer = __commonJS(function(exports) {
   var cst = require_cst();
   function isEmpty(ch) {
     switch (ch) {
@@ -5981,7 +5981,7 @@ var require_lexer = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/line-counter.js
-var require_line_counter = __commonJS((exports) => {
+var require_line_counter = __commonJS(function(exports) {
   class LineCounter {
     constructor() {
       this.lineStarts = [];
@@ -6009,7 +6009,7 @@ var require_line_counter = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/parser.js
-var require_parser = __commonJS((exports) => {
+var require_parser = __commonJS(function(exports) {
   var node_process = __require("process");
   var cst = require_cst();
   var lexer = require_lexer();
@@ -6865,7 +6865,7 @@ var require_parser = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/public-api.js
-var require_public_api = __commonJS((exports) => {
+var require_public_api = __commonJS(function(exports) {
   var composer = require_composer();
   var Document = require_Document();
   var errors2 = require_errors();
@@ -6962,10 +6962,7 @@ var require_public_api = __commonJS((exports) => {
 import { parseArgs } from "node:util";
 
 // src/analyze.ts
-import { resolve as resolve2 } from "node:path";
-
-// src/checks/index.ts
-import { basename as basename2 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 
 // src/checks/budgets.ts
 import { basename } from "node:path";
@@ -7042,28 +7039,6 @@ function countFinding(args) {
     })
   ];
 }
-function packageManagerDrift(facts) {
-  if (facts.packageManager !== "bun") {
-    return [];
-  }
-  const hits = facts.policyFiles.filter((p) => p.text.includes("npm install"));
-  if (hits.length === 0) {
-    return [];
-  }
-  return [
-    make("policy.package-manager-drift", "policy:package-manager", {
-      action: "drift",
-      severity: "info",
-      message: "Policy mentions npm install but packageManager is bun",
-      reason: "Docs drift vs packageManager field / lockfile convention",
-      evidence: [
-        { kind: "packageManager", value: facts.packageManager },
-        ...hits.map((p) => ({ kind: "policy", value: p.path }))
-      ],
-      suggest: "Prefer bun install in AGENTS.md / CLAUDE.md"
-    })
-  ];
-}
 function runBudgets(facts, options) {
   return [
     ...policyLengthFinding({
@@ -7099,114 +7074,80 @@ function runBudgets(facts, options) {
       message: `MCP surface above sweet spot (${facts.mcp.length} > ${options.mcp})`,
       reason: "What actually degrades an agent is the number of tool definitions in context, not the number of servers: benchmarks show large models near-perfect at ~20 tools and failing outright past ~100, and a typical server carries tens of tools. Server count is the only proxy available without connecting to them, so treat this as a hint to go count the tools, not as a measurement.",
       suggest: "Count the tools your servers actually expose; disable unused servers in mcp.json or set thresholds.mcp in .agentscanrc.json"
-    }),
-    ...packageManagerDrift(facts)
+    })
   ];
 }
 
-// src/checks/index.ts
-var STRUCTURAL_CHECKS = [
-  {
-    id: "config.unreadable",
-    description: "Config file is not valid JSON or cannot be read"
-  },
-  {
-    id: "hook.unknown-event",
-    description: "Hook registered under an event name that is never dispatched"
-  },
-  {
-    id: "hook.missing-script",
-    description: "Hook points at a script that does not exist, so it never runs"
-  },
-  {
-    id: "skill.missing-skill-md",
-    description: "Skill directory has no SKILL.md"
-  },
-  {
-    id: "skill.missing-frontmatter",
-    description: "SKILL.md has no YAML frontmatter block"
-  },
-  {
-    id: "skill.missing-description",
-    description: "SKILL.md frontmatter has no description (recommended field)"
-  },
-  {
-    id: "skill.not-in-lock",
-    description: "Skill on disk is not tracked by skills-lock.json"
-  },
-  {
-    id: "skill.locked-not-installed",
-    description: "skills-lock.json pins a skill that is not installed"
-  },
-  {
-    id: "skill.broken-reference",
-    description: "SKILL.md points at a bundled file that does not exist"
-  },
-  {
-    id: "skill.duplicate-description",
-    description: "Two or more skills share an identical description"
-  },
-  {
-    id: "skill.description-budget",
-    description: "Skill descriptions exceed the startup character budget"
-  },
-  {
-    id: "skill.no-lockfile",
-    description: "Skills present with no skills-lock.json (requireLock only)"
-  },
-  {
-    id: "agent.missing-frontmatter",
-    description: "Agent definition has no YAML frontmatter block"
-  },
-  {
-    id: "agent.missing-description",
-    description: "Agent frontmatter has no description"
-  },
-  {
-    id: "mcp.no-launch",
-    description: "MCP server declares neither command nor url"
-  },
-  {
-    id: "mcp.url-without-type",
-    description: "Remote MCP server has a url but no transport type"
-  },
-  {
-    id: "mcp.hardcoded-secret",
-    description: "MCP config contains a token-shaped literal"
-  },
-  {
-    id: "mcp.literal-env",
-    description: "MCP env value is a long literal instead of ${VAR}"
-  },
-  {
-    id: "budget.agents-md",
-    description: "AGENTS.md longer than the point where added lines stop helping (>150 lines)"
-  },
-  {
-    id: "budget.claude-md",
-    description: "CLAUDE.md longer than the instruction budget a model reliably follows (>200 lines)"
-  },
-  {
-    id: "budget.agents",
-    description: "More agent definitions than a focused set (>8 files in .claude/agents)"
-  },
-  {
-    id: "budget.mcp",
-    description: "Project MCP server count above the point where tool selection degrades"
-  },
-  {
-    id: "policy.package-manager-drift",
-    description: "Policy mentions npm install while packageManager is bun"
-  }
-];
-var SECRET_PATTERNS = [
-  { label: "Anthropic key", re: /\bsk-ant-[A-Za-z0-9_-]{16,}/ },
-  { label: "OpenAI-style key", re: /\bsk-[A-Za-z0-9_]{20,}\b/ },
-  { label: "GitHub token", re: /\bgh[pousr]_[A-Za-z0-9]{20,}/ },
-  { label: "Google API key", re: /\bAIza[A-Za-z0-9_-]{20,}/ },
-  { label: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/ },
-  { label: "AWS access key id", re: /\bAKIA[0-9A-Z]{16}\b/ }
-];
+// src/checks/agents.ts
+function checkAgents(facts) {
+  const out = [];
+  const names = new Map;
+  for (const agent of facts.agents) {
+    if (agent.unreadable === true || agent.unparseableFrontmatter === true) {
+      continue;
+    }
+    if (!agent.hasFrontmatter) {
+      out.push(make("agent.missing-frontmatter", `agent:${agent.name}`, {
+        action: "warn",
+        severity: "error",
+        message: "Agent definition has no YAML frontmatter block",
+        reason: "An agent is selected by its declared description; without a frontmatter block there is nothing to select on, and the file is unlikely to load as an agent at all.",
+        evidence: [{ kind: "agent", value: agent.path }],
+        suggest: "Add a --- delimited block with a description"
+      }));
+      continue;
+    }
+    if (agent.description === undefined) {
+      out.push(make("agent.missing-description", `agent:${agent.name}`, {
+        action: "warn",
+        severity: "error",
+        message: "Agent frontmatter has no `description`",
+        reason: "The description is how the main session decides which agent to dispatch. Without one the agent can still be named explicitly, but it will not be chosen on its own.",
+        evidence: [{ kind: "agent", value: agent.path }],
+        suggest: "Add a one-line description saying when to dispatch it"
+      }));
+    }
+    if (agent.frontmatterName === undefined) {
+      out.push(make("agent.missing-name", `agent:${agent.name}`, {
+        action: "warn",
+        severity: "error",
+        message: "Agent frontmatter has no `name`",
+        reason: "Agent identity is declared by the required frontmatter name.",
+        evidence: [{ kind: "agent", value: agent.path }],
+        suggest: "Add a `name` field to the frontmatter"
+      }));
+    } else {
+      if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(agent.frontmatterName)) {
+        out.push(make("agent.invalid-name", `agent:${agent.name}`, {
+          action: "warn",
+          severity: "warning",
+          message: `Agent name "${agent.frontmatterName}" is not a valid identifier`,
+          reason: "The subagent reference specifies a unique identifier in lowercase letters and hyphens. A name outside that shape is not documented to load reliably, and a `:` in it is documented not to load at all. See docs/spec/agents.md.",
+          evidence: [{ kind: "agent", value: agent.path }],
+          suggest: "Use lowercase letters, numbers, and hyphens in the `name` field"
+        }));
+      }
+      const list = names.get(agent.frontmatterName) ?? [];
+      list.push(agent.path);
+      names.set(agent.frontmatterName, list);
+    }
+  }
+  for (const [name, paths] of names)
+    if (paths.length > 1) {
+      out.push(make("agent.duplicate-name", `agent:${name}`, {
+        action: "warn",
+        severity: "error",
+        message: `Agent name "${name}" is declared by multiple files`,
+        reason: "Duplicate names make dispatch ambiguous.",
+        evidence: paths.map((path) => ({ kind: "agent", value: path })),
+        suggest: "Give each agent a unique frontmatter name"
+      }));
+    }
+  return out;
+}
+
+// src/checks/config.ts
+import { basename as basename2 } from "node:path";
 function safeDetail(detail) {
   const position = detail.match(/\bline \d+(?:, column \d+)?/i)?.[0];
   const kind = detail.split(/[:(]/)[0]?.trim().slice(0, 60);
@@ -7215,6 +7156,18 @@ function safeDetail(detail) {
 }
 function checkConfigErrors(facts) {
   return facts.configErrors.map((err) => {
+    if (err.kind === "truncated") {
+      return make("scan.truncated", `scan:${err.path}`, {
+        action: "warn",
+        severity: "info",
+        message: `${basename2(err.path)} is larger than the scan cap — only its first bytes were read`,
+        reason: "The file itself is fine; agentscan reads a bounded prefix of it. Checks that read the body — skill.broken-reference, and the AGENTS.md / CLAUDE.md line counts — see only that prefix, so they can undercount on this file.",
+        evidence: [
+          { kind: "config", value: err.path },
+          { kind: "detail", value: err.detail }
+        ]
+      });
+    }
     const what = err.kind === "invalid-json" ? "is not valid JSON" : err.kind === "unreadable" ? "could not be read" : "has an unexpected shape";
     return make("config.unreadable", `config:${err.path}#${err.kind}:${safeDetail(err.detail)}`, {
       action: "warn",
@@ -7229,6 +7182,8 @@ function checkConfigErrors(facts) {
     });
   });
 }
+
+// src/checks/hooks.ts
 var KNOWN_HOOK_EVENTS = new Set([
   "SessionStart",
   "Setup",
@@ -7314,6 +7269,85 @@ function checkHooks(facts) {
   }
   return out;
 }
+
+// src/checks/mcp.ts
+var SECRET_PATTERNS = [
+  { label: "Anthropic key", re: /\bsk-ant-[A-Za-z0-9_-]{16,}/ },
+  { label: "OpenAI project key", re: /\bsk-proj-[A-Za-z0-9_-]{16,}/ },
+  { label: "OpenAI service-account key", re: /\bsk-svcacct-[A-Za-z0-9_-]{16,}/ },
+  { label: "OpenAI-style key", re: /\bsk-[A-Za-z0-9_]{20,}\b/ },
+  { label: "GitHub token", re: /\bgh[pousr]_[A-Za-z0-9]{20,}/ },
+  { label: "Google API key", re: /\bAIza[A-Za-z0-9_-]{20,}/ },
+  { label: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/ },
+  { label: "AWS access key id", re: /\bAKIA[0-9A-Z]{16}\b/ }
+];
+function checkMcp(facts) {
+  const out = [];
+  for (const server of facts.mcp) {
+    if (!(server.hasCommand || server.hasUrl)) {
+      out.push(make("mcp.no-launch", `mcp:${server.name}@${server.path}`, {
+        action: "warn",
+        severity: "error",
+        message: `MCP server "${server.name}" declares neither command nor url`,
+        reason: "Without a command or url the entry is not a launchable MCP server by schema — its tools will not be available, and the entry is dead weight that still costs a config read.",
+        evidence: [{ kind: "mcp", value: `${server.name} @ ${server.path}` }],
+        suggest: `Add a command (or url) for "${server.name}", or remove it`
+      }));
+    }
+    if (server.command !== undefined && server.commandExists === false) {
+      out.push(make("mcp.command-missing", `mcp:${server.name}@${server.path}`, {
+        action: "warn",
+        severity: "error",
+        message: `MCP server "${server.name}" points at a command path that does not exist: ${server.command}`,
+        reason: "The server declares a filesystem command, but that path is not a file on disk, so the entry is not launchable as configured. Bare PATH binaries are not checked — only path-like values this tool can resolve honestly.",
+        evidence: [
+          { kind: "mcp", value: `${server.name} @ ${server.path}` },
+          { kind: "command", value: server.command }
+        ],
+        suggest: `Restore ${server.command} or fix the command path for "${server.name}"`
+      }));
+    }
+    if (server.hasUrl && server.transport === undefined) {
+      out.push(make("mcp.url-without-type", `mcp:${server.name}@${server.path}`, {
+        action: "warn",
+        severity: "error",
+        message: `MCP server "${server.name}" has a url but no transport type`,
+        reason: "An entry with no `type` is read as a stdio server, so a remote server declared this way is misconfigured by schema and is skipped — its tools never appear, with no error in the report you are reading. See docs/spec/mcp.md.",
+        evidence: [{ kind: "mcp", value: `${server.name} @ ${server.path}` }],
+        suggest: `Add "type": "http" (or "sse" / "ws") to "${server.name}"`
+      }));
+    }
+    const hit = SECRET_PATTERNS.find((p) => p.re.test(server.raw));
+    if (hit !== undefined) {
+      out.push(make("mcp.hardcoded-secret", `mcp:${server.name}@${server.path}`, {
+        action: "warn",
+        severity: "error",
+        message: `MCP server "${server.name}" contains what looks like a hardcoded credential (${hit.label})`,
+        reason: "Credentials in a config file get committed, shared and cached. Treat it as leaked: rotate the key, then reference it through an environment variable.",
+        evidence: [{ kind: "mcp", value: `${server.name} @ ${server.path}` }],
+        suggest: "Rotate the credential, then replace the literal with ${ENV_VAR}"
+      }));
+      continue;
+    }
+    if (server.literalEnvKeys.length > 0) {
+      out.push(make("mcp.literal-env", `mcp:${server.name}@${server.path}`, {
+        action: "warn",
+        severity: "warning",
+        message: `MCP server "${server.name}" has literal env values: ${server.literalEnvKeys.join(", ")}`,
+        reason: "Long literal env values in config are usually secrets that should be indirected through ${VAR} so they are never committed.",
+        evidence: [
+          { kind: "mcp", value: `${server.name} @ ${server.path}` },
+          { kind: "env", value: server.literalEnvKeys.join(",") }
+        ],
+        suggest: "Replace the literals with ${ENV_VAR} references"
+      }));
+    }
+  }
+  return out;
+}
+
+// src/checks/skills.ts
+import { dirname } from "node:path";
 function skillEvidence(skill, value) {
   const evidence = [{ kind: "skill", value }];
   if (skill.source === "global") {
@@ -7321,6 +7355,12 @@ function skillEvidence(skill, value) {
   }
   return evidence;
 }
+function skillSubject(skill) {
+  return `skill:${skill.instanceId ?? skill.id}`;
+}
+function skillRoot(skill) {
+  return dirname(skill.path.replaceAll("\\", "/"));
+}
 function checkSkillStructure(facts) {
   const out = [];
   for (const skill of facts.skills) {
@@ -7328,7 +7368,7 @@ function checkSkillStructure(facts) {
       continue;
     }
     if (!skill.hasSkillMd) {
-      out.push(make("skill.missing-skill-md", `skill:${skill.id}`, {
+      out.push(make("skill.missing-skill-md", skillSubject(skill), {
         action: "warn",
         severity: "warning",
         message: `Skill directory has no SKILL.md`,
@@ -7341,8 +7381,8 @@ function checkSkillStructure(facts) {
     if (skill.unparseableFrontmatter === true) {
       continue;
     }
-    if (!skill.hasFrontmatter) {
-      out.push(make("skill.missing-frontmatter", `skill:${skill.id}`, {
+    if (skill.runtime !== "agents" && !skill.hasFrontmatter) {
+      out.push(make("skill.missing-frontmatter", skillSubject(skill), {
         action: "warn",
         severity: "warning",
         message: "SKILL.md has no YAML frontmatter block",
@@ -7353,10 +7393,10 @@ function checkSkillStructure(facts) {
       continue;
     }
     const broken = skill.brokenReferences;
-    if (broken !== undefined && broken.length > 0) {
+    if (skill.runtime !== "agents" && broken !== undefined && broken.length > 0) {
       const shown = broken.slice(0, 3).join(", ");
       const rest = broken.length - Math.min(3, broken.length);
-      out.push(make("skill.broken-reference", `skill:${skill.id}`, {
+      out.push(make("skill.broken-reference", skillSubject(skill), {
         action: "warn",
         severity: "warning",
         message: `SKILL.md points at ${broken.length} file${broken.length === 1 ? "" : "s"} that do not exist: ${shown}${rest > 0 ? ` (+${rest} more)` : ""}`,
@@ -7368,8 +7408,8 @@ function checkSkillStructure(facts) {
         suggest: `Restore the missing files under ${skill.path}, or drop the references from SKILL.md`
       }));
     }
-    if (skill.description === undefined) {
-      out.push(make("skill.missing-description", `skill:${skill.id}`, {
+    if (skill.runtime !== "agents" && skill.description === undefined) {
+      out.push(make("skill.missing-description", skillSubject(skill), {
         action: "warn",
         severity: "info",
         message: "SKILL.md frontmatter has no `description`",
@@ -7397,13 +7437,16 @@ function checkLockIntegrity(facts, options) {
     }
     return out;
   }
+  if (facts.skillsLockInvalid === true) {
+    return out;
+  }
   const onDisk = new Set(projectSkills.map((s) => s.id));
   const locked = new Map(facts.lockedSkills.map((l) => [l.id, l]));
   for (const skill of projectSkills) {
     if (locked.has(skill.id)) {
       continue;
     }
-    out.push(make("skill.not-in-lock", `skill:${skill.id}`, {
+    out.push(make("skill.not-in-lock", skillSubject(skill), {
       action: "warn",
       severity: "info",
       message: "Skill is not in skills-lock.json — local and unpinned",
@@ -7437,11 +7480,18 @@ function checkDuplicateDescriptions(facts) {
     if (skill.source !== "project" || skill.description === undefined) {
       continue;
     }
-    const key = skill.description.trim().replace(/\s+/g, " ").toLowerCase();
+    if (skill.runtime === "agents") {
+      continue;
+    }
+    const key = `${skillRoot(skill)}\x00${skill.description.trim().replace(/\s+/g, " ").toLowerCase()}`;
     if (key.length === 0) {
       continue;
     }
-    groups.set(key, [...groups.get(key) ?? [], skill.id]);
+    const ids = groups.get(key);
+    if (ids === undefined)
+      groups.set(key, [skill.instanceId ?? skill.id]);
+    else
+      ids.push(skill.instanceId ?? skill.id);
   }
   const out = [];
   for (const ids of groups.values()) {
@@ -7466,105 +7516,141 @@ function checkDescriptionBudget(facts, options) {
     return [];
   }
   const project = facts.skills.filter((s) => s.source === "project" && s.hasSkillMd && s.description !== undefined);
-  const bytes = project.reduce((sum, s) => sum + Buffer.byteLength(s.id) + Buffer.byteLength(s.description ?? ""), 0);
-  if (bytes <= ceiling) {
-    return [];
+  const byRoot = new Map;
+  for (const s of project) {
+    const root = skillRoot(s);
+    const bucket = byRoot.get(root);
+    if (bucket === undefined)
+      byRoot.set(root, [s]);
+    else
+      bucket.push(s);
   }
-  return [
-    make("skill.description-budget", "skills:description-budget", {
+  const out = [];
+  for (const [root, skills] of byRoot) {
+    const bytes = skills.reduce((sum, s) => sum + Buffer.byteLength(s.id) + Buffer.byteLength(s.description ?? ""), 0);
+    if (bytes <= ceiling) {
+      continue;
+    }
+    const where = root.startsWith(`${facts.root}/`) ? root.slice(facts.root.length + 1) : root;
+    const subject = byRoot.size === 1 ? "skills:description-budget" : `skills:description-budget:${where}`;
+    out.push(make("skill.description-budget", subject, {
       action: "warn",
       severity: "info",
-      message: `Skill descriptions total ${bytes} bytes across ${project.length} skills (over ${ceiling})`,
+      message: `Skill descriptions total ${bytes} bytes across ${skills.length} skills in ${where} (over ${ceiling})`,
       reason: "Names and descriptions for every skill are loaded at startup, within a budget of roughly 1-2% of the context window. Past it they are truncated, and a skill whose description is cut short stops being matched for the tasks it was written for.",
       evidence: [
         { kind: "count", value: `descriptionBytes=${bytes}` },
         { kind: "threshold", value: String(ceiling) }
       ],
       suggest: "Shorten the longest descriptions, or remove skills this project does not use"
-    })
-  ];
+    }));
+  }
+  return out;
 }
-function checkAgents(facts) {
-  const out = [];
-  for (const agent of facts.agents) {
-    if (agent.unreadable === true || agent.unparseableFrontmatter === true) {
-      continue;
-    }
-    if (!agent.hasFrontmatter) {
-      out.push(make("agent.missing-frontmatter", `agent:${agent.name}`, {
-        action: "warn",
-        severity: "warning",
-        message: "Agent definition has no YAML frontmatter block",
-        reason: "An agent is selected by its declared description; without a frontmatter block there is nothing to select on, and the file is unlikely to load as an agent at all.",
-        evidence: [{ kind: "agent", value: agent.path }],
-        suggest: "Add a --- delimited block with a description"
-      }));
-      continue;
-    }
-    if (agent.description === undefined) {
-      out.push(make("agent.missing-description", `agent:${agent.name}`, {
-        action: "warn",
-        severity: "info",
-        message: "Agent frontmatter has no `description`",
-        reason: "The description is how the main session decides which agent to dispatch. Without one the agent can still be named explicitly, but it will not be chosen on its own.",
-        evidence: [{ kind: "agent", value: agent.path }],
-        suggest: "Add a one-line description saying when to dispatch it"
-      }));
-    }
-  }
-  return out;
-}
-function checkMcp(facts) {
-  const out = [];
-  for (const server of facts.mcp) {
-    if (!(server.hasCommand || server.hasUrl)) {
-      out.push(make("mcp.no-launch", `mcp:${server.name}@${server.path}`, {
-        action: "warn",
-        severity: "error",
-        message: `MCP server "${server.name}" declares neither command nor url`,
-        reason: "There is no way to start or reach this server, so its tools are never available — the entry is dead weight that still costs a config read.",
-        evidence: [{ kind: "mcp", value: `${server.name} @ ${server.path}` }],
-        suggest: `Add a command (or url) for "${server.name}", or remove it`
-      }));
-    }
-    if (server.hasUrl && server.transport === undefined) {
-      out.push(make("mcp.url-without-type", `mcp:${server.name}@${server.path}`, {
-        action: "warn",
-        severity: "error",
-        message: `MCP server "${server.name}" has a url but no transport type`,
-        reason: "An entry with no `type` is read as a stdio server, so a remote server declared this way fails to start and is skipped — its tools never appear, with no error in the report you are reading. See docs/spec/mcp.md.",
-        evidence: [{ kind: "mcp", value: `${server.name} @ ${server.path}` }],
-        suggest: `Add "type": "http" (or "sse" / "ws") to "${server.name}"`
-      }));
-    }
-    const hit = SECRET_PATTERNS.find((p) => p.re.test(server.raw));
-    if (hit !== undefined) {
-      out.push(make("mcp.hardcoded-secret", `mcp:${server.name}@${server.path}`, {
-        action: "warn",
-        severity: "error",
-        message: `MCP server "${server.name}" contains what looks like a hardcoded credential (${hit.label})`,
-        reason: "Credentials in a config file get committed, shared and cached. Treat it as leaked: rotate the key, then reference it through an environment variable.",
-        evidence: [{ kind: "mcp", value: `${server.name} @ ${server.path}` }],
-        suggest: "Rotate the credential, then replace the literal with ${ENV_VAR}"
-      }));
-      continue;
-    }
-    if (server.literalEnvKeys.length > 0) {
-      out.push(make("mcp.literal-env", `mcp:${server.name}@${server.path}`, {
-        action: "warn",
-        severity: "warning",
-        message: `MCP server "${server.name}" has literal env values: ${server.literalEnvKeys.join(", ")}`,
-        reason: "Long literal env values in config are usually secrets that should be indirected through ${VAR} so they are never committed.",
-        evidence: [
-          { kind: "mcp", value: `${server.name} @ ${server.path}` },
-          { kind: "env", value: server.literalEnvKeys.join(",") }
-        ],
-        suggest: "Replace the literals with ${ENV_VAR} references"
-      }));
-    }
+// src/checks/registry.ts
+var STRUCTURAL_CHECKS = [
+  {
+    id: "config.unreadable",
+    description: "Config file is not valid JSON or cannot be read"
+  },
+  {
+    id: "scan.truncated",
+    description: "File is larger than the scan cap, so body checks read only a prefix of it"
+  },
+  {
+    id: "hook.unknown-event",
+    description: "Hook registered under an event name that is never dispatched"
+  },
+  {
+    id: "hook.missing-script",
+    description: "Hook points at a script that does not exist, so it never runs"
+  },
+  {
+    id: "skill.missing-skill-md",
+    description: "Skill directory has no SKILL.md"
+  },
+  {
+    id: "skill.missing-frontmatter",
+    description: "SKILL.md has no YAML frontmatter block"
+  },
+  {
+    id: "skill.missing-description",
+    description: "SKILL.md frontmatter has no description (recommended field)"
+  },
+  {
+    id: "skill.not-in-lock",
+    description: "Skill on disk is not tracked by skills-lock.json"
+  },
+  {
+    id: "skill.locked-not-installed",
+    description: "skills-lock.json pins a skill that is not installed"
+  },
+  {
+    id: "skill.broken-reference",
+    description: "SKILL.md points at a bundled file that does not exist"
+  },
+  {
+    id: "skill.duplicate-description",
+    description: "Two or more skills share an identical description"
+  },
+  {
+    id: "skill.description-budget",
+    description: "Skill descriptions exceed the startup character budget"
+  },
+  {
+    id: "skill.no-lockfile",
+    description: "Skills present with no skills-lock.json (requireLock only)"
+  },
+  {
+    id: "agent.missing-frontmatter",
+    description: "Agent definition has no YAML frontmatter block"
+  },
+  {
+    id: "agent.missing-description",
+    description: "Agent frontmatter has no description"
+  },
+  { id: "agent.missing-name", description: "Agent frontmatter has no name" },
+  { id: "agent.duplicate-name", description: "Agent names are duplicated" },
+  { id: "agent.invalid-name", description: "Agent frontmatter name is not a valid identifier" },
+  {
+    id: "mcp.no-launch",
+    description: "MCP server declares neither command nor url"
+  },
+  {
+    id: "mcp.command-missing",
+    description: "MCP server command is a path that does not exist on disk"
+  },
+  {
+    id: "mcp.url-without-type",
+    description: "Remote MCP server has a url but no transport type"
+  },
+  {
+    id: "mcp.hardcoded-secret",
+    description: "MCP config contains a token-shaped literal"
+  },
+  {
+    id: "mcp.literal-env",
+    description: "MCP env value is a long literal instead of ${VAR}"
+  },
+  {
+    id: "budget.agents-md",
+    description: "AGENTS.md longer than the point where added lines stop helping (>150 lines)"
+  },
+  {
+    id: "budget.claude-md",
+    description: "CLAUDE.md longer than the instruction budget a model reliably follows (>200 lines)"
+  },
+  {
+    id: "budget.agents",
+    description: "More agent definitions than a focused set (>8 files in .claude/agents)"
+  },
+  {
+    id: "budget.mcp",
+    description: "Project MCP server count above the point where tool selection degrades"
   }
-  return out;
-}
+];
+
+// src/checks/index.ts
 function runChecks(facts, options = {}) {
   return [
     ...checkConfigErrors(facts),
@@ -7587,113 +7673,113 @@ import { join } from "node:path";
 // node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -11560,7 +11646,6 @@ var NEVER = INVALID;
 // src/config/schema.ts
 var defaultThresholds = {
   skillDescriptionBytes: 16000,
-  skills: 30,
   mcp: 5,
   agentsMdLines: 150,
   claudeMdLines: 200,
@@ -11580,12 +11665,12 @@ var defaultConfig = {
 };
 var thresholdsSchema = exports_external.object({
   skillDescriptionBytes: exports_external.number().int().positive().default(defaultThresholds.skillDescriptionBytes),
-  skills: exports_external.number().int().positive().default(defaultThresholds.skills),
+  skills: exports_external.number().int().positive().optional(),
   mcp: exports_external.number().int().positive().default(defaultThresholds.mcp),
   agentsMdLines: exports_external.number().int().positive().default(defaultThresholds.agentsMdLines),
   claudeMdLines: exports_external.number().int().positive().default(defaultThresholds.claudeMdLines),
   agents: exports_external.number().int().positive().default(defaultThresholds.agents)
-});
+}).strict();
 var configSchema = exports_external.object({
   skillPaths: exports_external.array(exports_external.string()).default(defaultConfig.skillPaths),
   mcpPaths: exports_external.array(exports_external.string()).default(defaultConfig.mcpPaths),
@@ -11597,7 +11682,7 @@ var configSchema = exports_external.object({
   includeGlobal: exports_external.boolean().default(false),
   requireLock: exports_external.boolean().default(false),
   thresholds: thresholdsSchema.default(defaultThresholds)
-});
+}).strict();
 
 // src/config/load.ts
 function loadConfig(root, configPath) {
@@ -11617,9 +11702,16 @@ function loadConfig(root, configPath) {
 }
 
 // src/discover/index.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { isAbsolute, join as join2, resolve } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { join as join8, resolve as resolve3 } from "node:path";
+
+// src/discover/agents.ts
+import { existsSync as existsSync3, readdirSync, statSync } from "node:fs";
+import { join as join3 } from "node:path";
+
+// src/discover/shared.ts
+import { closeSync, existsSync as existsSync2, openSync, readFileSync as readFileSync2, readSync } from "node:fs";
+import { join as join2, resolve } from "node:path";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -11667,18 +11759,40 @@ var $stringify = publicApi.stringify;
 var $visit = visit.visit;
 var $visitAsync = visit.visitAsync;
 
-// src/discover/index.ts
+// src/discover/shared.ts
 var POLICY_CAP = 1e5;
 var SKILL_MD_CAP = 65536;
+function readCapped(path, cap) {
+  const fd = openSync(path, "r");
+  try {
+    const buf = Buffer.allocUnsafe(cap + 1);
+    const bytes = readSync(fd, buf, 0, cap + 1, 0);
+    return { buf: buf.subarray(0, bytes), truncated: bytes > cap };
+  } finally {
+    closeSync(fd);
+  }
+}
+var AGENT_CONFIG_SIGNALS = [
+  ".claude",
+  ".agents",
+  ".mcp.json",
+  "mcp.json",
+  "AGENTS.md",
+  "CLAUDE.md",
+  "skills-lock.json"
+];
+function hasAgentConfigSignal(dir) {
+  return AGENT_CONFIG_SIGNALS.some((name) => existsSync2(join2(dir, name)));
+}
 function resolveRoot(startDir) {
   let dir = resolve(startDir);
   for (;; ) {
-    if (existsSync2(join2(dir, "package.json"))) {
+    if (existsSync2(join2(dir, "package.json")) || hasAgentConfigSignal(dir)) {
       return dir;
     }
     const parent = resolve(dir, "..");
     if (parent === dir) {
-      throw new Error(`No package.json found walking up from ${resolve(startDir)}`);
+      throw new Error(`No package.json or agent configuration found walking up from ${resolve(startDir)}`);
     }
     dir = parent;
   }
@@ -11706,25 +11820,6 @@ function readJsonConfig(path, errors3) {
     return;
   }
 }
-var BUNDLED = "scripts|references|assets|templates|examples";
-var REFERENCE_RE = new RegExp(`(?<![\\w/.-])(?:\\./)?((?:${BUNDLED})/[A-Za-z0-9_./-]+\\.[A-Za-z0-9]{1,10})(?![A-Za-z0-9_.-])`, "g");
-var FENCE_BLOCK = /^[ \t]*(`{3,}|~{3,})[^\n]*\n[\s\S]*?(?:^[ \t]*\1[ \t]*$|$)/gm;
-var INLINE_CODE = /`[^`\n]*`/g;
-var URLS = /\b[a-z][a-z0-9+.-]*:\/\/\S+/gi;
-function skillReferences(body) {
-  const prose = body.replace(FENCE_BLOCK, "").replace(INLINE_CODE, "").replace(URLS, "");
-  const out = [];
-  const seen = new Set;
-  for (const match of prose.matchAll(REFERENCE_RE)) {
-    const path = match[1];
-    if (path === undefined || seen.has(path)) {
-      continue;
-    }
-    seen.add(path);
-    out.push(path);
-  }
-  return out;
-}
 function scalar(value) {
   if (typeof value === "string") {
     const trimmed = value.trim();
@@ -11739,14 +11834,17 @@ function readFrontmatter(skillMdPath, errors3) {
   let text;
   let truncated = false;
   try {
-    const buf = readFileSync2(skillMdPath);
-    truncated = buf.length > SKILL_MD_CAP;
-    text = buf.subarray(0, SKILL_MD_CAP).toString("utf8");
+    const result = readCapped(skillMdPath, SKILL_MD_CAP);
+    truncated = result.truncated;
+    text = result.buf.subarray(0, SKILL_MD_CAP).toString("utf8");
     if (text.charCodeAt(0) === 65279) {
       text = text.slice(1);
     }
     text = text.replace(/\r\n/g, `
 `);
+    if (truncated) {
+      errors3.push({ path: skillMdPath, kind: "truncated", detail: `file exceeds ${SKILL_MD_CAP} byte scan cap` });
+    }
   } catch (err) {
     errors3.push({
       path: skillMdPath,
@@ -11803,23 +11901,12 @@ function readFrontmatter(skillMdPath, errors3) {
   }
   return out;
 }
-function brokenReferences(body, skillDir, root) {
-  const isFile = (p) => {
-    try {
-      return statSync(p).isFile();
-    } catch {
-      return false;
-    }
-  };
-  return skillReferences(body).filter((rel) => !isFile(join2(skillDir, rel)) && !isFile(join2(root, rel)));
-}
-function discoverSkillsInDir(dir, source, errors3, root) {
-  if (!existsSync2(dir)) {
-    return [];
-  }
+
+// src/discover/agents.ts
+function agentFiles(dir, errors3) {
   let entries;
   try {
-    entries = readdirSync(dir);
+    entries = readdirSync(dir, { withFileTypes: true }).map((e) => e.isDirectory() ? `${e.name}/` : e.name);
   } catch (err) {
     errors3.push({
       path: dir,
@@ -11828,144 +11915,66 @@ function discoverSkillsInDir(dir, source, errors3, root) {
     });
     return [];
   }
-  const skills = [];
-  for (const name of entries) {
-    if (name.startsWith(".") || name === "node_modules") {
+  const out = [];
+  for (const entry of entries) {
+    if (entry.startsWith(".")) {
       continue;
     }
-    const skillDir = join2(dir, name);
-    let st;
-    try {
-      st = statSync(skillDir);
-    } catch {
+    if (entry.endsWith("/")) {
+      out.push(...agentFiles(join3(dir, entry.slice(0, -1)), errors3).map((p) => join3(entry.slice(0, -1), p)));
       continue;
     }
-    if (!st.isDirectory()) {
+    out.push(entry);
+  }
+  return out;
+}
+function discoverAgents(root, errors3) {
+  const dir = join3(root, ".claude", "agents");
+  if (!existsSync3(dir)) {
+    return [];
+  }
+  const entries = agentFiles(dir, errors3);
+  const facts = [];
+  for (const name of entries) {
+    if (!name.endsWith(".md")) {
       continue;
     }
-    const skillMd = join2(skillDir, "SKILL.md");
-    let dirReadable = true;
+    const filePath = join3(dir, name);
     try {
-      readdirSync(skillDir);
-    } catch (err) {
-      dirReadable = false;
-      errors3.push({
-        path: skillDir,
-        kind: "unreadable",
-        detail: err instanceof Error ? err.message : String(err)
-      });
+      const st = statSync(filePath);
+      if (!st.isFile()) {
+        continue;
+      }
+    } catch {
+      continue;
     }
-    const hasSkillMd = dirReadable && existsSync2(skillMd);
-    const fm = hasSkillMd ? readFrontmatter(skillMd, errors3) : { hasFrontmatter: false };
+    const fm = readFrontmatter(filePath, errors3);
     const fact = {
-      id: name,
-      path: skillDir,
-      source,
-      hasSkillMd,
+      name: name.slice(0, -".md".length),
+      path: filePath,
       hasFrontmatter: fm.hasFrontmatter
     };
-    if (fm.unreadable === true || !dirReadable) {
+    if (fm.unreadable === true) {
       fact.unreadable = true;
     }
     if (fm.unparseable === true) {
       fact.unparseableFrontmatter = true;
     }
-    if (fm.body !== undefined) {
-      const broken = brokenReferences(fm.body, skillDir, root);
-      if (broken.length > 0) {
-        fact.brokenReferences = broken;
-      }
-    }
-    if (fm.description !== undefined) {
-      fact.description = fm.description;
-    }
     if (fm.name !== undefined) {
       fact.frontmatterName = fm.name;
     }
-    skills.push(fact);
-  }
-  return skills;
-}
-function parseMcpServers(raw, filePath, errors3) {
-  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
-    errors3.push({
-      path: filePath,
-      kind: "unexpected-shape",
-      detail: "MCP config root is not a JSON object"
-    });
-    return [];
-  }
-  const obj = raw;
-  let servers;
-  if ("mcpServers" in obj && obj.mcpServers !== null && typeof obj.mcpServers === "object" && !Array.isArray(obj.mcpServers)) {
-    servers = obj.mcpServers;
-  } else if (!("mcpServers" in obj) && Object.keys(obj).length > 0 && Object.values(obj).every((v) => v !== null && typeof v === "object" && !Array.isArray(v) && (("command" in v) || ("url" in v) || ("type" in v)))) {
-    servers = obj;
-  } else {
-    errors3.push({
-      path: filePath,
-      kind: "unexpected-shape",
-      detail: "no usable `mcpServers` object and the root is not a server map"
-    });
-    return [];
-  }
-  const facts = [];
-  for (const [name, value] of Object.entries(servers)) {
-    let hasCommand = false;
-    let hasUrl = false;
-    let transport;
-    const literalEnvKeys = [];
-    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-      const entry = value;
-      hasCommand = typeof entry.command === "string" && entry.command.length > 0;
-      hasUrl = typeof entry.url === "string" && entry.url.length > 0;
-      if (typeof entry.type === "string" && entry.type.length > 0) {
-        transport = entry.type;
-      }
-      const env = entry.env;
-      if (env !== null && typeof env === "object" && !Array.isArray(env)) {
-        for (const [key, val] of Object.entries(env)) {
-          if (typeof val === "string" && val.length > 0 && !val.includes("${") && !val.startsWith("$") && /(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL)S?$/i.test(key)) {
-            literalEnvKeys.push(key);
-          }
-        }
-      }
-    }
-    facts.push({
-      name,
-      path: filePath,
-      hasCommand,
-      hasUrl,
-      ...transport === undefined ? {} : { transport },
-      literalEnvKeys,
-      raw: JSON.stringify(value)
-    });
-  }
-  return facts;
-}
-function discoverMcp(root, mcpPaths, errors3) {
-  const facts = [];
-  const seen = new Set;
-  for (const rel of mcpPaths) {
-    const filePath = join2(root, rel);
-    if (!existsSync2(filePath)) {
-      continue;
-    }
-    const raw = readJsonConfig(filePath, errors3);
-    if (raw === undefined) {
-      continue;
-    }
-    for (const fact of parseMcpServers(raw, filePath, errors3)) {
-      const key = `${fact.name}@${fact.path}`;
-      if (seen.has(key)) {
-        continue;
-      }
-      seen.add(key);
-      facts.push(fact);
+    if (fm.description !== undefined) {
+      fact.description = fm.description;
     }
+    facts.push(fact);
   }
   return facts;
 }
+
+// src/discover/hooks.ts
+import { existsSync as existsSync4, statSync as statSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, join as join4 } from "node:path";
 var INTERPRETERS = /^(?:bash|sh|zsh|python3?|node|bun|deno)$/;
 var INLINE_CODE_FLAGS = /^-(?:e|p|c)$/;
 var SHELL_METACHARS = /[|;&`]|\$\(|\|\||&&/;
@@ -11981,7 +11990,9 @@ function hookScriptPath(command) {
   const unquote = (t) => t.startsWith('"') && t.endsWith('"') || t.startsWith("'") && t.endsWith("'") ? t.slice(1, -1) : t;
   let i = 0;
   const first = unquote(tokens[0]);
+  let interpreted = false;
   if (INTERPRETERS.test(first)) {
+    interpreted = true;
     i = 1;
     while (i < tokens.length) {
       const flag = unquote(tokens[i]);
@@ -11995,7 +12006,7 @@ function hookScriptPath(command) {
     }
   }
   const candidate = tokens[i] === undefined ? undefined : unquote(tokens[i]);
-  if (candidate === undefined || !candidate.includes("/")) {
+  if (candidate === undefined || !candidate.includes("/") && !(interpreted && /\.(?:js|mjs|cjs|ts|py|sh|bash|zsh)$/i.test(candidate))) {
     return;
   }
   if (/^[A-Za-z]:[/\\]/.test(candidate)) {
@@ -12016,21 +12027,25 @@ function resolveHookScript(root, raw) {
   }
   let expanded = extracted;
   if (expanded.startsWith("~/")) {
-    expanded = join2(homedir(), expanded.slice(2));
+    expanded = join4(homedir(), expanded.slice(2));
   } else if (expanded.startsWith("$")) {
     expanded = expanded.replace(/^\$(?:CLAUDE_PROJECT_DIR|\{CLAUDE_PROJECT_DIR\})\/?/, "");
   }
-  const abs = isAbsolute(expanded) ? expanded : join2(root, expanded);
-  return { scriptPath: extracted, exists: existsSync2(abs) };
+  const abs = isAbsolute(expanded) ? expanded : join4(root, expanded);
+  try {
+    return { scriptPath: extracted, exists: statSync2(abs).isFile() };
+  } catch {
+    return { scriptPath: extracted, exists: false };
+  }
 }
 function discoverHooks(root, errors3) {
   const files = [
-    join2(root, ".claude", "settings.json"),
-    join2(root, ".claude", "settings.local.json")
+    join4(root, ".claude", "settings.json"),
+    join4(root, ".claude", "settings.local.json")
   ];
   const facts = [];
   for (const filePath of files) {
-    if (!existsSync2(filePath)) {
+    if (!existsSync4(filePath)) {
       continue;
     }
     const raw = readJsonConfig(filePath, errors3);
@@ -12058,6 +12073,25 @@ function discoverHooks(root, errors3) {
       continue;
     }
     for (const [event, groups] of Object.entries(hooks)) {
+      const malformed = !Array.isArray(groups) || groups.some((group) => {
+        if (group === null || typeof group !== "object" || Array.isArray(group)) {
+          return true;
+        }
+        const inner = group.hooks;
+        if (!Array.isArray(inner))
+          return true;
+        return inner.some((entry) => {
+          if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+            return true;
+          }
+          const item = entry;
+          return item.command !== undefined && (typeof item.command !== "string" || item.command.length === 0) || item.type === "command" && typeof item.command !== "string";
+        });
+      });
+      if (malformed) {
+        errors3.push({ path: filePath, kind: "unexpected-shape", detail: `invalid hook groups for ${event}` });
+        continue;
+      }
       const commands = collectHookCommands(groups);
       if (commands.length === 0) {
         facts.push({ name: event, path: filePath, event });
@@ -12098,87 +12132,160 @@ function collectHookCommands(groups) {
         out.push(command);
       }
     }
-  }
-  return out;
-}
-function agentFiles(dir, errors3) {
-  let entries;
-  try {
-    entries = readdirSync(dir, { withFileTypes: true }).map((e) => e.isDirectory() ? `${e.name}/` : e.name);
-  } catch (err) {
-    errors3.push({
-      path: dir,
-      kind: "unreadable",
-      detail: err instanceof Error ? err.message : String(err)
+  }
+  return out;
+}
+
+// src/discover/mcp.ts
+import { existsSync as existsSync5, statSync as statSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { isAbsolute as isAbsolute2, join as join5 } from "node:path";
+var SHELL_METACHARS2 = /[|;&`]|\$\(|\|\||&&|\s/;
+function mcpCommandPath(command) {
+  const trimmed = command.trim();
+  if (trimmed.length === 0 || SHELL_METACHARS2.test(trimmed)) {
+    return;
+  }
+  if (/^[A-Za-z]:[/\\]/.test(trimmed)) {
+    return;
+  }
+  if (trimmed.startsWith("$")) {
+    return /^\$(?:CLAUDE_PROJECT_DIR\b|\{CLAUDE_PROJECT_DIR\})/.test(trimmed) ? trimmed : undefined;
+  }
+  if (trimmed.startsWith("/") || trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith("~/") || trimmed.startsWith(".")) {
+    return trimmed;
+  }
+  if (trimmed.includes("/")) {
+    return trimmed;
+  }
+  return;
+}
+function resolveMcpCommand(root, raw) {
+  const extracted = mcpCommandPath(raw);
+  if (extracted === undefined) {
+    return;
+  }
+  let expanded = extracted;
+  if (expanded.startsWith("~/")) {
+    expanded = join5(homedir2(), expanded.slice(2));
+  } else if (expanded.startsWith("$")) {
+    expanded = expanded.replace(/^\$(?:CLAUDE_PROJECT_DIR|\{CLAUDE_PROJECT_DIR\})\/?/, "");
+  }
+  const abs = isAbsolute2(expanded) ? expanded : join5(root, expanded);
+  try {
+    return { command: extracted, exists: statSync3(abs).isFile() };
+  } catch {
+    return { command: extracted, exists: false };
+  }
+}
+function parseMcpServers(raw, filePath, root, errors3) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    errors3.push({
+      path: filePath,
+      kind: "unexpected-shape",
+      detail: "MCP config root is not a JSON object"
+    });
+    return [];
+  }
+  const obj = raw;
+  let servers;
+  if ("mcpServers" in obj && obj.mcpServers !== null && typeof obj.mcpServers === "object" && !Array.isArray(obj.mcpServers)) {
+    servers = obj.mcpServers;
+  } else if (!("mcpServers" in obj) && Object.keys(obj).length > 0 && Object.values(obj).every((v) => v !== null && typeof v === "object" && !Array.isArray(v) && (("command" in v) || ("url" in v) || ("type" in v)))) {
+    servers = obj;
+  } else {
+    errors3.push({
+      path: filePath,
+      kind: "unexpected-shape",
+      detail: "no usable `mcpServers` object and the root is not a server map"
+    });
+    return [];
+  }
+  const facts = [];
+  for (const [name, value] of Object.entries(servers)) {
+    let hasCommand = false;
+    let hasUrl = false;
+    let command;
+    let commandExists;
+    let transport;
+    const literalEnvKeys = [];
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      const entry = value;
+      hasCommand = typeof entry.command === "string" && entry.command.length > 0;
+      if (typeof entry.command === "string" && entry.command.length > 0) {
+        command = entry.command;
+        const resolved = resolveMcpCommand(root, entry.command);
+        if (resolved !== undefined) {
+          commandExists = resolved.exists;
+        }
+      }
+      hasUrl = typeof entry.url === "string" && entry.url.length > 0;
+      if (typeof entry.type === "string" && entry.type.length > 0) {
+        transport = entry.type;
+      }
+      const env = entry.env;
+      if (env !== null && typeof env === "object" && !Array.isArray(env)) {
+        for (const [key, val] of Object.entries(env)) {
+          if (typeof val === "string" && val.length > 0 && !/\$\{[A-Za-z_][A-Za-z0-9_]*(?::-[^}]*)?\}/.test(val) && /(?:TOKEN|SECRET|KEY|PASSWORD|PASSWD|CREDENTIAL)S?$/i.test(key)) {
+            literalEnvKeys.push(key);
+          }
+        }
+      }
+    }
+    facts.push({
+      name,
+      path: filePath,
+      hasCommand,
+      hasUrl,
+      ...command === undefined ? {} : { command },
+      ...commandExists === undefined ? {} : { commandExists },
+      ...transport === undefined ? {} : { transport },
+      literalEnvKeys,
+      raw: JSON.stringify(value)
     });
-    return [];
-  }
-  const out = [];
-  for (const entry of entries) {
-    if (entry.startsWith(".")) {
-      continue;
-    }
-    if (entry.endsWith("/")) {
-      out.push(...agentFiles(join2(dir, entry.slice(0, -1)), errors3).map((p) => join2(entry.slice(0, -1), p)));
-      continue;
-    }
-    out.push(entry);
   }
-  return out;
+  return facts;
 }
-function discoverAgents(root, errors3) {
-  const dir = join2(root, ".claude", "agents");
-  if (!existsSync2(dir)) {
-    return [];
-  }
-  const entries = agentFiles(dir, errors3);
+function discoverMcp(root, mcpPaths, errors3) {
   const facts = [];
-  for (const name of entries) {
-    if (!name.endsWith(".md")) {
+  const seen = new Set;
+  for (const rel of mcpPaths) {
+    const filePath = join5(root, rel);
+    if (!existsSync5(filePath)) {
       continue;
     }
-    const filePath = join2(dir, name);
-    try {
-      const st = statSync(filePath);
-      if (!st.isFile()) {
-        continue;
-      }
-    } catch {
+    const raw = readJsonConfig(filePath, errors3);
+    if (raw === undefined) {
       continue;
     }
-    const fm = readFrontmatter(filePath, errors3);
-    const fact = {
-      name: name.slice(0, -".md".length),
-      path: filePath,
-      hasFrontmatter: fm.hasFrontmatter
-    };
-    if (fm.unreadable === true) {
-      fact.unreadable = true;
-    }
-    if (fm.unparseable === true) {
-      fact.unparseableFrontmatter = true;
-    }
-    if (fm.name !== undefined) {
-      fact.frontmatterName = fm.name;
-    }
-    if (fm.description !== undefined) {
-      fact.description = fm.description;
+    for (const fact of parseMcpServers(raw, filePath, root, errors3)) {
+      const key = `${fact.name}@${fact.path}`;
+      if (seen.has(key)) {
+        continue;
+      }
+      seen.add(key);
+      facts.push(fact);
     }
-    facts.push(fact);
   }
   return facts;
 }
+
+// src/discover/policy.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join6 } from "node:path";
 function discoverPolicyFiles(root, policyFiles, errors3) {
   const out = [];
   for (const rel of policyFiles) {
-    const filePath = join2(root, rel);
-    if (!existsSync2(filePath)) {
+    const filePath = join6(root, rel);
+    if (!existsSync6(filePath)) {
       continue;
     }
     try {
-      const buf = readFileSync2(filePath);
-      const text = buf.subarray(0, POLICY_CAP).toString("utf8");
+      const result = readCapped(filePath, POLICY_CAP);
+      const text = result.buf.subarray(0, POLICY_CAP).toString("utf8");
       out.push({ path: filePath, text });
+      if (result.truncated)
+        errors3.push({ path: filePath, kind: "truncated", detail: `file exceeds ${POLICY_CAP} byte scan cap` });
     } catch (err) {
       errors3.push({
         path: filePath,
@@ -12190,13 +12297,13 @@ function discoverPolicyFiles(root, policyFiles, errors3) {
   return out;
 }
 function discoverSkillsLock(root, errors3) {
-  const filePath = join2(root, "skills-lock.json");
-  if (!existsSync2(filePath)) {
+  const filePath = join6(root, "skills-lock.json");
+  if (!existsSync6(filePath)) {
     return { locked: [], present: false };
   }
   const raw = readJsonConfig(filePath, errors3);
   if (raw === undefined) {
-    return { locked: [], present: true };
+    return { locked: [], present: true, invalid: true };
   }
   if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
     errors3.push({
@@ -12204,7 +12311,7 @@ function discoverSkillsLock(root, errors3) {
       kind: "unexpected-shape",
       detail: "skills-lock.json is not a JSON object"
     });
-    return { locked: [], present: true };
+    return { locked: [], present: true, invalid: true };
   }
   const skills = raw.skills;
   if (skills === null || typeof skills !== "object" || Array.isArray(skills)) {
@@ -12213,7 +12320,7 @@ function discoverSkillsLock(root, errors3) {
       kind: "unexpected-shape",
       detail: "skills-lock.json has no `skills` object"
     });
-    return { locked: [], present: true };
+    return { locked: [], present: true, invalid: true };
   }
   const locked = [];
   for (const [id, value] of Object.entries(skills)) {
@@ -12234,50 +12341,219 @@ function discoverSkillsLock(root, errors3) {
   }
   return { locked, present: true };
 }
+
+// src/discover/skills.ts
+import { existsSync as existsSync7, readdirSync as readdirSync2, statSync as statSync4 } from "node:fs";
+import { join as join7, resolve as resolve2 } from "node:path";
+var BUNDLED = "scripts|references|assets|templates|examples";
+var REFERENCE_RE = new RegExp(`(?<![\\w/.-])(?:\\./)?((?:${BUNDLED})/[A-Za-z0-9_./-]+\\.[A-Za-z0-9]{1,10})(?![A-Za-z0-9_.-])`, "g");
+var FENCE_BLOCK = /^[ \t]*(`{3,}|~{3,})[^\n]*\n[\s\S]*?(?:^[ \t]*\1[ \t]*$|$)/gm;
+var INLINE_CODE = /`[^`\n]*`/g;
+var URLS = /\b[a-z][a-z0-9+.-]*:\/\/\S+/gi;
+function skillReferences(body) {
+  const prose = body.replace(FENCE_BLOCK, "").replace(INLINE_CODE, (code) => /(?:scripts|references|assets|templates|examples)\/[A-Za-z0-9_./-]+\.[A-Za-z0-9]{1,10}/.test(code) ? code : "").replace(URLS, "");
+  const out = [];
+  const seen = new Set;
+  for (const match of prose.matchAll(REFERENCE_RE)) {
+    const path = match[1];
+    if (path === undefined || seen.has(path)) {
+      continue;
+    }
+    seen.add(path);
+    out.push(path);
+  }
+  return out;
+}
+function brokenReferences(body, skillDir, root) {
+  const isFile = (p) => {
+    try {
+      return statSync4(p).isFile();
+    } catch {
+      return false;
+    }
+  };
+  return skillReferences(body).filter((rel) => !isFile(join7(skillDir, rel)) && !isFile(join7(root, rel)));
+}
+function discoverSkillsInDir(dir, source, errors3, root) {
+  if (!existsSync7(dir)) {
+    return [];
+  }
+  let entries;
+  try {
+    entries = readdirSync2(dir);
+  } catch (err) {
+    errors3.push({
+      path: dir,
+      kind: "unreadable",
+      detail: err instanceof Error ? err.message : String(err)
+    });
+    return [];
+  }
+  const skills = [];
+  const normalizedDir = dir.replaceAll("\\", "/");
+  const runtime = normalizedDir.includes("/.claude/skills") || normalizedDir.endsWith("/.claude/skills") ? "claude" : normalizedDir.includes("/.agents/skills") || normalizedDir.endsWith("/.agents/skills") ? "agents" : "unknown";
+  for (const name of entries) {
+    if (name.startsWith(".") || name === "node_modules") {
+      continue;
+    }
+    const skillDir = join7(dir, name);
+    let st;
+    try {
+      st = statSync4(skillDir);
+    } catch {
+      continue;
+    }
+    if (!st.isDirectory()) {
+      continue;
+    }
+    const skillMd = join7(skillDir, "SKILL.md");
+    let dirReadable = true;
+    try {
+      readdirSync2(skillDir);
+    } catch (err) {
+      dirReadable = false;
+      errors3.push({
+        path: skillDir,
+        kind: "unreadable",
+        detail: err instanceof Error ? err.message : String(err)
+      });
+    }
+    const hasSkillMd = dirReadable && existsSync7(skillMd);
+    const fm = hasSkillMd ? readFrontmatter(skillMd, errors3) : { hasFrontmatter: false };
+    const fact = {
+      id: name,
+      runtime,
+      path: skillDir,
+      source,
+      hasSkillMd,
+      hasFrontmatter: fm.hasFrontmatter
+    };
+    if (fm.unreadable === true || !dirReadable) {
+      fact.unreadable = true;
+    }
+    if (fm.unparseable === true) {
+      fact.unparseableFrontmatter = true;
+    }
+    if (fm.body !== undefined) {
+      const broken = brokenReferences(fm.body, skillDir, root);
+      if (broken.length > 0) {
+        fact.brokenReferences = broken;
+      }
+    }
+    if (fm.description !== undefined) {
+      fact.description = fm.description;
+    }
+    if (fm.name !== undefined) {
+      fact.frontmatterName = fm.name;
+    }
+    skills.push(fact);
+  }
+  return skills;
+}
+var NESTED_DISCOVERY_MAX_DEPTH = 8;
+var NESTED_DISCOVERY_SKIP = new Set([
+  ".git",
+  "node_modules",
+  ".next",
+  "dist",
+  "build",
+  "coverage",
+  "vendor"
+]);
+function discoverNestedClaudeSkills(root, configuredRoots, errors3, options = {}) {
+  const out = [];
+  const read = (dir) => {
+    options.onDirectoryRead?.();
+    try {
+      return readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      errors3.push({ path: dir, kind: "unreadable", detail: "could not read nested skill directories" });
+      return;
+    }
+  };
+  const inspectClaude = (dir) => {
+    const entries = read(dir);
+    if (entries === undefined)
+      return;
+    for (const entry of entries) {
+      if (!entry.isDirectory() || entry.name !== "skills")
+        continue;
+      const child = join7(dir, entry.name);
+      if (configuredRoots.has(resolve2(child)))
+        continue;
+      out.push(...discoverSkillsInDir(child, "project", errors3, root));
+    }
+  };
+  const walk = (dir, depth) => {
+    const entries = read(dir);
+    if (entries === undefined)
+      return;
+    for (const entry of entries) {
+      if (!entry.isDirectory() || NESTED_DISCOVERY_SKIP.has(entry.name))
+        continue;
+      if (entry.name.startsWith(".") && entry.name !== ".claude")
+        continue;
+      const child = join7(dir, entry.name);
+      if (entry.name === ".claude") {
+        inspectClaude(child);
+        continue;
+      }
+      if (depth >= NESTED_DISCOVERY_MAX_DEPTH)
+        continue;
+      walk(child, depth + 1);
+    }
+  };
+  walk(root, 0);
+  return out;
+}
+function disambiguateSkills(skills, root) {
+  const counts = new Map;
+  for (const skill of skills)
+    counts.set(skill.id, (counts.get(skill.id) ?? 0) + 1);
+  return skills.map((skill) => {
+    if ((counts.get(skill.id) ?? 0) < 2)
+      return skill;
+    const location = skill.source === "project" ? skill.path.slice(root.length + 1) : `global:${skill.path}`;
+    return { ...skill, instanceId: `${skill.id}@${location}` };
+  });
+}
+
+// src/discover/index.ts
 function discoverAgentSurface(root, config, opts) {
   const configErrors = [];
   const skills = [];
   for (const rel of config.skillPaths) {
-    skills.push(...discoverSkillsInDir(join2(root, rel), "project", configErrors, root));
+    skills.push(...discoverSkillsInDir(join8(root, rel), "project", configErrors, root));
   }
+  const configuredRoots = new Set(config.skillPaths.map((rel) => resolve3(root, rel)));
+  skills.push(...discoverNestedClaudeSkills(root, configuredRoots, configErrors, {
+    onDirectoryRead: opts.onNestedDirectoryRead
+  }));
   if (opts.includeGlobal) {
-    const home = homedir();
-    skills.push(...discoverSkillsInDir(join2(home, ".claude", "skills"), "global", configErrors, root));
-    skills.push(...discoverSkillsInDir(join2(home, ".codex", "skills"), "global", configErrors, root));
+    const home = homedir3();
+    skills.push(...discoverSkillsInDir(join8(home, ".claude", "skills"), "global", configErrors, root));
+    skills.push(...discoverSkillsInDir(join8(home, ".codex", "skills"), "global", configErrors, root));
   }
   const lock = discoverSkillsLock(root, configErrors);
   return {
-    skills: dedupeSkillsById(skills),
+    skills: disambiguateSkills(skills, root),
     agents: discoverAgents(root, configErrors),
     hooks: discoverHooks(root, configErrors),
     mcp: discoverMcp(root, config.mcpPaths, configErrors),
     policyFiles: discoverPolicyFiles(root, config.policyFiles, configErrors),
     lockedSkills: lock.locked,
     hasSkillsLock: lock.present,
+    skillsLockInvalid: lock.invalid,
     configErrors
   };
 }
-function dedupeSkillsById(skills) {
-  const byId = new Map;
-  for (const skill of skills) {
-    const existing = byId.get(skill.id);
-    if (!existing) {
-      byId.set(skill.id, skill);
-      continue;
-    }
-    if (existing.source === "global" && skill.source === "project") {
-      byId.set(skill.id, skill);
-    }
-  }
-  return [...byId.values()];
-}
 
 // src/facts/extract.ts
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync3 } from "node:fs";
+import { join as join9 } from "node:path";
 function readPackageJson(root, errors3) {
-  const path = join3(root, "package.json");
-  if (!existsSync3(path)) {
+  const path = join9(root, "package.json");
+  if (!existsSync8(path)) {
     return {};
   }
   let text;
@@ -12315,7 +12591,7 @@ function readPackageJson(root, errors3) {
   if (typeof obj.packageManager === "string") {
     pkg.packageManager = obj.packageManager;
   }
-  for (const field of ["dependencies", "devDependencies", "scripts"]) {
+  for (const field of ["dependencies", "devDependencies"]) {
     const raw2 = obj[field];
     const kept = stringEntries(raw2);
     if (kept === undefined) {
@@ -12337,6 +12613,19 @@ function readPackageJson(root, errors3) {
     }
     pkg[field] = kept.values;
   }
+  const scripts = obj.scripts;
+  if (scripts !== undefined) {
+    const kept = stringEntries(scripts);
+    if (kept === undefined) {
+      errors3.push({ path, kind: "unexpected-shape", detail: "scripts is not an object" });
+    } else if (kept.dropped > 0) {
+      errors3.push({
+        path,
+        kind: "unexpected-shape",
+        detail: `scripts: ${kept.dropped} entr${kept.dropped === 1 ? "y" : "ies"} ignored (value is not a string)`
+      });
+    }
+  }
   return pkg;
 }
 function stringEntries(value) {
@@ -12362,95 +12651,32 @@ function inferPackageManager(root, pkg) {
       return prefix;
     }
   }
-  if (existsSync3(join3(root, "bun.lock")) || existsSync3(join3(root, "bun.lockb"))) {
+  if (existsSync8(join9(root, "bun.lock")) || existsSync8(join9(root, "bun.lockb"))) {
     return "bun";
   }
-  if (existsSync3(join3(root, "pnpm-lock.yaml"))) {
+  if (existsSync8(join9(root, "pnpm-lock.yaml"))) {
     return "pnpm";
   }
-  if (existsSync3(join3(root, "yarn.lock"))) {
+  if (existsSync8(join9(root, "yarn.lock"))) {
     return "yarn";
   }
-  if (existsSync3(join3(root, "package-lock.json"))) {
+  if (existsSync8(join9(root, "package-lock.json"))) {
     return "npm";
   }
   return "unknown";
 }
-function hasNextConfig(root) {
-  try {
-    const entries = readdirSync2(root);
-    return entries.some((name) => name === "next.config.js" || name === "next.config.mjs" || name === "next.config.cjs" || name === "next.config.ts" || name === "next.config.mts");
-  } catch {
-    return false;
-  }
-}
-function readNextConfigText(root) {
-  const candidates = [
-    "next.config.ts",
-    "next.config.mjs",
-    "next.config.js",
-    "next.config.mts",
-    "next.config.cjs"
-  ];
-  for (const name of candidates) {
-    const path = join3(root, name);
-    if (!existsSync3(path)) {
-      continue;
-    }
-    try {
-      return readFileSync3(path, "utf8");
-    } catch {
-      return;
-    }
-  }
-  return;
-}
-function extractConfigs(root, deps, devDeps, scripts) {
-  const configs = {};
-  if (existsSync3(join3(root, "components.json"))) {
-    configs.shadcn = true;
-  }
-  if (existsSync3(join3(root, "biome.json")) || existsSync3(join3(root, "biome.jsonc"))) {
-    configs.biome = true;
-  }
-  const allDeps = { ...deps, ...devDeps };
-  const hasUltraciteDep = "ultracite" in allDeps;
-  const hasUltraciteScript = Object.values(scripts).some((s) => s.includes("ultracite"));
-  if (hasUltraciteDep || hasUltraciteScript) {
-    configs.ultracite = true;
-  }
-  if ("next" in allDeps) {
-    const next = {};
-    if (hasNextConfig(root)) {
-      next.appRouter = true;
-      const text = readNextConfigText(root);
-      if (text !== undefined) {
-        if (/\bcacheComponents\s*:\s*true\b/.test(text) || /\bcacheComponents\s*:\s*!0\b/.test(text)) {
-          next.cacheComponents = true;
-        } else if (/\bcacheComponents\s*:\s*false\b/.test(text) || /\bcacheComponents\s*:\s*!1\b/.test(text)) {
-          next.cacheComponents = false;
-        }
-      }
-    }
-    configs.next = next;
-  }
-  return configs;
-}
 function extractFacts(root, config, opts) {
   const includeGlobal = opts?.includeGlobal ?? config.includeGlobal;
   const packageErrors = [];
   const pkg = readPackageJson(root, packageErrors);
   const dependencies = { ...pkg.dependencies ?? {} };
   const devDependencies = { ...pkg.devDependencies ?? {} };
-  const scripts = { ...pkg.scripts ?? {} };
   const surface = discoverAgentSurface(root, config, { includeGlobal });
   return {
     root,
     packageManager: inferPackageManager(root, pkg),
     dependencies,
     devDependencies,
-    scripts,
-    configs: extractConfigs(root, dependencies, devDependencies, scripts),
     skills: surface.skills,
     agents: surface.agents,
     hooks: surface.hooks,
@@ -12458,6 +12684,7 @@ function extractFacts(root, config, opts) {
     policyFiles: surface.policyFiles,
     lockedSkills: surface.lockedSkills,
     hasSkillsLock: surface.hasSkillsLock,
+    skillsLockInvalid: surface.skillsLockInvalid,
     configErrors: [...packageErrors, ...surface.configErrors]
   };
 }
@@ -12487,7 +12714,7 @@ function compareAction(a, b) {
 
 // src/analyze.ts
 function analyze(options = {}) {
-  const requested = resolve2(options.dir ?? process.cwd());
+  const requested = resolve4(options.dir ?? process.cwd());
   const root = resolveRoot(requested);
   const loaded = loadConfig(root, options.configPath);
   const config = {
@@ -12508,7 +12735,7 @@ function analyze(options = {}) {
       agents: config.thresholds.agents,
       mcp: config.thresholds.mcp
     }
-  }).filter((f) => !ignoredRules.has(f.ruleId) && !(f.subject.startsWith("skill:") && ignoredSkills.has(f.subject.slice("skill:".length))));
+  }).filter((f) => !ignoredRules.has(f.ruleId) && !(f.subject.startsWith("skill:") && ignoredSkills.has(f.subject.slice("skill:".length).split("@", 1)[0] ?? "")));
   const ignoredFindings = new Set(config.ignoreFindings);
   const findings = sortFindings(structural.filter((f) => !ignoredFindings.has(f.id)));
   return {
@@ -12741,16 +12968,13 @@ function shouldColour(args) {
 }
 
 // src/report/text.ts
-var ACTION_LABEL = {
-  keep: "KEEP",
-  delete: "DELETE",
-  add: "ADD",
-  refresh: "REFRESH",
-  warn: "WARN",
-  drift: "DRIFT"
+var SEVERITY_LABEL = {
+  error: "ERROR",
+  warning: "WARN",
+  info: "INFO"
 };
-function actionColumn(action) {
-  return ACTION_LABEL[action].padEnd(7, " ");
+function severityColumn(severity) {
+  return SEVERITY_LABEL[severity].padEnd(7, " ");
 }
 function renderText(args) {
   const { version, facts, verbose, quiet } = args;
@@ -12775,7 +12999,7 @@ function renderText(args) {
   lines.push(ink.dim(`Scanned: ${formatStack(facts)}`));
   lines.push("");
   for (const group of groupByRule(visible)) {
-    lines.push(...formatGroup(group, facts.root, ink));
+    lines.push(...formatGroup(group, facts.root, ink, verbose));
     lines.push("");
   }
   lines.push(summary);
@@ -12830,62 +13054,78 @@ function groupByRule(findings) {
 function shortPath(value, root) {
   return value.split(`${root}/`).join("");
 }
-var ACTION_TONE = {
-  delete: "red",
-  warn: "yellow",
-  drift: "yellow",
-  add: "green",
-  refresh: "green"
+var SEVERITY_TONE = {
+  error: "red",
+  warning: "yellow",
+  info: undefined
 };
-function formatGroup(group, root, ink) {
+function formatGroup(group, root, ink, verbose) {
   const first = group[0];
   const count = group.length;
   const out = [];
-  const tone = ACTION_TONE[first.action];
-  const label = actionColumn(first.action);
+  const tone = SEVERITY_TONE[first.severity];
+  const label = severityColumn(first.severity);
   out.push(`${tone === undefined ? ink.dim(label) : ink.tone(tone, label)} ${ink.dim(`rule:${safe(first.ruleId)}`)}${count > 1 ? ink.bold(`  ×${count}`) : ""}`);
-  out.push(`        ${safe(count === 1 ? first.message : ruleHeadline(first))}`);
+  out.push(`        ${safe(count === 1 ? first.message : groupHeadline(group))}`);
   for (const f of group) {
     const where = f.evidence.filter((e) => e.kind !== "count" && e.kind !== "threshold").map((e) => shortPath(e.value, root));
     const location = where.length > 0 ? where.join(" · ") : f.subject;
     out.push(ink.dim(`          ${safe(shortPath(location, root))}`));
+    if (verbose) {
+      out.push(ink.dim(`            id: ${safe(f.id)}`));
+    }
   }
   return out;
 }
-function ruleHeadline(f) {
-  const cut = f.message.indexOf(": ");
-  return cut === -1 ? f.message : f.message.slice(0, cut);
+function groupHeadline(group) {
+  const stripped = group.map((f) => {
+    const cut = f.message.indexOf(": ");
+    return cut === -1 ? f.message : f.message.slice(0, cut);
+  });
+  if (new Set(stripped).size === 1) {
+    return stripped[0];
+  }
+  const deEvented = stripped.map((s) => s.replace(/^[A-Za-z][A-Za-z0-9]* hook /, "Hook "));
+  if (new Set(deEvented).size === 1) {
+    return deEvented[0];
+  }
+  return `${group.length} findings`;
 }
 function countsLine(findings, verbose) {
-  const parts = actionParts(findings, verbose);
+  const parts = severityParts(findings, verbose);
   return parts.length === 0 ? "no findings" : parts.join(" · ");
 }
-function actionParts(findings, verbose) {
+function severityParts(findings, verbose) {
   const counts = {
-    keep: 0,
-    delete: 0,
-    add: 0,
-    refresh: 0,
-    warn: 0,
-    drift: 0
+    error: 0,
+    warning: 0,
+    info: 0
   };
   let infoHidden = 0;
   for (const f of findings) {
+    if (!verbose && f.action === "keep") {
+      continue;
+    }
     if (!verbose && f.severity === "info") {
       infoHidden += 1;
       continue;
     }
-    counts[f.action] += 1;
+    counts[f.severity] += 1;
   }
-  const order = ["delete", "add", "refresh", "drift", "warn", "keep"];
-  const parts = order.filter((action) => counts[action] > 0).map((action) => `${counts[action]} ${action}`);
+  const order = ["error", "warning", "info"];
+  const labels = {
+    error: "error",
+    warning: "warning",
+    info: "info"
+  };
+  const parts = order.filter((severity) => counts[severity] > 0).map((severity) => `${counts[severity]} ${labels[severity]}`);
   if (!verbose && infoHidden > 0) {
     parts.push(`${infoHidden} info hidden (--verbose)`);
   }
   return parts;
 }
 function formatSummary(findings, verbose, ink) {
-  const parts = actionParts(findings, verbose);
+  const parts = severityParts(findings, verbose);
   const points = score(findings);
   const scored = `score ${ink.tone(scoreTone(points), `${points}/100 ${scoreLabel(points)}`)}`;
   if (parts.length === 0) {
@@ -12895,7 +13135,7 @@ function formatSummary(findings, verbose, ink) {
 }
 
 // src/version.ts
-var VERSION = "0.4.0";
+var VERSION = "0.6.0";
 
 // src/commands/check.ts
 async function runCheck(options) {
@@ -12934,6 +13174,54 @@ async function runCheck(options) {
   };
 }
 
+// src/commands/demo.ts
+import {
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join10 } from "node:path";
+async function runDemo() {
+  const root = mkdtempSync(join10(tmpdir(), "agentscan-demo-"));
+  try {
+    const claude = join10(root, ".claude");
+    mkdirSync(claude, { recursive: true });
+    writeFileSync(join10(claude, "settings.json"), `${JSON.stringify({
+      hooks: {
+        PreToolUse: [
+          {
+            hooks: [
+              {
+                type: "command",
+                command: ".claude/hooks/guard-destructive-bash.js"
+              }
+            ]
+          }
+        ]
+      }
+    }, null, 2)}
+`, "utf8");
+    const result = await runCheck({
+      dir: root,
+      failOn: "never",
+      colour: false
+    });
+    const intro = `Demo fixture: PreToolUse hook points at a script that is not on disk.
+` + `This is the failure agentscan exists for — the agent starts normally; the guard does not.
+
+`;
+    return {
+      exitCode: 0,
+      stdout: intro + result.stdout,
+      stderr: ""
+    };
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
 // src/commands/explain.ts
 async function runExplain(findingId, options = {}) {
   const { findings } = analyze(options);
@@ -12974,12 +13262,12 @@ function formatExplain(f) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync4, writeFileSync } from "node:fs";
-import { join as join4, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync9, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join11, resolve as resolve5 } from "node:path";
 async function runInit(dir, options = {}) {
-  const root = resolve3(dir ?? process.cwd());
-  const path = join4(root, ".agentscanrc.json");
-  if (existsSync4(path) && !options.force) {
+  const root = resolve5(dir ?? process.cwd());
+  const path = join11(root, ".agentscanrc.json");
+  if (existsSync9(path) && !options.force) {
     return {
       exitCode: 2,
       stdout: "",
@@ -12989,7 +13277,7 @@ async function runInit(dir, options = {}) {
   }
   const body = `${JSON.stringify(defaultConfig, null, 2)}
 `;
-  writeFileSync(path, body, "utf8");
+  writeFileSync2(path, body, "utf8");
   return {
     exitCode: 0,
     stdout: `Wrote ${path}
@@ -13015,7 +13303,7 @@ async function runRulesCommand(options = {}) {
 // src/report/clipboard.ts
 import { spawn } from "node:child_process";
 import { accessSync, constants } from "node:fs";
-import { delimiter, join as join5 } from "node:path";
+import { delimiter, join as join12 } from "node:path";
 var TOOLS = [
   ["wl-copy"],
   ["xclip", "-selection", "clipboard"],
@@ -13024,15 +13312,15 @@ var TOOLS = [
   ["clip.exe"]
 ];
 var TIMEOUT_MS = 3000;
-function clipboardCandidates(onPath = (name) => resolve4(name) !== null) {
+function clipboardCandidates(onPath = (name) => resolve6(name) !== null) {
   return TOOLS.filter((t) => onPath(t[0])).map((t) => [...t]);
 }
-function resolve4(name) {
+function resolve6(name) {
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (dir.length === 0) {
       continue;
     }
-    const candidate = join5(dir, name);
+    const candidate = join12(dir, name);
     try {
       accessSync(candidate, constants.X_OK);
       return candidate;
@@ -13051,7 +13339,7 @@ async function copyToClipboard(text) {
   const failures = [];
   for (const argv of candidates) {
     const tool = argv[0];
-    const bin = resolve4(tool);
+    const bin = resolve6(tool);
     if (bin === null) {
       continue;
     }
@@ -13087,6 +13375,7 @@ function printHelp() {
 Usage:
   agentscan                            scan the current directory
   agentscan check [dir] [options]
+  agentscan demo                       one-shot fixture (no project required)
   agentscan explain <findingId> [dir]
   agentscan rules [dir]
   agentscan init [dir] [--force]
@@ -13252,6 +13541,16 @@ async function main(argv) {
         }
         return result.exitCode;
       }
+      case "demo": {
+        const result = await runDemo();
+        if (result.stderr.length > 0) {
+          process.stderr.write(result.stderr);
+        }
+        if (result.stdout.length > 0) {
+          process.stdout.write(result.stdout);
+        }
+        return result.exitCode;
+      }
       case "help":
         printHelp();
         return 0;