@codexguild/mcp 0.0.0-stage → 1.4.0

package/dist/codexguild-mcp.js

@@ -0,0 +1,1243 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { access, readFile as readFile3 } from "node:fs/promises";
+import { isAbsolute, join as join3 } from "node:path";
+
+// src/local-scan.ts
+import { readdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, relative, resolve } from "node:path";
+
+// ../scanner/src/index.ts
+import { createHash } from "crypto";
+
+// ../scanner/src/rules.ts
+var SENSITIVE = /~\/\.ssh|\bid_(rsa|ed25519|ecdsa)\b|\.aws\/credentials|\.npmrc|\.netrc|\.git-credentials|\.pypirc|\.docker\/config\.json|\.kube\/config|(^|[\s"'/])\.env\b|\b(GITHUB_TOKEN|GH_TOKEN|ANTHROPIC_API_KEY|OPENAI_API_KEY|AWS_SECRET_ACCESS_KEY|NPM_TOKEN|SLACK_TOKEN)\b|security\s+find-(generic|internet)-password|Login Data|Cookies\.binarycookies|keychain/i;
+var OFFICIAL_TOKEN_USE = new RegExp(
+  [
+    String.raw`^(?!.*https?:\/\/(?!(?:(api\.)?github\.com|uploads\.github\.com)(?![\w.-]))[\w.-]+).*\$\{?(GITHUB_TOKEN|GH_TOKEN)\b`,
+    String.raw`^(?!.*https?:\/\/(?!(?:api\.anthropic\.com)(?![\w.-]))[\w.-]+).*\$\{?ANTHROPIC_API_KEY\b`,
+    String.raw`^(?!.*https?:\/\/(?!(?:api\.openai\.com)(?![\w.-]))[\w.-]+).*\$\{?OPENAI_API_KEY\b`,
+    String.raw`^(?!.*https?:\/\/(?!(?:registry\.npmjs\.org)(?![\w.-]))[\w.-]+).*\$\{?NPM_TOKEN\b`
+  ].join("|"),
+  "i"
+);
+var NETWORK_SEND = /\bcurl\b|\bwget\b|\bfetch\s*\(|requests\.(post|put|get)\b|urllib|http\.request|axios\.|\bnc\s|\bncat\b|\bscp\s|\brsync\s.*@|Invoke-WebRequest|\bwebhook\b/i;
+var WRITE_OP = /(^|[^-=<>&\d])>>?\s*["']?[~/$.\w]|\btee\b|writeFile(Sync)?\s*\(|appendFile(Sync)?\s*\(|open\([^)]*['"][wa]\+?['"]|\bcp\s|\bmv\s|\bln\s+-s|\bsed\s+-i\b|Set-Content|Add-Content/i;
+var AGENT_CONFIG = /\.claude\/(settings(\.local)?\.json|hooks)|(^|[\s"'/`])CLAUDE\.md|(^|[\s"'/`])AGENTS\.md|\.cursor\/rules|\.cursorrules|\.mcp\.json|\.codex\/config|\.gemini\/settings|\.windsurfrules|\.clinerules/i;
+var AGENT_EXTENSIONS = /\.(claude|codex|agents|hermes|cursor)\/(commands|agents|skills)\//i;
+var SHELL_RC = /~\/\.(bashrc|zshrc|bash_profile|profile|zprofile|zshenv)|\$HOME\/\.(bashrc|zshrc|profile)/i;
+var PERSISTENCE = /\bcrontab\b|LaunchAgents|LaunchDaemons|systemctl\s+(--user\s+)?enable|authorized_keys|\/etc\/(sudoers|hosts|profile|rc\.local)|\/etc\/cron/i;
+var EXEC_PAYLOAD = /\b(curl|wget|nc|ncat|eval|base64|python3?\s+-c|node\s+-e)\b/i;
+var LINE_RULES = [
+  // ── critical: remote code execution & exfiltration ──
+  {
+    id: "pipe-to-shell",
+    severity: "critical",
+    title: "Downloads and executes remote code",
+    why: "Piping a download into a shell runs whatever the server returns at that moment \u2014 the content can change after review.",
+    scope: "all",
+    pattern: /\b(curl|wget|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[^\n|]*\|\s*(sudo\s+(-\S+\s+)*)?((ba|z|da|k|fi)?sh|python3?|node|perl|ruby|iex|Invoke-Expression)(?=\s*$|\s*[;&|)`'"]|\s+-s\b|\s+-\s|\s+--\s)|\b(eval|source|\.)\s+["']?[$<]\(\s*(curl|wget)\b|\bpython3?\s+-c\s+["']?\$\(\s*(curl|wget)/i
+  },
+  {
+    id: "reverse-shell",
+    severity: "critical",
+    title: "Reverse shell pattern",
+    why: "Opens an interactive shell to a remote host \u2014 full remote control of the machine.",
+    scope: "all",
+    pattern: (
+      // /dev/tcp only when a shell's stdin/stdout is wired to it — `cat < /dev/null > /dev/tcp/host/port` is a port probe.
+      /(>&|<>|0<&)\s*\/dev\/(tcp|udp)\/|\/dev\/(tcp|udp)\/[^\n]*(0>&1|[<>]&\s*\d|\|\s*\/?(bin\/)?(ba|z)?sh\b)|\bnc(at)?\b[^\n]*\s(-e|-c|--exec|--sh-exec)\s|\bsocat\b[^\n]*\bexec:|\bbash\s+-i\s*>&|pty\.spawn\(\s*["']\/bin\/(ba)?sh/i
+    )
+  },
+  {
+    id: "encoded-exec",
+    severity: "critical",
+    title: "Executes base64/obfuscated payload",
+    why: "Decoding a payload straight into a shell or eval hides what actually runs from reviewers.",
+    scope: "all",
+    pattern: /base64\s+(-d|--decode|-D)\b[^\n]*\|\s*(sudo\s+)?((ba|z)?sh|python3?|node|perl)\b|\beval\s*\(\s*(atob|Buffer\.from|base64\.b64decode|bytes\.fromhex)\s*\(|\bexec\s*\(\s*(base64\.b64decode|codecs\.decode|zlib\.decompress)|powershell[^\n]*-(e|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}/i
+  },
+  {
+    id: "secret-exfiltration",
+    severity: "critical",
+    title: "Reads credentials and sends them over the network",
+    why: "Combines access to secrets (SSH keys, cloud creds, tokens, .env) with a network call on the same line.",
+    scope: "all",
+    pattern: SENSITIVE,
+    alsoRequires: NETWORK_SEND,
+    unless: OFFICIAL_TOKEN_USE
+  },
+  {
+    id: "credential-access",
+    severity: "medium",
+    title: "Sends an API token to its own service",
+    why: "Normal API usage (e.g. $GITHUB_TOKEN to api.github.com), listed so reviewers know the skill handles secrets.",
+    scope: "all",
+    pattern: OFFICIAL_TOKEN_USE
+  },
+  {
+    id: "known-exfil-endpoint",
+    severity: "high",
+    title: "Sends data to a request-capture service",
+    why: "webhook.site, requestbin, interactsh/OAST and similar capture every request \u2014 the classic exfiltration sink.",
+    scope: "all",
+    // URL form only: naming the tool in prose (e.g. a pentest guide) is not a request.
+    pattern: /https?:\/\/[\w.-]*\b(webhook\.site|requestbin\.(com|net)|pipedream\.net|interact\.sh|oast\.(fun|live|me|pro|site)|burpcollaborator\.net|hookbin\.com|beeceptor\.com|canarytokens\.com)\b/i
+  },
+  // ── high: agent hijack, destruction, safety bypass, persistence ──
+  {
+    id: "prompt-injection",
+    severity: "high",
+    title: "Instructions that override the agent or hide actions from the user",
+    why: "Skills are loaded into the agent context verbatim; these phrases try to subvert the agent's instructions or keep the user uninformed.",
+    scope: "markdown",
+    pattern: /\b(ignore|disregard|forget|override)\s+(all\s+|any\s+|the\s+)?(previous|prior|above|earlier|system|original)\s+(instructions|prompts?|rules|guidelines|directives)|\b(do\s+not|don't|never)\s+(tell|inform|notify|alert|mention\s+(this\s+)?to)\s+the\s+user(?!\s+to\b)|\bhide\s+(this|these|it|the\s+\w+)\s+(from\s+the\s+user(?!'s)|actions?)|\byou\s+are\s+now\s+(in\s+)?(developer|dan|jailbreak|unrestricted|god)\s*mode|(?<!\b(would|could|might|may|can|will|to)\s)\bsilently\s+(run|execute|install|delete|send|upload)\b/i,
+    // "Do not tell the user their tickets are for sale unless it says live" keeps the user from being misinformed.
+    unless: /\b(do\s+not|don't|never)\s+(tell|inform)\s+the\s+user\b[^.!?]*\b(is|are)\b[^.!?]*\b(unless|until)\b/i
+  },
+  {
+    id: "prompt-injection",
+    severity: "high",
+    title: "Instructions to act without the user's knowledge",
+    why: 'Telling the agent to act "without asking the user" removes the human from consequential decisions.',
+    scope: "markdown",
+    pattern: /\bwithout\s+(first\s+)?(asking|telling|informing|notifying|confirming\s+with|consulting)\s+the\s+user/i,
+    // "Never … without asking the user" is a safety rule, not an injection.
+    unless: /\b(never|don't|do\s+not|must\s+not|mustn't|should\s+not|shouldn't|cannot|can't|no)\b[^.!?]*\bwithout\s+(first\s+)?(asking|telling|informing|notifying|confirming|consulting)/i
+  },
+  {
+    id: "shell-rc-edit",
+    severity: "medium",
+    title: "Edits shell startup files",
+    why: "Appending to ~/.bashrc/~/.zshrc changes every future shell \u2014 often just PATH or env vars, but review what is added.",
+    scope: "all",
+    pattern: SHELL_RC,
+    alsoRequires: WRITE_OP,
+    unless: EXEC_PAYLOAD
+    // reported by 'persistence' as high instead
+  },
+  {
+    id: "safety-bypass",
+    severity: "high",
+    title: "Disables agent or tool safety checks",
+    why: "Turning off permission prompts, sandboxes, hooks or TLS verification removes the guardrails that catch mistakes and attacks.",
+    scope: "all",
+    pattern: /--dangerously-skip-permissions|dangerouslyDisableSandbox|bypassPermissions|--yolo\b|--full-auto\b|--dangerously-bypass-approvals|--trust-all-tools|autoApprove["']?\s*:\s*true|\bGIT_SSL_NO_VERIFY\b|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*['"]?0|\bverify\s*=\s*False\b/i
+  },
+  {
+    id: "weakened-checks",
+    severity: "medium",
+    title: "Skips hooks, TLS checks or browser sandbox",
+    why: "Sometimes needed (CI containers, local certs) but each one turns off a check that exists for a reason.",
+    scope: "all",
+    pattern: /git\s+(commit|push)\b[^\n]*--no-verify|--no-sandbox\b|\bcurl\b[^\n]*\s(-k|--insecure)\b/i
+  },
+  {
+    id: "destructive-command",
+    severity: "high",
+    title: "Destructive filesystem or disk command",
+    why: "Can irreversibly delete the home directory, the whole filesystem, or wipe a disk.",
+    scope: "all",
+    pattern: /\brm\s+(-[a-zA-Z]*\s+)*-[a-zA-Z]*r[a-zA-Z]*\s+(-[a-zA-Z]+\s+)*(\/|~|\$HOME|\/\*|~\/\*|\*|\.\/\*|"\$HOME")(\s|$|;|&)|\bmkfs(\.\w+)?\s|\bdd\s+[^\n]*of=\/dev\/(sd|disk|nvme|hd)|:\(\)\s*\{\s*:\|:&\s*\};:|\bshred\s+[^\n]*\/dev\//
+  },
+  {
+    id: "agent-config-tamper",
+    severity: "high",
+    title: "Modifies agent configuration or instructions",
+    why: "Writing to settings, hooks, MCP config or CLAUDE.md/AGENTS.md lets a skill persist behavior or grant itself permissions beyond its own scope.",
+    scope: "all",
+    pattern: AGENT_CONFIG,
+    alsoRequires: WRITE_OP
+  },
+  {
+    id: "agent-extension-write",
+    severity: "medium",
+    title: "Writes agent commands, subagents or skills",
+    why: "Adds instructions the agent may load later; check what gets written.",
+    scope: "all",
+    pattern: AGENT_EXTENSIONS,
+    alsoRequires: WRITE_OP
+  },
+  {
+    id: "persistence",
+    severity: "high",
+    title: "Installs persistence (cron, launch agents, SSH keys, sudoers, shell rc payloads)",
+    why: "Changes that survive the session and run code later or grant remote access.",
+    scope: "all",
+    pattern: PERSISTENCE,
+    alsoRequires: WRITE_OP
+  },
+  {
+    id: "persistence",
+    severity: "high",
+    title: "Installs persistence (cron, launch agents, SSH keys, sudoers, shell rc payloads)",
+    why: "Code appended to shell startup files runs in every future shell.",
+    scope: "all",
+    // rc file + executable payload on the same line (plus a write, below)
+    pattern: new RegExp(`^(?=.*(?:${SHELL_RC.source}))(?=.*(?:${EXEC_PAYLOAD.source}))`, "i"),
+    alsoRequires: WRITE_OP
+  },
+  {
+    id: "download-and-run",
+    severity: "high",
+    title: "Downloads a binary and runs it",
+    why: "Fetching an executable and running it bypasses package-manager integrity checks.",
+    scope: "all",
+    pattern: /\b(curl|wget)\b[^\n]*(-o|-O|--output)\s*\S+[^\n]*&&[^\n]*(chmod\s+\+x|\.\/\S+|sudo\s+\S+)/i
+  },
+  // ── medium: suspicious but often legitimate ──
+  {
+    id: "credential-access",
+    severity: "medium",
+    title: "Reads credential files or secret env vars",
+    why: "Legitimate for some tools, but a skill touching secrets deserves a human look.",
+    scope: "code",
+    pattern: SENSITIVE,
+    unless: NETWORK_SEND
+    // same-line network use is already reported as critical
+  },
+  {
+    id: "raw-ip-url",
+    severity: "medium",
+    title: "Talks to a raw IP address",
+    why: "Hardcoded public IPs are a common way to hide command-and-control or exfil hosts.",
+    scope: "all",
+    pattern: /\b(https?|ftp|tcp):\/\/(\d{1,3}\.){3}\d{1,3}\b/i,
+    unless: /\b(https?|ftp|tcp):\/\/(127\.|0\.0\.0\.0|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)/i
+  },
+  {
+    id: "url-shortener",
+    severity: "medium",
+    title: "Uses a URL shortener",
+    why: "Shortened links hide the real destination from reviewers.",
+    scope: "all",
+    pattern: /\bhttps?:\/\/(bit\.ly|tinyurl\.com|t\.co|goo\.gl|is\.gd|cutt\.ly|rb\.gy|shorturl\.at|ow\.ly)\//i
+  },
+  {
+    id: "obfuscated-blob",
+    severity: "medium",
+    title: "Large encoded blob",
+    why: "Long base64/hex strings can smuggle payloads past review.",
+    scope: "all",
+    pattern: /[A-Za-z0-9+/]{240,}={0,2}|(\\x[0-9a-fA-F]{2}){40,}/,
+    unless: /data:(image|font)\/|sha(256|384|512)-|integrity=/i
+  },
+  {
+    id: "privilege-escalation",
+    severity: "medium",
+    title: "Uses sudo or world-writable permissions",
+    why: "Root access or chmod 777 widens the blast radius of anything the skill runs.",
+    scope: "all",
+    pattern: /(^|[\s;&|`(])sudo\s+\S|\bchmod\s+(-R\s+)?(777|a\+rwx|o\+w)\b/
+  },
+  {
+    id: "history-rewrite",
+    severity: "medium",
+    title: "Rewrites or discards git history",
+    why: "Force-push and hard reset can destroy other people's work or uncommitted changes.",
+    scope: "all",
+    pattern: /\bgit\s+push\b[^\n]*(--force\b|-f\b)(?!-with-lease)|\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-[a-zA-Z]*f[a-zA-Z]*d|\bgit\s+filter-(branch|repo)\b/
+  },
+  // ── low: informational ──
+  {
+    id: "dynamic-eval",
+    severity: "low",
+    title: "Dynamic code evaluation",
+    why: "eval/exec of computed strings makes behavior hard to audit.",
+    scope: "code",
+    pattern: /\beval\s*\(|\bnew\s+Function\s*\(|\bexec\s*\(\s*compile\(/
+  },
+  {
+    id: "unpinned-install",
+    severity: "low",
+    title: "Installs packages without pinned versions",
+    why: "Unpinned installs pull whatever is latest \u2014 the vector used in the 2026 npm supply-chain wave.",
+    scope: "all",
+    pattern: /\bnpm\s+(i|install)\s+(-g\s+)?(?![^\n]*@\d)[a-z@][\w@/.-]*(\s|$)|\bpip3?\s+install\s+(?![^\n]*(==|-r\s|-e\s|\.))[a-zA-Z][\w.-]*(\s|$)/i,
+    unless: /\bnpm\s+(i|install)\s*$|--save-dev\s*$|npm\s+ci\b/
+  }
+];
+var HIDDEN_UNICODE = /[​-‍⁠-⁤⁦-⁩‪-‮]|[\u{E0000}-\u{E007F}\u{E0100}-\u{E01EF}]/gu;
+
+// ../scanner/src/instructions.ts
+var WEIGHT = { high: 25, medium: 10, low: 3 };
+var README_HEADINGS = /^#{1,3}\s*(installation|install|license|licen[cs]e|contributing|contributors|badges?|table of contents|toc|features|screenshots?|demo|acknowledg(e)?ments?|sponsors?|changelog|roadmap|faq|support|authors?)\s*$/i;
+var COMMAND = /\b(npm|pnpm|yarn|bun|npx|bunx|pip|uv|poetry|pytest|python3?|go|cargo|make|just|gradle|\.\/gradlew|mvn|dotnet|bundle|rake|rails|php|composer|mix|deno|docker( compose)?|kubectl|terraform|tox|nox|ruff|eslint|prettier|tsc|jest|vitest|playwright)\s+[\w:./-]+/;
+var COMMAND_START = new RegExp(`^(?:sudo\\s+|\\w+=\\S+\\s+)*${COMMAND.source}`);
+var VAGUE = /\b(write (clean|good|readable|maintainable) code|follow best practices|use (good|meaningful|descriptive) (names|naming)|be careful|make sure (the )?code (is|works)|keep (it|things|the code) simple|use common sense|write (good|proper) tests)\b/i;
+var SECRET = /\b(sk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{30,}|xox[abpr]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|cgk_[A-Za-z0-9]{20,})/;
+var ABS_PATH = /(?:^|[\s`'"(])(\/Users\/[^/\s`'"]+|\/home\/[^/\s`'"]+|[A-Z]:\\Users\\[^\\\s`'"]+)/;
+var SHOUT = /\b(IMPORTANT|CRITICAL|MUST|NEVER|ALWAYS|DO NOT)\b/g;
+function grade(score) {
+  return score >= 90 ? "A" : score >= 75 ? "B" : score >= 60 ? "C" : score >= 40 ? "D" : "F";
+}
+function lintInstructions(content, filename = "AGENTS.md") {
+  const issues = [];
+  const lines = content.split(/\r?\n/);
+  const approxTokens = Math.ceil(content.length / 4);
+  let inFence = false;
+  let codeBlocks = 0;
+  let commands2 = 0;
+  let headings = 0;
+  const seen = /* @__PURE__ */ new Map();
+  lines.forEach((raw, i) => {
+    const line = raw.trimEnd();
+    const n = i + 1;
+    if (/^\s*(```|~~~)/.test(line)) {
+      if (!inFence) codeBlocks++;
+      inFence = !inFence;
+      return;
+    }
+    const code = inFence ? line : /^\s*\$\s/.test(line) ? line.replace(/^\s*\$\s/, "") : [...line.matchAll(/`([^`]+)`/g)].map((m) => m[1]).join("\n");
+    if (code && code.split("\n").some((c) => COMMAND_START.test(c.trim()))) commands2++;
+    if (inFence) return;
+    if (/^#{1,6}\s/.test(line)) {
+      headings++;
+      if (README_HEADINGS.test(line.trim())) {
+        issues.push({ id: "readme-section", severity: "medium", line: n, title: `README section "${line.replace(/^#+\s*/, "")}"`, detail: "Install/license/contributing sections are for humans and already in the README. In an instruction file they cost tokens every session without changing what the agent does." });
+      }
+    }
+    if (/!\[[^\]]*\]\(https?:\/\/(img\.)?shields\.io|badge(n)?\.svg|\[!\[/.test(line)) {
+      issues.push({ id: "badges", severity: "low", line: n, title: "Badges", detail: "Badges carry no instructions; drop them from the agent file." });
+    }
+    if (VAGUE.test(line)) {
+      issues.push({ id: "vague-rule", severity: "low", line: n, title: "Generic advice", detail: `"${line.trim().slice(0, 80)}" \u2014 agents already try to do this. Replace it with the project-specific rule you actually mean (naming scheme, error handling pattern, which test command).` });
+    }
+    if (SECRET.test(line)) {
+      issues.push({ id: "secret", severity: "high", line: n, title: "Looks like a secret", detail: "Instruction files are committed and sent to the model provider every session. Move the value to an env var or secret store and rotate it." });
+    }
+    if (ABS_PATH.test(line)) {
+      issues.push({ id: "absolute-path", severity: "low", line: n, title: "Machine-specific path", detail: "A home-directory path only works on one machine; use paths relative to the repo root." });
+    }
+    const key = line.trim().toLowerCase();
+    if (key.length > 30) {
+      if (seen.has(key)) issues.push({ id: "duplicate", severity: "low", line: n, title: "Repeated line", detail: `Same as line ${seen.get(key)}.` });
+      else seen.set(key, n);
+    }
+  });
+  if (approxTokens > 8e3) {
+    issues.push({ id: "too-long", severity: "high", title: `~${approxTokens.toLocaleString("en-US")} tokens`, detail: `${filename} is loaded into every session. Past a few thousand tokens it crowds out the task and rules get ignored \u2014 keep the essentials here and move reference material into docs the agent reads on demand (or skills).` });
+  } else if (approxTokens > 2500) {
+    issues.push({ id: "long", severity: "medium", title: `~${approxTokens.toLocaleString("en-US")} tokens`, detail: `${filename} is loaded into every session; aim for under ~2,500 tokens of rules and commands.` });
+  }
+  if (content.trim() && !commands2) {
+    issues.push({ id: "no-commands", severity: "medium", title: "No build/test commands", detail: "The most useful thing an instruction file gives an agent is the exact commands to build, test and lint. Without them it guesses (and often runs the wrong ones)." });
+  }
+  if (lines.length > 40 && headings < 2) {
+    issues.push({ id: "no-structure", severity: "low", title: "No sections", detail: "Split the file into a few headed sections (Commands, Architecture, Conventions, Don'ts) so rules are easy to find and update." });
+  }
+  const shouts = content.match(SHOUT)?.length ?? 0;
+  if (shouts > 15) {
+    issues.push({ id: "shouting", severity: "low", title: `${shouts} all-caps emphasis words`, detail: "When everything is IMPORTANT nothing is. Keep caps for the two or three rules that really are hard limits." });
+  }
+  const scan = scanSkill([{ path: filename.endsWith(".md") ? filename : `${filename}.md`, content }]);
+  for (const f of scan.findings) {
+    issues.push({ id: `security:${f.ruleId}`, severity: f.severity === "critical" || f.severity === "high" ? "high" : f.severity === "medium" ? "medium" : "low", line: f.line, title: f.title, detail: `${f.why} \u2014 ${f.snippet}` });
+  }
+  const order = { high: 0, medium: 1, low: 2 };
+  issues.sort((a, b) => order[a.severity] - order[b.severity] || (a.line ?? 0) - (b.line ?? 0));
+  const counted = /* @__PURE__ */ new Set();
+  let penalty = 0;
+  for (const i of issues) {
+    const k = i.severity === "low" ? i.id : `${i.id}:${i.line ?? ""}`;
+    if (counted.has(k)) continue;
+    counted.add(k);
+    penalty += WEIGHT[i.severity];
+  }
+  const score = content.trim() ? Math.max(0, 100 - penalty) : 0;
+  return { score, grade: grade(score), stats: { lines: lines.length, approxTokens, headings, codeBlocks, commands: commands2 }, issues: issues.slice(0, 100) };
+}
+
+// ../scanner/src/index.ts
+var SCANNER_VERSION = "1.2.0";
+var MAX_PER_RULE_PER_FILE = 5;
+var SEVERITY_ORDER = ["critical", "high", "medium", "low"];
+var MARKDOWN_EXT = /\.(md|mdx|markdown|txt|rst)$/i;
+var SCANNABLE_EXT = /\.(md|mdx|markdown|txt|rst|sh|bash|zsh|fish|ps1|psm1|bat|cmd|py|js|mjs|cjs|ts|mts|cts|rb|pl|php|lua|go|rs|json|jsonc|ya?ml|toml|ini|cfg|conf|env|plist)$|(^|\/)(Makefile|Dockerfile|justfile)$/i;
+function fileScope(path) {
+  return MARKDOWN_EXT.test(path) || !/\.[a-z0-9]+$/i.test(path.split("/").pop() ?? "") ? "markdown" : "code";
+}
+function visible(s) {
+  return s.replace(HIDDEN_UNICODE, (c) => `\u27E6U+${c.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")}\u27E7`);
+}
+function snippetOf(line) {
+  const t = visible(line.trim());
+  return t.length > 160 ? `${t.slice(0, 157)}\u2026` : t;
+}
+function looksQuoted(line, rule) {
+  const m = rule.pattern.exec(line);
+  if (!m) return false;
+  const before = line.slice(0, m.index);
+  if (/^\s*>/.test(line)) return true;
+  if (/(\s-c|\beval|\bexec(Sync)?|\bsystem|\bspawn|\bsubprocess\.\w+|\bos\.popen)\s*\(?\s*[\[(]?\s*["'`][^"'`]*$/.test(before)) return false;
+  const opens = (before.match(/["“'`]/g) ?? []).length;
+  return opens % 2 === 1;
+}
+var ATTACK_REFERENCE = /(^|\/)(references?|docs?|examples?|patterns?)\/[^/]*(attack|exploit|vuln|dangerous|malicious|injection|payload|threat|cve|pwn|insecure|supply-chain|evasion)[^/]*\.(md|mdx|txt)$/i;
+var CODE_COMMENT = /^\s*(#(?!!)|\/\/|--\s|\/?\*|<!--|REM\s|::)/i;
+var PATTERN_DEFINITION = /\\[sbdwSW]|\bre\.(compile|search|match)\b|new RegExp\(|\br["']\S/;
+var DESCRIPTIVE_KEY = /^\s*["']?(example|examples|description|desc|pattern|patterns|message|reason|title|name|label|comment|note|bad|dangerous|blocked|deny|denylist)["']?\s*[:=]/i;
+var NEGATED_BEFORE = /\b(not|never|avoid|instead\s+of|rather\s+than|don't\s+use|do\s+not\s+use)\s*[`"'(]*$/i;
+var WARNING_CONTEXT = /\b(never|avoid|dangerous|malicious|attackers?|vulnerable|insecure|anti-?pattern)\b|❌|⚠️?|🚫|⛔/i;
+function adjust(rule, scope, path, lines, idx) {
+  const line = lines[idx];
+  if (rule.severity === "low" || rule.severity === "medium") {
+    return { severity: rule.severity };
+  }
+  if (scope === "markdown" && ATTACK_REFERENCE.test(path)) {
+    return { severity: "medium", note: "in attack/vulnerability reference material" };
+  }
+  if (/(^|\/)\.(github\/workflows|gitlab-ci|circleci)\b|(^|\/)\.gitlab-ci\.ya?ml$/.test(path)) {
+    return { severity: "medium", note: "runs in CI, not on the agent's machine" };
+  }
+  if (scope === "code") {
+    if (CODE_COMMENT.test(line)) return { severity: "low", note: "in a code comment" };
+    if (PATTERN_DEFINITION.test(line)) return { severity: "low", note: "in a pattern/denylist definition" };
+    if (/\.(json|jsonc|ya?ml|toml)$/i.test(path) && DESCRIPTIVE_KEY.test(line)) {
+      return { severity: "low", note: "descriptive data field" };
+    }
+  }
+  if (rule.id === "prompt-injection" && looksQuoted(line, rule)) {
+    return { severity: "medium", note: "quoted \u2014 likely an example" };
+  }
+  if (scope === "markdown" && rule.id !== "prompt-injection") {
+    const m = rule.pattern.exec(line);
+    if (m && NEGATED_BEFORE.test(line.slice(0, m.index))) return { severity: "medium", note: "advised against" };
+  }
+  if (scope === "markdown" && rule.id !== "prompt-injection") {
+    const prose = [];
+    for (let j = idx - 1; j >= 0 && j >= idx - 6 && prose.length < 2; j--) {
+      if (lines[j].trim() && !/^\s*(```|~~~)/.test(lines[j])) prose.push(lines[j]);
+    }
+    const context = [...prose, line.replace(rule.pattern, "")].join("\n");
+    if (WARNING_CONTEXT.test(context)) return { severity: "medium", note: "appears in a warning/example" };
+  }
+  return { severity: rule.severity };
+}
+var PICTOGRAPH = new RegExp("\\p{Extended_Pictographic}", "u");
+function hiddenChars(line, isFirstLine) {
+  const found = [];
+  for (const m of line.matchAll(HIDDEN_UNICODE)) {
+    const ch = m[0];
+    const i = m.index ?? 0;
+    if (ch === "\uFEFF" && isFirstLine && i === 0) continue;
+    if (ch === "\u200D") {
+      const neighbors = [i - 1, i - 2, i + 1].filter((j) => j >= 0 && j < line.length).map((j) => String.fromCodePoint(line.codePointAt(j)));
+      if (neighbors.some((c) => PICTOGRAPH.test(c))) continue;
+    }
+    found.push(`U+${ch.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")}`);
+  }
+  return found;
+}
+function matches(rule, text2) {
+  return rule.pattern.test(text2) && (!rule.alsoRequires || rule.alsoRequires.test(text2)) && !(rule.unless && rule.unless.test(text2));
+}
+function scanSkill(files) {
+  const findings = [];
+  const hash = createHash("sha256");
+  const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
+  for (const file of sorted) {
+    hash.update(file.path).update("\0").update(file.content).update("\0");
+    const scope = fileScope(file.path);
+    const perRule = /* @__PURE__ */ new Map();
+    const push = (f) => {
+      const n = perRule.get(f.ruleId) ?? 0;
+      if (n >= MAX_PER_RULE_PER_FILE) return;
+      perRule.set(f.ruleId, n + 1);
+      findings.push(f);
+    };
+    const lines = file.content.split(/\r?\n/);
+    let inFence = false;
+    lines.forEach((physical, idx) => {
+      if (scope === "markdown" && /^\s*(```|~~~)/.test(physical)) inFence = !inFence;
+      const lineNo = idx + 1;
+      if (idx > 0 && /\\\s*$/.test(lines[idx - 1])) return;
+      let line = physical;
+      for (let j = idx; /\\\s*$/.test(lines[j] ?? "") && j + 1 < lines.length && j - idx < 20; j++) {
+        line = `${line.replace(/\\\s*$/, " ")}${lines[j + 1]}`;
+      }
+      const hidden = hiddenChars(line, idx === 0);
+      if (hidden.length) {
+        const inReference = scope === "markdown" && ATTACK_REFERENCE.test(file.path);
+        push({
+          ruleId: "hidden-unicode",
+          severity: inReference ? "medium" : "critical",
+          title: `Hidden unicode characters (${[...new Set(hidden)].join(", ")})${inReference ? " (in attack/vulnerability reference material)" : ""}`,
+          why: "Invisible or direction-changing characters can hide instructions from human reviewers while the agent still reads them (TrapDoor / Trojan Source).",
+          file: file.path,
+          line: lineNo,
+          snippet: snippetOf(line)
+        });
+      }
+      const prose = scope === "markdown" && !inFence ? line.replace(/^\s*(?:>\s?)+/, "").replace(/<[a-z][\w -]{0,30}>/gi, "") : line;
+      for (const rule of LINE_RULES) {
+        if (rule.scope !== "all" && rule.scope !== scope) continue;
+        if (!matches(rule, rule.alsoRequires === WRITE_OP ? prose : line)) continue;
+        if (scope === "markdown" && rule.alsoRequires && !inFence && line.includes("`")) {
+          const spans = line.match(/`[^`]+`/g) ?? [];
+          if (!spans.some((sp) => matches(rule, sp))) continue;
+        }
+        const { severity, note } = adjust(rule, scope, file.path, lines, idx);
+        const title = note ? `${rule.title} (${note})` : rule.title;
+        push({ ruleId: rule.id, severity, title, why: rule.why, file: file.path, line: lineNo, snippet: snippetOf(line) });
+      }
+    });
+  }
+  findings.sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
+  const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+  for (const f of findings) counts[f.severity]++;
+  return {
+    status: statusOf(counts),
+    counts,
+    findings,
+    filesScanned: files.length,
+    contentHash: hash.digest("hex"),
+    scannerVersion: SCANNER_VERSION
+  };
+}
+function statusOf(counts) {
+  if (counts.critical > 0 || counts.high > 0) return "flagged";
+  if (counts.medium > 0) return "warn";
+  return "passed";
+}
+function summarize(result) {
+  const parts = SEVERITY_ORDER.filter((s) => result.counts[s] > 0).map((s) => `${result.counts[s]} ${s}`);
+  return parts.length ? `${result.status}: ${parts.join(", ")}` : result.status;
+}
+
+// src/local-scan.ts
+var MAX_FILE_BYTES = 1e5;
+var MAX_FILES_PER_SKILL = 200;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".venv", "venv", "__pycache__"]);
+function defaultSkillRoots(cwd = process.cwd()) {
+  const h = homedir();
+  return [
+    join(h, ".claude", "skills"),
+    join(h, ".claude", "plugins"),
+    join(h, ".codex", "skills"),
+    join(h, ".agents", "skills"),
+    join(h, ".hermes", "skills"),
+    join(h, ".config", "opencode", "skills"),
+    join(h, ".cursor", "skills"),
+    join(h, ".openclaude", "skills"),
+    join(h, ".gemini", "skills"),
+    join(h, ".kimi-code", "skills"),
+    join(h, ".openclaw", "skills"),
+    join(h, ".copilot", "skills"),
+    join(h, ".codeium", "windsurf", "skills"),
+    join(h, ".config", "devin", "skills"),
+    join(h, ".cline", "skills"),
+    join(cwd, ".claude", "skills"),
+    join(cwd, ".agents", "skills"),
+    join(cwd, ".cursor", "skills"),
+    join(cwd, ".github", "skills"),
+    join(cwd, ".devin", "skills"),
+    join(cwd, ".windsurf", "skills"),
+    join(cwd, ".cline", "skills"),
+    join(cwd, ".clinerules", "skills"),
+    join(cwd, ".opencode", "skills"),
+    join(cwd, ".gemini", "skills")
+  ];
+}
+async function exists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function findSkillDirs(root, depth = 6, out = []) {
+  let entries;
+  try {
+    entries = await readdir(root, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  if (entries.some((e) => e.isFile() && /^SKILL\.md$/i.test(e.name))) out.push(root);
+  if (depth > 0) {
+    for (const e of entries) {
+      if (e.isDirectory() && !SKIP_DIRS.has(e.name)) await findSkillDirs(join(root, e.name), depth - 1, out);
+    }
+  }
+  return out;
+}
+async function collectFiles(dir) {
+  const files = [];
+  const skipped = [];
+  async function walk(d, depth) {
+    if (depth < 0) return;
+    for (const e of await readdir(d, { withFileTypes: true })) {
+      const full = join(d, e.name);
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name)) await walk(full, depth - 1);
+      } else if (e.isFile() && SCANNABLE_EXT.test(e.name)) {
+        const rel = relative(dir, full);
+        const size = (await stat(full)).size;
+        if (size > MAX_FILE_BYTES || files.length >= MAX_FILES_PER_SKILL) skipped.push(rel);
+        else files.push({ path: rel, content: await readFile(full, "utf8") });
+      }
+    }
+  }
+  await walk(dir, 5);
+  return { files, skipped };
+}
+async function scanLocalSkills(paths) {
+  const roots = [];
+  for (const p of paths?.length ? paths.map((x) => resolve(x.replace(/^~(?=$|\/)/, homedir()))) : defaultSkillRoots()) {
+    if (await exists(p)) roots.push(p);
+  }
+  const dirs = [...new Set((await Promise.all(roots.map((r) => findSkillDirs(r)))).flat())];
+  const reports = [];
+  for (const dir of dirs) {
+    const { files, skipped } = await collectFiles(dir);
+    reports.push({ dir, result: scanSkill(files), skipped });
+  }
+  const rank = { flagged: 0, warn: 1, passed: 2 };
+  reports.sort((a, b) => rank[a.result.status] - rank[b.result.status] || a.dir.localeCompare(b.dir));
+  return { roots, reports };
+}
+function formatLocalScan({ roots, reports }, verbose = false) {
+  if (!roots.length) return "No skill directories found. Pass `paths` to scan a specific location.";
+  const home = homedir();
+  const short = (p) => p.startsWith(home) ? `~${p.slice(home.length)}` : p;
+  const counts = { flagged: 0, warn: 0, passed: 0 };
+  for (const r of reports) counts[r.result.status]++;
+  const lines = [
+    `Scanned ${reports.length} skills locally (nothing was uploaded) in: ${roots.map(short).join(", ")}`,
+    `flagged ${counts.flagged} \xB7 warn ${counts.warn} \xB7 passed ${counts.passed}`,
+    ""
+  ];
+  for (const r of reports) {
+    if (r.result.status === "passed" && !verbose) continue;
+    lines.push(`[${r.result.status.toUpperCase()}] ${short(r.dir)} \u2014 ${summarize(r.result)}`);
+    const shown = r.result.findings.filter((f) => verbose || f.severity !== "low").slice(0, verbose ? 50 : 5);
+    for (const f of shown) lines.push(`  - ${f.severity}: ${f.title} \u2014 ${f.file}:${f.line}  ${f.snippet}`);
+    if (r.skipped.length) lines.push(`  - not scanned (too large/many): ${r.skipped.slice(0, 5).join(", ")}`);
+  }
+  if (counts.flagged) {
+    lines.push(
+      "",
+      "Flagged skills need a human decision. Show these findings to the user and ask before using, updating or removing them. Do not delete or modify skills on your own."
+    );
+  }
+  return lines.join("\n");
+}
+
+// src/stack-detect.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { basename, dirname, join as join2, relative as relative2, resolve as resolve2, sep } from "node:path";
+async function read(path) {
+  try {
+    return await readFile2(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function isDir(path) {
+  try {
+    return (await stat2(path)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isExactVersion(v) {
+  return !!v && /^v?\d+\.\d+\.\d+(?:[-+.][0-9A-Za-z.-]+)?$/.test(v.trim());
+}
+var pep503 = (name) => name.toLowerCase().replace(/[-_.]+/g, "-");
+var unquote = (s) => s.trim().replace(/^['"]|['"]$/g, "");
+function fromPackageJson(raw) {
+  try {
+    const pkg = JSON.parse(raw);
+    return [pkg.dependencies, pkg.devDependencies, pkg.optionalDependencies].flatMap((deps) => Object.entries(deps ?? {})).map(([name, spec]) => ({ name, spec: String(spec).trim() })).filter((d) => !/^(workspace:|file:|link:|portal:)/.test(d.spec));
+  } catch {
+    return [];
+  }
+}
+function nodeEngine(raw) {
+  try {
+    const e = JSON.parse(raw).engines?.node;
+    return e ? String(e).trim().slice(0, 64) : null;
+  } catch {
+    return null;
+  }
+}
+function npmLockResolver(raw, rel) {
+  let lock;
+  try {
+    lock = JSON.parse(raw);
+  } catch {
+    return () => null;
+  }
+  const prefix = rel && rel !== "." ? `${rel.split(sep).join("/")}/` : "";
+  return (name) => {
+    const p = lock.packages;
+    if (p) {
+      const hit = prefix && p[`${prefix}node_modules/${name}`] || p[`node_modules/${name}`];
+      if (hit && !hit.link && hit.version && !/^(file|link):/.test(hit.version)) return hit.version;
+      return null;
+    }
+    return lock.dependencies?.[name]?.version ?? null;
+  };
+}
+function pnpmLockResolver(raw, rel) {
+  const importer = !rel || rel === "." ? "." : rel.split(sep).join("/");
+  const out = /* @__PURE__ */ new Map();
+  const clean = (v) => unquote(v).replace(/\(.*$/, "").replace(/_.*$/, "");
+  let inImporters = false;
+  let current = null;
+  let pkg = null;
+  let inDeps = false;
+  for (const line of raw.split("\n")) {
+    if (/^importers:\s*$/.test(line)) {
+      inImporters = true;
+      continue;
+    }
+    if (!inImporters) continue;
+    if (/^\S/.test(line)) break;
+    let m = line.match(/^ {2}(\S.*?):\s*$/);
+    if (m) {
+      current = unquote(m[1]);
+      inDeps = false;
+      continue;
+    }
+    if (current !== importer) continue;
+    m = line.match(/^ {4}(\S+):\s*$/);
+    if (m) {
+      inDeps = /^(dependencies|devDependencies|optionalDependencies)$/.test(m[1]);
+      continue;
+    }
+    if (!inDeps) continue;
+    m = line.match(/^ {6}(\S.*?):\s*(.*)$/);
+    if (m) {
+      pkg = unquote(m[1]);
+      if (m[2] && !/^\s*$/.test(m[2])) out.set(pkg, clean(m[2]));
+      continue;
+    }
+    m = line.match(/^ {8}version:\s*(.+)$/);
+    if (m && pkg) out.set(pkg, clean(m[1]));
+  }
+  return (name) => {
+    const v = out.get(name);
+    return v && !/^(link|file|workspace):/.test(v) ? v : null;
+  };
+}
+function yarnLockResolver(raw) {
+  const bySpec = /* @__PURE__ */ new Map();
+  const byName = /* @__PURE__ */ new Map();
+  let keys = [];
+  for (const line of raw.split("\n")) {
+    if (/^\S.*:\s*$/.test(line) && !line.startsWith("#") && !line.startsWith("__metadata")) {
+      keys = line.replace(/:\s*$/, "").split(/,\s*/).map(unquote).filter(Boolean);
+      continue;
+    }
+    const m = line.match(/^ {2}version:?\s+"?([^"\s]+)"?\s*$/);
+    if (m && keys.length) {
+      for (const k of keys) {
+        const at = k.lastIndexOf("@");
+        if (at <= 0) continue;
+        const name = k.slice(0, at);
+        const spec = k.slice(at + 1).replace(/^npm:/, "");
+        bySpec.set(`${name}@${spec}`, m[1]);
+        if (!byName.has(name)) byName.set(name, m[1]);
+      }
+      keys = [];
+    }
+  }
+  return (name, spec) => bySpec.get(`${name}@${spec}`) ?? byName.get(name) ?? null;
+}
+function bunLockResolver(raw) {
+  let pkgs = {};
+  try {
+    pkgs = JSON.parse(raw.replace(/,(\s*[}\]])/g, "$1")).packages ?? {};
+  } catch {
+    return () => null;
+  }
+  return (name) => {
+    const id = pkgs[name]?.[0];
+    if (typeof id !== "string") return null;
+    const v = id.slice(id.lastIndexOf("@") + 1);
+    return /^\d/.test(v) ? v : null;
+  };
+}
+function fromRequirements(raw) {
+  return raw.split("\n").map((l) => l.replace(/#.*/, "").trim()).filter((l) => l && !l.startsWith("-") && !/^(git\+|https?:)/.test(l)).map((l) => {
+    const m = l.match(/^([A-Za-z0-9_.-]+)(?:\[.*?\])?\s*(===?|~=|>=|<=|!=|>|<)?\s*([\w.*+-]+)?/);
+    if (!m) return null;
+    const [, name, op, v] = m;
+    if (!v) return { name };
+    return { name, version: op === "==" || op === "===" ? v : `${op ?? ""}${v}`.slice(0, 64) };
+  }).filter((d) => d !== null);
+}
+function fromPyproject(raw) {
+  const pep621 = raw.match(/^\s*dependencies\s*=\s*\[([\s\S]*?)\]/m)?.[1] ?? "";
+  const deps = fromRequirements([...pep621.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]).join("\n"));
+  const poetry = raw.match(/^\[tool\.poetry\.(?:dev-)?dependencies\]\s*$([\s\S]*?)(?=^\[|(?![\s\S]))/m)?.[1] ?? "";
+  for (const m of poetry.matchAll(/^([A-Za-z0-9_.-]+)\s*=\s*(?:"([^"]*)"|\{[^}]*version\s*=\s*"([^"]*)")/gm)) {
+    if (m[1].toLowerCase() === "python") continue;
+    deps.push({ name: m[1], ...m[2] ?? m[3] ? { version: (m[2] ?? m[3]).slice(0, 64) } : {} });
+  }
+  return deps;
+}
+function tomlPackages(raw, normalize = pep503) {
+  const out = /* @__PURE__ */ new Map();
+  for (const block of raw.split(/^\[\[package\]\]\s*$/m).slice(1)) {
+    const name = block.match(/^name\s*=\s*"([^"]+)"/m)?.[1];
+    const version = block.match(/^version\s*=\s*"([^"]+)"/m)?.[1];
+    if (name && version && !out.has(normalize(name))) out.set(normalize(name), version);
+  }
+  return out;
+}
+function pipfileLock(raw) {
+  const out = /* @__PURE__ */ new Map();
+  try {
+    const j = JSON.parse(raw);
+    for (const section of [j.default, j.develop]) {
+      for (const [name, v] of Object.entries(section ?? {})) {
+        const ver = v.version?.replace(/^==/, "");
+        if (ver) out.set(pep503(name), ver);
+      }
+    }
+  } catch {
+  }
+  return out;
+}
+function fromGoMod(raw) {
+  return [...raw.matchAll(/^\s*(?:require\s+)?([\w.-]+\.[\w.-]+\/[\w./-]+)\s+(v[\w.+-]+)/gm)].map((m) => ({ name: m[1], version: m[2] }));
+}
+function fromCargoToml(raw) {
+  const deps = [];
+  const sections = raw.matchAll(/^\[(?:workspace\.)?(?:dev-|build-)?dependencies\]\s*$([\s\S]*?)(?=^\[|(?![\s\S]))/gm);
+  for (const s of sections) {
+    for (const m of s[1].matchAll(/^([A-Za-z0-9_-]+)\s*=\s*(?:"([^"]*)"|\{([^}]*)\})/gm)) {
+      const v = m[2] ?? m[3]?.match(/version\s*=\s*"([^"]*)"/)?.[1];
+      deps.push({ name: m[1], ...v ? { version: v.slice(0, 64) } : {} });
+    }
+  }
+  return deps;
+}
+async function runtimes(dir, pkgRaw) {
+  const out = [];
+  const node = (await read(join2(dir, ".nvmrc")))?.trim() || (await read(join2(dir, ".node-version")))?.trim();
+  const tool = await read(join2(dir, ".tool-versions"));
+  const toolNode = tool?.match(/^(?:nodejs|node)\s+(\S+)/m)?.[1];
+  const nodeVersion = node || toolNode || (pkgRaw ? nodeEngine(pkgRaw) : null);
+  if (nodeVersion && /\d/.test(nodeVersion)) out.push({ name: "node", version: nodeVersion.replace(/^v/, "").slice(0, 64), runtime: true });
+  const py = (await read(join2(dir, ".python-version")))?.trim().split("\n")[0] || tool?.match(/^python\s+(\S+)/m)?.[1];
+  if (py && /^\d/.test(py)) out.push({ name: "python", version: py.slice(0, 64), runtime: true });
+  return out;
+}
+var SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "vendor", "venv", ".venv", "coverage", "tmp", "target", "__pycache__"]);
+async function subdirs(dir) {
+  try {
+    return (await readdir2(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".") && !SKIP.has(e.name)).map((e) => join2(dir, e.name));
+  } catch {
+    return [];
+  }
+}
+async function projectRoot(cwd) {
+  let dir = resolve2(cwd);
+  for (; ; ) {
+    if (await isDir(join2(dir, ".git")) || await read(join2(dir, ".git")) !== null) return dir;
+    const up = dirname(dir);
+    if (up === dir) return resolve2(cwd);
+    dir = up;
+  }
+}
+async function projectKey(cwd) {
+  const root = await projectRoot(cwd);
+  return `${basename(root).slice(0, 100)}#${createHash2("sha256").update(root).digest("hex").slice(0, 8)}`;
+}
+async function findUp(dir, stop, names) {
+  let d = dir;
+  for (; ; ) {
+    for (const n of names) if (await read(join2(d, n)) !== null) return { path: join2(d, n), dir: d };
+    if (d === stop || dirname(d) === d) return null;
+    d = dirname(d);
+  }
+}
+var NPM_LOCKS = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"];
+async function npmResolver(dir, root, used) {
+  const lock = await findUp(dir, root, NPM_LOCKS);
+  if (!lock) return () => null;
+  const raw = await read(lock.path) ?? "";
+  used.add(lock.path);
+  const rel = relative2(lock.dir, dir) || ".";
+  const file = basename(lock.path);
+  if (file === "pnpm-lock.yaml") return pnpmLockResolver(raw, rel);
+  if (file === "yarn.lock") return yarnLockResolver(raw);
+  if (file === "bun.lock") return bunLockResolver(raw);
+  return npmLockResolver(raw, rel);
+}
+async function pythonLock(dir, root, used) {
+  const lock = await findUp(dir, root, ["poetry.lock", "uv.lock", "Pipfile.lock"]);
+  if (!lock) return /* @__PURE__ */ new Map();
+  used.add(lock.path);
+  const raw = await read(lock.path) ?? "";
+  return basename(lock.path) === "Pipfile.lock" ? pipfileLock(raw) : tomlPackages(raw);
+}
+async function detectStack(cwd = process.cwd()) {
+  const base = resolve2(cwd);
+  const root = await projectRoot(base);
+  const level1 = await subdirs(base);
+  const level2 = (await Promise.all(level1.map(subdirs))).flat();
+  const dirs = [base, ...level1, ...level2].slice(0, 400);
+  const deps = /* @__PURE__ */ new Map();
+  const manifests = [];
+  const locks = /* @__PURE__ */ new Set();
+  const add = (d) => {
+    const key = `${d.runtime ? "runtime" : d.ecosystem}:${d.ecosystem === "pypi" ? pep503(d.name) : d.name.toLowerCase()}@${d.version ?? ""}`;
+    if (!deps.has(key)) deps.set(key, d);
+  };
+  const rel = (p) => relative2(base, p) || basename(p);
+  for (const dir of dirs) {
+    const pkgRaw = await read(join2(dir, "package.json"));
+    if (pkgRaw !== null) {
+      manifests.push(rel(join2(dir, "package.json")));
+      const resolveVersion = await npmResolver(dir, root, locks);
+      for (const { name, spec } of fromPackageJson(pkgRaw)) {
+        const locked = resolveVersion(name, spec);
+        add({ name, ecosystem: "npm", ...locked ?? spec ? { version: (locked ?? spec).slice(0, 64) } : {} });
+      }
+    }
+    for (const r of await runtimes(dir, pkgRaw)) add(r);
+    const req = await read(join2(dir, "requirements.txt"));
+    const pyproject = await read(join2(dir, "pyproject.toml"));
+    if (req !== null || pyproject !== null) {
+      const locked = await pythonLock(dir, root, locks);
+      const pyDeps = [...req !== null ? fromRequirements(req) : [], ...pyproject !== null ? fromPyproject(pyproject) : []];
+      if (req !== null) manifests.push(rel(join2(dir, "requirements.txt")));
+      if (pyproject !== null) manifests.push(rel(join2(dir, "pyproject.toml")));
+      for (const d of pyDeps) {
+        const v = locked.get(pep503(d.name)) ?? d.version;
+        add({ name: d.name, ecosystem: "pypi", ...v ? { version: v } : {} });
+      }
+    }
+    const gomod = await read(join2(dir, "go.mod"));
+    if (gomod !== null) {
+      manifests.push(rel(join2(dir, "go.mod")));
+      for (const d of fromGoMod(gomod)) add({ ...d, ecosystem: "go" });
+    }
+    const cargo = await read(join2(dir, "Cargo.toml"));
+    if (cargo !== null) {
+      manifests.push(rel(join2(dir, "Cargo.toml")));
+      const lock = await findUp(dir, root, ["Cargo.lock"]);
+      const locked = lock ? tomlPackages(await read(lock.path) ?? "", (n) => n.toLowerCase()) : /* @__PURE__ */ new Map();
+      if (lock) locks.add(lock.path);
+      for (const d of fromCargoToml(cargo)) {
+        const v = locked.get(d.name.toLowerCase()) ?? d.version;
+        add({ name: d.name, ecosystem: "cargo", ...v ? { version: v } : {} });
+      }
+    }
+  }
+  const all = [...deps.values()];
+  const exactOf = (d) => d.ecosystem === "go" && !!d.version || isExactVersion(d.version);
+  all.sort((a, b) => Number(exactOf(b)) - Number(exactOf(a)));
+  const sent = all.slice(0, 300);
+  const exact = sent.filter((d) => !d.runtime && exactOf(d)).length;
+  return {
+    deps: sent,
+    manifests,
+    lockfiles: [...locks].map((p) => relative2(base, p) || basename(p)),
+    exact,
+    ranges: sent.filter((d) => !d.runtime).length - exact
+  };
+}
+async function installedSkillNames(skillDirs) {
+  const names = /* @__PURE__ */ new Set();
+  for (const dir of skillDirs) {
+    const md = await read(join2(dir, "SKILL.md"));
+    const fm = md?.match(/^---\r?\n[\s\S]*?^name:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim();
+    names.add((fm || basename(dir)).slice(0, 120));
+  }
+  return [...names];
+}
+
+// src/guard.ts
+function commands(line) {
+  return line.split(/&&|\|\||[;|\n]/).map((c) => (c.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((w) => w.replace(/^["']|["']$/g, ""))).filter((w) => w.length);
+}
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["-r", "--requirement", "-c", "--constraint", "-e", "--editable", "-i", "--index-url", "--extra-index-url", "-f", "--find-links", "--registry", "--tag", "--filter", "-w", "--workspace", "--cwd", "--prefix", "-C", "--dir", "--python", "-p", "--group", "-G", "--source", "--features", "-F", "--package", "--with"]);
+function args(words) {
+  const out = [];
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (w.startsWith("-")) {
+      if (VALUE_FLAGS.has(w)) i++;
+      continue;
+    }
+    out.push(w);
+  }
+  return out;
+}
+var isLocalOrUrl = (s) => /^(\.{0,2}\/|~|file:|git[+:]|https?:|github:|link:|workspace:)/.test(s) || /\.(tgz|tar\.gz|whl|zip)$/.test(s);
+function npmSpec(s) {
+  if (isLocalOrUrl(s) || /^[\w.-]+\/[\w.-]+$/.test(s)) return null;
+  const m = s.match(/^(@[^/@\s]+\/[^@\s]+|[^@\s]+)(?:@(.+))?$/);
+  if (!m || !/^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/i.test(m[1])) return null;
+  const version = m[2] && /\d/.test(m[2]) ? m[2] : void 0;
+  return { name: m[1], ecosystem: "npm", ...version ? { version } : {} };
+}
+function pySpec(s) {
+  if (isLocalOrUrl(s)) return null;
+  const m = s.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*(?:(==|~=|>=|<=|>|<|!=)\s*([^,;\s]+))?/);
+  if (!m) return null;
+  return { name: m[1], ecosystem: "pypi", ...m[3] ? { version: m[3] } : {} };
+}
+function cargoSpec(s) {
+  const m = s.match(/^([A-Za-z0-9_-]+)(?:@(.+))?$/);
+  return m ? { name: m[1], ecosystem: "cargo", ...m[2] ? { version: m[2] } : {} } : null;
+}
+function goSpec(s) {
+  const m = s.match(/^([a-z0-9.-]+\.[a-z]{2,}\/[^@\s]+?)(?:\/\.\.\.)?(?:@(.+))?$/i);
+  if (!m) return null;
+  const version = m[2] && /^v\d/.test(m[2]) ? m[2] : void 0;
+  return { name: m[1], ecosystem: "go", ...version ? { version } : {} };
+}
+function packagesInCommand(line) {
+  const out = [];
+  for (let words of commands(line)) {
+    while (words.length && /^(sudo|env|\w+=\S*|time|nice|command)$/.test(words[0])) words = words.slice(1);
+    const [tool, sub, ...rest] = words;
+    if (!tool) continue;
+    const bin = tool.split("/").pop();
+    let specs = [];
+    if (bin === "npm" && ["install", "i", "add", "in", "isntall"].includes(sub)) specs = args(rest).map(npmSpec);
+    else if (bin === "pnpm" && ["add", "install", "i"].includes(sub)) specs = args(rest).map(npmSpec);
+    else if (bin === "yarn" && sub === "add") specs = args(rest).map(npmSpec);
+    else if (bin === "bun" && ["add", "install", "i"].includes(sub)) specs = args(rest).map(npmSpec);
+    else if (["npx", "bunx"].includes(bin)) specs = [npmSpec(args([sub, ...rest].filter(Boolean))[0] ?? "")];
+    else if ((bin === "pnpm" || bin === "yarn") && sub === "dlx") specs = [npmSpec(args(rest)[0] ?? "")];
+    else if (/^pip3?$/.test(bin) && sub === "install") specs = args(rest).map(pySpec);
+    else if (/^python3?$/.test(bin) && sub === "-m" && /^pip3?$/.test(rest[0] ?? "") && rest[1] === "install") specs = args(rest.slice(2)).map(pySpec);
+    else if (bin === "uv" && sub === "add") specs = args(rest).map(pySpec);
+    else if (bin === "uv" && sub === "pip" && rest[0] === "install") specs = args(rest.slice(1)).map(pySpec);
+    else if (bin === "uv" && sub === "tool" && rest[0] === "install") specs = args(rest.slice(1)).map(pySpec);
+    else if (bin === "uvx" || bin === "pipx" && sub === "run") specs = [pySpec(args(bin === "uvx" ? [sub, ...rest].filter(Boolean) : rest)[0] ?? "")];
+    else if (bin === "pipx" && sub === "install") specs = args(rest).map(pySpec);
+    else if (bin === "poetry" && sub === "add") specs = args(rest).map(pySpec);
+    else if (bin === "cargo" && (sub === "add" || sub === "install")) specs = args(rest).map(cargoSpec);
+    else if (bin === "go" && (sub === "get" || sub === "install")) specs = args(rest).map(goSpec);
+    for (const s of specs) if (s) out.push(s);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return out.filter((p) => !seen.has(`${p.ecosystem}:${p.name}`) && !!seen.add(`${p.ecosystem}:${p.name}`)).slice(0, 25);
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function runGuard(opts) {
+  let command = "";
+  try {
+    const payload = JSON.parse(await readStdin());
+    command = payload.tool_input?.command ?? "";
+  } catch {
+    return 0;
+  }
+  const packages = packagesInCommand(command);
+  if (!packages.length) return 0;
+  if (!opts.key) {
+    console.error("codexguild guard: CODEXGUILD_API_KEY is not set \u2014 packages were not checked.");
+    return 0;
+  }
+  let results;
+  try {
+    const res = await fetch(`${opts.api}/packages/check`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${opts.key}` },
+      body: JSON.stringify({ packages }),
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    results = (await res.json()).results;
+  } catch (e) {
+    console.error(`codexguild guard: check failed (${e instanceof Error ? e.message : e}) \u2014 command not blocked.`);
+    return 0;
+  }
+  const decision = guardDecision(results);
+  if (decision) {
+    process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: decision.decision, permissionDecisionReason: decision.reason } }));
+  }
+  return 0;
+}
+function guardDecision(results) {
+  const flagged = results.filter((r) => r.verdict === "block" || r.verdict === "warn");
+  if (!flagged.length) return null;
+  const lines = flagged.map((r) => `${r.verdict === "block" ? "BLOCKED" : "Check"} ${r.ecosystem}:${r.name}${r.version ? `@${r.version}` : ""} \u2014 ${r.reasons.join(" ")}`);
+  const blocked = flagged.some((r) => r.verdict === "block");
+  return {
+    decision: blocked ? "deny" : "ask",
+    reason: `CodexGuild package check:
+${lines.join("\n")}${blocked ? "\nUse the correct package name, or ask the user before trying again." : ""}`
+  };
+}
+
+// src/index.ts
+var API = (process.env.CODEXGUILD_API_URL || "https://api.codexguild.com/v1").replace(/\/$/, "");
+var KEY = process.env.CODEXGUILD_API_KEY ?? "";
+var VERSION = "1.4.0";
+if (process.argv[2] === "guard") process.exit(await runGuard({ api: API, key: KEY }));
+var INSTRUCTION_FILES = ["CLAUDE.md", ".claude/CLAUDE.md", "AGENTS.md", "AGENTS.override.md", ".hermes.md", "HERMES.md", "GEMINI.md", ".cursorrules"];
+async function existingInstructionFiles(cwd) {
+  const present = await Promise.all(INSTRUCTION_FILES.map((f) => access(join3(cwd, f)).then(() => f, () => null)));
+  return present.filter((f) => f !== null);
+}
+var remote = null;
+function remoteClient() {
+  if (!KEY) return Promise.reject(new Error("CODEXGUILD_API_KEY is not set \u2014 create an agent key in the CodexGuild dashboard."));
+  remote ??= (async () => {
+    const client = new Client({ name: "codexguild-local", version: VERSION });
+    await client.connect(new StreamableHTTPClientTransport(new URL(`${API}/mcp`), { requestInit: { headers: { Authorization: `Bearer ${KEY}` } } }));
+    return client;
+  })().catch((e) => {
+    remote = null;
+    throw e;
+  });
+  return remote;
+}
+var SCAN_TOOL = {
+  name: "codexguild_scan_skills",
+  description: "Security-audit the skills installed on THIS machine (~/.claude/skills, Claude plugins, ~/.codex/skills, ~/.agents/skills, ~/.hermes/skills, project skills\u2026). Detects pipe-to-shell, credential exfiltration, hidden unicode, prompt injection, agent-config tampering and safety bypasses. Runs locally \u2014 nothing is uploaded.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      paths: { type: "array", items: { type: "string" }, description: "Optional directories to scan instead of the defaults" },
+      verbose: { type: "boolean", description: "Include passed skills and all findings" }
+    }
+  },
+  annotations: { readOnlyHint: true, openWorldHint: false }
+};
+var ENHANCED = {
+  codexguild_sync: "Runs locally first: the stack (package.json, requirements.txt, go.mod, \u2026) and installed skill NAMES are detected automatically \u2014 only names/versions are sent, never file contents; you only need force/since.",
+  codexguild_advise: "Runs locally first: stack, installed skills and the instruction files present in the project are detected automatically; you only need harness."
+};
+function enhance(t) {
+  const note = ENHANCED[t.name];
+  if (!note) return t;
+  return {
+    ...t,
+    description: `${t.description ?? ""}
+${note}`,
+    inputSchema: {
+      ...t.inputSchema,
+      properties: { ...t.inputSchema.properties, cwd: { type: "string", description: "Project directory (defaults to the current directory)" } }
+    }
+  };
+}
+async function detected(name, cwd) {
+  const [{ deps, manifests, lockfiles, exact, ranges }, local, project] = await Promise.all([detectStack(cwd), scanLocalSkills(), projectKey(cwd)]);
+  const installedSkills = await installedSkillNames(local.reports.map((r) => r.dir));
+  if (name === "codexguild_advise") {
+    return { args: { stack: deps, installedSkills, existingInstructionFiles: await existingInstructionFiles(cwd), project } };
+  }
+  const flagged = local.reports.filter((x) => x.result.status === "flagged");
+  const shown = (xs) => xs.length > 8 ? `${xs.slice(0, 8).join(", ")} +${xs.length - 8} more` : xs.join(", ");
+  const summary = [
+    `Project ${project}: ${deps.length} dependencies from ${shown(manifests) || "no manifest"} \u2014 ${exact} exact${lockfiles.length ? ` (lockfiles: ${shown(lockfiles)})` : ""}, ${ranges} ranges${ranges ? " (no lockfile entry; reported as ranges, not exact versions)" : ""}.`,
+    `Local skill scan: ${local.reports.length} skills \u2014 ${flagged.length} flagged, ${local.reports.filter((x) => x.result.status === "warn").length} to review.`,
+    ...flagged.slice(0, 10).map((x) => `  - FLAGGED ${x.dir}: ${x.result.findings[0]?.title ?? ""}`),
+    ...flagged.length ? ["  Run codexguild_scan_skills for details and ask the user before using flagged skills."] : []
+  ].join("\n");
+  return { args: { stack: deps, installedSkills, project }, summary };
+}
+var LINT_TOOL = {
+  name: "codexguild_lint_instructions",
+  description: "Lint the agent instruction files in this project (AGENTS.md, CLAUDE.md, GEMINI.md, .cursorrules\u2026): size per session, missing build/test commands, README copy, generic advice, secrets, machine-specific paths, prompt-injection and other scanner findings. Runs locally \u2014 file contents are not uploaded.",
+  inputSchema: {
+    type: "object",
+    properties: { files: { type: "array", items: { type: "string" }, description: "Paths to lint instead of the instruction files found in the project root" } }
+  }
+};
+async function lintLocal(cwd, files) {
+  const targets = files?.length ? files : await existingInstructionFiles(cwd);
+  if (!targets.length) return "No instruction files found (looked for CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules, \u2026).";
+  const out = [];
+  for (const f of targets) {
+    const content = await readFile3(isAbsolute(f) ? f : join3(cwd, f), "utf8").catch(() => null);
+    if (content === null) {
+      out.push(`## ${f}
+Could not read the file.`);
+      continue;
+    }
+    const r = lintInstructions(content, f.split("/").pop());
+    out.push(`## ${f} \u2014 ${r.score}/100 (${r.grade}) \xB7 ~${r.stats.approxTokens} tokens \xB7 ${r.stats.commands} commands`);
+    out.push(...r.issues.length ? r.issues.slice(0, 25).map((i) => `- [${i.severity}]${i.line ? ` line ${i.line}` : ""} ${i.title}: ${i.detail}`) : ["- No issues."]);
+  }
+  return out.join("\n");
+}
+var text = (t, isError = false) => ({ content: [{ type: "text", text: t }], ...isError ? { isError } : {} });
+var server = new Server({ name: "codexguild", version: VERSION }, { capabilities: { tools: { listChanged: true } } });
+var LOCAL_TOOLS = [SCAN_TOOL, LINT_TOOL];
+var RETRY_MS = [1e3, 3e3];
+var RECONNECT_MS = 3e4;
+var reconnectTimer = null;
+async function remoteTools() {
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return (await (await remoteClient()).listTools()).tools;
+    } catch (e) {
+      if (!KEY || attempt >= RETRY_MS.length) throw e;
+      await new Promise((r) => setTimeout(r, RETRY_MS[attempt]));
+    }
+  }
+}
+function scheduleReconnect() {
+  if (reconnectTimer || !KEY) return;
+  reconnectTimer = setInterval(async () => {
+    try {
+      await (await remoteClient()).listTools();
+      clearInterval(reconnectTimer);
+      reconnectTimer = null;
+      console.error("CodexGuild: remote endpoint reachable again \u2014 tool list updated.");
+      await server.sendToolListChanged();
+    } catch {
+    }
+  }, RECONNECT_MS);
+  reconnectTimer.unref();
+}
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+  try {
+    return { tools: [...LOCAL_TOOLS, ...(await remoteTools()).map(enhance)] };
+  } catch (e) {
+    console.error(`CodexGuild: remote tools unavailable (${e instanceof Error ? e.message : String(e)}) \u2014 serving local tools only; retrying in the background.`);
+    scheduleReconnect();
+    return { tools: LOCAL_TOOLS };
+  }
+});
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  const { name } = req.params;
+  const args2 = { ...req.params.arguments ?? {} };
+  try {
+    if (name === LINT_TOOL.name) {
+      return text(await lintLocal(process.cwd(), Array.isArray(args2.files) ? args2.files.map(String) : void 0));
+    }
+    if (name === SCAN_TOOL.name) {
+      const paths = Array.isArray(args2.paths) ? args2.paths.map(String) : void 0;
+      return text(formatLocalScan(await scanLocalSkills(paths), args2.verbose === true));
+    }
+    let summary;
+    if (name in ENHANCED) {
+      const cwd = typeof args2.cwd === "string" ? args2.cwd : process.cwd();
+      delete args2.cwd;
+      const d = await detected(name, cwd);
+      summary = d.summary;
+      Object.assign(args2, { ...d.args, ...args2 });
+    }
+    const r = await (await remoteClient()).callTool({ name, arguments: args2 });
+    return summary ? { ...r, content: [{ type: "text", text: summary }, ...r.content ?? []] } : r;
+  } catch (e) {
+    return text(`CodexGuild error: ${e instanceof Error ? e.message : String(e)}`, true);
+  }
+});
+await server.connect(new StdioServerTransport());
+console.error(`CodexGuild MCP (stdio) \u2192 ${API}/mcp`);