@codions/portta 0.0.0-develop.157.sha-ae5ce5e → 0.0.0-develop.162.sha-7b40859

package/dist/assets/skills/portta-workflows/SKILL.md

@@ -1,8 +1,11 @@
 ---
-name: taskflow-workflows
+name: portta-workflows
 description: Author and run custom multi-agent workflows with Taskflow — JavaScript files that orchestrate Codex, Claude Code, OpenCode, and Pi agents deterministically via agent()/parallel()/pipeline()/phase(). Use when a task should be decomposed across agents, independently verified, resumed durably, or managed as a reusable project workflow.
+license: MIT
+compatibility: Requires the portta CLI with the Taskflow module enabled, and at least one agent CLI (Codex, Claude Code, OpenCode or Pi).
 metadata:
-  type: reference
+  author: codions-labs
+  version: "1"
 ---
 
 # Taskflow workflows
@@ -242,7 +245,6 @@ portta flow workflows save <file.workflow.js> [--project] [--force]
 portta flow workflows validate <file.workflow.js | name>
 portta flow workflows doctor
 portta flow workflows guide
-portta flow workflows install-skill [--claude] [--agents|--codex]
 ```
 
 Use `portta flow workflows validate <file>` before adding or changing a catalog workflow. `--fake` runs with a fake worker for a fast smoke test; `--json` prints `{runId, status, url, result, error}`. A standalone `run` auto-starts its live viewer and prints the URL; `--open` also opens it in a browser.
@@ -272,9 +274,12 @@ When you (an agent such as Claude Code or Codex) create or run a workflow on a u
 
 ## Installation
 
-Install this repository's skill with:
+Install with the [Skills CLI](https://www.skills.sh):
+
 ```
-npx skills add <owner/repo> --skill taskflow-workflows
+npx skills add codions-labs/portta --skill portta-workflows -g
 ```
 
-The Skills CLI can install it for Claude Code, Codex, OpenCode, Pi, and other supported agents. `portta flow workflows install-skill` remains available as a compatibility installer for Claude Code and the generic/Codex skill directory.
+It installs into Claude Code, Codex, OpenCode, Cursor, Zed and the other agents it supports, symlinking by default so an update reaches every agent at once. `npx skills update` refreshes it; `npx skills remove` takes it out.
+
+Pair it with `portta-method`, which carries the branching, worktree, commit and pull request rules this project follows.

package/dist/cli.js

@@ -20141,6 +20141,26 @@ function isLoopbackAddress(address) {
 function isWildcardAddress(address) {
   return address === "0.0.0.0" || address === "::";
 }
+function isLoopbackIp(address) {
+  return address === "::1" || /^127(\.\d{1,3}){3}$/.test(address);
+}
+function localhostDnsVerdict(addresses) {
+  const hint = "see docs/product/guides/local-development.md#how-localhost-resolves";
+  if (addresses.length === 0) return check2("dns.local", "warn", "local DNS", "could not confirm *.localhost resolution", hint);
+  const stray = addresses.filter((address) => !isLoopbackIp(address));
+  return stray.length === 0 ? check2("dns.local", "pass", "local DNS", "*.localhost resolves to loopback") : check2("dns.local", "warn", "local DNS", `*.localhost resolves to ${stray.join(", ")}, not loopback`, hint);
+}
+function loopbackDomainVerdict(domain2, resolved2, bind) {
+  if (!isLoopbackIp(resolved2)) return null;
+  const served = isWildcardAddress(bind) || bind === resolved2 || isLoopbackAddress(bind) && resolved2 === "127.0.0.1";
+  return served ? check2("domain.reachable", "pass", "project hostnames", `*.${domain2} resolves to loopback, served on ${bind}`) : check2(
+    "domain.reachable",
+    "warn",
+    "project hostnames",
+    `*.${domain2} resolves to ${resolved2}, but Traefik listens on ${bind}`,
+    "point the wildcard at an address Traefik listens on; see docs/product/guides/local-domains.md"
+  );
+}
 function publishesSensitivePort(published) {
   return SENSITIVE_PORTS.some((port) => published.includes(`0.0.0.0:`) && published.includes(`->${port}`));
 }
@@ -22364,7 +22384,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@codions/portta",
-      version: "0.0.0-develop.157.sha-ae5ce5e",
+      version: "0.0.0-develop.162.sha-7b40859",
       description: "Machine-first CLI for a shared Docker development gateway",
       license: "MIT",
       type: "module",
@@ -22438,7 +22458,7 @@ var init_version = __esm({
     "use strict";
     init_package();
     CLI_VERSION = package_default.version;
-    CLI_BUILD_DATE = true ? "2026-09-16T21:32:25Z" : void 0;
+    CLI_BUILD_DATE = true ? "2026-09-17T23:23:40Z" : void 0;
   }
 });
 
@@ -37260,7 +37280,7 @@ function parseLinearTarget(raw2) {
   if (LinearTeamKeySchema.safeParse(trimmed).success) return { kind: "team", teamKey: trimmed };
   return { kind: "invalid", raw: trimmed };
 }
-var BooleanLikeSchema, ErrorResponseSchema, OkResponseSchema, EnabledResponseSchema, DiagnosticCheckStatusSchema, DiagnosticCheckSchema, DiagnosticsResponseSchema, JsonValueSchema, TimestampSchema, PublicIdSchema, ConfigurationValueSchema, SequenceSchema, SequenceQuerySchema, RunIdSchema, ExecutionIdSchema, SessionIdSchema, WorkspaceIdSchema, WorkflowIdSchema, ProjectIdSchema, IdempotencyKeySchema, RunModeSchema, RunStatusSchema, ExecutionStatusSchema, AgentTransportSchema, AgentPermissionModeSchema, StdioMcpServerSchema, WorkspacePolicySchema, WorkspaceStrategySchema, WorkspaceAccessSchema, WorkspaceStateSchema, WorkflowOriginSchema, WorkflowAvailabilitySchema, EventSourceSchema, SessionCapabilitySchema, RunCapabilitySchema, WorkspaceSchema, WorkspaceSelectionSchema, WorkflowWorkspacePolicySchema, WorkflowPhaseSchema, WorkflowDefinitionSchema, WorkflowSnapshotSchema, ExecutionUsageSchema, ExecutionObservabilitySchema, ExecutionSchema, RunSchema, WorkflowProgressPhaseStatusSchema, WorkflowProgressPhaseSchema, WorkflowProgressSchema, RunArtifactSchema, RunDetailSchema, TranscriptChunkSchema, TranscriptEntrySchema, ExecutionTranscriptResponseSchema, CreateRunFields, CreateRunRequestSchema, CancelRunRequestSchema, ResumeRunRequestSchema, RespondRunPermissionRequestSchema, RunEventPayloadSchema, RunEventSchema, ProjectIdParamsSchema, TaskflowRunIdParamsSchema, ExecutionIdParamsSchema, RunEventsQuerySchema, ExecutionTranscriptQuerySchema, WorkflowListResponseSchema, RunWorkspaceContextSchema, RunListResponseSchema, RunDetailResponseSchema, RunEventsResponseSchema, BuiltInAgentIdSchema, AgentIdSchema, WorktreeCreateModeSchema, LinearIssueIdSchema, LinearTeamKeySchema, PostWorktreeToLinearTargetSchema, PostWorktreeToLinearRequestSchema, PostWorktreeToLinearResponseSchema, FromLinearInputSchema, OneshotConfigSchema, AgentCapabilitiesSchema, AgentSummarySchema, AgentDetailsSchema, AgentListResponseSchema, UpsertCustomAgentRequestSchema, AgentResponseSchema, ValidateCustomAgentResponseSchema, WorktreeCreationPhaseSchema, AvailableBranchSchema, AvailableBranchesQuerySchema, NumberLikePathParamSchema, BranchListResponseSchema, WorktreeSourceSchema, SessionInterfaceModeSchema, CreateWorktreeRequestSchema, OpenWorktreeRequestSchema, CreateWorktreeResponseSchema, SetWorktreeArchivedRequestSchema, SetWorktreeArchivedResponseSchema, SetWorktreeLabelRequestSchema, SetWorktreeLabelResponseSchema, SetWorktreeProfileRequestSchema, SetWorktreeProfileResponseSchema, ToggleEnabledRequestSchema, SendWorktreePromptRequestSchema, AgentsSendMessageRequestSchema, PullMainRequestSchema, PullMainStatusSchema, PullMainResponseSchema, ServiceStatusSchema, PrCommentSchema, CiCheckSchema, PrEntrySchema, LinearIssueLabelSchema, LinearIssueStateSchema, LinkedLinearIssueSchema, LinearIssueSchema, LinearIssueAvailabilitySchema, LinearIssuesResponseSchema, AutoNameProviderSchema, AutoNameConfigResponseSchema, WorktreeCreationStateSchema, AppNotificationSchema, WorktreeTabSchema, ProjectWorktreeSnapshotSchema, ProjectSnapshotSchema, WorktreeConversationProviderSchema, CodexWorktreeConversationRefSchema, ClaudeWorktreeConversationRefSchema, WorktreeConversationRefSchema, AgentsUiWorktreeSummarySchema, AgentsUiConversationMessageRoleSchema, AgentsUiConversationMessageStatusSchema, AgentsUiConversationMessageKindSchema, AgentsUiConversationMessageSchema, AgentsUiConversationStateSchema, AgentsUiWorktreeConversationResponseSchema, AgentsUiSendMessageResponseSchema, AgentsUiInterruptResponseSchema, AgentsUiConversationMessageDeltaEventSchema, AgentsUiConversationMessageUpsertEventSchema, AgentsUiConversationStatusEventSchema, AgentsUiConversationErrorEventSchema, AgentsUiConversationEventSchema, WorktreeListResponseSchema, UnpushedCommitSchema, WorktreeDiffResponseSchema, ServiceConfigSchema, EnvironmentIdParamsSchema, EnvironmentServiceParamsSchema, EnvironmentServiceActionRequestSchema, EndpointIdParamsSchema, EnvironmentStatusSchema, EnvironmentCapabilitiesSchema, EnvironmentSecuritySchema, EndpointSchema, EnvironmentServiceSchema, EnvironmentSchema, EnvironmentResponseSchema, EnvironmentServicesResponseSchema, EnvironmentExecRequestSchema, EnvironmentExecResponseSchema, EnvironmentTerminalResponseSchema, EnvironmentExposeRequestSchema, ProfileConfigSchema, LinkedRepoInfoSchema, MultiplexerKindSchema, BuildInfoSchema, AppConfigSchema, CiLogsResponseSchema, WorktreeNameParamsSchema, WorktreeTabParamsSchema, CreateTabResponseSchema, NotificationIdParamsSchema, AgentIdParamsSchema, RunIdParamsSchema, ProjectSummarySchema, ProjectsResponseSchema, AddProjectRequestSchema, AddProjectResponseSchema, ProjectInitPhaseSchema, ProjectInitStateSchema, ProjectInitsResponseSchema, ProjectPrefixParamsSchema;
+var BooleanLikeSchema, ErrorResponseSchema, OkResponseSchema, EnabledResponseSchema, DiagnosticCheckStatusSchema, DiagnosticCheckSchema, DiagnosticsResponseSchema, JsonValueSchema, TimestampSchema, PublicIdSchema, ConfigurationValueSchema, SequenceSchema, SequenceQuerySchema, RunIdSchema, ExecutionIdSchema, SessionIdSchema, WorkspaceIdSchema, WorkflowIdSchema, ProjectIdSchema, IdempotencyKeySchema, RunModeSchema, RunStatusSchema, ExecutionStatusSchema, AgentTransportSchema, AgentPermissionModeSchema, StdioMcpServerSchema, WorkspacePolicySchema, WorkspaceStrategySchema, WorkspaceAccessSchema, WorkspaceStateSchema, WorkflowOriginSchema, WorkflowAvailabilitySchema, EventSourceSchema, SessionCapabilitySchema, RunCapabilitySchema, WorkspaceSchema, WorkspaceSelectionSchema, WorkflowWorkspacePolicySchema, WorkflowPhaseSchema, WorkflowDefinitionSchema, WorkflowSnapshotSchema, ExecutionUsageSchema, ExecutionObservabilitySchema, ExecutionSchema, RunSchema, WorkflowProgressPhaseStatusSchema, WorkflowProgressPhaseSchema, WorkflowProgressSchema, RunArtifactSchema, RunDetailSchema, TranscriptChunkSchema, TranscriptEntrySchema, ExecutionTranscriptResponseSchema, CreateRunFields, CreateRunRequestSchema, CancelRunRequestSchema, ResumeRunRequestSchema, RespondRunPermissionRequestSchema, RunEventPayloadSchema, RunEventSchema, ProjectIdParamsSchema, TaskflowRunIdParamsSchema, ExecutionIdParamsSchema, RunEventsQuerySchema, ExecutionTranscriptQuerySchema, WorkflowListResponseSchema, RunWorkspaceContextSchema, RunListResponseSchema, RunDetailResponseSchema, RunEventsResponseSchema, BuiltInAgentIdSchema, AgentIdSchema, WorktreeCreateModeSchema, LinearIssueIdSchema, LinearTeamKeySchema, PostWorktreeToLinearTargetSchema, PostWorktreeToLinearRequestSchema, PostWorktreeToLinearResponseSchema, FromLinearInputSchema, OneshotConfigSchema, AgentCapabilitiesSchema, AgentSummarySchema, AgentDetailsSchema, AgentListResponseSchema, UpsertCustomAgentRequestSchema, AgentResponseSchema, ValidateCustomAgentResponseSchema, WorktreeCreationPhaseSchema, AvailableBranchSchema, AvailableBranchesQuerySchema, RemoveWorktreeQuerySchema, NumberLikePathParamSchema, BranchListResponseSchema, WorktreeSourceSchema, SessionInterfaceModeSchema, CreateWorktreeRequestSchema, OpenWorktreeRequestSchema, CreateWorktreeResponseSchema, SetWorktreeArchivedRequestSchema, SetWorktreeArchivedResponseSchema, SetWorktreeLabelRequestSchema, SetWorktreeLabelResponseSchema, SetWorktreeProfileRequestSchema, SetWorktreeProfileResponseSchema, ToggleEnabledRequestSchema, SendWorktreePromptRequestSchema, AgentsSendMessageRequestSchema, PullMainRequestSchema, PullMainStatusSchema, PullMainResponseSchema, ServiceStatusSchema, PrCommentSchema, CiCheckSchema, PrEntrySchema, LinearIssueLabelSchema, LinearIssueStateSchema, LinkedLinearIssueSchema, LinearIssueSchema, LinearIssueAvailabilitySchema, LinearIssuesResponseSchema, AutoNameProviderSchema, AutoNameConfigResponseSchema, WorktreeCreationStateSchema, AppNotificationSchema, WorktreeTabSchema, ProjectWorktreeSnapshotSchema, ProjectSnapshotSchema, WorktreeConversationProviderSchema, CodexWorktreeConversationRefSchema, ClaudeWorktreeConversationRefSchema, WorktreeConversationRefSchema, AgentsUiWorktreeSummarySchema, AgentsUiConversationMessageRoleSchema, AgentsUiConversationMessageStatusSchema, AgentsUiConversationMessageKindSchema, AgentsUiConversationMessageSchema, AgentsUiConversationStateSchema, AgentsUiWorktreeConversationResponseSchema, AgentsUiSendMessageResponseSchema, AgentsUiInterruptResponseSchema, AgentsUiConversationMessageDeltaEventSchema, AgentsUiConversationMessageUpsertEventSchema, AgentsUiConversationStatusEventSchema, AgentsUiConversationErrorEventSchema, AgentsUiConversationEventSchema, WorktreeListResponseSchema, UnpushedCommitSchema, WorktreeDiffResponseSchema, ServiceConfigSchema, EnvironmentIdParamsSchema, EnvironmentServiceParamsSchema, EnvironmentServiceActionRequestSchema, EndpointIdParamsSchema, EnvironmentStatusSchema, EnvironmentCapabilitiesSchema, EnvironmentSecuritySchema, EndpointSchema, EnvironmentServiceSchema, EnvironmentSchema, EnvironmentResponseSchema, EnvironmentServicesResponseSchema, EnvironmentExecRequestSchema, EnvironmentExecResponseSchema, EnvironmentTerminalResponseSchema, EnvironmentExposeRequestSchema, ProfileConfigSchema, LinkedRepoInfoSchema, MultiplexerKindSchema, BuildInfoSchema, AppConfigSchema, CiLogsResponseSchema, WorktreeNameParamsSchema, WorktreeTabParamsSchema, CreateTabResponseSchema, NotificationIdParamsSchema, AgentIdParamsSchema, RunIdParamsSchema, ProjectSummarySchema, ProjectsResponseSchema, AddProjectRequestSchema, AddProjectResponseSchema, ProjectInitPhaseSchema, ProjectInitStateSchema, ProjectInitsResponseSchema, ProjectPrefixParamsSchema;
 var init_schemas3 = __esm({
   "../contracts/src/taskflow/schemas.ts"() {
     "use strict";
@@ -37741,6 +37761,9 @@ var init_schemas3 = __esm({
     AvailableBranchesQuerySchema = external_exports.object({
       includeRemote: BooleanLikeSchema.optional()
     });
+    RemoveWorktreeQuerySchema = external_exports.object({
+      force: BooleanLikeSchema.optional()
+    });
     NumberLikePathParamSchema = external_exports.union([
       external_exports.number().int().nonnegative(),
       external_exports.string().regex(/^\d+$/).transform((value3) => Number(value3))
@@ -38682,6 +38705,7 @@ var init_contract = __esm({
         summary: "Remove a worktree",
         path: apiPaths.removeWorktree,
         pathParams: WorktreeNameParamsSchema,
+        query: RemoveWorktreeQuerySchema,
         responses: {
           200: OkResponseSchema,
           ...commonErrorResponses
@@ -54927,6 +54951,21 @@ var init_git = __esm({
         const result = tryRunGit(["diff", "HEAD", "--no-color"], cwd);
         return result.ok ? result.stdout : "";
       }
+      /**
+       * Commits reachable from HEAD and from nothing else that would survive this
+       * worktree: not on an origin branch, not on the project's main branch. It
+       * answers "would deleting this branch lose work", which `aheadCount` cannot:
+       * with no upstream and no remote at all, every commit counts as ahead.
+       */
+      countUnsavedCommits(cwd, baseBranch) {
+        const count2 = (args) => {
+          const result = tryRunGit(args, cwd);
+          return result.ok ? parseInt(result.stdout, 10) || 0 : null;
+        };
+        const excludingBase = baseBranch ? count2(["rev-list", "--count", "HEAD", "--not", "--remotes=origin", baseBranch]) : null;
+        if (excludingBase !== null) return excludingBase;
+        return count2(["rev-list", "--count", "HEAD", "--not", "--remotes=origin"]) ?? 0;
+      }
       listUnpushedCommits(cwd) {
         let result = tryRunGit(["log", "--oneline", "@{upstream}..HEAD"], cwd);
         if (!result.ok) {
@@ -58702,9 +58741,23 @@ var init_lifecycle_service = __esm({
           throw this.wrapOperationError(error61);
         }
       }
-      async removeWorktree(branch) {
+      /**
+       * Removing a worktree deletes its branch with `--force`, so anything living
+       * only there is gone. Uncommitted changes and unpushed commits therefore
+       * refuse the removal unless the caller says to discard them.
+       */
+      async removeWorktree(branch, options = {}) {
         try {
           const resolved2 = await this.resolveExistingWorktree(branch);
+          if (!options.force) {
+            const unsaved = this.describeUnsavedWork(resolved2.entry);
+            if (unsaved) {
+              throw new LifecycleError(
+                `Worktree has ${unsaved}: ${branch}. Commit or push them, or remove with --force to discard them.`,
+                409
+              );
+            }
+          }
           await this.removeResolvedWorktree(resolved2);
         } catch (error61) {
           throw this.wrapOperationError(error61);
@@ -58715,15 +58768,21 @@ var init_lifecycle_service = __esm({
           const resolvedWorktrees = await this.resolveAllWorktrees();
           const sessionName = buildProjectSessionName(this.deps.projectRoot);
           const removedBranches = [];
+          const keptBranches = [];
           for (const resolved2 of resolvedWorktrees) {
             const branch = resolved2.entry.branch ?? resolved2.entry.path;
             if (await this.deps.sessions.hasWindow(sessionName, buildWorktreeWindowName(branch))) {
               continue;
             }
+            const unsaved = this.describeUnsavedWork(resolved2.entry);
+            if (unsaved) {
+              keptBranches.push({ branch, reason: unsaved });
+              continue;
+            }
             await this.removeResolvedWorktree(resolved2);
             removedBranches.push(branch);
           }
-          return { removedBranches };
+          return { removedBranches, keptBranches };
         } catch (error61) {
           throw this.wrapOperationError(error61);
         }
@@ -59220,6 +59279,14 @@ ${oneshotPrompt}` : oneshotPrompt ?? baseSystemPrompt;
         }
         return cleanupErrors.length > 0 ? cleanupErrors.join("; ") : null;
       }
+      /** What this worktree holds that exists nowhere else, or null when it is safe to delete. */
+      describeUnsavedWork(entry) {
+        const status = this.deps.git.readWorktreeStatus(entry.path);
+        if (status.dirty) return "uncommitted changes";
+        const commits = this.deps.git.countUnsavedCommits(entry.path, this.deps.config.workspace.mainBranch);
+        if (commits > 0) return `${commits} commit${commits === 1 ? "" : "s"} that are only here`;
+        return null;
+      }
       ensureNoUncommittedChanges(entry) {
         const status = this.deps.git.readWorktreeStatus(entry.path);
         if (status.dirty) {
@@ -59316,7 +59383,7 @@ ${oneshotPrompt}` : oneshotPrompt ?? baseSystemPrompt;
         const cleanupErrors = [];
         for (const branch of [...branches].reverse()) {
           try {
-            await this.removeWorktree(branch);
+            await this.removeWorktree(branch, { force: true });
           } catch (error61) {
             cleanupErrors.push(`rollback failed for ${branch}: ${toErrorMessage2(error61)}`);
           }
@@ -68913,14 +68980,14 @@ ${resolvedPrompt}` : conversationContext;
     201
   );
 }
-async function apiDeleteWorktree(project2, name) {
+async function apiDeleteWorktree(project2, name, force) {
   return project2.withRemovingBranch(name, async () => {
     log.info(`[worktree:rm] name=${name}`);
     const worktree = project2.runtime.projectRuntime.getWorktreeByBranch(name);
     const environmentId = worktree ? environmentIdForWorkspace(project2.environments.projectEnvironments(), worktree.worktreeId) : null;
     const environment = environmentId ? project2.environments.environmentForProject(environmentId) : null;
     if (environment) await project2.environments.destroyEnvironmentRecord(environment);
-    await project2.runtime.lifecycleService.removeWorktree(name);
+    await project2.runtime.lifecycleService.removeWorktree(name, { force });
     log.debug(`[worktree:rm] done name=${name}`);
     return jsonResponse({ ok: true });
   });
@@ -69107,9 +69174,9 @@ function worktreeRoutes(deps) {
   const app = projectRouter();
   projectRoute(app, deps, "fetchWorktrees", "Worktrees", (project2) => apiGetWorktrees(project2));
   projectRoute(app, deps, "createWorktree", "Worktrees", (project2, { body }) => apiCreateWorktree(project2, body));
-  projectRoute(app, deps, "removeWorktree", "Worktrees", (project2, { params }) => {
+  projectRoute(app, deps, "removeWorktree", "Worktrees", (project2, { params, query: query2 }) => {
     const name = worktreeName(params.name);
-    return name instanceof Response ? name : apiDeleteWorktree(project2, name);
+    return name instanceof Response ? name : apiDeleteWorktree(project2, name, query2.force === true);
   });
   projectRoute(app, deps, "openWorktree", "Worktrees", (project2, { params, body }) => {
     const name = worktreeName(params.name);
@@ -89799,7 +89866,7 @@ function createDaemonTaskflowHost(context) {
       port: hostListen(env).port,
       workflowBuiltinsDir: taskflowAssets(env).workflowBuiltinsDir,
       version: env.PORTTA_VERSION || "0.0.0-local",
-      buildDate: true ? "2026-09-16T21:32:25Z" : (/* @__PURE__ */ new Date()).toISOString(),
+      buildDate: true ? "2026-09-17T23:23:40Z" : (/* @__PURE__ */ new Date()).toISOString(),
       environmentStore: createEnvironmentStore(paths3.database),
       hostEnvironmentProvider: new HostEnvironmentProvider(),
       devContainerProvider: new DevContainerProvider(),
@@ -111947,11 +112014,12 @@ function worktreeRequestFromCli(action) {
         branch: requireWorktreeName(first),
         ...options.interface !== void 0 ? { interfaceMode: parseInterfaceMode(options.interface) } : {}
       };
+    case "remove":
+      return { command, branch: requireWorktreeName(first), force: options.force === true };
     case "close":
     case "refresh":
     case "archive":
     case "unarchive":
-    case "remove":
     case "merge":
       return { command, branch: requireWorktreeName(first) };
     case "label":
@@ -112205,6 +112273,9 @@ ${parsed.input.prompt}` : seed.data.conversationMarkdown;
         return 0;
       }
       const result = await runtime3.lifecycleService.pruneWorktrees();
+      for (const kept of result.keptBranches) {
+        stdout2(`Kept ${kept.branch}: ${kept.reason}`);
+      }
       if (result.removedBranches.length === 0) {
         stdout2("No closed worktrees to prune.");
         return 0;
@@ -112441,7 +112512,9 @@ ${parsed.input.prompt}` : seed.data.conversationMarkdown;
         stdout2(`Restored worktree ${branch}`);
         return 0;
       case "remove":
-        await runtime2.lifecycleService.removeWorktree(branch);
+        await runtime2.lifecycleService.removeWorktree(branch, {
+          force: request2.command === "remove" && request2.force
+        });
         stdout2(`Removed worktree ${branch}`);
         return 0;
       case "merge":
@@ -113354,7 +113427,6 @@ var cli_exports = {};
 __export(cli_exports, {
   UsageError: () => UsageError2,
   browserOpenCommand: () => browserOpenCommand,
-  installTaskflowWorkflowSkill: () => installTaskflowWorkflowSkill,
   isUserFacingError: () => isUserFacingError,
   main: () => main,
   openBrowser: () => openBrowser,
@@ -113369,11 +113441,9 @@ import {
   readFileSync as readFileSync28,
   realpathSync as realpathSync6,
   rmSync as rmSync9,
-  statSync as statSync10,
-  writeFileSync as writeFileSync14
+  statSync as statSync10
 } from "node:fs";
 import { get as httpGet } from "node:http";
-import { homedir as homedir9 } from "node:os";
 import { dirname as dirname28, join as join50, resolve as resolve30, sep as sep3 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function parseArgs(argv) {
@@ -113479,7 +113549,7 @@ async function main(argv = process.argv.slice(2), options = {}) {
     case "doctor":
       return cmdDoctor();
     case "install-skill":
-      return cmdInstallSkill(flags, options.skillPath);
+      return cmdInstallSkillRetired();
     case "guide":
       return cmdGuide(options.skillPath);
     case void 0:
@@ -113860,37 +113930,16 @@ function readSkill(skillPath) {
 async function cmdGuide(skillPath) {
   process.stdout.write(readSkill(skillPath).replace(/^---\n[\s\S]*?\n---\n+/, ""));
 }
-function installTaskflowWorkflowSkill(home2, body, flags = {}) {
-  const wantClaude = flags.claude === true;
-  const wantGeneric = flags.agents === true || flags.codex === true;
-  const both = !wantClaude && !wantGeneric;
-  const targets = [];
-  if (both || wantClaude) targets.push(join50(home2, ".claude", "skills"));
-  if (both || wantGeneric) targets.push(join50(home2, ".agents", "skills"));
-  return targets.map((base2) => {
-    const dest = join50(base2, `${APP_SLUG}-workflows`);
-    mkdirSync17(dest, { recursive: true });
-    const path7 = join50(dest, "SKILL.md");
-    writeFileSync14(path7, body);
-    return path7;
-  });
-}
-async function cmdInstallSkill(flags, skillPath) {
-  let body;
-  try {
-    body = readSkill(skillPath);
-  } catch (err2) {
-    console.error(err2 instanceof Error ? err2.message : String(err2));
-    process.exitCode = 1;
-    return;
-  }
-  installTaskflowWorkflowSkill(homedir9(), body, {
-    claude: flags.claude,
-    agents: flags.agents,
-    codex: flags.codex
-  }).forEach((path7) => {
-    console.log(`installed skill \u2192 ${path7}`);
-  });
+function cmdInstallSkillRetired() {
+  console.error(
+    `${CLI_NAME} workflows install-skill has been retired. Install the skill with the Skills CLI instead:
+
+  npx skills add codions-labs/portta --skill portta-workflows -g
+
+It supports Claude Code, Codex, OpenCode, Cursor, Zed and others, symlinks by default,
+and \`npx skills update\` keeps every agent current. See https://www.skills.sh.`
+  );
+  process.exitCode = 1;
 }
 function printHelp() {
   console.log(`${APP_NAME} workflows \u2014 run JS workflow files that orchestrate coding agents
@@ -113920,7 +113969,6 @@ Usage:
   ${CLI_NAME} workflows validate <file.workflow.js | name>
   ${CLI_NAME} workflows doctor
   ${CLI_NAME} workflows guide
-  ${CLI_NAME} workflows install-skill [--claude] [--agents|--codex] Install the ${APP_NAME} authoring skill
 
 Named workflows resolve by meta.name across three tiers (highest first): project
 (${PROJECT_CONFIG_DIR}/${PATH_NAMES.workflows}/), user (~/${GLOBAL_CONFIG_DIR}/${PATH_NAMES.workflows}/), and package built-ins.
@@ -113929,9 +113977,10 @@ Named workflows resolve by meta.name across three tiers (highest first): project
   ${CLI_NAME} workflows run deep-research --args '"<question>"'
   ${CLI_NAME} workflows run code-review [--args '{"target": "<ref|path>", "level": "high|xhigh|max"}']
 
-Run journals are stored in ~/${GLOBAL_CONFIG_DIR}/${PATH_NAMES.runs}/<id>/. The guide, install-skill command,
-and skills/portta-workflows/SKILL.md share one source of truth \u2014 run
-\`${CLI_NAME} workflows guide\` to read it.`);
+Run journals are stored in ~/${GLOBAL_CONFIG_DIR}/${PATH_NAMES.runs}/<id>/. The guide and
+skills/portta-workflows/SKILL.md share one source of truth \u2014 run
+\`${CLI_NAME} workflows guide\` to read it. Install the skill into your agents with
+\`npx skills add codions-labs/portta --skill portta-workflows -g\`.`);
 }
 function isUserFacingError(err2) {
   if (err2 instanceof UsageError2 || err2 instanceof WorkflowSyntaxError || err2 instanceof WorkflowNotFoundError || err2 instanceof WorkflowError || err2 instanceof AgentError || err2 instanceof AgentInterrupted || err2 instanceof JournalNotFoundError || err2 instanceof ResumePreconditionError) {
@@ -120174,7 +120223,7 @@ var WORKFLOW_ENGINE_ACTIONS = [
   ["save", "Save a workflow file into the registry"],
   ["doctor", "Check the standalone workflow engine"],
   ["guide", "Print the workflow authoring guide"],
-  ["install-skill", "Install the workflow authoring skill for coding agents"]
+  ["install-skill", "Retired \u2014 install with: npx skills add codions-labs/portta --skill portta-workflows -g"]
 ];
 var USAGE_HINT = "(run with --help for usage)";
 function parsePort2(value3) {
@@ -120302,7 +120351,14 @@ running, resume with \`${invocation2} --resume <branch> --prompt <text>\`).`
 worktree is restarted with the new pane layout and commands; a closed
 one picks the new profile up on its next open.`
   );
-  leaf(flow, "remove <branch>", "Remove a worktree");
+  helpAfter(
+    leaf(flow, "remove <branch>", "Remove a worktree").option(
+      "--force",
+      "Remove even when the worktree holds uncommitted changes or commits that exist nowhere else"
+    ),
+    () => `Removing a worktree deletes its branch, so work that lives only there
+is gone. Without --force the removal is refused and says what it found.`
+  );
   leaf(flow, "merge <branch>", "Merge a worktree into the main branch and remove it");
   leaf(flow, "send <branch> [prompt]", "Send a prompt to a running worktree agent").option("--prompt <text>", "Prompt text (alternative to positional arg)").option("--preamble <text>", "Preamble text sent before the prompt");
   helpAfter(
@@ -121127,14 +121183,7 @@ async function domainChecks(config3, env) {
   const domain2 = config3.domain;
   const panelExpose = env["PORTTA_WEB_EXPOSE"] || "local";
   if (domain2 === "localhost" || domain2.endsWith(".localhost")) {
-    const probe = await resolveIpv4("portta-probe.localhost");
-    checks.push(probe.length > 0 ? check2("dns.local", "pass", "local DNS", "*.localhost resolves to loopback") : check2(
-      "dns.local",
-      "warn",
-      "local DNS",
-      "could not confirm *.localhost resolution",
-      "see docs/product/guides/local-development.md if hostnames do not resolve"
-    ));
+    checks.push(localhostDnsVerdict(await resolveIpv4("portta-probe.localhost")));
     if (panelExpose !== "local") {
       checks.push(check2(
         "domain.reachable",
@@ -121150,6 +121199,8 @@ async function domainChecks(config3, env) {
   const resolved2 = (await resolveIpv4(`portta-probe.${domain2}`))[0];
   if (!resolved2) {
     checks.push(check2("dns.wildcard", "fail", "wildcard DNS", `*.${domain2} does not resolve`, "portta dns setup"));
+  } else if (isLoopbackIp(resolved2)) {
+    checks.push(check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2} (this machine)`));
   } else {
     const expected = env["PORTTA_PUBLIC_IP"] ?? "";
     checks.push(!expected ? check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2}`) : resolved2 === expected ? check2("dns.wildcard", "pass", "wildcard DNS", `*.${domain2} -> ${resolved2} (this host)`) : check2(
@@ -121161,7 +121212,19 @@ async function domainChecks(config3, env) {
     ));
   }
   const bind = config3.bindAddress;
-  if (isLoopbackAddress(bind)) {
+  const loopback = resolved2 ? loopbackDomainVerdict(domain2, resolved2, bind) : null;
+  if (loopback) {
+    checks.push(loopback);
+    if (panelExpose !== "local") {
+      checks.push(check2(
+        "domain.reachable.remote",
+        "warn",
+        "project hostnames",
+        `*.${domain2} resolves to loopback, and the panel is reached from elsewhere`,
+        "point the wildcard at this host, or portta config set domain.mode auto"
+      ));
+    }
+  } else if (isLoopbackAddress(bind)) {
     const publicIp = env["PORTTA_PUBLIC_IP"] ?? "";
     const fix = publicIp && isPrivateAddress(publicIp) ? `portta config set gateway.bindAddress ${publicIp}   serves them on that network only` : "portta public enable   exposes the HTTP services that opted in";
     checks.push(check2(
@@ -122067,17 +122130,17 @@ async function dnsSetup(options, command) {
 
 // src/commands/host-service.ts
 init_config2();
-import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync19, readFileSync as readFileSync32, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync15 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
+import { chmodSync as chmodSync10, existsSync as existsSync39, mkdirSync as mkdirSync19, readFileSync as readFileSync32, realpathSync as realpathSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 import { dirname as dirname29, join as join59 } from "node:path";
 init_context();
 init_errors3();
 var AUTO_PICKUP_ENV_VARS = ["LINEAR_API_KEY"];
 var RESERVED_ENV_KEYS = /* @__PURE__ */ new Set(["PATH", "PORTTA_ROOT"]);
 function logFile2() {
-  return join59(homedir10(), "Library", "Logs", SERVICE_IDENTITY.logFile);
+  return join59(homedir9(), "Library", "Logs", SERVICE_IDENTITY.logFile);
 }
-function serviceFilePath(platform4, home2 = homedir10()) {
+function serviceFilePath(platform4, home2 = homedir9()) {
   return platform4 === "linux" ? join59(home2, ".config", "systemd", "user", `${SERVICE_IDENTITY.name}.service`) : join59(home2, "Library", "LaunchAgents", `${SERVICE_IDENTITY.launchdLabel}.plist`);
 }
 function escapePlistText(value3) {
@@ -122280,7 +122343,7 @@ ${notes.join("\n")}`);
     await confirm(`${installed ? "Reinstall" : "Install"} the ${SERVICE_IDENTITY.name} service?`, Boolean(options.yes));
     if (installed) await runAll(serviceCommands("uninstall", platform4, filePath), output2, true);
     mkdirSync19(dirname29(filePath), { recursive: true });
-    writeFileSync15(filePath, content);
+    writeFileSync14(filePath, content);
     if (Object.keys(envVars).length > 0) chmodSync10(filePath, 384);
     await runAll(serviceCommands("install", platform4, filePath), output2);
     if (output2.json) output2.data({ installed: true, file: filePath });
@@ -122580,7 +122643,7 @@ function configPrepare(command) {
 init_src();
 init_context();
 import { chmodSync as chmodSync11, copyFileSync as copyFileSync4, cpSync, existsSync as existsSync40, mkdirSync as mkdirSync20, readdirSync as readdirSync9, realpathSync as realpathSync8, rmSync as rmSync11 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
+import { homedir as homedir10 } from "node:os";
 import { dirname as dirname30, join as join61, resolve as resolve31 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 init_errors3();
@@ -122637,7 +122700,7 @@ async function setupCommand(options, command) {
   const output2 = new Output(global3);
   if (process.platform === "win32") throw new PreconditionError("setup requires a POSIX host");
   const currentRoot = findGatewayRoot();
-  const target = resolve31(options.dir ?? currentRoot ?? join61(homedir11(), "portta"));
+  const target = resolve31(options.dir ?? currentRoot ?? join61(homedir10(), "portta"));
   const profile = options.profile ?? global3.profile ?? "local";
   const runtime2 = packagedRuntime();
   const steps = [];
@@ -123155,7 +123218,7 @@ async function shareGc(command) {
 // src/commands/tls.ts
 init_src();
 init_context();
-import { chmodSync as chmodSync13, existsSync as existsSync42, mkdirSync as mkdirSync22, writeFileSync as writeFileSync16 } from "node:fs";
+import { chmodSync as chmodSync13, existsSync as existsSync42, mkdirSync as mkdirSync22, writeFileSync as writeFileSync15 } from "node:fs";
 import { platform as platform3 } from "node:os";
 import { join as join64 } from "node:path";
 init_errors3();
@@ -123306,7 +123369,7 @@ async function tlsInit(command) {
     }
   }
   output2.progress(`issued ${paths3.leafCertificate} for *.${domain2}`);
-  writeFileSync16(paths3.dynamic, localTlsDynamic());
+  writeFileSync15(paths3.dynamic, localTlsDynamic());
   const envPath = join64(context.root, ".env");
   patchEnvFile(envPath, { TLS_ENABLED: "true", TLS_MODE: "local" });
   output2.progress("TLS enabled in .env");
@@ -123363,7 +123426,7 @@ function paths2(root2) {
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync36, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync17 } from "node:fs";
+import { chmodSync as chmodSync14, copyFileSync as copyFileSync5, cpSync as cpSync2, existsSync as existsSync43, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, readFileSync as readFileSync36, rmSync as rmSync12, statSync as statSync12, writeFileSync as writeFileSync16 } from "node:fs";
 import { hostname as hostname3, tmpdir as tmpdir5 } from "node:os";
 import { dirname as dirname32, join as join65 } from "node:path";
 function globals16(command) {
@@ -123410,7 +123473,7 @@ async function backupCommand(options, command) {
   const staging = mkdtempSync3(join65(tmpdir5(), "portta-backup-"));
   chmodSync14(staging, 448);
   try {
-    writeFileSync17(join65(staging, "portta-backup.json"), renderManifest({
+    writeFileSync16(join65(staging, "portta-backup.json"), renderManifest({
       version: BACKUP_VERSION,
       portta: context.version,
       created: (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d+Z$/, "Z"),
@@ -128587,7 +128650,7 @@ async function buildCommand(command) {
 
 // src/commands/remote.ts
 init_src();
-import { existsSync as existsSync44, mkdirSync as mkdirSync24, readFileSync as readFileSync37, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync18 } from "node:fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync24, readFileSync as readFileSync37, readdirSync as readdirSync10, rmSync as rmSync13, writeFileSync as writeFileSync17 } from "node:fs";
 import { basename as basename20, join as join67 } from "node:path";
 import { createServer as createServer3 } from "node:net";
 import { randomBytes as randomBytes10 } from "node:crypto";
@@ -128867,7 +128930,7 @@ async function remoteAccessOpen(target, options, command) {
     throw new PreconditionError("the SSH tunnel exited immediately", `check that ${target} is reachable and that ${localPort} is free locally`);
   }
   const record6 = { id, pid, target, project: options.project, service: options.service, remotePort, localPort, started: Math.floor(Date.now() / 1e3) };
-  writeFileSync18(join67(directoryPath, `${id}.json`), renderTunnelRecord(record6));
+  writeFileSync17(join67(directoryPath, `${id}.json`), renderTunnelRecord(record6));
   if (output2.json) {
     output2.data({ ...record6, address: `127.0.0.1:${localPort}` });
     return;
@@ -128932,7 +128995,7 @@ init_src();
 init_src();
 init_context();
 init_errors3();
-import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync38, rmSync as rmSync14, writeFileSync as writeFileSync19 } from "node:fs";
+import { chmodSync as chmodSync15, closeSync as closeSync3, existsSync as existsSync45, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync38, rmSync as rmSync14, writeFileSync as writeFileSync18 } from "node:fs";
 import { ReadStream } from "node:tty";
 import { join as join68 } from "node:path";
 function globals20(command) {
@@ -129092,11 +129155,11 @@ async function tunnelSetup(options, command) {
       "copy the whole eyJ... string from the Cloudflare dashboard, not the install command around it"
     );
   }
-  writeFileSync19(paths3.credentials, renderTunnelCredentials(credentials), { mode: 384 });
+  writeFileSync18(paths3.credentials, renderTunnelCredentials(credentials), { mode: 384 });
   chmodSync15(paths3.credentials, 384);
   const origin = options.origin || defaultOrigin(context);
   const config3 = { id: credentials.TunnelID, zone: options.zone, origin, credentialsFile: "/etc/cloudflared/credentials.json", includeApex: options.apex ?? false };
-  writeFileSync19(paths3.config, renderTunnelConfig(config3));
+  writeFileSync18(paths3.config, renderTunnelConfig(config3));
   const envPath = join68(context.root, ".env");
   patchEnvFile(envPath, { CLOUDFLARE_TUNNEL_ZONE: options.zone, CLOUDFLARE_TUNNEL_ID: credentials.TunnelID });
   if (output2.json) {