@csark0812/skeleton 1.5.1 → 1.5.3

package/dist/cli.js

@@ -15651,6 +15651,9 @@ var require_extend = __commonJS((exports, module) => {
   };
 });
 
+// src/cli.ts
+import { readFileSync as readFileSync22 } from "node:fs";
+
 // src/audit/config/load.ts
 var import_ajv = __toESM(require_ajv(), 1);
 import { existsSync, readFileSync } from "node:fs";
@@ -16984,12 +16987,99 @@ async function loadPlugins(root, config) {
 }
 
 // src/audit/core/collect.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
-import { join as join5, relative as relative4 } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync5, realpathSync as realpathSync4, statSync as statSync2 } from "node:fs";
+import { join as join6, relative as relative4 } from "node:path";
+
+// src/audit/core/skill-roots.ts
+import { existsSync as existsSync6, readdirSync as readdirSync2, readlinkSync, realpathSync as realpathSync3 } from "node:fs";
+import { join as join5, relative as relative3 } from "node:path";
+
+// src/audit/core/skill-provenance.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { join as join4 } from "node:path";
+var DEFAULT_SKILLS_LOCKFILE = "skills-lock.json";
+function isForeignLockSourceType(sourceType) {
+  return sourceType !== "local";
+}
+function loadSkillsLock(root, lockfileRel = DEFAULT_SKILLS_LOCKFILE) {
+  const warnings = [];
+  const abs = join4(root, lockfileRel);
+  if (!existsSync5(abs)) {
+    return { lockfile: null, entries: {}, warnings };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync4(abs, "utf8"));
+  } catch (error) {
+    warnings.push(`malformed ${lockfileRel}: ${error instanceof Error ? error.message : String(error)}`);
+    return { lockfile: lockfileRel, entries: {}, warnings };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    warnings.push(`${lockfileRel}: expected a JSON object`);
+    return { lockfile: lockfileRel, entries: {}, warnings };
+  }
+  const obj = raw;
+  if (obj.version !== 1) {
+    warnings.push(`${lockfileRel}: unsupported version ${String(obj.version)} (expected 1); ignoring entries`);
+    return { lockfile: lockfileRel, entries: {}, warnings };
+  }
+  const skillsRaw = obj.skills;
+  if (!skillsRaw || typeof skillsRaw !== "object" || Array.isArray(skillsRaw)) {
+    warnings.push(`${lockfileRel}: missing or invalid "skills" object`);
+    return { lockfile: lockfileRel, entries: {}, warnings };
+  }
+  const entries = {};
+  for (const [slug, value] of Object.entries(skillsRaw)) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      warnings.push(`${lockfileRel}: skill "${slug}" has invalid entry`);
+      continue;
+    }
+    const entry = value;
+    const source = entry.source;
+    const sourceType = entry.sourceType;
+    if (typeof source !== "string" || source.length === 0) {
+      warnings.push(`${lockfileRel}: skill "${slug}" missing source`);
+      continue;
+    }
+    if (typeof sourceType !== "string" || sourceType.length === 0) {
+      warnings.push(`${lockfileRel}: skill "${slug}" missing sourceType`);
+      continue;
+    }
+    const parsed = { source, sourceType };
+    if (typeof entry.skillPath === "string")
+      parsed.skillPath = entry.skillPath;
+    if (typeof entry.computedHash === "string")
+      parsed.computedHash = entry.computedHash;
+    entries[slug] = parsed;
+  }
+  return { lockfile: lockfileRel, entries, warnings };
+}
+function classifySkillOwnership(slug, provenance, ownership) {
+  const ownedOverrides = new Set(ownership?.ownedSlugs ?? []);
+  const foreignOverrides = new Set(ownership?.foreignSlugs ?? []);
+  if (ownedOverrides.has(slug))
+    return "owned";
+  if (foreignOverrides.has(slug))
+    return "foreign";
+  const entry = provenance.entries[slug];
+  if (entry && isForeignLockSourceType(entry.sourceType))
+    return "foreign";
+  return "owned";
+}
+function resolveOwnershipForSlugs(slugs, provenance, ownership) {
+  const ownedSlugs = [];
+  const foreignSlugs = [];
+  for (const slug of slugs) {
+    if (classifySkillOwnership(slug, provenance, ownership) === "foreign") {
+      foreignSlugs.push(slug);
+    } else {
+      ownedSlugs.push(slug);
+    }
+  }
+  return { ownedSlugs, foreignSlugs };
+}
 
 // src/audit/core/skill-roots.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readlinkSync, realpathSync as realpathSync3 } from "node:fs";
-import { join as join4, relative as relative3 } from "node:path";
 var NESTED_SKILL_ROOTS = [".claude/skills", ".agents/skills"];
 var FLAT_SKILL_DENYLIST = new Set([
   ".git",
@@ -17018,10 +17108,10 @@ function safeRealpath(path) {
   }
 }
 function listNestedSlugs(root, relRoot) {
-  const absRoot = join4(root, relRoot);
-  if (!existsSync5(absRoot))
+  const absRoot = join5(root, relRoot);
+  if (!existsSync6(absRoot))
     return [];
-  return readdirSync2(absRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NESTED_EXCLUDED_DIRS.has(entry.name)).filter((entry) => existsSync5(join4(absRoot, entry.name, "SKILL.md"))).map((entry) => entry.name).sort();
+  return readdirSync2(absRoot, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.name.startsWith(".") && !NESTED_EXCLUDED_DIRS.has(entry.name)).filter((entry) => existsSync6(join5(absRoot, entry.name, "SKILL.md"))).map((entry) => entry.name).sort();
 }
 function listFlatSlugs(root) {
   const slugs = [];
@@ -17030,7 +17120,7 @@ function listFlatSlugs(root) {
       continue;
     if (FLAT_SKILL_DENYLIST.has(entry.name))
       continue;
-    if (existsSync5(join4(root, entry.name, "SKILL.md"))) {
+    if (existsSync6(join5(root, entry.name, "SKILL.md"))) {
       slugs.push(entry.name);
     }
   }
@@ -17040,8 +17130,8 @@ function detectSkillRoots(root) {
   const roots = [];
   let claudeReal = null;
   for (const relRoot of NESTED_SKILL_ROOTS) {
-    const abs = join4(root, relRoot);
-    if (!existsSync5(abs))
+    const abs = join5(root, relRoot);
+    if (!existsSync6(abs))
       continue;
     if (relRoot === ".claude/skills") {
       claudeReal = safeRealpath(abs);
@@ -17055,11 +17145,11 @@ function detectSkillRoots(root) {
         continue;
       try {
         const link = readlinkSync(abs);
-        if (link && claudeReal && safeRealpath(join4(root, link)) === claudeReal)
+        if (link && claudeReal && safeRealpath(join5(root, link)) === claudeReal)
           continue;
       } catch {}
     }
-    if (listNestedSlugs(root, relRoot).length > 0 || existsSync5(abs)) {
+    if (listNestedSlugs(root, relRoot).length > 0 || existsSync6(abs)) {
       roots.push({ kind: "nested", relPath: relRoot });
     }
   }
@@ -17069,12 +17159,13 @@ function detectSkillRoots(root) {
   }
   return roots;
 }
-function buildSkillIndex(root) {
+function buildSkillIndex(root, ownership) {
   const roots = detectSkillRoots(root);
   const slugSet = new Set;
   const slugs = [];
+  const flatSlugs = listFlatSlugs(root);
   for (const skillRoot of roots) {
-    const rootSlugs = skillRoot.kind === "nested" ? listNestedSlugs(root, skillRoot.relPath) : listFlatSlugs(root);
+    const rootSlugs = skillRoot.kind === "nested" ? listNestedSlugs(root, skillRoot.relPath) : flatSlugs;
     for (const slug of rootSlugs) {
       if (!slugSet.has(slug)) {
         slugSet.add(slug);
@@ -17082,40 +17173,94 @@ function buildSkillIndex(root) {
       }
     }
   }
-  return { roots, slugs };
+  const lockfileRel = ownership?.lockfile ?? DEFAULT_SKILLS_LOCKFILE;
+  const provenance = loadSkillsLock(root, lockfileRel);
+  const { ownedSlugs, foreignSlugs } = resolveOwnershipForSlugs(slugs, provenance, ownership);
+  return { roots, slugs, flatSlugs, ownedSlugs, foreignSlugs, provenance };
+}
+function isForeignSkillSlug(index, slug) {
+  return index.foreignSlugs.includes(slug);
 }
 function resolveSkillPath(index, root, slug) {
   for (const skillRoot of index.roots) {
-    const candidate = skillRoot.kind === "nested" ? join4(root, skillRoot.relPath, slug, "SKILL.md") : join4(root, slug, "SKILL.md");
-    if (existsSync5(candidate)) {
+    const candidate = skillRoot.kind === "nested" ? join5(root, skillRoot.relPath, slug, "SKILL.md") : join5(root, slug, "SKILL.md");
+    if (existsSync6(candidate)) {
       return normalizeRelPath(relative3(root, candidate));
     }
   }
   return null;
 }
 function isSkillPath(relPath, index) {
+  return skillSlugForPath(relPath, index) !== null;
+}
+function skillSlugForPath(relPath, index) {
   const normalized = normalizeRelPath(relPath);
-  if (normalized.endsWith("/SKILL.md"))
-    return true;
+  const flat = new Set(index.flatSlugs);
   for (const skillRoot of index.roots) {
-    const prefix = skillRoot.kind === "nested" ? `${skillRoot.relPath}/` : "";
-    if (prefix && normalized.startsWith(prefix))
-      return true;
-    if (skillRoot.kind === "flat") {
-      const first = normalized.split("/")[0];
-      if (first && index.slugs.includes(first))
-        return true;
+    if (skillRoot.kind === "nested") {
+      const prefix = `${skillRoot.relPath}/`;
+      if (!normalized.startsWith(prefix))
+        continue;
+      const slug = normalized.slice(prefix.length).split("/")[0];
+      if (slug && index.slugs.includes(slug))
+        return slug;
+      continue;
     }
+    const first = normalized.split("/")[0];
+    if (first && flat.has(first))
+      return first;
   }
-  return false;
+  return null;
+}
+function isForeignSkillPath(relPath, index) {
+  const slug = skillSlugForPath(relPath, index);
+  if (!slug)
+    return false;
+  return isForeignSkillSlug(index, slug);
+}
+var NESTED_SKILL_SLUG_RE = /(?:^|\/)\.(?:claude|agents)\/skills\/([a-z0-9-]+)\//;
+var FLAT_SKILL_REFERENCES_RE = /(?:^|\/)([a-z0-9-]+)\/references(?:\/|$)/;
+function slugFromSkillPath(relPath) {
+  const normalized = normalizeRelPath(relPath);
+  const nested = normalized.match(NESTED_SKILL_SLUG_RE);
+  if (nested?.[1])
+    return nested[1];
+  if (normalized.endsWith("/SKILL.md")) {
+    const parts = normalized.split("/");
+    return parts.at(-2) ?? null;
+  }
+  return null;
+}
+function slugFromPath(filePath, workspaceRoot) {
+  const normalized = normalizeRelPath(filePath);
+  const nested = normalized.match(NESTED_SKILL_SLUG_RE);
+  if (nested?.[1])
+    return nested[1];
+  if (normalized.endsWith("/SKILL.md")) {
+    return slugFromSkillPath(normalized);
+  }
+  const flatRef = normalized.match(FLAT_SKILL_REFERENCES_RE);
+  const flatSlug = flatRef?.[1];
+  if (!flatSlug || FLAT_SKILL_DENYLIST.has(flatSlug))
+    return null;
+  if (workspaceRoot) {
+    if (!existsSync6(join5(workspaceRoot, flatSlug, "SKILL.md")))
+      return null;
+  }
+  return flatSlug;
 }
 function skillCollectAugments(index) {
+  const owned = new Set(index.ownedSlugs);
   const patterns = [];
   for (const skillRoot of index.roots) {
     if (skillRoot.kind === "nested") {
-      patterns.push(`${skillRoot.relPath}/**`);
+      for (const slug of index.ownedSlugs) {
+        patterns.push(`${skillRoot.relPath}/${slug}/**`);
+      }
     } else {
-      for (const slug of index.slugs) {
+      for (const slug of index.flatSlugs) {
+        if (!owned.has(slug))
+          continue;
         patterns.push(`${slug}/**`);
       }
     }
@@ -17123,12 +17268,15 @@ function skillCollectAugments(index) {
   return patterns;
 }
 function listSkillMarkdownPaths(root, index) {
+  const owned = new Set(index.ownedSlugs);
   const paths = new Set;
   for (const skillRoot of index.roots) {
     const slugs = skillRoot.kind === "nested" ? listNestedSlugs(root, skillRoot.relPath) : listFlatSlugs(root);
     for (const slug of slugs) {
-      const absDir = skillRoot.kind === "nested" ? join4(root, skillRoot.relPath, slug) : join4(root, slug);
-      if (!existsSync5(absDir))
+      if (!owned.has(slug))
+        continue;
+      const absDir = skillRoot.kind === "nested" ? join5(root, skillRoot.relPath, slug) : join5(root, slug);
+      if (!existsSync6(absDir))
         continue;
       for (const abs of globSync("**/*.{md,mdc}", {
         cwd: absDir,
@@ -17145,6 +17293,9 @@ function listSkillMarkdownPaths(root, index) {
 function listSkillSlugs(index) {
   return index.slugs;
 }
+function listOwnedSkillSlugs(index) {
+  return index.ownedSlugs;
+}
 
 // src/audit/core/collect.ts
 var MARKDOWN_GLOBS = ["**/*.md", "**/*.mdc"];
@@ -17156,7 +17307,7 @@ function shouldExclude(relPath, exclude) {
   return exclude.some((pattern) => matchesGlobScope(relPath, pattern));
 }
 function expandPatterns(root, patterns, exclude) {
-  const files = new Set;
+  const byReal = new Map;
   for (const pattern of patterns) {
     for (const abs of globSync(pattern, {
       cwd: root,
@@ -17169,10 +17320,19 @@ function expandPatterns(root, patterns, exclude) {
       const rel = normalizeRelPath(relative4(root, abs));
       if (shouldExclude(rel, exclude))
         continue;
-      files.add(abs);
+      let real;
+      try {
+        real = realpathSync4(abs);
+      } catch {
+        real = abs;
+      }
+      const existing = byReal.get(real);
+      if (existing === undefined || abs === real && existing !== real) {
+        byReal.set(real, abs);
+      }
     }
   }
-  return [...files];
+  return [...byReal.values()];
 }
 function collectScanFiles(config, root, skillIndex) {
   const exclude = mergedExcludes(config);
@@ -17180,7 +17340,13 @@ function collectScanFiles(config, root, skillIndex) {
   if (skillIndex) {
     includePatterns.push(...skillCollectAugments(skillIndex));
   }
-  return expandPatterns(root, includePatterns, exclude);
+  const files = expandPatterns(root, includePatterns, exclude);
+  if (!skillIndex)
+    return files;
+  return files.filter((abs) => {
+    const rel = normalizeRelPath(relative4(root, abs));
+    return !isForeignSkillPath(rel, skillIndex);
+  });
 }
 function collectBannedFiles(config, root) {
   if (config.scan.banned.length === 0)
@@ -17226,19 +17392,19 @@ function collectDocMetaPaths(config, root, registryPaths, skillIndex) {
   }
   const extras = ["docs/README.md", ".skeleton/registry.md"];
   for (const file of extras) {
-    const abs = join5(root, file);
-    if (existsSync6(abs))
+    const abs = join6(root, file);
+    if (existsSync7(abs))
       paths.push(normalizeRelPath(file));
   }
   for (const rel of registryPaths) {
     if (!rel.endsWith(".md") && !rel.endsWith(".mdc"))
       continue;
-    const abs = join5(root, rel);
-    if (existsSync6(abs))
+    const abs = join6(root, rel);
+    if (existsSync7(abs))
       paths.push(normalizeRelPath(rel));
   }
   for (const abs of collectScanFiles(config, root, skillIndex)) {
-    const content = readFileSync4(abs, "utf8");
+    const content = readFileSync5(abs, "utf8");
     if (/<!--\s*doc-meta:/.test(content)) {
       paths.push(normalizeRelPath(relative4(root, abs)));
     }
@@ -17248,7 +17414,7 @@ function collectDocMetaPaths(config, root, registryPaths, skillIndex) {
 function validateScanRoots(config, root) {
   const missing = [];
   for (const tree of extractScanRootsFromInclude(config.scan.include)) {
-    if (!existsSync6(join5(root, tree)))
+    if (!existsSync7(join6(root, tree)))
       missing.push(tree);
   }
   return missing;
@@ -17270,8 +17436,8 @@ function includeExplicitMarkdownPaths(files, paths, root) {
   const out = new Set(files);
   for (const raw of paths) {
     const rel = normalizeRelPath(raw);
-    const abs = join5(root, rel);
-    if (!existsSync6(abs))
+    const abs = join6(root, rel);
+    if (!existsSync7(abs))
       continue;
     if (isMarkdownFile(rel)) {
       out.add(abs);
@@ -17295,23 +17461,23 @@ function includeExplicitMarkdownPaths(files, paths, root) {
   return [...out];
 }
 function readFileContent(absPath) {
-  return readFileSync4(absPath, "utf8");
+  return readFileSync5(absPath, "utf8");
 }
 function relPath(absPath, root) {
   return normalizeRelPath(relative4(root, absPath));
 }
 
 // src/audit/core/registry.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "node:fs";
-import { join as join6, relative as relative5, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { join as join7, relative as relative5, resolve as resolve4 } from "node:path";
 var REGISTRY_TABLE_ROW_RE = /^\|\s*[^|]+\|\s*\[[^\]]*\]\(([^)]+)\)\s*\|/;
 var REGISTRY_TABLE_HEADER_RE = /\|\s*Topic\s*\|\s*Canonical file\s*\|/i;
 function parseRegistry(root) {
-  const abs = join6(root, REGISTRY_REL_PATH);
-  if (!existsSync7(abs)) {
+  const abs = join7(root, REGISTRY_REL_PATH);
+  if (!existsSync8(abs)) {
     return { paths: [], hasTableHeader: false };
   }
-  const content = readFileSync5(abs, "utf8");
+  const content = readFileSync6(abs, "utf8");
   const hasTableHeader = REGISTRY_TABLE_HEADER_RE.test(content);
   const paths = [];
   for (const line of content.split(`
@@ -17322,7 +17488,7 @@ function parseRegistry(root) {
     const linkTarget = match[1].trim();
     if (linkTarget.startsWith("#"))
       continue;
-    const resolved = resolve4(join6(root, REGISTRY_DIR_REL), linkTarget);
+    const resolved = resolve4(join7(root, REGISTRY_DIR_REL), linkTarget);
     paths.push(normalizeRelPath(relative5(root, resolved)));
   }
   return { paths: [...new Set(paths)], hasTableHeader };
@@ -17335,7 +17501,7 @@ function parseRegistryPaths(root) {
 function createContext(options = {}) {
   const root = options.root ?? findRepoRoot();
   const config = loadConfig(root);
-  const skillIndex = buildSkillIndex(root);
+  const skillIndex = buildSkillIndex(root, config.skillOwnership);
   let files = collectScanFiles(config, root, skillIndex);
   if (options.includeExcludedSkillTrees) {
     files = includeExplicitMarkdownPaths(files, listSkillMarkdownPaths(root, skillIndex), root);
@@ -17355,16 +17521,17 @@ function createContext(options = {}) {
     registryHasTableHeader: registry.hasTableHeader,
     retiredSkills: new Set(retiredSkills(config)),
     skillIndex,
+    lockedSkillSlugs: new Set(skillIndex.foreignSlugs),
     policies: options.policies ?? []
   };
 }
 
 // src/audit/core/fix.ts
-import { existsSync as existsSync10, realpathSync as realpathSync4, writeFileSync } from "node:fs";
+import { existsSync as existsSync11, realpathSync as realpathSync5, writeFileSync } from "node:fs";
 import { dirname as dirname6, resolve as resolve6, sep as sep3 } from "node:path";
 
 // src/audit/fix/anchors.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
 import { dirname as dirname5, resolve as resolve5 } from "node:path";
 
 // node_modules/github-slugger/regex.js
@@ -25545,7 +25712,7 @@ var handle = {
 };
 
 // node_modules/mdast-util-to-markdown/lib/join.js
-var join7 = [joinDefaults];
+var join8 = [joinDefaults];
 function joinDefaults(left, right, parent, state) {
   if (right.type === "code" && formatCodeAsIndented(right, state) && (left.type === "list" || left.type === right.type && formatCodeAsIndented(left, state))) {
     return false;
@@ -25928,7 +26095,7 @@ function toMarkdown(tree, options) {
     handle: undefined,
     indentLines,
     indexStack: [],
-    join: [...join7],
+    join: [...join8],
     options: {},
     safe: safeBound,
     stack: [],
@@ -28918,9 +29085,9 @@ function collectAnchorFixes(ctx) {
       if (!anchor)
         continue;
       const resolved = resolveLink(filePath, target);
-      if (!existsSync8(resolved))
+      if (!existsSync9(resolved))
         continue;
-      const targetContent = readFileSync6(resolved, "utf8");
+      const targetContent = readFileSync7(resolved, "utf8");
       const slugs = extractHeadingSlugs(targetContent, resolved);
       const anchorSlug = slugifyAnchor(anchor);
       if (slugs.has(anchorSlug))
@@ -28969,8 +29136,8 @@ function collectAnchorFixes(ctx) {
 }
 
 // src/audit/fix/doc-meta.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
-import { join as join8 } from "node:path";
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
+import { join as join9 } from "node:path";
 
 // src/audit/core/git-meta.ts
 import { spawnSync } from "node:child_process";
@@ -29001,10 +29168,10 @@ function bumpDocMetaLastReviewed(content3, gitDate) {
 function collectDocMetaFixes(ctx) {
   const edits = [];
   for (const relPath2 of ctx.docMetaPaths) {
-    const abs = join8(ctx.root, relPath2);
-    if (!existsSync9(abs))
+    const abs = join9(ctx.root, relPath2);
+    if (!existsSync10(abs))
       continue;
-    const content3 = readFileSync7(abs, "utf8");
+    const content3 = readFileSync8(abs, "utf8");
     if (!DOC_META_RE.test(content3))
       continue;
     const reviewedStr = docMetaLastReviewed(content3);
@@ -29071,11 +29238,11 @@ function resolveWritePath(root2, relFile) {
   if (!underRoot(rootResolved, abs)) {
     throw new Error(`Refusing autofix outside repo root: ${relFile}`);
   }
-  const rootReal = existsSync10(rootResolved) ? realpathSync4(rootResolved) : rootResolved;
+  const rootReal = existsSync11(rootResolved) ? realpathSync5(rootResolved) : rootResolved;
   let cursor = abs;
   while (true) {
-    if (existsSync10(cursor)) {
-      const real = realpathSync4(cursor);
+    if (existsSync11(cursor)) {
+      const real = realpathSync5(cursor);
       if (!underRoot(rootReal, real)) {
         throw new Error(`Refusing autofix outside repo root: ${relFile}`);
       }
@@ -29184,8 +29351,8 @@ function printReport(issues, options) {
 }
 
 // src/references/check.ts
-import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "node:fs";
-import { join as join10, relative as relative7 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync10 } from "node:fs";
+import { join as join11, relative as relative7 } from "node:path";
 
 // src/references/constants.ts
 var CANONICAL_REFS_DIR = ".skeleton/references";
@@ -29208,16 +29375,16 @@ function isGeneratedReference(content3) {
 }
 
 // src/references/discover.ts
-import { existsSync as existsSync11, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "node:fs";
-import { join as join9, relative as relative6 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "node:fs";
+import { join as join10, relative as relative6 } from "node:path";
 function walkMarkdownFiles(dir, root2) {
   const files = [];
-  if (!existsSync11(dir))
+  if (!existsSync12(dir))
     return files;
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (entry.name.startsWith("."))
       continue;
-    const fullPath = join9(dir, entry.name);
+    const fullPath = join10(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkMarkdownFiles(fullPath, root2));
       continue;
@@ -29229,7 +29396,7 @@ function walkMarkdownFiles(dir, root2) {
   return files;
 }
 function canonicalExists(root2, refPath) {
-  return existsSync11(join9(root2, CANONICAL_REFS_DIR, refPath));
+  return existsSync12(join10(root2, CANONICAL_REFS_DIR, refPath));
 }
 function findSharedRefLinks(content3, sourceFile) {
   const links = [];
@@ -29260,7 +29427,7 @@ function findLocalCanonicalLinks(root2, content3, sourceFile) {
       const raw = normalizeRelPath(match[1] ?? "");
       if (!raw)
         continue;
-      const refPath = withinDir ? normalizeRelPath(join9(withinDir, raw)) : raw;
+      const refPath = withinDir ? normalizeRelPath(join10(withinDir, raw)) : raw;
       if (!canonicalExists(root2, refPath))
         continue;
       links.push({ refPath, sourceFile });
@@ -29268,17 +29435,17 @@ function findLocalCanonicalLinks(root2, content3, sourceFile) {
   }
   return links;
 }
-function discoverSkillReferencePlans(root2) {
-  const index2 = buildSkillIndex(root2);
+function discoverSkillReferencePlans(root2, ownership) {
+  const index2 = buildSkillIndex(root2, ownership);
   const plans = [];
-  for (const slug2 of index2.slugs) {
-    const skillDir = join9(root2, slug2);
-    if (!existsSync11(join9(skillDir, "SKILL.md")))
+  for (const slug2 of index2.ownedSlugs) {
+    const skillDir = join10(root2, slug2);
+    if (!existsSync12(join10(skillDir, "SKILL.md")))
       continue;
     const refPaths = new Set;
     const links = [];
     for (const relFile of walkMarkdownFiles(skillDir, root2)) {
-      const content3 = readFileSync8(join9(root2, relFile), "utf8");
+      const content3 = readFileSync9(join10(root2, relFile), "utf8");
       if (isGeneratedReference(content3))
         continue;
       for (const link2 of findSharedRefLinks(content3, relFile)) {
@@ -29295,7 +29462,7 @@ function discoverSkillReferencePlans(root2) {
       const refPath = queue.pop();
       if (!refPath || !canonicalExists(root2, refPath))
         continue;
-      const canonicalContent = readFileSync8(join9(root2, CANONICAL_REFS_DIR, refPath), "utf8");
+      const canonicalContent = readFileSync9(join10(root2, CANONICAL_REFS_DIR, refPath), "utf8");
       const syntheticSource = generatedRefPath(slug2, refPath);
       for (const link2 of findLocalCanonicalLinks(root2, canonicalContent, syntheticSource)) {
         if (refPaths.has(link2.refPath))
@@ -29312,7 +29479,7 @@ function discoverSkillReferencePlans(root2) {
   return plans.sort((a, b) => a.skill.localeCompare(b.skill));
 }
 function generatedRefPath(skill, refPath) {
-  return normalizeRelPath(join9(skill, "references", refPath));
+  return normalizeRelPath(join10(skill, "references", refPath));
 }
 function rewriteSharedRefTarget(sourceFile, skill, refPath) {
   const sourceDir = sourceFile.slice(0, sourceFile.lastIndexOf("/"));
@@ -29341,19 +29508,19 @@ function rewriteSharedRefLinks(content3, sourceFile, skill) {
 function listAllGeneratedFiles(root2) {
   const files = [];
   const walk = (dir) => {
-    if (!existsSync12(dir))
+    if (!existsSync13(dir))
       return;
     for (const entry of readdirSync4(dir, { withFileTypes: true })) {
       if (entry.name.startsWith("."))
         continue;
-      const fullPath = join10(dir, entry.name);
+      const fullPath = join11(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
         continue;
       }
       if (!entry.name.endsWith(".md"))
         continue;
-      const content3 = readFileSync9(fullPath, "utf8");
+      const content3 = readFileSync10(fullPath, "utf8");
       if (isGeneratedReference(content3)) {
         files.push(normalizeRelPath(relative7(root2, fullPath)));
       }
@@ -29362,12 +29529,13 @@ function listAllGeneratedFiles(root2) {
   walk(root2);
   return files;
 }
-function runGeneratedReferencesCheck(root2) {
+function runGeneratedReferencesCheck(root2, ownership) {
   const issues = [];
-  const canonicalDir = join10(root2, CANONICAL_REFS_DIR);
-  if (!existsSync12(canonicalDir))
+  const canonicalDir = join11(root2, CANONICAL_REFS_DIR);
+  if (!existsSync13(canonicalDir))
     return issues;
-  const plans = discoverSkillReferencePlans(root2);
+  const skillIndex = buildSkillIndex(root2, ownership);
+  const plans = discoverSkillReferencePlans(root2, ownership);
   const needed = new Set;
   for (const plan of plans) {
     for (const refPath of plan.refPaths) {
@@ -29375,42 +29543,44 @@ function runGeneratedReferencesCheck(root2) {
     }
   }
   for (const targetRel of needed) {
-    const targetPath = join10(root2, targetRel);
-    if (!existsSync12(targetPath)) {
+    const targetPath = join11(root2, targetRel);
+    if (!existsSync13(targetPath)) {
       issues.push(issue("generated-references", targetRel, "missing generated copy — run skeleton references sync"));
       continue;
     }
-    const generated = readFileSync9(targetPath, "utf8");
+    const generated = readFileSync10(targetPath, "utf8");
     if (!isGeneratedReference(generated)) {
       issues.push(issue("generated-references", targetRel, "expected generated-reference provenance header"));
       continue;
     }
     const body = stripGeneratedHeader(generated);
-    const sourceRel = normalizeRelPath(generated.match(/source: ([^\n]+)/)?.[1] ?? join10(CANONICAL_REFS_DIR, targetRel.split("/references/")[1] ?? ""));
-    const canonicalPath = join10(root2, sourceRel);
-    if (!existsSync12(canonicalPath)) {
+    const sourceRel = normalizeRelPath(generated.match(/source: ([^\n]+)/)?.[1] ?? join11(CANONICAL_REFS_DIR, targetRel.split("/references/")[1] ?? ""));
+    const canonicalPath = join11(root2, sourceRel);
+    if (!existsSync13(canonicalPath)) {
       issues.push(issue("generated-references", targetRel, `canonical source missing: ${sourceRel}`));
       continue;
     }
-    const canonical = readFileSync9(canonicalPath, "utf8");
+    const canonical = readFileSync10(canonicalPath, "utf8");
     if (body !== canonical) {
       issues.push(issue("generated-references", targetRel, "stale generated copy — run skeleton references sync"));
     }
   }
   for (const generatedRel of listAllGeneratedFiles(root2)) {
+    if (isForeignSkillPath(generatedRel, skillIndex))
+      continue;
     if (!needed.has(generatedRel)) {
       issues.push(issue("generated-references", generatedRel, "orphaned generated copy — run skeleton references sync"));
     }
   }
   for (const plan of plans) {
-    const skillDir = join10(root2, plan.skill);
-    if (!existsSync12(skillDir))
+    const skillDir = join11(root2, plan.skill);
+    if (!existsSync13(skillDir))
       continue;
     const walk = (dir) => {
       for (const entry of readdirSync4(dir, { withFileTypes: true })) {
         if (entry.name.startsWith("."))
           continue;
-        const fullPath = join10(dir, entry.name);
+        const fullPath = join11(dir, entry.name);
         if (entry.isDirectory()) {
           walk(fullPath);
           continue;
@@ -29418,7 +29588,7 @@ function runGeneratedReferencesCheck(root2) {
         if (!entry.name.endsWith(".md"))
           continue;
         const relFile = normalizeRelPath(relative7(root2, fullPath));
-        const content3 = readFileSync9(fullPath, "utf8");
+        const content3 = readFileSync10(fullPath, "utf8");
         if (content3.match(SHARED_REF_LINK_RE)) {
           issues.push(issue("generated-references", relFile, "still links to shared root references/ — run skeleton references sync"));
         }
@@ -29429,7 +29599,7 @@ function runGeneratedReferencesCheck(root2) {
   return issues;
 }
 function runGeneratedReferencesRule(ctx) {
-  return runGeneratedReferencesCheck(ctx.root);
+  return runGeneratedReferencesCheck(ctx.root, ctx.config.skillOwnership);
 }
 var generatedReferencesRule = {
   id: "generated-references",
@@ -29449,16 +29619,16 @@ function runBannedRule(ctx) {
 var bannedRule = { id: "banned", run: runBannedRule };
 
 // src/audit/rules/doc-meta.ts
-import { existsSync as existsSync13, readFileSync as readFileSync10 } from "node:fs";
-import { join as join11 } from "node:path";
+import { existsSync as existsSync14, readFileSync as readFileSync11 } from "node:fs";
+import { join as join12 } from "node:path";
 function runDocMetaRule(ctx) {
   const issues = [];
   const today = new Date;
   for (const relPath2 of ctx.docMetaPaths) {
-    const abs = join11(ctx.root, relPath2);
-    if (!existsSync13(abs))
+    const abs = join12(ctx.root, relPath2);
+    if (!existsSync14(abs))
       continue;
-    const content3 = readFileSync10(abs, "utf8");
+    const content3 = readFileSync11(abs, "utf8");
     if (!DOC_META_RE.test(content3)) {
       issues.push(issue("doc-meta", relPath2, "missing doc-meta comment (owner + last-reviewed)"));
       continue;
@@ -29473,6 +29643,9 @@ function runDocMetaRule(ctx) {
     if (ageDays > ctx.config.daysUntilStale) {
       issues.push(issue("doc-meta", relPath2, `doc-meta last-reviewed ${reviewedStr} is stale (>${ctx.config.daysUntilStale} days)`, { severity: "warning" }));
     }
+    const slug2 = slugFromPath(relPath2, ctx.root);
+    if (slug2 !== null && ctx.lockedSkillSlugs.has(slug2))
+      continue;
     const gitDate = lastGitCommitDate(relPath2, ctx.root);
     if (!gitDate)
       continue;
@@ -29488,7 +29661,7 @@ function runDocMetaRule(ctx) {
 var docMetaRule = { id: "doc-meta", run: runDocMetaRule };
 
 // src/audit/rules/links.ts
-import { existsSync as existsSync14, readFileSync as readFileSync11 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync12 } from "node:fs";
 import { dirname as dirname7, resolve as resolve7 } from "node:path";
 function resolveLink2(sourceFile, target) {
   const withoutAnchor = target.split("#")[0]?.split("?")[0] ?? "";
@@ -29525,19 +29698,19 @@ function validateTarget(ctx, sourceFile, target, linkLabel) {
   }
   if ((target.includes(".claude/agents/") || target.includes(".cursor/agents/")) && target.endsWith(".md")) {
     const agentPath = resolved.endsWith(".md") ? resolved : `${resolved}.md`;
-    if (!existsSync14(agentPath)) {
+    if (!existsSync15(agentPath)) {
       issues.push(issue("links", relSource, "missing agent file", { link: linkLabel }));
     }
     return issues;
   }
-  if (pathPart && !existsSync14(resolved)) {
+  if (pathPart && !existsSync15(resolved)) {
     issues.push(issue("links", relSource, `broken link → ${relTarget}`, {
       link: linkLabel
     }));
     return issues;
   }
-  if (anchor && existsSync14(resolved)) {
-    const targetContent = readFileSync11(resolved, "utf8");
+  if (anchor && existsSync15(resolved)) {
+    const targetContent = readFileSync12(resolved, "utf8");
     const slugs = extractHeadingSlugs(targetContent, resolved);
     const anchorSlug = slugifyAnchor(anchor);
     if (!slugs.has(anchorSlug)) {
@@ -29612,8 +29785,8 @@ function runProsePolicyRule(ctx) {
 var prosePolicyRule = { id: "prose-policy", run: runProsePolicyRule };
 
 // src/audit/rules/registry.ts
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync13 } from "node:fs";
+import { join as join13 } from "node:path";
 function runRegistryRule(ctx) {
   const issues = [];
   const registry = new Set(ctx.registryPaths);
@@ -29621,12 +29794,12 @@ function runRegistryRule(ctx) {
     issues.push(issue("registry", REGISTRY_REL_PATH, "registry table header found but 0 rows parsed — check | Topic | Canonical file | format and link syntax"));
   }
   for (const rel of ctx.registryPaths) {
-    const abs = join12(ctx.root, rel);
-    if (!existsSync15(abs)) {
+    const abs = join13(ctx.root, rel);
+    if (!existsSync16(abs)) {
       issues.push(issue("registry", rel, "registry entry file missing"));
       continue;
     }
-    const content3 = readFileSync12(abs, "utf8");
+    const content3 = readFileSync13(abs, "utf8");
     if (!SOURCE_OF_TRUTH_BANNER_RE.test(content3)) {
       issues.push(issue("registry", rel, "missing **Source of truth for** banner (required for registry entry)"));
     }
@@ -29637,7 +29810,7 @@ function runRegistryRule(ctx) {
       continue;
     if (!rel.endsWith(".md") && !rel.endsWith(".mdc"))
       continue;
-    const content3 = readFileSync12(filePath, "utf8");
+    const content3 = readFileSync13(filePath, "utf8");
     if (!SOURCE_OF_TRUTH_BANNER_LINE_RE.test(content3))
       continue;
     if (!registry.has(rel)) {
@@ -29674,16 +29847,16 @@ function runScanRootsRule(ctx) {
 var scanRootsRule = { id: "scan-roots", run: runScanRootsRule };
 
 // src/audit/rules/skill-index.ts
-import { existsSync as existsSync16, readdirSync as readdirSync5, readFileSync as readFileSync13 } from "node:fs";
-import { join as join13, relative as relative8 } from "node:path";
+import { existsSync as existsSync17, readdirSync as readdirSync5, readFileSync as readFileSync14 } from "node:fs";
+import { join as join14, relative as relative8 } from "node:path";
 function walkSkillMarkdown(dir) {
   const files = [];
-  if (!existsSync16(dir))
+  if (!existsSync17(dir))
     return files;
   for (const entry of readdirSync5(dir, { withFileTypes: true })) {
     if (entry.name.startsWith("."))
       continue;
-    const fullPath = join13(dir, entry.name);
+    const fullPath = join14(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkSkillMarkdown(fullPath));
       continue;
@@ -29710,7 +29883,7 @@ function parseReadmeTaxonomySlugs(content3) {
 function scanFileForSkillLinks(ctx, filePath, index2) {
   const issues = [];
   const rel = relative8(ctx.root, filePath).replace(/\\/g, "/");
-  const content3 = readFileSync13(filePath, "utf8");
+  const content3 = readFileSync14(filePath, "utf8");
   if (isGeneratedReference(content3))
     return issues;
   for (const match of content3.matchAll(SKILL_LINK_RE)) {
@@ -29733,15 +29906,16 @@ function validateReadmeTaxonomy(ctx, index2, diskSlugs) {
   for (const skillRoot of index2.roots) {
     if (skillRoot.kind !== "nested")
       continue;
-    const readmePath = join13(ctx.root, skillRoot.relPath, "README.md");
-    if (!existsSync16(readmePath))
+    const readmePath = join14(ctx.root, skillRoot.relPath, "README.md");
+    if (!existsSync17(readmePath))
       continue;
-    const readme = readFileSync13(readmePath, "utf8");
+    const readme = readFileSync14(readmePath, "utf8");
     if (!readme.includes("## Taxonomy"))
       continue;
     const taxonomySlugs = parseReadmeTaxonomySlugs(readme);
-    const nestedSlugs = diskSlugs.filter((slug2) => existsSync16(join13(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
-    const publicSlugs = nestedSlugs.filter((slug2) => !nonPublic.has(slug2));
+    const nestedSlugs = diskSlugs.filter((slug2) => existsSync17(join14(ctx.root, skillRoot.relPath, slug2, "SKILL.md")));
+    const foreign = new Set(index2.foreignSlugs);
+    const publicSlugs = nestedSlugs.filter((slug2) => !nonPublic.has(slug2) && !foreign.has(slug2));
     const relReadme = `${skillRoot.relPath}/README.md`;
     for (const slug2 of publicSlugs) {
       if (!taxonomySlugs.includes(slug2)) {
@@ -29760,30 +29934,45 @@ function runSkillIndexRule(ctx) {
   const issues = [];
   const index2 = ctx.skillIndex;
   const diskSlugs = listSkillSlugs(index2);
+  for (const warning of index2.provenance.warnings) {
+    issues.push(issue("skill-index", index2.provenance.lockfile ?? "skills-lock.json", `skill provenance: ${warning}`, {
+      severity: "warning"
+    }));
+  }
   issues.push(...validateReadmeTaxonomy(ctx, index2, diskSlugs));
+  const owned = new Set(index2.ownedSlugs);
   for (const skillRoot of index2.roots) {
-    const scanRoot = skillRoot.kind === "nested" ? join13(ctx.root, skillRoot.relPath) : join13(ctx.root);
-    if (skillRoot.kind === "nested" && existsSync16(scanRoot)) {
-      for (const skillMd of walkSkillMarkdown(scanRoot)) {
-        issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
+    if (skillRoot.kind === "nested") {
+      for (const slug2 of index2.ownedSlugs) {
+        const skillDir = join14(ctx.root, skillRoot.relPath, slug2);
+        if (!existsSync17(skillDir))
+          continue;
+        for (const skillMd of walkSkillMarkdown(skillDir)) {
+          issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
+        }
       }
+      continue;
     }
-    if (skillRoot.kind === "flat") {
-      for (const slug2 of index2.slugs) {
-        const skillDir = join13(ctx.root, slug2);
-        if (existsSync16(skillDir)) {
-          for (const skillMd of walkSkillMarkdown(skillDir)) {
-            issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
-          }
-        }
+    for (const slug2 of index2.flatSlugs) {
+      if (!owned.has(slug2))
+        continue;
+      const skillDir = join14(ctx.root, slug2);
+      if (!existsSync17(skillDir))
+        continue;
+      for (const skillMd of walkSkillMarkdown(skillDir)) {
+        issues.push(...scanFileForSkillLinks(ctx, skillMd, index2));
       }
     }
   }
   return issues;
 }
 var skillIndexRule = { id: "skill-index", run: runSkillIndexRule };
-function skillCountOnDisk(ctx) {
-  return listSkillSlugs(ctx.skillIndex).length;
+function skillAuditSuffix(ctx) {
+  const owned = listOwnedSkillSlugs(ctx.skillIndex).length;
+  const foreign = ctx.skillIndex.foreignSlugs.length;
+  if (foreign === 0)
+    return ` (${owned} skills on disk)`;
+  return ` (${owned} owned skills audited, ${foreign} foreign ignored)`;
 }
 
 // src/audit/rules/index.ts
@@ -29952,24 +30141,24 @@ async function runAudit(options) {
     json: options.json,
     label,
     fileCount: options.suite === "docs" || options.suite === "self" ? ctx.files.length : undefined,
-    successSuffix: options.suite === "skills" ? ` (${skillCountOnDisk(ctx)} skills on disk)` : undefined
+    successSuffix: options.suite === "skills" ? skillAuditSuffix(ctx) : undefined
   });
 }
 
 // src/customize/resolve.ts
-import { existsSync as existsSync17, readFileSync as readFileSync14 } from "node:fs";
-import { basename as basename3, join as join14, relative as relative9 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync15 } from "node:fs";
+import { basename as basename3, join as join15, relative as relative9 } from "node:path";
 var CUSTOMIZE_PREFIX = "Customize: ";
 function customizeDir(root2) {
-  return join14(root2, REGISTRY_DIR_REL, "customize");
+  return join15(root2, REGISTRY_DIR_REL, "customize");
 }
 function customizePathForSlug(root2, slug2) {
-  return join14(customizeDir(root2), `${slug2}.md`);
+  return join15(customizeDir(root2), `${slug2}.md`);
 }
 function findCustomizeViaRegistry(root2, slug2) {
   for (const rel of parseRegistryPaths(root2)) {
     const expected = `${REGISTRY_DIR_REL}/customize/${slug2}.md`;
-    if (normalizeRelPath(rel) === expected && existsSync17(join14(root2, rel))) {
+    if (normalizeRelPath(rel) === expected && existsSync18(join15(root2, rel))) {
       return rel;
     }
   }
@@ -29977,17 +30166,17 @@ function findCustomizeViaRegistry(root2, slug2) {
 }
 function resolveSlugFile(root2, slug2) {
   const direct = customizePathForSlug(root2, slug2);
-  if (existsSync17(direct)) {
+  if (existsSync18(direct)) {
     return {
-      content: readFileSync14(direct, "utf8"),
+      content: readFileSync15(direct, "utf8"),
       path: normalizeRelPath(relative9(root2, direct))
     };
   }
   const registryPath = findCustomizeViaRegistry(root2, slug2);
   if (registryPath) {
-    const abs = join14(root2, registryPath);
+    const abs = join15(root2, registryPath);
     return {
-      content: readFileSync14(abs, "utf8"),
+      content: readFileSync15(abs, "utf8"),
       path: registryPath
     };
   }
@@ -30009,10 +30198,10 @@ function readAlwaysInclude(root2, basenames, skipBasename) {
     const file = basename3(name);
     if (skipBasename && file === skipBasename)
       continue;
-    const abs = join14(dir, file);
-    if (!existsSync17(abs))
+    const abs = join15(dir, file);
+    if (!existsSync18(abs))
       continue;
-    parts.push(readFileSync14(abs, "utf8").trimEnd());
+    parts.push(readFileSync15(abs, "utf8").trimEnd());
     paths.push(normalizeRelPath(relative9(root2, abs)));
   }
   return { parts, paths };
@@ -30051,61 +30240,151 @@ function resolveCustomizeFromRoot(slug2, startDir) {
   return resolveCustomize(root2, slug2);
 }
 
+// src/hooks/run.ts
+function parsePayload(raw) {
+  if (!raw.trim())
+    return {};
+  return JSON.parse(raw);
+}
+function extractPath(payload) {
+  const input = payload.tool_input ?? payload.toolInput ?? {};
+  const candidates = [
+    input.path,
+    input.file_path,
+    input.filePath,
+    input.target_file,
+    input.targetFile
+  ];
+  for (const value of candidates) {
+    if (typeof value === "string" && value.trim())
+      return normalizeRelPath(value.trim());
+  }
+  return null;
+}
+function extractSkillSlug(payload) {
+  const tool = payload.tool_name ?? payload.toolName ?? "";
+  if (tool === "Skill" || tool === "skill") {
+    const input = payload.tool_input ?? payload.toolInput ?? {};
+    const slug2 = input.skill ?? input.slug ?? input.name;
+    if (typeof slug2 === "string" && slug2.trim())
+      return slug2.trim();
+  }
+  const path2 = extractPath(payload);
+  if (path2)
+    return slugFromPath(path2, process.cwd());
+  return null;
+}
+function cursorResponse(content3) {
+  return JSON.stringify({ additional_context: content3 });
+}
+function claudeResponse(content3) {
+  return JSON.stringify({
+    hookSpecificOutput: {
+      additionalContext: content3
+    }
+  });
+}
+function codexResponse(content3) {
+  return JSON.stringify({ additionalContext: content3 });
+}
+function formatResponse(payload, content3) {
+  const tool = payload.tool_name ?? payload.toolName ?? "";
+  if (tool === "read_file")
+    return codexResponse(content3);
+  if (payload.hook_event_name?.toLowerCase().includes("claude"))
+    return claudeResponse(content3);
+  if (tool === "Read" && payload.hook_event_name === "postToolUse")
+    return cursorResponse(content3);
+  if (tool === "Read" || tool === "Skill")
+    return claudeResponse(content3);
+  return cursorResponse(content3);
+}
+function runCustomizeHook(raw) {
+  try {
+    const payload = parsePayload(raw);
+    const slug2 = extractSkillSlug(payload);
+    if (!slug2)
+      return "{}";
+    const resolved = resolveCustomizeFromRoot(slug2);
+    if (!resolved.content)
+      return "{}";
+    const from = resolved.included.length > 0 ? resolved.included.join(", ") : resolved.path ?? ".skeleton/customize";
+    const prefix = `
+
+---
+Customize override for /${slug2} (from ${from}):
+
+`;
+    return formatResponse(payload, prefix + resolved.content);
+  } catch (error) {
+    console.error(`customize hook error: ${error}`);
+    return "{}";
+  }
+}
+
 // src/init/init.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { copyFileSync, existsSync as existsSync21, mkdirSync as mkdirSync2, readFileSync as readFileSync16 } from "node:fs";
-import { join as join18 } from "node:path";
+import { copyFileSync, existsSync as existsSync22, mkdirSync as mkdirSync2, readFileSync as readFileSync17 } from "node:fs";
+import { join as join19 } from "node:path";
 
 // src/init/merge-hooks.ts
-import { existsSync as existsSync20, mkdirSync, readFileSync as readFileSync15, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname10, join as join17 } from "node:path";
+import { existsSync as existsSync21, mkdirSync, readFileSync as readFileSync16, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname10, join as join18 } from "node:path";
 
 // src/init/package-paths.ts
-import { existsSync as existsSync18 } from "node:fs";
-import { dirname as dirname8, join as join15 } from "node:path";
+import { existsSync as existsSync19 } from "node:fs";
+import { dirname as dirname8, join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var MODULE_DIR = dirname8(fileURLToPath5(import.meta.url));
-var PACKAGE_ROOT_CANDIDATES = [join15(MODULE_DIR, "../.."), join15(MODULE_DIR, "..")];
+var PACKAGE_ROOT_CANDIDATES = [join16(MODULE_DIR, "../.."), join16(MODULE_DIR, "..")];
 function resolvePackageRoot() {
   for (const candidate of PACKAGE_ROOT_CANDIDATES) {
-    if (existsSync18(join15(candidate, "package.json")))
+    if (existsSync19(join16(candidate, "package.json")))
       return candidate;
   }
   throw new Error("Could not resolve @csark0812/skeleton package root");
 }
 function resolveTemplatesDir() {
-  const dir = join15(resolvePackageRoot(), "templates/skeleton-init");
-  if (!existsSync18(dir)) {
+  const dir = join16(resolvePackageRoot(), "templates/skeleton-init");
+  if (!existsSync19(dir)) {
     throw new Error("Missing templates/skeleton-init in package");
   }
   return dir;
 }
 
 // src/init/resolve-hook-command.ts
-import { existsSync as existsSync19 } from "node:fs";
+import { existsSync as existsSync20, realpathSync as realpathSync6 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
-import { dirname as dirname9, join as join16, relative as relative10, resolve as resolve8 } from "node:path";
+import { dirname as dirname9, join as join17, relative as relative10, resolve as resolve8 } from "node:path";
 var PACKAGE_NAME = "@csark0812/skeleton";
-var HOOK_DIST = "dist/hooks/customize-on-skill-read.js";
-var HOOK_SRC = "src/hooks/customize-on-skill-read.ts";
+var CLI_DIST = "dist/cli.js";
 var PACKAGE_ROOT = resolvePackageRoot();
+var DEV_HOOK_COMMAND = "bun src/cli.ts hook customize";
+var FALLBACK_HOOK_COMMAND = `node node_modules/${PACKAGE_NAME}/${CLI_DIST} hook customize`;
+function safeRealpath2(path2) {
+  try {
+    return realpathSync6(path2);
+  } catch {
+    return path2;
+  }
+}
 function toRepoRelative(cwd, absPath) {
-  const rel = relative10(cwd, absPath).replace(/\\/g, "/");
+  const rel = relative10(safeRealpath2(cwd), safeRealpath2(absPath)).replace(/\\/g, "/");
   return rel.startsWith("..") ? absPath.replace(/\\/g, "/") : rel;
 }
-function tryResolvePublished(cwd) {
+function tryResolvePublishedCli(cwd) {
   try {
-    const req = createRequire3(join16(cwd, "package.json"));
-    return req.resolve(`${PACKAGE_NAME}/${HOOK_DIST}`);
+    const req = createRequire3(join17(cwd, "package.json"));
+    return req.resolve(`${PACKAGE_NAME}/${CLI_DIST}`);
   } catch {
     return null;
   }
 }
-function walkNodeModules(cwd) {
+function walkNodeModulesCli(cwd) {
   let dir = cwd;
   while (true) {
-    const candidate = join16(dir, "node_modules", PACKAGE_NAME, HOOK_DIST);
-    if (existsSync19(candidate))
+    const candidate = join17(dir, "node_modules", PACKAGE_NAME, CLI_DIST);
+    if (existsSync20(candidate))
       return candidate;
     const parent = dirname9(dir);
     if (parent === dir)
@@ -30118,28 +30397,25 @@ function isInsidePackageRoot(cwd) {
   const rel = relative10(PACKAGE_ROOT, resolve8(cwd)).replace(/\\/g, "/");
   return rel === "" || !rel.startsWith("..") && !rel.startsWith("/");
 }
+function nodeCliHookCommand(cliPath) {
+  return `node ${cliPath} hook customize`;
+}
 function resolveHookCommand(cwd) {
-  const published = tryResolvePublished(cwd);
+  if (isInsidePackageRoot(cwd))
+    return DEV_HOOK_COMMAND;
+  const published = tryResolvePublishedCli(cwd);
   if (published)
-    return toRepoRelative(cwd, published);
-  const hoisted = walkNodeModules(cwd);
+    return nodeCliHookCommand(toRepoRelative(cwd, published));
+  const hoisted = walkNodeModulesCli(cwd);
   if (hoisted)
-    return toRepoRelative(cwd, hoisted);
-  if (isInsidePackageRoot(cwd)) {
-    const distHook = join16(PACKAGE_ROOT, HOOK_DIST);
-    if (existsSync19(distHook))
-      return toRepoRelative(cwd, distHook);
-    const srcHook = join16(PACKAGE_ROOT, HOOK_SRC);
-    if (existsSync19(srcHook)) {
-      const rel = toRepoRelative(cwd, srcHook);
-      return rel.includes("/") ? `bun ${rel}` : `bun ./${rel}`;
-    }
-  }
-  return `node node_modules/${PACKAGE_NAME}/${HOOK_DIST}`;
+    return nodeCliHookCommand(toRepoRelative(cwd, hoisted));
+  return FALLBACK_HOOK_COMMAND;
 }
 function isSkeletonHookCommand(command) {
   if (!command)
     return false;
+  if (/\bhook\s+customize\b/.test(command))
+    return true;
   return /customize-on-skill-read\.(js|ts)\b/.test(command);
 }
 
@@ -30149,14 +30425,14 @@ function identityKey(platform, event, matcher) {
   return `skeleton:customize:${platform}:${event}:${matcher}`;
 }
 function loadFragment(name, hookCommand) {
-  const raw = readFileSync15(join17(TEMPLATES_DIR, name), "utf8");
+  const raw = readFileSync16(join18(TEMPLATES_DIR, name), "utf8");
   return JSON.parse(raw.replaceAll("{{HOOK_COMMAND}}", hookCommand));
 }
 function readJson(path2) {
-  if (!existsSync20(path2))
+  if (!existsSync21(path2))
     return null;
   try {
-    return JSON.parse(readFileSync15(path2, "utf8"));
+    return JSON.parse(readFileSync16(path2, "utf8"));
   } catch (error) {
     throw new Error(`Invalid JSON in ${path2}: ${error}`);
   }
@@ -30262,14 +30538,14 @@ function mergeNestedHooks(platform, targetPath, fragment, eventName, opts) {
 }
 function mergeHookConfigs(opts) {
   const results = [];
-  const cursorPath = join17(opts.cwd, ".cursor/hooks.json");
+  const cursorPath = join18(opts.cwd, ".cursor/hooks.json");
   const cursorFragment = loadFragment("cursor-hooks.fragment.json", opts.hookCommand);
   results.push(mergeCursorHooks(cursorPath, cursorFragment, opts));
-  const claudePath = join17(opts.cwd, ".claude/settings.json");
+  const claudePath = join18(opts.cwd, ".claude/settings.json");
   const claudeFragment = loadFragment("claude-settings.fragment.json", opts.hookCommand);
   results.push(mergeNestedHooks("claude", claudePath, claudeFragment, "PostToolUse", opts));
-  const codexPath = join17(opts.cwd, ".codex/hooks.json");
-  if (existsSync20(join17(opts.cwd, ".codex"))) {
+  const codexPath = join18(opts.cwd, ".codex/hooks.json");
+  if (existsSync21(join18(opts.cwd, ".codex"))) {
     const codexFragment = loadFragment("codex-hooks.fragment.json", opts.hookCommand);
     results.push(mergeNestedHooks("codex", codexPath, codexFragment, "PostToolUse", opts));
   } else {
@@ -30278,11 +30554,11 @@ function mergeHookConfigs(opts) {
   return results;
 }
 function mergePackageJsonScripts(cwd) {
-  const pkgPath = join17(cwd, "package.json");
-  if (!existsSync20(pkgPath))
+  const pkgPath = join18(cwd, "package.json");
+  if (!existsSync21(pkgPath))
     return "skipped";
-  const fragment = JSON.parse(readFileSync15(join17(TEMPLATES_DIR, "package.json.scripts.fragment.json"), "utf8"));
-  const pkg = JSON.parse(readFileSync15(pkgPath, "utf8"));
+  const fragment = JSON.parse(readFileSync16(join18(TEMPLATES_DIR, "package.json.scripts.fragment.json"), "utf8"));
+  const pkg = JSON.parse(readFileSync16(pkgPath, "utf8"));
   pkg.scripts ??= {};
   let changed = false;
   for (const [key, value] of Object.entries(fragment)) {
@@ -30338,27 +30614,27 @@ function skillsAddArgs(options = {}) {
 // src/init/init.ts
 var TEMPLATES_DIR2 = resolveTemplatesDir();
 function writeScaffold(cwd) {
-  const skeletonDir2 = join18(cwd, ".skeleton");
+  const skeletonDir2 = join19(cwd, ".skeleton");
   mkdirSync2(skeletonDir2, { recursive: true });
   let created = false;
-  const configPath = join18(skeletonDir2, "config.yaml");
-  if (!existsSync21(configPath)) {
-    copyFileSync(join18(TEMPLATES_DIR2, "config.yaml"), configPath);
+  const configPath = join19(skeletonDir2, "config.yaml");
+  if (!existsSync22(configPath)) {
+    copyFileSync(join19(TEMPLATES_DIR2, "config.yaml"), configPath);
     created = true;
   }
-  const registryPath = join18(skeletonDir2, "registry.md");
-  if (!existsSync21(registryPath)) {
-    copyFileSync(join18(TEMPLATES_DIR2, "registry.md"), registryPath);
+  const registryPath = join19(skeletonDir2, "registry.md");
+  if (!existsSync22(registryPath)) {
+    copyFileSync(join19(TEMPLATES_DIR2, "registry.md"), registryPath);
     created = true;
   }
-  mkdirSync2(join18(skeletonDir2, "customize"), { recursive: true });
+  mkdirSync2(join19(skeletonDir2, "customize"), { recursive: true });
   return created ? "created" : "skipped";
 }
 function assertPackageResolvable(cwd) {
-  const pkgPath = join18(cwd, "package.json");
-  if (!existsSync21(pkgPath))
+  const pkgPath = join19(cwd, "package.json");
+  if (!existsSync22(pkgPath))
     return;
-  const pkg = JSON.parse(readFileSync16(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync17(pkgPath, "utf8"));
   const hasDep = pkg.devDependencies?.["@csark0812/skeleton"] || pkg.dependencies?.["@csark0812/skeleton"];
   if (!hasDep) {
     try {
@@ -30442,7 +30718,7 @@ function parseInitArgs(argv) {
 // src/plugins/build.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync17, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync23, readFileSync as readFileSync18, writeFileSync as writeFileSync3 } from "node:fs";
 import { basename as basename4, dirname as dirname11, resolve as resolve9 } from "node:path";
 function parseBuildPluginArgs(argv) {
   let check = false;
@@ -30483,7 +30759,7 @@ function localImportPaths(tsAbs, content3) {
       candidates.push(resolve9(dir, spec), resolve9(dir, `${spec}.ts`), resolve9(dir, `${spec}.js`), resolve9(dir, spec, "index.ts"));
     }
     for (const candidate of candidates) {
-      if (existsSync22(candidate) && candidate.endsWith(".ts")) {
+      if (existsSync23(candidate) && candidate.endsWith(".ts")) {
         deps.push(candidate);
         break;
       }
@@ -30500,7 +30776,7 @@ function sourceFingerprint(tsAbs, seen = new Set) {
     if (seen.has(abs))
       return;
     seen.add(abs);
-    const content3 = readFileSync17(abs, "utf8");
+    const content3 = readFileSync18(abs, "utf8");
     hash.update(basename4(abs));
     hash.update("\x00");
     hash.update(content3);
@@ -30518,7 +30794,7 @@ function writeStamp(tsAbs, mjsAbs) {
 }
 async function buildOne(tsAbs) {
   const mjsAbs = mjsPathForTs(tsAbs);
-  if (!existsSync22(tsAbs)) {
+  if (!existsSync23(tsAbs)) {
     throw new Error(`Plugin source not found: ${tsAbs}`);
   }
   const proc = spawnSync3("bun", ["build", tsAbs, "--target=node", "--format=esm", `--outfile=${mjsAbs}`, "--packages=external"], { encoding: "utf8" });
@@ -30538,17 +30814,17 @@ ${proc.stderr || proc.stdout || `exit ${proc.status}`}`);
 }
 function checkOne(tsAbs) {
   const mjsAbs = mjsPathForTs(tsAbs);
-  if (!existsSync22(mjsAbs)) {
+  if (!existsSync23(mjsAbs)) {
     throw new Error(`Plugin not built: ${tsAbs} (missing ${mjsAbs}). Run: skeleton build-plugin`);
   }
-  if (!existsSync22(tsAbs)) {
+  if (!existsSync23(tsAbs)) {
     throw new Error(`Plugin source not found: ${tsAbs}`);
   }
   const stampAbs = stampPathForMjs(mjsAbs);
-  if (!existsSync22(stampAbs)) {
+  if (!existsSync23(stampAbs)) {
     throw new Error(`Plugin stale: ${mjsAbs} has no fingerprint stamp. Run: skeleton build-plugin`);
   }
-  const expected = readFileSync17(stampAbs, "utf8").trim();
+  const expected = readFileSync18(stampAbs, "utf8").trim();
   const actual = sourceFingerprint(tsAbs);
   if (expected !== actual) {
     throw new Error(`Plugin stale: ${mjsAbs} does not match ${tsAbs} (or local imports). Run: skeleton build-plugin`);
@@ -30578,22 +30854,31 @@ async function runBuildPlugin(options = {}) {
 
 // src/references/sync.ts
 import {
-  existsSync as existsSync23,
+  existsSync as existsSync24,
   mkdirSync as mkdirSync3,
   readdirSync as readdirSync6,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   unlinkSync,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname12, join as join19, relative as relative11 } from "node:path";
+import { dirname as dirname12, join as join20, relative as relative11 } from "node:path";
+function resolveOwnership(root2, override) {
+  if (override !== undefined)
+    return override;
+  try {
+    return loadConfig(root2).skillOwnership;
+  } catch {
+    return;
+  }
+}
 function walkMarkdownFiles2(dir, root2) {
   const files = [];
-  if (!existsSync23(dir))
+  if (!existsSync24(dir))
     return files;
   for (const entry of readdirSync6(dir, { withFileTypes: true })) {
     if (entry.name.startsWith("."))
       continue;
-    const fullPath = join19(dir, entry.name);
+    const fullPath = join20(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...walkMarkdownFiles2(fullPath, root2));
       continue;
@@ -30605,20 +30890,20 @@ function walkMarkdownFiles2(dir, root2) {
   return files;
 }
 function listGeneratedReferenceFiles(skillDir, skill) {
-  const refsDir = join19(skillDir, "references");
-  if (!existsSync23(refsDir))
+  const refsDir = join20(skillDir, "references");
+  if (!existsSync24(refsDir))
     return [];
   const files = [];
   const walk = (dir) => {
     for (const entry of readdirSync6(dir, { withFileTypes: true })) {
-      const fullPath = join19(dir, entry.name);
+      const fullPath = join20(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
         continue;
       }
       if (!entry.name.endsWith(".md"))
         continue;
-      const content3 = readFileSync18(fullPath, "utf8");
+      const content3 = readFileSync19(fullPath, "utf8");
       if (isGeneratedReference(content3)) {
         const refPath = normalizeRelPath(relative11(refsDir, fullPath));
         files.push(generatedRefPath(skill, refPath));
@@ -30630,8 +30915,8 @@ function listGeneratedReferenceFiles(skillDir, skill) {
 }
 function syncReferences(options = {}) {
   const root2 = options.root ?? process.cwd();
-  const canonicalDir = join19(root2, CANONICAL_REFS_DIR);
-  if (!existsSync23(canonicalDir)) {
+  const canonicalDir = join20(root2, CANONICAL_REFS_DIR);
+  if (!existsSync24(canonicalDir)) {
     throw new Error(`canonical references dir not found: ${CANONICAL_REFS_DIR}`);
   }
   const result = {
@@ -30640,23 +30925,23 @@ function syncReferences(options = {}) {
     removed: [],
     skipped: []
   };
-  const plans = discoverSkillReferencePlans(root2);
+  const plans = discoverSkillReferencePlans(root2, resolveOwnership(root2, options.ownership));
   for (const plan of plans) {
-    const skillDir = join19(root2, plan.skill);
+    const skillDir = join20(root2, plan.skill);
     for (const refPath of plan.refPaths) {
-      const sourceRel = normalizeRelPath(join19(CANONICAL_REFS_DIR, refPath));
-      const canonicalPath = join19(root2, sourceRel);
-      if (!existsSync23(canonicalPath)) {
+      const sourceRel = normalizeRelPath(join20(CANONICAL_REFS_DIR, refPath));
+      const canonicalPath = join20(root2, sourceRel);
+      if (!existsSync24(canonicalPath)) {
         throw new Error(`canonical reference missing: ${sourceRel}`);
       }
       const targetRel = generatedRefPath(plan.skill, refPath);
-      const targetPath = join19(root2, targetRel);
-      const canonicalContent = readFileSync18(canonicalPath, "utf8");
+      const targetPath = join20(root2, targetRel);
+      const canonicalContent = readFileSync19(canonicalPath, "utf8");
       const nextContent = formatGeneratedHeader(sourceRel) + canonicalContent;
       if (!options.dryRun) {
         mkdirSync3(dirname12(targetPath), { recursive: true });
       }
-      const existing = existsSync23(targetPath) ? readFileSync18(targetPath, "utf8") : null;
+      const existing = existsSync24(targetPath) ? readFileSync19(targetPath, "utf8") : null;
       if (existing !== nextContent) {
         if (!options.dryRun)
           writeFileSync4(targetPath, nextContent, "utf8");
@@ -30667,8 +30952,8 @@ function syncReferences(options = {}) {
     }
     if (options.rewriteLinks !== false) {
       for (const relFile of walkMarkdownFiles2(skillDir, root2)) {
-        const filePath = join19(root2, relFile);
-        const content3 = readFileSync18(filePath, "utf8");
+        const filePath = join20(root2, relFile);
+        const content3 = readFileSync19(filePath, "utf8");
         const next = rewriteSharedRefLinks(content3, relFile, plan.skill);
         if (next !== content3) {
           if (!options.dryRun)
@@ -30680,7 +30965,7 @@ function syncReferences(options = {}) {
     for (const generatedRel of listGeneratedReferenceFiles(skillDir, plan.skill)) {
       const refPath = generatedRel.slice(`${plan.skill}/references/`.length);
       if (!plan.refPaths.has(refPath)) {
-        const fullPath = join19(root2, generatedRel);
+        const fullPath = join20(root2, generatedRel);
         if (!options.dryRun)
           unlinkSync(fullPath);
         result.removed.push(generatedRel);
@@ -30696,7 +30981,13 @@ function runReferencesSync(options = {}) {
 }
 function runReferencesCheck(options = {}) {
   const root2 = options.root ?? process.cwd();
-  const issues = runGeneratedReferencesCheck(root2);
+  let ownership;
+  try {
+    ownership = loadConfig(root2).skillOwnership;
+  } catch {
+    ownership = undefined;
+  }
+  const issues = runGeneratedReferencesCheck(root2, ownership);
   return printReport(issues, {
     strict: options.strict,
     json: options.json,
@@ -30725,8 +31016,8 @@ function printSyncResult(result) {
 }
 
 // src/register.ts
-import { existsSync as existsSync24, readFileSync as readFileSync19, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname13, join as join20, relative as relative12 } from "node:path";
+import { existsSync as existsSync25, readFileSync as readFileSync20, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname13, join as join21, relative as relative12 } from "node:path";
 var REGISTRY_TABLE_ROW_RE2 = /^\|\s*([^|]+)\|\s*\[[^\]]*\]\(([^)]+)\)\s*\|/;
 var REGISTRY_TABLE_HEADER = "| Topic | Canonical file |";
 function extractTopic(content3) {
@@ -30734,7 +31025,7 @@ function extractTopic(content3) {
   return match?.[1]?.trim().replace(/\s+$/, "") ?? null;
 }
 function toRegistryLink(root2, absPath) {
-  const fromRegistry = join20(root2, REGISTRY_DIR_REL);
+  const fromRegistry = join21(root2, REGISTRY_DIR_REL);
   return normalizeRelPath(relative12(fromRegistry, absPath));
 }
 function inferSection(registryLink) {
@@ -30759,11 +31050,11 @@ function parseRegistryRows(content3) {
   return rows;
 }
 function pathFromRegistryLink(root2, link2) {
-  return normalizeRelPath(relative12(root2, join20(root2, REGISTRY_DIR_REL, link2)));
+  return normalizeRelPath(relative12(root2, join21(root2, REGISTRY_DIR_REL, link2)));
 }
 function isOutsideScan(root2, relPath2) {
   const config = loadConfig(root2);
-  const skillIndex = buildSkillIndex(root2);
+  const skillIndex = buildSkillIndex(root2, config.skillOwnership);
   const scanned = collectScanFiles(config, root2, skillIndex).map((abs) => normalizeRelPath(relative12(root2, abs)));
   if (scanned.includes(relPath2))
     return false;
@@ -30826,11 +31117,11 @@ ${newLine}
 function registerPath(options) {
   const root2 = options.root ?? findRepoRoot();
   const relPath2 = normalizeRelPath(options.path);
-  const absPath = join20(root2, relPath2);
-  if (!existsSync24(absPath)) {
+  const absPath = join21(root2, relPath2);
+  if (!existsSync25(absPath)) {
     throw new Error(`File not found: ${relPath2}`);
   }
-  const content3 = readFileSync19(absPath, "utf8");
+  const content3 = readFileSync20(absPath, "utf8");
   let topic = options.topic ?? extractTopic(content3);
   if (!topic) {
     throw new Error(`No **Source of truth for** banner in ${relPath2} — add banner or pass --topic`);
@@ -30838,9 +31129,9 @@ function registerPath(options) {
   const registryLink = toRegistryLink(root2, absPath);
   topic = ensureCustomizeTopic(topic, registryLink);
   const section = inferSection(registryLink);
-  const registryAbs = join20(root2, REGISTRY_REL_PATH);
-  let registryContent = existsSync24(registryAbs) ? readFileSync19(registryAbs, "utf8") : defaultRegistryContent();
-  if (!existsSync24(registryAbs) && !existsSync24(join20(root2, ".skeleton/config.yaml"))) {
+  const registryAbs = join21(root2, REGISTRY_REL_PATH);
+  let registryContent = existsSync25(registryAbs) ? readFileSync20(registryAbs, "utf8") : defaultRegistryContent();
+  if (!existsSync25(registryAbs) && !existsSync25(join21(root2, ".skeleton/config.yaml"))) {
     throw new Error("Missing .skeleton/config.yaml — run skeleton init first");
   }
   const { content: updated, action } = upsertRow(registryContent, topic, registryLink, section, root2);
@@ -30854,7 +31145,7 @@ function registerPath(options) {
   };
   if (!options.dryRun && action !== "noop") {
     const dir = dirname13(registryAbs);
-    if (!existsSync24(dir)) {
+    if (!existsSync25(dir)) {
       throw new Error(`Missing ${REGISTRY_DIR_REL}/ directory`);
     }
     writeFileSync5(registryAbs, registryContent, "utf8");
@@ -30876,8 +31167,8 @@ function registerPath(options) {
 
 // src/validate/changed.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync25, readFileSync as readFileSync20 } from "node:fs";
-import { basename as basename5, extname as extname2, join as join21 } from "node:path";
+import { existsSync as existsSync26, readFileSync as readFileSync21 } from "node:fs";
+import { basename as basename5, extname as extname2, join as join22 } from "node:path";
 
 // src/validate/git-diff.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -30916,7 +31207,7 @@ function isSkeletonYamlCandidate(normalized, ext) {
     return false;
   return true;
 }
-function bucketFor(relPath2, root2, wiredPolicies) {
+function bucketFor(relPath2, root2, wiredPolicies, skillIndex) {
   const normalized = normalizeRelPath(relPath2);
   const ext = extname2(normalized).toLowerCase();
   const name = basename5(normalized);
@@ -30929,9 +31220,11 @@ function bucketFor(relPath2, root2, wiredPolicies) {
       return "policy";
     return "skip";
   }
-  const skillIndex = buildSkillIndex(root2);
-  if (isSkillPath(normalized, skillIndex))
+  if (isSkillPath(normalized, skillIndex)) {
+    if (isForeignSkillPath(normalized, skillIndex))
+      return "foreign-skill";
     return "skills";
+  }
   if (DOC_EXTENSIONS.has(ext)) {
     const config = loadConfig(root2);
     if (isInScanPerimeter(normalized, config, root2, skillIndex))
@@ -30960,9 +31253,9 @@ function parseJsonContent(content3) {
   }
 }
 function validateJson(relPath2, root2) {
-  const abs = join21(root2, relPath2);
+  const abs = join22(root2, relPath2);
   try {
-    parseJsonContent(readFileSync20(abs, "utf8"));
+    parseJsonContent(readFileSync21(abs, "utf8"));
     return 0;
   } catch (error) {
     console.error(`validate changed: invalid JSON in ${relPath2}: ${error}`);
@@ -30970,9 +31263,9 @@ function validateJson(relPath2, root2) {
   }
 }
 function validatePolicy(relPath2, root2) {
-  const abs = join21(root2, relPath2);
+  const abs = join22(root2, relPath2);
   try {
-    loadPolicyFile(abs, readFileSync20(abs, "utf8"));
+    loadPolicyFile(abs, readFileSync21(abs, "utf8"));
     return 0;
   } catch (error) {
     console.error(`validate changed: invalid policy ${relPath2}: ${error}`);
@@ -30980,7 +31273,7 @@ function validatePolicy(relPath2, root2) {
   }
 }
 function validateShell(relPath2, root2) {
-  const abs = join21(root2, relPath2);
+  const abs = join22(root2, relPath2);
   const shellcheck = spawnSync5("shellcheck", [abs], { encoding: "utf8" });
   if (shellcheck.status === 0)
     return 0;
@@ -31002,23 +31295,23 @@ function resolvePaths(options) {
 }
 function codeValidationHint(root2) {
   let pm2 = null;
-  const pkgPath = join21(root2, "package.json");
-  if (existsSync25(pkgPath)) {
+  const pkgPath = join22(root2, "package.json");
+  if (existsSync26(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync20(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync21(pkgPath, "utf8"));
       const raw = pkg.packageManager?.split("@")[0];
       if (raw === "bun" || raw === "npm" || raw === "pnpm" || raw === "yarn")
         pm2 = raw;
     } catch {}
   }
   if (!pm2) {
-    if (existsSync25(join21(root2, "bun.lock")) || existsSync25(join21(root2, "bun.lockb")))
+    if (existsSync26(join22(root2, "bun.lock")) || existsSync26(join22(root2, "bun.lockb")))
       pm2 = "bun";
-    else if (existsSync25(join21(root2, "pnpm-lock.yaml")))
+    else if (existsSync26(join22(root2, "pnpm-lock.yaml")))
       pm2 = "pnpm";
-    else if (existsSync25(join21(root2, "yarn.lock")))
+    else if (existsSync26(join22(root2, "yarn.lock")))
       pm2 = "yarn";
-    else if (existsSync25(join21(root2, "package-lock.json")))
+    else if (existsSync26(join22(root2, "package-lock.json")))
       pm2 = "npm";
   }
   switch (pm2) {
@@ -31042,6 +31335,7 @@ async function runValidateChanged(options = {}) {
     return 0;
   }
   const config = loadConfig(root2);
+  const skillIndex = buildSkillIndex(root2, config.skillOwnership);
   let wiredPolicies;
   try {
     wiredPolicies = await collectWiredPolicyRelPaths(root2, config);
@@ -31058,11 +31352,12 @@ async function runValidateChanged(options = {}) {
   };
   let missing = 0;
   let skipped = 0;
+  let foreignSkipped = 0;
   const orphans = [];
   for (const relPath2 of relPaths) {
     const normalized = normalizeRelPath(relPath2);
-    const abs = join21(root2, normalized);
-    if (!existsSync25(abs)) {
+    const abs = join22(root2, normalized);
+    if (!existsSync26(abs)) {
       missing++;
       console.error(`validate changed: path not found: ${relPath2}`);
       continue;
@@ -31072,11 +31367,16 @@ async function runValidateChanged(options = {}) {
       orphans.push(normalized);
       continue;
     }
-    const bucket = bucketFor(normalized, root2, wiredPolicies);
+    const bucket = bucketFor(normalized, root2, wiredPolicies, skillIndex);
     if (bucket === "skip") {
       skipped++;
       continue;
     }
+    if (bucket === "foreign-skill") {
+      foreignSkipped++;
+      console.log(`validate changed: skipping foreign skill ${normalized} (owned upstream; see skills-lock.json / skillOwnership)`);
+      continue;
+    }
     buckets[bucket].push(normalized);
   }
   if (orphans.length > 0) {
@@ -31124,24 +31424,24 @@ async function runValidateChanged(options = {}) {
       exitCode = 1;
   }
   if (buckets.skills.length > 0) {
-    const skillsOnly = buckets.docs.length === 0 && buckets.shell.length === 0 && buckets.json.length === 0 && buckets.policy.length === 0;
-    if (skillsOnly && !options.base) {
+    if (!options.base) {
       console.error(`validate changed: skill paths need the full skills suite (path-scoped skill rules are empty).
 ` + `  Run: skeleton audit skills
 ` + "  (audit self covers docs + .skeleton; excluded skill trees still need audit skills)");
-      return 1;
-    }
-    const skillExit = await runAudit({
-      suite: "skills",
-      strict: false,
-      json: false,
-      paths: buckets.skills,
-      only: null,
-      root: root2,
-      pathScopedOnly: true
-    });
-    if (skillExit !== 0)
       exitCode = 1;
+    } else {
+      const skillExit = await runAudit({
+        suite: "skills",
+        strict: false,
+        json: false,
+        paths: buckets.skills,
+        only: null,
+        root: root2,
+        pathScopedOnly: true
+      });
+      if (skillExit !== 0)
+        exitCode = 1;
+    }
   }
   for (const relPath2 of buckets.shell) {
     if (validateShell(relPath2, root2) !== 0)
@@ -31167,7 +31467,7 @@ async function runValidateChanged(options = {}) {
       });
       if (proseExit !== 0)
         exitCode = 1;
-      const skillPaths = listSkillMarkdownPaths(root2, buildSkillIndex(root2));
+      const skillPaths = listSkillMarkdownPaths(root2, skillIndex);
       if (skillPaths.length > 0) {
         const skillProseExit = await runAudit({
           suite: "skills",
@@ -31182,17 +31482,20 @@ async function runValidateChanged(options = {}) {
           exitCode = 1;
       }
     } else {
-      if (exitCode === 0) {
-        console.error(`validate changed: policy YAML changes need a full prose-policy pass (path-scoped docs are not enough).
+      console.error(`validate changed: policy YAML changes need a full prose-policy pass (path-scoped docs are not enough).
 ` + `  Run: skeleton audit docs
 ` + `  And: skeleton audit skills
 ` + "  (audit self covers docs + .skeleton; excluded skill trees still need audit skills)");
-      }
       return 1;
     }
   }
   if (exitCode === 0) {
-    const note = skipped > 0 ? ` (${skipped} path(s) skipped)` : "";
+    const parts = [];
+    if (skipped > 0)
+      parts.push(`${skipped} path(s) skipped`);
+    if (foreignSkipped > 0)
+      parts.push(`${foreignSkipped} foreign skill(s) ignored`);
+    const note = parts.length > 0 ? ` (${parts.join(", ")})` : "";
     console.log(`validate changed passed${note}.`);
   }
   return exitCode;
@@ -31210,6 +31513,7 @@ Commands:
   validate changed [paths…] [--staged] [--base <ref>]
   register <path> [--topic=…] [--dry-run] [--json]
   customize resolve <slug> [--json]
+  hook customize            (reads a host hook payload on stdin)
   references sync [--dry-run] [--no-rewrite-links]
   references check [--json] [--strict]`);
 }
@@ -31306,6 +31610,14 @@ async function main() {
       }
       process.exit(0);
     }
+    if (command === "hook") {
+      if (argv[1] !== "customize") {
+        usage();
+        process.exit(1);
+      }
+      process.stdout.write(runCustomizeHook(readFileSync22(0, "utf8")));
+      process.exit(0);
+    }
     if (command === "init") {
       const parsed = parseInitArgs(argv.slice(1));
       runInit(parsed);