@cleocode/caamp 2026.5.83 → 2026.5.86

package/dist/{chunk-4W35AEYA.js → chunk-WXL7RPS4.js}

@@ -3,7 +3,7 @@ import {
   getPrimaryProvider,
   groupByInstructFile,
   injectAll
-} from "./chunk-OPUPNLUJ.js";
+} from "./chunk-PGETUTYZ.js";
 import {
   __export,
   getAgentsConfigPath,
@@ -16,7 +16,7 @@ import {
   resolveProviderConfigPath,
   resolveProviderProjectPath,
   resolveProviderSkillsDirs
-} from "./chunk-OCI4RYI5.js";
+} from "./chunk-H5YXR2DC.js";
 
 // src/core/logger.ts
 var verboseMode = false;
@@ -247,10 +247,28 @@ async function linkToAgent(canonicalPath, provider, skillName, isGlobal, project
     error: errors.join("; ") || `Provider ${provider.id} has no skills directory`
   };
 }
-async function installSkill(sourcePath, skillName, providers, isGlobal, projectDir) {
+function inferSkillSourceType(sourceUrl) {
+  if (!sourceUrl) return "user";
+  if (sourceUrl.startsWith("library:")) return "canonical";
+  if (sourceUrl.startsWith("@") || sourceUrl.includes("github.com") || sourceUrl.includes("gitlab.com") || sourceUrl.includes("://")) {
+    return "community";
+  }
+  return "user";
+}
+async function installSkill(sourcePath, skillName, providers, isGlobal, projectDir, options) {
   const errors = [];
   const linkedAgents = [];
   const canonicalPath = await installToCanonical(sourcePath, skillName);
+  if (options?.recordRow) {
+    const resolvedSourceUrl = options.sourceUrl ?? sourcePath;
+    const resolvedSourceType = options.sourceType ?? inferSkillSourceType(resolvedSourceUrl);
+    await options.recordRow({
+      name: skillName,
+      installPath: canonicalPath,
+      sourceUrl: resolvedSourceUrl,
+      sourceType: resolvedSourceType
+    });
+  }
   for (const provider of providers) {
     const result = await linkToAgent(canonicalPath, provider, skillName, isGlobal, projectDir);
     if (result.success) {
@@ -302,8 +320,8 @@ async function removeSkill(skillName, providers, isGlobal, projectDir) {
 }
 async function listCanonicalSkills() {
   if (!existsSync2(getCanonicalSkillsDir())) return [];
-  const { readdir: readdir3 } = await import("fs/promises");
-  const entries = await readdir3(getCanonicalSkillsDir(), { withFileTypes: true });
+  const { readdir: readdir4 } = await import("fs/promises");
+  const entries = await readdir4(getCanonicalSkillsDir(), { withFileTypes: true });
   return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => e.name);
 }
 
@@ -1088,7 +1106,7 @@ ${MARKER_END}`;
         task.signal.addEventListener("abort", onAbort, { once: true });
       }
     }
-    const exitPromise = new Promise((resolve) => {
+    const exitPromise = new Promise((resolve2) => {
       child.on("close", (exitCode, signal) => {
         flushStdoutBuffer(true);
         flushStderrBuffer(true);
@@ -1110,7 +1128,7 @@ ${MARKER_END}`;
         };
         Promise.allSettled(pendingWrites).then(() => {
           safeOnStream({ kind: "exit", subagentId, payload: result2 });
-          resolve(result2);
+          resolve2(result2);
         });
       });
       child.on("error", () => {
@@ -1839,11 +1857,11 @@ async function terminateSubagent(child, graceMs) {
   }
   const pollInterval = Math.min(25, Math.max(1, graceMs));
   const deadline = Date.now() + graceMs;
-  await new Promise((resolve) => {
+  await new Promise((resolve2) => {
     const timer = setInterval(() => {
       if (child.exitCode !== null || child.signalCode !== null) {
         clearInterval(timer);
-        resolve();
+        resolve2();
         return;
       }
       if (Date.now() >= deadline) {
@@ -1852,12 +1870,12 @@ async function terminateSubagent(child, graceMs) {
           child.kill("SIGKILL");
         } catch {
         }
-        resolve();
+        resolve2();
       }
     }, pollInterval);
     child.once("close", () => {
       clearInterval(timer);
-      resolve();
+      resolve2();
     });
   });
 }
@@ -2207,9 +2225,9 @@ function getNestedValue(obj, keyPath) {
   return current;
 }
 async function ensureDir(filePath) {
-  const { mkdir: mkdir5 } = await import("fs/promises");
-  const { dirname: dirname4 } = await import("path");
-  await mkdir5(dirname4(filePath), { recursive: true });
+  const { mkdir: mkdir6 } = await import("fs/promises");
+  const { dirname: dirname5 } = await import("path");
+  await mkdir6(dirname5(filePath), { recursive: true });
 }
 
 // src/core/formats/json.ts
@@ -2654,11 +2672,11 @@ function parseSource(input) {
   if (ghUrlMatch) {
     const owner = ghUrlMatch[1];
     const repo = ghUrlMatch[2];
-    const path = ghUrlMatch[4];
+    const path2 = ghUrlMatch[4];
     if (!owner || !repo) {
       return { type: "command", value: input, inferredName: inferName(input, "command") };
     }
-    const inferredName = path ? path.split("/").pop() ?? repo : repo;
+    const inferredName = path2 ? path2.split("/").pop() ?? repo : repo;
     return {
       type: "github",
       value: input,
@@ -2666,18 +2684,18 @@ function parseSource(input) {
       owner,
       repo,
       ref: ghUrlMatch[3],
-      path
+      path: path2
     };
   }
   const glUrlMatch = input.match(GITLAB_URL);
   if (glUrlMatch) {
     const owner = glUrlMatch[1];
     const repo = glUrlMatch[2];
-    const path = glUrlMatch[4];
+    const path2 = glUrlMatch[4];
     if (!owner || !repo) {
       return { type: "command", value: input, inferredName: inferName(input, "command") };
     }
-    const inferredName = path ? path.split("/").pop() ?? repo : repo;
+    const inferredName = path2 ? path2.split("/").pop() ?? repo : repo;
     return {
       type: "gitlab",
       value: input,
@@ -2685,7 +2703,7 @@ function parseSource(input) {
       owner,
       repo,
       ref: glUrlMatch[3],
-      path
+      path: path2
     };
   }
   if (HTTP_URL.test(input)) {
@@ -2706,18 +2724,18 @@ function parseSource(input) {
   if (ghShorthand && !NPM_SCOPED.test(input)) {
     const owner = ghShorthand[1];
     const repo = ghShorthand[2];
-    const path = ghShorthand[3];
+    const path2 = ghShorthand[3];
     if (!owner || !repo) {
       return { type: "command", value: input, inferredName: inferName(input, "command") };
     }
-    const inferredName = path ? path.split("/").pop() ?? repo : repo;
+    const inferredName = path2 ? path2.split("/").pop() ?? repo : repo;
     return {
       type: "github",
       value: `https://github.com/${owner}/${repo}`,
       inferredName,
       owner,
       repo,
-      path
+      path: path2
     };
   }
   const libraryMatch = input.match(LIBRARY_SKILL);
@@ -3163,14 +3181,14 @@ async function scanFile(filePath, rules) {
   return { file: filePath, findings, score, passed };
 }
 async function scanDirectory(dirPath) {
-  const { readdir: readdir3 } = await import("fs/promises");
-  const { join: join9 } = await import("path");
+  const { readdir: readdir4 } = await import("fs/promises");
+  const { join: join11 } = await import("path");
   if (!existsSync10(dirPath)) return [];
-  const entries = await readdir3(dirPath, { withFileTypes: true });
+  const entries = await readdir4(dirPath, { withFileTypes: true });
   const results = [];
   for (const entry of entries) {
     if (entry.isDirectory() || entry.isSymbolicLink()) {
-      const skillFile = join9(dirPath, entry.name, "SKILL.md");
+      const skillFile = join11(dirPath, entry.name, "SKILL.md");
       if (existsSync10(skillFile)) {
         results.push(await scanFile(skillFile));
       }
@@ -3233,7 +3251,7 @@ import { mkdir as mkdir4, open as open2, readFile as readFile6, rename as rename
 var LOCK_GUARD_PATH = `${LOCK_FILE_PATH}.lock`;
 var STALE_LOCK_MS = 5e3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 async function removeStaleLock() {
   try {
@@ -3431,6 +3449,759 @@ async function checkAllSkillUpdates() {
   return results;
 }
 
+// src/commands/skills/doctor-bridge.ts
+import { existsSync as existsSync12, lstatSync as lstatSync3, readdirSync, readlinkSync, realpathSync } from "fs";
+import { cp as cp4, mkdir as mkdir5, readdir as readdir2, rm as rm5, symlink as symlink3, unlink } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import * as path from "path";
+import pc from "picocolors";
+
+// src/core/lafs.ts
+import { randomUUID } from "crypto";
+import { resolveOutputFormat } from "@cleocode/lafs";
+function resolveFormat(options) {
+  return resolveOutputFormat({
+    jsonFlag: options.jsonFlag ?? false,
+    humanFlag: (options.humanFlag ?? false) || isHuman(),
+    projectDefault: options.projectDefault ?? "json"
+  }).format;
+}
+function buildEnvelope(operation, mvi, result, error, page = null, sessionId, warnings) {
+  return {
+    $schema: "https://lafs.dev/schemas/v1/envelope.schema.json",
+    _meta: {
+      specVersion: "1.0.0",
+      schemaVersion: "1.0.0",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      operation,
+      requestId: randomUUID(),
+      transport: "cli",
+      strict: true,
+      mvi,
+      contextVersion: 0,
+      ...sessionId && { sessionId },
+      ...warnings && warnings.length > 0 && { warnings }
+    },
+    success: error === null,
+    result,
+    error,
+    page
+  };
+}
+function emitError(operation, mvi, code, message, category, details = {}, exitCode = 1) {
+  const envelope = buildEnvelope(operation, mvi, null, {
+    code,
+    message,
+    category,
+    retryable: category === "TRANSIENT" || category === "RATE_LIMIT",
+    retryAfterMs: null,
+    details
+  });
+  console.error(JSON.stringify(envelope, null, 2));
+  process.exit(exitCode);
+}
+function emitJsonError(operation, mvi, code, message, category, details = {}) {
+  const envelope = buildEnvelope(operation, mvi, null, {
+    code,
+    message,
+    category,
+    retryable: category === "TRANSIENT" || category === "RATE_LIMIT",
+    retryAfterMs: null,
+    details
+  });
+  console.error(JSON.stringify(envelope, null, 2));
+}
+function outputSuccess(operation, mvi, result, page, sessionId, warnings) {
+  const envelope = buildEnvelope(operation, mvi, result, null, page ?? null, sessionId, warnings);
+  if (isQuiet() && !envelope.error) {
+    return;
+  }
+  console.log(JSON.stringify(envelope, null, 2));
+}
+function handleFormatError(error, operation, mvi, jsonFlag) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (jsonFlag) {
+    emitJsonError(operation, mvi, "E_FORMAT_CONFLICT", message, "VALIDATION");
+  } else {
+    console.error(message);
+  }
+  process.exit(1);
+}
+var ErrorCategories = {
+  VALIDATION: "VALIDATION",
+  AUTH: "AUTH",
+  PERMISSION: "PERMISSION",
+  NOT_FOUND: "NOT_FOUND",
+  CONFLICT: "CONFLICT",
+  RATE_LIMIT: "RATE_LIMIT",
+  TRANSIENT: "TRANSIENT",
+  INTERNAL: "INTERNAL",
+  CONTRACT: "CONTRACT",
+  MIGRATION: "MIGRATION"
+};
+var ErrorCodes = {
+  // Format errors
+  FORMAT_CONFLICT: "E_FORMAT_CONFLICT",
+  INVALID_JSON: "E_INVALID_JSON",
+  // Not found errors
+  SKILL_NOT_FOUND: "E_SKILL_NOT_FOUND",
+  PROVIDER_NOT_FOUND: "E_PROVIDER_NOT_FOUND",
+  MCP_SERVER_NOT_FOUND: "E_MCP_SERVER_NOT_FOUND",
+  FILE_NOT_FOUND: "E_FILE_NOT_FOUND",
+  // Validation errors
+  INVALID_INPUT: "E_INVALID_INPUT",
+  INVALID_CONSTRAINT: "E_INVALID_CONSTRAINT",
+  INVALID_FORMAT: "E_INVALID_FORMAT",
+  // Operation errors
+  INSTALL_FAILED: "E_INSTALL_FAILED",
+  // Skills federation gates (T9564 — Sphere B)
+  SKILL_TRUST_GATE_BLOCKED: "E_SKILL_TRUST_GATE_BLOCKED",
+  FEDERATION_UNKNOWN_SOURCE_INTERACTIVE_REQUIRED: "E_FEDERATION_UNKNOWN_SOURCE_INTERACTIVE_REQUIRED",
+  FEDERATION_CHECKSUM_MISMATCH: "E_FEDERATION_CHECKSUM_MISMATCH",
+  REMOVE_FAILED: "E_REMOVE_FAILED",
+  UPDATE_FAILED: "E_UPDATE_FAILED",
+  VALIDATION_FAILED: "E_VALIDATION_FAILED",
+  AUDIT_FAILED: "E_AUDIT_FAILED",
+  // System errors
+  NETWORK_ERROR: "E_NETWORK_ERROR",
+  FILE_SYSTEM_ERROR: "E_FILE_SYSTEM_ERROR",
+  PERMISSION_DENIED: "E_PERMISSION_DENIED",
+  INTERNAL_ERROR: "E_INTERNAL_ERROR"
+};
+
+// src/commands/skills/doctor-bridge.ts
+var AgentsSkillsRealDirError = class extends Error {
+  /** LAFS error code surfaced by the CLI. */
+  code = "E_AGENTS_SKILLS_REAL_DIR";
+  /** Resolved path of the offending real directory. */
+  agentsSkillsPath;
+  /** Number of immediate entries in the offending directory. */
+  entryCount;
+  /**
+   * Construct an `AgentsSkillsRealDirError`.
+   *
+   * @param agentsSkillsPath - Path to the real `~/.agents/skills` directory.
+   * @param entryCount - Number of entries inside the directory.
+   */
+  constructor(agentsSkillsPath, entryCount) {
+    super(
+      `Refusing to replace real directory at ${agentsSkillsPath} (${entryCount} entries). Pass --force to back up and bridge.`
+    );
+    this.name = "AgentsSkillsRealDirError";
+    this.agentsSkillsPath = agentsSkillsPath;
+    this.entryCount = entryCount;
+  }
+};
+function buildBackupTimestamp() {
+  const d = /* @__PURE__ */ new Date();
+  const pad = (n) => n.toString().padStart(2, "0");
+  return `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}-${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}`;
+}
+function resolveBridgePaths(homeRoot) {
+  return {
+    skillsRoot: path.join(homeRoot, ".cleo", "skills"),
+    bridgeTarget: path.join(homeRoot, ".claude", "skills", "agents-shared"),
+    bridgePath: path.join(homeRoot, ".agents", "skills"),
+    backupsRoot: path.join(homeRoot, ".cleo", "backups"),
+    claudeSkillsRoot: path.join(homeRoot, ".claude", "skills")
+  };
+}
+function listSkillDirs(skillsRoot) {
+  if (!existsSync12(skillsRoot)) return [];
+  const entries = readdirSync(skillsRoot, { withFileTypes: true });
+  return entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => e.name).filter((n) => !n.startsWith(".")).sort();
+}
+function symlinkPointsAt(linkPath, target) {
+  try {
+    const stat4 = lstatSync3(linkPath);
+    if (!stat4.isSymbolicLink()) return false;
+    const current = readlinkSync(linkPath);
+    const resolved = path.isAbsolute(current) ? current : path.resolve(path.dirname(linkPath), current);
+    return path.resolve(resolved) === path.resolve(target);
+  } catch {
+    return false;
+  }
+}
+async function ensureSymlink(linkPath, target, dryRun) {
+  if (dryRun) return;
+  await mkdir5(path.dirname(linkPath), { recursive: true });
+  if (existsSync12(linkPath)) {
+    try {
+      await unlink(linkPath);
+    } catch {
+    }
+  }
+  await symlink3(target, linkPath, "dir");
+}
+async function countEntries(dir) {
+  try {
+    const entries = await readdir2(dir);
+    return entries.length;
+  } catch {
+    return 0;
+  }
+}
+async function runDoctorBridge(options = {}) {
+  const homeRoot = options.homeDir ?? homedir3();
+  const force = options.force ?? false;
+  const dryRun = options.dryRun ?? false;
+  const { skillsRoot, bridgeTarget, bridgePath, backupsRoot, claudeSkillsRoot } = resolveBridgePaths(homeRoot);
+  if (!dryRun) {
+    await mkdir5(bridgeTarget, { recursive: true });
+  }
+  const skillNames = listSkillDirs(skillsRoot);
+  const created = [];
+  for (const name of skillNames) {
+    const linkPath = path.join(bridgeTarget, name);
+    const target = path.join(skillsRoot, name);
+    if (symlinkPointsAt(linkPath, target)) continue;
+    await ensureSymlink(linkPath, target, dryRun);
+    created.push({ name, linkPath, target });
+  }
+  const removed = [];
+  if (existsSync12(claudeSkillsRoot)) {
+    const entries = readdirSync(claudeSkillsRoot, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name === "agents-shared") continue;
+      const entryPath = path.join(claudeSkillsRoot, entry.name);
+      let stat4;
+      try {
+        stat4 = lstatSync3(entryPath);
+      } catch {
+        continue;
+      }
+      if (!stat4.isSymbolicLink()) continue;
+      let resolvedTarget = null;
+      try {
+        const raw = readlinkSync(entryPath);
+        resolvedTarget = path.isAbsolute(raw) ? raw : path.resolve(path.dirname(entryPath), raw);
+      } catch {
+        resolvedTarget = null;
+      }
+      if (resolvedTarget !== null) {
+        const realResolved = (() => {
+          try {
+            return realpathSync(resolvedTarget);
+          } catch {
+            return resolvedTarget;
+          }
+        })();
+        if (realResolved === bridgeTarget || realResolved.startsWith(`${bridgeTarget}${path.sep}`)) {
+          continue;
+        }
+      }
+      if (!dryRun) {
+        await unlink(entryPath);
+      }
+      removed.push({ linkPath: entryPath, previousTarget: resolvedTarget });
+    }
+  }
+  let backupPath = null;
+  const bridgeAlreadyCorrect = symlinkPointsAt(bridgePath, bridgeTarget);
+  let bridgeSymlinkActive = bridgeAlreadyCorrect;
+  if (!bridgeAlreadyCorrect) {
+    if (existsSync12(bridgePath)) {
+      const lstat = lstatSync3(bridgePath);
+      if (lstat.isSymbolicLink()) {
+        if (!dryRun) await unlink(bridgePath);
+      } else if (lstat.isDirectory()) {
+        const entryCount = await countEntries(bridgePath);
+        if (entryCount > 0 && !force) {
+          throw new AgentsSkillsRealDirError(bridgePath, entryCount);
+        }
+        if (entryCount > 0) {
+          backupPath = path.join(backupsRoot, `agents-skills-pre-bridge-${buildBackupTimestamp()}`);
+          if (!dryRun) {
+            await mkdir5(backupsRoot, { recursive: true });
+            await cp4(bridgePath, backupPath, { recursive: true, dereference: false });
+            await rm5(bridgePath, { recursive: true, force: true });
+          }
+        } else if (!dryRun) {
+          await rm5(bridgePath, { recursive: true, force: true });
+        }
+      } else if (!dryRun) {
+        await unlink(bridgePath);
+      }
+    }
+    if (!dryRun) {
+      await mkdir5(path.dirname(bridgePath), { recursive: true });
+      await symlink3(bridgeTarget, bridgePath, "dir");
+      bridgeSymlinkActive = true;
+    }
+  }
+  return {
+    bridgeCreated: !bridgeAlreadyCorrect,
+    bridgeSymlinkActive,
+    perSkillSymlinksCreated: created,
+    perSkillSymlinksRemoved: removed,
+    backupPath,
+    dryRun,
+    skillsRoot,
+    bridgeTarget,
+    bridgePath
+  };
+}
+function printHumanSummary(result) {
+  if (result.dryRun) {
+    console.log(pc.dim("(dry-run \u2014 no disk state mutated)"));
+  }
+  if (!result.bridgeCreated && result.perSkillSymlinksCreated.length === 0) {
+    console.log(pc.green("Bridge already correct \u2014 nothing to do."));
+  } else {
+    console.log(pc.green("Bridge configured."));
+  }
+  console.log(`  ${pc.dim("bridge:")} ${result.bridgePath} -> ${result.bridgeTarget}`);
+  console.log(
+    `  ${pc.dim("per-skill symlinks created:")} ${result.perSkillSymlinksCreated.length}`
+  );
+  console.log(
+    `  ${pc.dim("per-skill symlinks removed:")} ${result.perSkillSymlinksRemoved.length}`
+  );
+  if (result.backupPath) {
+    console.log(`  ${pc.yellow("backup:")} ${result.backupPath}`);
+  }
+}
+function registerDoctorBridge(parent) {
+  parent.command("bridge").description("Create the single ~/.agents/skills bridge symlink and rip per-skill symlinks").option("--force", "Back up and replace a real ~/.agents/skills directory if present").option("--dry-run", "Print planned actions without mutating disk state").option("--json", "Output as JSON (default)").option("--human", "Output in human-readable format").action(
+    async (opts) => {
+      const operation = "skills.doctor.bridge";
+      const mvi = "standard";
+      let format;
+      try {
+        format = resolveFormat({
+          jsonFlag: opts.json ?? false,
+          humanFlag: opts.human ?? false,
+          projectDefault: "json"
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        emitJsonError(
+          operation,
+          mvi,
+          ErrorCodes.FORMAT_CONFLICT,
+          message,
+          ErrorCategories.VALIDATION
+        );
+        process.exit(1);
+      }
+      try {
+        const result = await runDoctorBridge({
+          force: opts.force ?? false,
+          dryRun: opts.dryRun ?? false
+        });
+        if (format === "json") {
+          outputSuccess(operation, mvi, result);
+        } else {
+          printHumanSummary(result);
+        }
+      } catch (error) {
+        if (error instanceof AgentsSkillsRealDirError) {
+          if (format === "json") {
+            emitJsonError(operation, mvi, error.code, error.message, ErrorCategories.CONFLICT, {
+              agentsSkillsPath: error.agentsSkillsPath,
+              entryCount: error.entryCount
+            });
+          } else {
+            console.error(pc.red(error.message));
+          }
+          process.exit(1);
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        if (format === "json") {
+          emitJsonError(
+            operation,
+            mvi,
+            ErrorCodes.INTERNAL_ERROR,
+            message,
+            ErrorCategories.INTERNAL
+          );
+        } else {
+          console.error(pc.red(message));
+        }
+        process.exit(1);
+      }
+    }
+  );
+}
+
+// src/commands/skills/doctor-adopt.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  cpSync,
+  existsSync as existsSync13,
+  lstatSync as lstatSync4,
+  mkdirSync,
+  readdirSync as readdirSync2,
+  realpathSync as realpathSync2,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
+import { createInterface } from "readline/promises";
+import pc2 from "picocolors";
+function cleoSkillsRoot() {
+  return join7(homedir4(), ".cleo", "skills");
+}
+function legacyAgentsSkillsRoot() {
+  return join7(homedir4(), ".local", "share", "agents", "skills");
+}
+function homeAgentsSkillsRoot() {
+  return join7(homedir4(), ".agents", "skills");
+}
+function archiveRoot() {
+  return join7(cleoSkillsRoot(), ".archive");
+}
+function auditLogRoot() {
+  return join7(cleoSkillsRoot(), ".audit-log");
+}
+function listCandidates(root) {
+  if (!existsSync13(root)) return [];
+  let entries;
+  try {
+    entries = readdirSync2(root);
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const name of entries) {
+    if (name.startsWith(".")) continue;
+    const full = join7(root, name);
+    let isDirLike = false;
+    try {
+      const stat4 = lstatSync4(full);
+      if (stat4.isDirectory()) {
+        isDirLike = true;
+      } else if (stat4.isSymbolicLink()) {
+        try {
+          const real = statSync(full);
+          isDirLike = real.isDirectory();
+        } catch {
+          isDirLike = false;
+        }
+      }
+    } catch {
+      isDirLike = false;
+    }
+    if (isDirLike) {
+      out.push({ name, path: full });
+    }
+  }
+  return out;
+}
+function approxDirSize(dir) {
+  let total = 0;
+  try {
+    const entries = readdirSync2(dir);
+    for (const entry of entries) {
+      try {
+        const stat4 = statSync(join7(dir, entry));
+        if (stat4.isFile()) total += stat4.size;
+      } catch {
+      }
+    }
+  } catch {
+    return 0;
+  }
+  return total;
+}
+function discoverOrphans(registeredNames) {
+  const cleoRoot = cleoSkillsRoot();
+  const legacyRoot = legacyAgentsSkillsRoot();
+  const homeRoot = homeAgentsSkillsRoot();
+  const seen = /* @__PURE__ */ new Map();
+  const visit = (root, via, filter) => {
+    for (const candidate of listCandidates(root)) {
+      if (seen.has(candidate.name)) continue;
+      if (registeredNames.has(candidate.name)) continue;
+      if (filter && !filter(candidate.path)) continue;
+      seen.set(candidate.name, {
+        name: candidate.name,
+        path: candidate.path,
+        discoveredVia: via,
+        hasSkillMd: existsSync13(join7(candidate.path, "SKILL.md")),
+        sizeBytes: approxDirSize(candidate.path)
+      });
+    }
+  };
+  visit(cleoRoot, "cleo");
+  visit(legacyRoot, "legacy-agents");
+  visit(homeRoot, "home-agents", (path2) => {
+    try {
+      const real = realpathSync2(path2);
+      return !real.startsWith(`${cleoRoot}/`);
+    } catch {
+      return true;
+    }
+  });
+  return Array.from(seen.values()).sort((a, b) => a.name.localeCompare(b.name));
+}
+function canonicalAdoptRefusal() {
+  return {
+    code: "E_CANONICAL_ADOPT_REFUSED",
+    message: "Canonical adoption is refused on user machines. Canonical skills are owned by the CLEO core team and ONLY the owner-CI workflow may write them (architecture-v3 \xA76 invariant).",
+    remediation: "To contribute this skill to canonical: clone https://github.com/kryptobaseddev/cleo, place the skill under packages/skills/skills/<name>/, and open a PR. Local user-machine canonical writes are blocked by design."
+  };
+}
+function buildAdoptedRow(orphan, now) {
+  return {
+    name: orphan.name,
+    installPath: orphan.path,
+    installedAt: now,
+    sourceType: "user",
+    lifecycleState: "active"
+  };
+}
+function archiveAndDelete(orphan, now) {
+  const tsToken = now.replace(/[:.]/g, "-");
+  const archiveDir = join7(archiveRoot(), `${orphan.name}-${tsToken}`);
+  mkdirSync(archiveRoot(), { recursive: true });
+  cpSync(orphan.path, archiveDir, { recursive: true, dereference: false });
+  rmSync(orphan.path, { recursive: true, force: true });
+  return archiveDir;
+}
+async function applyDecision(orphan, decision, now, recordRow) {
+  const base = {
+    orphan,
+    decidedAt: now
+  };
+  if (decision === "canonical-adopt") {
+    return {
+      ...base,
+      decision,
+      applied: false,
+      refusal: canonicalAdoptRefusal(),
+      archivedTo: null
+    };
+  }
+  if (decision === "skip") {
+    return { ...base, decision, applied: true, refusal: null, archivedTo: null };
+  }
+  if (decision === "user-adopt") {
+    try {
+      await recordRow(buildAdoptedRow(orphan, now));
+      return { ...base, decision, applied: true, refusal: null, archivedTo: null };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return {
+        ...base,
+        decision,
+        applied: false,
+        refusal: {
+          code: "E_CANONICAL_ADOPT_REFUSED",
+          message: `user-adopt failed: ${message}`,
+          remediation: "Initialise the registry with `cleo skills list` then re-run."
+        },
+        archivedTo: null
+      };
+    }
+  }
+  try {
+    const archived = archiveAndDelete(orphan, now);
+    return { ...base, decision, applied: true, refusal: null, archivedTo: archived };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      ...base,
+      decision,
+      applied: false,
+      refusal: {
+        code: "E_CANONICAL_ADOPT_REFUSED",
+        message: `delete failed: ${message}`,
+        remediation: "Inspect filesystem permissions and rerun with --non-interactive to verify."
+      },
+      archivedTo: null
+    };
+  }
+}
+function writeAuditLog(result) {
+  const dir = auditLogRoot();
+  mkdirSync(dir, { recursive: true });
+  const tsToken = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const path2 = join7(dir, `adopt-${tsToken}.json`);
+  const tmp = `${path2}.tmp`;
+  const payload = {
+    runId: randomUUID2(),
+    writtenAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...result
+  };
+  writeFileSync(tmp, `${JSON.stringify(payload, null, 2)}
+`, "utf8");
+  renameSync(tmp, path2);
+  return path2;
+}
+async function promptDecision(rl, orphan) {
+  const kb = Math.round(orphan.sizeBytes / 1024);
+  process.stderr.write(
+    `
+${pc2.bold(orphan.name)}
+  path: ${orphan.path}
+  via:  ${orphan.discoveredVia}
+  size: ~${kb} KiB
+  SKILL.md: ${orphan.hasSkillMd ? "yes" : "no"}
+`
+  );
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const answer = (await rl.question("  [c]anonical-adopt | [u]ser-adopt | [d]elete | [s]kip: ")).trim().toLowerCase();
+    if (answer === "c" || answer === "canonical" || answer === "canonical-adopt") {
+      return "canonical-adopt";
+    }
+    if (answer === "u" || answer === "user" || answer === "user-adopt") {
+      return "user-adopt";
+    }
+    if (answer === "d" || answer === "delete") return "delete";
+    if (answer === "s" || answer === "skip" || answer === "") return "skip";
+    process.stderr.write(`  ${pc2.yellow("unrecognised input \u2014 try one of c/u/d/s")}
+`);
+  }
+  return "skip";
+}
+async function runDoctorAdopt(options) {
+  const discover = options.discoverFn ?? discoverOrphans;
+  const registeredNames = await options.loadRegisteredNames();
+  const orphans = discover(registeredNames);
+  const results = [];
+  const mode = options.nonInteractive ? "non-interactive" : options.autoUserAdopt ? "auto-user-adopt" : "interactive";
+  if (orphans.length === 0) {
+    const empty = {
+      totalOrphans: 0,
+      results: [],
+      auditLogPath: "",
+      mode
+    };
+    if (!options.skipAuditLog) empty.auditLogPath = writeAuditLog(empty);
+    return empty;
+  }
+  if (mode === "non-interactive") {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    for (const orphan of orphans) {
+      results.push({
+        orphan,
+        decision: "skip",
+        applied: true,
+        refusal: null,
+        archivedTo: null,
+        decidedAt: now
+      });
+    }
+  } else if (mode === "auto-user-adopt") {
+    for (const orphan of orphans) {
+      results.push(
+        await applyDecision(orphan, "user-adopt", (/* @__PURE__ */ new Date()).toISOString(), options.recordRow)
+      );
+    }
+  } else {
+    const promptFn = options.prompt ?? (async (orphan) => {
+      const rl = createInterface({ input: process.stdin, output: process.stderr });
+      try {
+        return await promptDecision(rl, orphan);
+      } finally {
+        rl.close();
+      }
+    });
+    for (const orphan of orphans) {
+      const decision = await promptFn(orphan);
+      results.push(
+        await applyDecision(orphan, decision, (/* @__PURE__ */ new Date()).toISOString(), options.recordRow)
+      );
+    }
+  }
+  const result = {
+    totalOrphans: orphans.length,
+    results,
+    auditLogPath: "",
+    mode
+  };
+  if (!options.skipAuditLog) result.auditLogPath = writeAuditLog(result);
+  return result;
+}
+var caampStandaloneAdapters = {
+  loadRegisteredNames: () => /* @__PURE__ */ new Set(),
+  recordRow: () => {
+    throw new Error(
+      "caamp standalone CLI cannot write to skills.db. Use `cleo skills doctor adopt-orphans` instead."
+    );
+  }
+};
+function registerSkillsDoctorAdopt(parent, adapters = caampStandaloneAdapters) {
+  const existing = parent.commands.find((c) => c.name() === "doctor");
+  const doctor = existing ?? parent.command("doctor").description("Diagnostics + repair for the skill system");
+  doctor.command("adopt-orphans").description(
+    "Interactive audit of on-disk skill dirs not tracked in skills.db (canonical/user/delete/skip)"
+  ).option("--json", "Output as LAFS JSON envelope (default)").option("--human", "Output a colorised human-readable summary").option("--non-interactive", "List orphans + exit without action").option("--auto-user-adopt", "Bulk-mark all orphans as source_type=user without prompting").action(
+    async (opts) => {
+      const operation = "skills.doctor.adopt-orphans";
+      const mvi = "standard";
+      let format;
+      try {
+        format = resolveFormat({
+          jsonFlag: opts.json ?? false,
+          humanFlag: opts.human ?? false,
+          projectDefault: "json"
+        });
+      } catch (error) {
+        handleFormatError(error, operation, mvi, opts.json);
+      }
+      try {
+        const result = await runDoctorAdopt({
+          nonInteractive: opts.nonInteractive ?? false,
+          autoUserAdopt: opts.autoUserAdopt ?? false,
+          loadRegisteredNames: adapters.loadRegisteredNames,
+          recordRow: adapters.recordRow
+        });
+        if (format === "json") {
+          outputSuccess(operation, mvi, result);
+          return;
+        }
+        const ok = result.results.filter((r) => r.applied);
+        const blocked = result.results.filter((r) => !r.applied);
+        console.log(pc2.bold(`
+skills doctor adopt-orphans (${result.mode})
+`));
+        console.log(
+          `  ${pc2.bold("Discovered")}: ${result.totalOrphans} orphan${result.totalOrphans === 1 ? "" : "s"}`
+        );
+        for (const r of result.results) {
+          const icon = r.decision === "skip" ? pc2.dim("\xB7") : r.applied ? pc2.green("\u2713") : pc2.red("\u2717");
+          const verb = r.applied ? r.decision : `${r.decision} (refused)`;
+          console.log(`  ${icon} ${r.orphan.name.padEnd(32)} ${pc2.dim(verb)}`);
+          if (r.refusal) {
+            console.log(`      ${pc2.yellow(r.refusal.message)}`);
+            console.log(`      ${pc2.dim(r.refusal.remediation)}`);
+          }
+          if (r.archivedTo) {
+            console.log(`      ${pc2.dim(`archived \u2192 ${r.archivedTo}`)}`);
+          }
+        }
+        console.log(
+          `
+  ${pc2.bold("Summary")}: ${pc2.green(`${ok.length} applied`)}, ${pc2.red(`${blocked.length} blocked`)}`
+        );
+        if (result.auditLogPath) {
+          console.log(`  ${pc2.dim(`audit log \u2192 ${result.auditLogPath}`)}`);
+        }
+        console.log();
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (format === "json") {
+          emitJsonError(
+            operation,
+            mvi,
+            ErrorCodes.INTERNAL_ERROR,
+            message,
+            ErrorCategories.INTERNAL
+          );
+        } else {
+          console.error(pc2.red(`Error: ${message}`));
+        }
+        process.exit(1);
+      }
+    }
+  );
+}
+
 // src/core/network/fetch.ts
 var DEFAULT_FETCH_TIMEOUT_MS = 1e4;
 var NetworkError = class extends Error {
@@ -4007,9 +4778,9 @@ async function recommendSkills2(query, criteria, options = {}) {
 }
 
 // src/core/skills/library-loader.ts
-import { existsSync as existsSync12, readdirSync, readFileSync } from "fs";
+import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync } from "fs";
 import { createRequire } from "module";
-import { basename as basename3, dirname as dirname3, join as join6 } from "path";
+import { basename as basename3, dirname as dirname4, join as join8 } from "path";
 var require2 = createRequire(import.meta.url);
 function loadLibraryFromModule(root) {
   let mod;
@@ -4055,16 +4826,16 @@ function loadLibraryFromModule(root) {
   return mod;
 }
 function buildLibraryFromFiles(root) {
-  const catalogPath = join6(root, "skills.json");
-  if (!existsSync12(catalogPath)) {
+  const catalogPath = join8(root, "skills.json");
+  if (!existsSync14(catalogPath)) {
     throw new Error(`No skills.json found at ${root}`);
   }
   const catalogData = JSON.parse(readFileSync(catalogPath, "utf-8"));
   const entries = catalogData.skills ?? [];
   const version = catalogData.version ?? "0.0.0";
-  const manifestPath = join6(root, "skills", "manifest.json");
+  const manifestPath = join8(root, "skills", "manifest.json");
   let manifest;
-  if (existsSync12(manifestPath)) {
+  if (existsSync14(manifestPath)) {
     manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
   } else {
     manifest = {
@@ -4074,14 +4845,14 @@ function buildLibraryFromFiles(root) {
       skills: []
     };
   }
-  const profilesDir = join6(root, "profiles");
+  const profilesDir = join8(root, "profiles");
   const profiles = /* @__PURE__ */ new Map();
-  if (existsSync12(profilesDir)) {
-    for (const file of readdirSync(profilesDir)) {
+  if (existsSync14(profilesDir)) {
+    for (const file of readdirSync3(profilesDir)) {
       if (!file.endsWith(".json")) continue;
       try {
         const profile = JSON.parse(
-          readFileSync(join6(profilesDir, file), "utf-8")
+          readFileSync(join8(profilesDir, file), "utf-8")
         );
         profiles.set(profile.name, profile);
       } catch {
@@ -4095,9 +4866,9 @@ function buildLibraryFromFiles(root) {
   function getSkillDir2(name) {
     const entry = skillMap.get(name);
     if (entry) {
-      return dirname3(join6(root, entry.path));
+      return dirname4(join8(root, entry.path));
     }
-    return join6(root, "skills", name);
+    return join8(root, "skills", name);
   }
   function resolveDeps(names, visited = /* @__PURE__ */ new Set()) {
     const result = [];
@@ -4125,8 +4896,8 @@ function buildLibraryFromFiles(root) {
     return resolveDeps([...new Set(skills)]);
   }
   function discoverFiles(dir, ext) {
-    if (!existsSync12(dir)) return [];
-    return readdirSync(dir).filter((f) => f.endsWith(ext)).map((f) => basename3(f, ext));
+    if (!existsSync14(dir)) return [];
+    return readdirSync3(dir).filter((f) => f.endsWith(ext)).map((f) => basename3(f, ext));
   }
   const library = {
     version,
@@ -4142,14 +4913,14 @@ function buildLibraryFromFiles(root) {
     getSkillPath(name) {
       const entry = skillMap.get(name);
       if (entry) {
-        return join6(root, entry.path);
+        return join8(root, entry.path);
       }
-      return join6(root, "skills", name, "SKILL.md");
+      return join8(root, "skills", name, "SKILL.md");
     },
     getSkillDir: getSkillDir2,
     readSkillContent(name) {
       const skillPath = library.getSkillPath(name);
-      if (!existsSync12(skillPath)) {
+      if (!existsSync14(skillPath)) {
         throw new Error(`Skill content not found: ${skillPath}`);
       }
       return readFileSync(skillPath, "utf-8");
@@ -4176,11 +4947,11 @@ function buildLibraryFromFiles(root) {
       return resolveProfileByName(name);
     },
     listSharedResources() {
-      return discoverFiles(join6(root, "skills", "_shared"), ".md");
+      return discoverFiles(join8(root, "skills", "_shared"), ".md");
     },
     getSharedResourcePath(name) {
-      const resourcePath = join6(root, "skills", "_shared", `${name}.md`);
-      return existsSync12(resourcePath) ? resourcePath : void 0;
+      const resourcePath = join8(root, "skills", "_shared", `${name}.md`);
+      return existsSync14(resourcePath) ? resourcePath : void 0;
     },
     readSharedResource(name) {
       const resourcePath = library.getSharedResourcePath(name);
@@ -4188,15 +4959,15 @@ function buildLibraryFromFiles(root) {
       return readFileSync(resourcePath, "utf-8");
     },
     listProtocols() {
-      const rootProtocols = discoverFiles(join6(root, "protocols"), ".md");
+      const rootProtocols = discoverFiles(join8(root, "protocols"), ".md");
       if (rootProtocols.length > 0) return rootProtocols;
-      return discoverFiles(join6(root, "skills", "protocols"), ".md");
+      return discoverFiles(join8(root, "skills", "protocols"), ".md");
     },
     getProtocolPath(name) {
-      const rootPath = join6(root, "protocols", `${name}.md`);
-      if (existsSync12(rootPath)) return rootPath;
-      const skillsPath = join6(root, "skills", "protocols", `${name}.md`);
-      return existsSync12(skillsPath) ? skillsPath : void 0;
+      const rootPath = join8(root, "protocols", `${name}.md`);
+      if (existsSync14(rootPath)) return rootPath;
+      const skillsPath = join8(root, "skills", "protocols", `${name}.md`);
+      return existsSync14(skillsPath) ? skillsPath : void 0;
     },
     readProtocol(name) {
       const protocolPath = library.getProtocolPath(name);
@@ -4221,8 +4992,8 @@ function buildLibraryFromFiles(root) {
       if (!entry.version) {
         issues.push({ level: "warn", field: "version", message: "Missing version" });
       }
-      const skillPath = join6(root, entry.path);
-      if (!existsSync12(skillPath)) {
+      const skillPath = join8(root, entry.path);
+      if (!existsSync14(skillPath)) {
         issues.push({
           level: "error",
           field: "path",
@@ -4281,15 +5052,15 @@ __export(catalog_exports, {
   validateAll: () => validateAll,
   validateSkillFrontmatter: () => validateSkillFrontmatter
 });
-import { existsSync as existsSync13 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync15 } from "fs";
+import { join as join9 } from "path";
 var _library = null;
 function registerSkillLibrary(library) {
   _library = library;
 }
 function registerSkillLibraryFromPath(root) {
-  const indexPath = join7(root, "index.js");
-  if (existsSync13(indexPath)) {
+  const indexPath = join9(root, "index.js");
+  if (existsSync15(indexPath)) {
     _library = loadLibraryFromModule(root);
     return;
   }
@@ -4300,13 +5071,13 @@ function clearRegisteredLibrary() {
 }
 function discoverLibrary() {
   const envPath = process.env["CAAMP_SKILL_LIBRARY"];
-  if (envPath && existsSync13(envPath)) {
+  if (envPath && existsSync15(envPath)) {
     try {
-      const indexPath = join7(envPath, "index.js");
-      if (existsSync13(indexPath)) {
+      const indexPath = join9(envPath, "index.js");
+      if (existsSync15(indexPath)) {
         return loadLibraryFromModule(envPath);
       }
-      if (existsSync13(join7(envPath, "skills.json"))) {
+      if (existsSync15(join9(envPath, "skills.json"))) {
         return buildLibraryFromFiles(envPath);
       }
     } catch {
@@ -4413,9 +5184,9 @@ function getLibraryRoot() {
 }
 
 // src/core/skills/discovery.ts
-import { existsSync as existsSync14 } from "fs";
-import { readdir as readdir2, readFile as readFile7 } from "fs/promises";
-import { join as join8 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { readdir as readdir3, readFile as readFile7 } from "fs/promises";
+import { join as join10 } from "path";
 import matter from "gray-matter";
 async function parseSkillFile(filePath) {
   try {
@@ -4439,8 +5210,8 @@ async function parseSkillFile(filePath) {
   }
 }
 async function discoverSkill(skillDir) {
-  const skillFile = join8(skillDir, "SKILL.md");
-  if (!existsSync14(skillFile)) return null;
+  const skillFile = join10(skillDir, "SKILL.md");
+  if (!existsSync16(skillFile)) return null;
   const metadata = await parseSkillFile(skillFile);
   if (!metadata) return null;
   return {
@@ -4451,12 +5222,12 @@ async function discoverSkill(skillDir) {
   };
 }
 async function discoverSkills(rootDir) {
-  if (!existsSync14(rootDir)) return [];
-  const entries = await readdir2(rootDir, { withFileTypes: true });
+  if (!existsSync16(rootDir)) return [];
+  const entries = await readdir3(rootDir, { withFileTypes: true });
   const skills = [];
   for (const entry of entries) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-    const skillDir = join8(rootDir, entry.name);
+    const skillDir = join10(rootDir, entry.name);
     const skill = await discoverSkill(skillDir);
     if (skill) {
       skills.push(skill);
@@ -4480,7 +5251,7 @@ async function discoverSkillsMulti(dirs) {
 }
 
 // src/core/skills/validator.ts
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { readFile as readFile8 } from "fs/promises";
 import matter2 from "gray-matter";
 var RESERVED_NAMES = [
@@ -4502,7 +5273,7 @@ var WARN_BODY_LINES = 500;
 var WARN_DESCRIPTION_LENGTH = 50;
 async function validateSkill(filePath) {
   const issues = [];
-  if (!existsSync15(filePath)) {
+  if (!existsSync17(filePath)) {
     return {
       valid: false,
       issues: [{ level: "error", field: "file", message: "File does not exist" }],
@@ -4631,6 +5402,7 @@ export {
   getInstalledProviders,
   detectProjectProviders,
   resetDetectionCache,
+  inferSkillSourceType,
   installSkill,
   removeSkill,
   listCanonicalSkills,
@@ -4657,6 +5429,14 @@ export {
   readConfig,
   writeConfig,
   removeConfig,
+  resolveFormat,
+  buildEnvelope,
+  emitError,
+  emitJsonError,
+  outputSuccess,
+  handleFormatError,
+  ErrorCategories,
+  ErrorCodes,
   readLockFile,
   resolveMcpConfigPath,
   listMcpServers,
@@ -4677,6 +5457,16 @@ export {
   getTrackedSkills,
   checkSkillUpdate,
   checkAllSkillUpdates,
+  AgentsSkillsRealDirError,
+  buildBackupTimestamp,
+  runDoctorBridge,
+  registerDoctorBridge,
+  discoverOrphans,
+  applyDecision,
+  writeAuditLog,
+  runDoctorAdopt,
+  caampStandaloneAdapters,
+  registerSkillsDoctorAdopt,
   MarketplaceClient,
   RECOMMENDATION_ERROR_CODES,
   tokenizeCriteriaValue,
@@ -4705,4 +5495,4 @@ export {
   discoverSkillsMulti,
   validateSkill
 };
-//# sourceMappingURL=chunk-4W35AEYA.js.map
+//# sourceMappingURL=chunk-WXL7RPS4.js.map