@deftai/directive-core 0.92.0 → 0.94.0

package/dist/init-deposit/hygiene.js

@@ -16,6 +16,9 @@ import { readdir, rm, stat } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 import { gitPorcelain } from "../story-ready/git.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
+import { CONSUMER_SKILL_DISCOVERY_INVENTORY } from "./skill-discovery-deposit.js";
+import { hostSkillRelativePath, listSkillDiscoveryHosts } from "./skill-discovery-hosts.js";
+import { slashCommandManagedExactPaths } from "./slash-deposit.js";
 export const CODEQL_CONFIG_REL = ".github/codeql/codeql-config.yml";
 export const CORE_GUARD_WORKFLOW_REL = ".github/workflows/deft-core-guard.yml";
 // The lifecycle dir names are identical across the legacy `vbrief/` tree and the
@@ -41,16 +44,35 @@ export const CONSUMER_GUARD_MUST_FIRE = [
     "xbrief/proposed/example-scope.xbrief.json",
     "vbrief/pending/example-scope.vbrief.json",
 ];
+/** Exact managed multi-host skill pointer paths only (#75 Greptile P1). */
+function multiHostSkillDiscoveryManagedMatchers() {
+    // Exact SKILL.md paths only so consumer-authored siblings under the same
+    // host skills tree stay app-owned (not staged / not guard-exempt).
+    const matchers = [];
+    for (const host of listSkillDiscoveryHosts()) {
+        for (const skill of CONSUMER_SKILL_DISCOVERY_INVENTORY) {
+            matchers.push({ exact: hostSkillRelativePath(host, skill.dir) });
+        }
+    }
+    return matchers;
+}
 /** Single source of truth for installer-managed paths (#1440 / #1576). */
 export function installerManagedMatchers() {
     return [
         { exact: "AGENTS.md" },
         { prefix: ".agents/" },
+        // Multi-host skill discovery thin pointers (#75 residual) — not slash commands (#55).
+        // Exact inventory paths only; never claim the whole host skills tree.
+        ...multiHostSkillDiscoveryManagedMatchers(),
         { prefix: ".githooks/" },
         { exact: ".claude/settings.json" },
         { exact: ".grok/hooks/deft.json" },
         { exact: ".cursor/hooks.json" },
         { exact: ".codex/hooks.json" },
+        // Multi-host slash product files only (#3054 / L8 prefer commit).
+        // Exact paths — not directory prefixes — so consumer custom commands under
+        // the same host dirs stay app-owned for staging + no-mixed-core-and-app.
+        ...slashCommandManagedExactPaths().map((exact) => ({ exact })),
         { exact: ".gitattributes" },
         { exact: ".gitignore" },
         // Installer-deposited Prettier gate exclusion (#2534); must be allowlisted or

package/dist/init-deposit/index.d.ts

@@ -6,5 +6,8 @@ export * from "./legacy-detect.js";
 export * from "./migrate.js";
 export * from "./refresh.js";
 export * from "./scaffold.js";
+export * from "./skill-discovery-deposit.js";
+export * from "./skill-discovery-hosts.js";
+export * from "./slash-deposit.js";
 export * from "./untrack-core.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/init-deposit/index.js

@@ -6,5 +6,8 @@ export * from "./legacy-detect.js";
 export * from "./migrate.js";
 export * from "./refresh.js";
 export * from "./scaffold.js";
+export * from "./skill-discovery-deposit.js";
+export * from "./skill-discovery-hosts.js";
+export * from "./slash-deposit.js";
 export * from "./untrack-core.js";
 //# sourceMappingURL=index.js.map

package/dist/init-deposit/init-deposit.js

@@ -14,6 +14,7 @@ import { prunePythonArtifactsFromDeposit } from "../deposit/python-free.js";
 import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { readCorePackageVersion } from "../engine-version.js";
 import { renderProjectDefinition } from "../render/project-render.js";
+import { depositOpenClawL2ProductCommands } from "../slash/openclaw-deposit.js";
 import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
 import { writeAgentHookDeposit } from "./agent-hooks.js";
 import { ensureInitGitignoreLines, reconstituteDepositFromContent } from "./gitignore.js";
@@ -22,6 +23,8 @@ import { buildLegacyRefusalJson, buildLegacyRefusalMessage, detectLegacyLayout,
 import { printMigrateNudgeIfNeeded } from "./migrate.js";
 import { ensurePrettierIgnoreLines } from "./prettierignore.js";
 import { CANONICAL_INSTALL_ROOT, depositNeutralization, ensureTaskfile, writeAgentsMd, writeAgentsSkills, writeConsumerGitHooks, writeConsumerVbrief, writeInstallManifest, } from "./scaffold.js";
+import { writeMultiHostSkillDiscovery } from "./skill-discovery-deposit.js";
+import { writeSlashCommandDeposit } from "./slash-deposit.js";
 import { syncBareVersionMarker } from "./xbrief-projections.js";
 export function parseInitArgv(canonicalArgv, userArgv = []) {
     const args = [...canonicalArgv, ...userArgv];
@@ -181,6 +184,7 @@ export async function runInitDeposit(args, io, seams = {}) {
     writeInstallManifest(projectDir, deftDir, manifestFields);
     writeAgentsMd(projectDir, deftDir, io);
     const skillsCreated = writeAgentsSkills(projectDir, io);
+    writeMultiHostSkillDiscovery(projectDir, io);
     await depositNeutralization(projectDir, io);
     await writeConsumerVbrief(projectDir, deftDir, io);
     seedMinimalProjectDefinition(projectDir, io);
@@ -191,6 +195,12 @@ export async function runInitDeposit(args, io, seams = {}) {
     removeStaleMigratedFrameworkNarrative(projectDir);
     writeConsumerGitHooks(projectDir, deftDir, io, seams.gitHooks);
     writeAgentHookDeposit(projectDir, io);
+    writeSlashCommandDeposit(projectDir, io);
+    // #3064: OpenClaw L2 product-command skills when OC signals present (fail-closed otherwise).
+    depositOpenClawL2ProductCommands({
+        projectRoot: projectDir,
+        printf: (t) => io.printf(t),
+    });
     let taskfileWired = false;
     if (args.nonInteractive) {
         taskfileWired = ensureTaskfile(projectDir, io);

package/dist/init-deposit/refresh.js

@@ -21,6 +21,7 @@ import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { runOrgForceOnMigration } from "../policy/org-force-on-migration.js";
 import { checkLocalEngineIntegrity, classify, ENGINE_PACKAGE, plan, renderGlobalInstall, resolveEngine, } from "../resolution/index.js";
+import { depositOpenClawL2ProductCommands } from "../slash/openclaw-deposit.js";
 import { gitPorcelain } from "../story-ready/git.js";
 import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
 import { writeAgentHookDeposit } from "./agent-hooks.js";
@@ -31,6 +32,8 @@ import { buildLegacyRefusalJson, buildLegacyRefusalMessage, detectLegacyLayout,
 import { printMigrateNudgeIfNeeded } from "./migrate.js";
 import { ensurePrettierIgnoreLines } from "./prettierignore.js";
 import { CANONICAL_INSTALL_ROOT, depositNeutralization, ensureTaskfile, writeAgentsMd, writeConsumerGitHooks, writeInstallManifest, } from "./scaffold.js";
+import { writeMultiHostSkillDiscovery } from "./skill-discovery-deposit.js";
+import { writeSlashCommandDeposit } from "./slash-deposit.js";
 import { syncBareVersionMarker, syncConsumerXbriefSchemas, syncExistingBareVersionMarker, } from "./xbrief-projections.js";
 function hasCanonicalXbriefLifecycle(projectDir) {
     try {
@@ -464,6 +467,14 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     }
     const agentsMdUpdated = writeAgentsMd(projectDir, deftDir, io);
     writeAgentHookDeposit(projectDir, io);
+    // #75 residual: multi-host thin skill discovery (mirror `.agents/skills` inventory).
+    writeMultiHostSkillDiscovery(projectDir, io);
+    writeSlashCommandDeposit(projectDir, io);
+    // #3064: OpenClaw L2 product-command skills when OC signals present (fail-closed otherwise).
+    depositOpenClawL2ProductCommands({
+        projectRoot: projectDir,
+        printf: (t) => io.printf(t),
+    });
     // #2530: root `.githooks/` is a consumer derivative like #2595 marker/schemas —
     // repair on every refresh, including the already-current no-op path.
     writeConsumerGitHooks(projectDir, deftDir, io, seams.gitHooks);

package/dist/init-deposit/scaffold.js

@@ -15,6 +15,7 @@ import { agentsRefreshPlan } from "../platform/agents-md.js";
 import { MIGRATED_ARTIFACT_DIR } from "../xbrief-migrate/constants.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
 import { assertInstallerAllowlistHonors1430, installerManagedGuardEre } from "./hygiene.js";
+import { writeAgentsSkillsFromInventory } from "./skill-discovery-deposit.js";
 import { syncConsumerXbriefSchemas } from "./xbrief-projections.js";
 export { CANONICAL_INSTALL_ROOT };
 export const CORE_GLOB = ".deft/core/**";
@@ -90,125 +91,6 @@ const DEFT_INCLUDE_CHILD_BLOCK = "  # Added by deft-install --yes (Epic-4)\n" +
     "  deft:\n" +
     "    taskfile: ./.deft/core/Taskfile.yml\n" +
     "    optional: true\n";
-const AGENTS_SKILLS = [
-    {
-        dir: "deft",
-        content: `---
-name: deft
-description: Apply deft framework standards for AI-assisted development. Use when starting projects, writing code, running tests, making commits, or when the user references deft, project standards, or coding guidelines.
----
-
-Read and follow: .deft/core/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-setup",
-        content: `---
-name: deft-directive-setup
-description: >-
-  Set up a new project with Deft framework standards. Use when the user wants
-  to bootstrap user preferences, configure a project, or generate a project
-  specification. Walks through setup conversationally — no separate CLI needed.
----
-
-Read and follow: .deft/core/skills/deft-directive-setup/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-build",
-        content: `---
-name: deft-directive-build
-description: >-
-  Build a project from scope vBRIEFs following Deft framework standards.
-  Use after deft-directive-setup has generated the project definition, or when
-  the user has scope vBRIEFs ready to implement. Handles scaffolding,
-  implementation, testing, and quality checks phase by phase.
----
-
-Read and follow: .deft/core/skills/deft-directive-build/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-review-cycle",
-        content: `---
-name: deft-directive-review-cycle
-description: >-
-  Greptile bot reviewer response workflow. Use when running a review cycle
-  on a PR — to audit process prerequisites, fetch bot findings, fix all
-  issues in a single batch commit, and exit cleanly when no P0/P1 issues
-  remain. Enables cloud agents to run autonomous PR review cycles.
----
-
-Read and follow: .deft/core/skills/deft-directive-review-cycle/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-refinement",
-        content: `---
-name: deft-directive-refinement
-description: >-
-  Structured refinement workflow. Compares open GitHub issues against
-  the roadmap, triages new issues one-at-a-time with human review, and updates
-  the roadmap with phase placement, analysis comments, and index entries.
----
-
-Read and follow: .deft/core/skills/deft-directive-refinement/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-swarm",
-        content: `---
-name: deft-directive-swarm
-description: >-
-  Parallel local agent orchestration. Use when running multiple agents
-  on roadmap items simultaneously — to select non-overlapping tasks, set up
-  isolated worktrees, launch agents with proven prompts, monitor progress,
-  handle stalled review cycles, and close out PRs cleanly.
----
-
-Read and follow: .deft/core/skills/deft-directive-swarm/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-interview",
-        content: `---
-name: deft-directive-interview
-description: >-
-  Deterministic structured Q&A interview skill. Use when a skill or workflow
-  needs to collect structured answers from the user — one question per turn,
-  numbered options, default acceptance, and a confirmation gate.
----
-
-Read and follow: .deft/core/skills/deft-directive-interview/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-pre-pr",
-        content: `---
-name: deft-directive-pre-pr
-description: >-
-  Iterative pre-PR quality loop (Read-Write-Lint-Diff-Loop). Use before
-  pushing a branch for PR creation — structured self-review that agents run
-  to catch issues before they reach the bot reviewer.
----
-
-Read and follow: .deft/core/skills/deft-directive-pre-pr/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-sync",
-        content: `---
-name: deft-directive-sync
-description: >-
-  Session-start framework sync skill. Use at the beginning of a session to
-  pull latest framework updates, validate project files, and confirm alignment
-  before starting work.
----
-
-Read and follow: .deft/core/skills/deft-directive-sync/SKILL.md
-`,
-    },
-];
 const BARE_SEMVER = /^\d+\.\d+\.\d+([-+][0-9A-Za-z.-]+)?$/;
 export function buildInstallManifestText(fields) {
     let effectiveTag = fields.tag;
@@ -376,20 +258,8 @@ export async function writeConsumerVbrief(projectDir, deftDir, io) {
     return true;
 }
 export function writeAgentsSkills(projectDir, io) {
-    projectionTarget(projectDir, ".agents");
-    const allExist = AGENTS_SKILLS.every((skill) => existsSync(join(projectDir, ".agents", "skills", skill.dir, "SKILL.md")));
-    if (allExist) {
-        io.printf(".agents/skills/ already present — skipping.\n");
-        return false;
-    }
-    for (const skill of AGENTS_SKILLS) {
-        const path = projectionTarget(projectDir, ".agents", "skills", skill.dir, "SKILL.md");
-        if (existsSync(path))
-            continue;
-        containedProjectWrite(projectDir, path, skill.content);
-    }
-    io.printf(".agents/skills/ created — deft skills will be auto-discovered.\n");
-    return true;
+    // Shared inventory with multi-host skill discovery (#75 residual).
+    return writeAgentsSkillsFromInventory(projectDir, io);
 }
 function hasTopLevelIncludes(content) {
     if (!content)

package/dist/init-deposit/skill-discovery-deposit.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Multi-host thin skill discovery deposit (#75 residual).
+ *
+ * Mirrors the consumer skill inventory already written to `.agents/skills/`
+ * into additional host paths (`.claude/skills/`, `.codex/skills/`,
+ * `.github/skills/`, `.cursor/skills/`). Thin pointers only — no full skill
+ * body copies. Windows-safe file writes (no elevated symlink requirement).
+ *
+ * Distinct from epic #55 slash-command deposit (#3054).
+ */
+import type { InitDepositIo } from "./constants.js";
+import { type HostSkillDiscoveryPolicy, type SkillDiscoveryHostId } from "./skill-discovery-hosts.js";
+export type { InitDepositIo };
+/**
+ * Consumer skill discovery inventory shared by `.agents/skills/` and multi-host
+ * deposit. Each entry is a thin SKILL.md pointer into `.deft/core/…` — never a
+ * full skill body. Keep this list the single SoT for install-time discovery.
+ */
+export declare const CONSUMER_SKILL_DISCOVERY_INVENTORY: ReadonlyArray<{
+    dir: string;
+    content: string;
+}>;
+/** Max bytes for a thin pointer body — fat full-skill copies fail this guard. */
+export declare const MAX_THIN_SKILL_POINTER_BYTES = 1200;
+/**
+ * True when content is a thin discovery pointer (not an inlined skill body).
+ * Managed deposit must stay pointer-shaped so updates do not rot full copies.
+ */
+export declare function isThinSkillPointer(content: string): boolean;
+export interface MultiHostSkillDiscoveryDepositResult {
+    readonly changed: boolean;
+    /** Repo-relative posix paths written or rewritten. */
+    readonly changedPaths: string[];
+    /** Hosts that received at least one write. */
+    readonly hostsTouched: SkillDiscoveryHostId[];
+    /** Hosts skipped because `plan.policy.hostSkillDiscovery.<host>` is false. */
+    readonly hostsSkipped: SkillDiscoveryHostId[];
+}
+export interface WriteMultiHostSkillDiscoveryOptions {
+    /** Override policy (tests); default loads from PROJECT-DEFINITION. */
+    policy?: HostSkillDiscoveryPolicy;
+    /**
+     * Skill inventory to deposit. Defaults to the shared consumer inventory
+     * (same set as `.agents/skills/`).
+     */
+    inventory?: ReadonlyArray<{
+        dir: string;
+        content: string;
+    }>;
+}
+/**
+ * Deposit thin skill discovery pointers into enabled multi-host paths.
+ * Idempotent: skips write when on-disk content already matches. Never creates
+ * symlinks (Windows-safe without elevation).
+ */
+export declare function writeMultiHostSkillDiscovery(projectDir: string, io: InitDepositIo, options?: WriteMultiHostSkillDiscoveryOptions): MultiHostSkillDiscoveryDepositResult;
+/**
+ * Shared inventory helper for `.agents/skills/` (canonical) deposit.
+ * Returns true when any pointer was created (matching writeAgentsSkills).
+ */
+export declare function writeAgentsSkillsFromInventory(projectDir: string, io: InitDepositIo, inventory?: ReadonlyArray<{
+    dir: string;
+    content: string;
+}>): boolean;
+//# sourceMappingURL=skill-discovery-deposit.d.ts.map

package/dist/init-deposit/skill-discovery-deposit.js

@@ -0,0 +1,287 @@
+/**
+ * Multi-host thin skill discovery deposit (#75 residual).
+ *
+ * Mirrors the consumer skill inventory already written to `.agents/skills/`
+ * into additional host paths (`.claude/skills/`, `.codex/skills/`,
+ * `.github/skills/`, `.cursor/skills/`). Thin pointers only — no full skill
+ * body copies. Windows-safe file writes (no elevated symlink requirement).
+ *
+ * Distinct from epic #55 slash-command deposit (#3054).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { assertDestinationNotSymlink } from "../fs/projection-containment.js";
+import { hostSkillRelativePath, isHostSkillDiscoveryEnabled, listSkillDiscoveryHosts, loadHostSkillDiscoveryPolicyFromProject, loadHostSkillDiscoveryRawFromProject, resolveHostSkillDiscoveryPolicyDetailed, SKILL_DISCOVERY_HOSTS, validateHostSkillDiscovery, } from "./skill-discovery-hosts.js";
+/**
+ * Consumer skill discovery inventory shared by `.agents/skills/` and multi-host
+ * deposit. Each entry is a thin SKILL.md pointer into `.deft/core/…` — never a
+ * full skill body. Keep this list the single SoT for install-time discovery.
+ */
+export const CONSUMER_SKILL_DISCOVERY_INVENTORY = [
+    {
+        dir: "deft",
+        content: `---
+name: deft
+description: Apply deft framework standards for AI-assisted development. Use when starting projects, writing code, running tests, making commits, or when the user references deft, project standards, or coding guidelines.
+---
+
+Read and follow: .deft/core/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-setup",
+        content: `---
+name: deft-directive-setup
+description: >-
+  Set up a new project with Deft framework standards. Use when the user wants
+  to bootstrap user preferences, configure a project, or generate a project
+  specification. Walks through setup conversationally — no separate CLI needed.
+---
+
+Read and follow: .deft/core/skills/deft-directive-setup/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-build",
+        content: `---
+name: deft-directive-build
+description: >-
+  Build a project from scope vBRIEFs following Deft framework standards.
+  Use after deft-directive-setup has generated the project definition, or when
+  the user has scope vBRIEFs ready to implement. Handles scaffolding,
+  implementation, testing, and quality checks phase by phase.
+---
+
+Read and follow: .deft/core/skills/deft-directive-build/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-review-cycle",
+        content: `---
+name: deft-directive-review-cycle
+description: >-
+  Greptile bot reviewer response workflow. Use when running a review cycle
+  on a PR — to audit process prerequisites, fetch bot findings, fix all
+  issues in a single batch commit, and exit cleanly when no P0/P1 issues
+  remain. Enables cloud agents to run autonomous PR review cycles.
+---
+
+Read and follow: .deft/core/skills/deft-directive-review-cycle/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-refinement",
+        content: `---
+name: deft-directive-refinement
+description: >-
+  Structured refinement workflow. Compares open GitHub issues against
+  the roadmap, triages new issues one-at-a-time with human review, and updates
+  the roadmap with phase placement, analysis comments, and index entries.
+---
+
+Read and follow: .deft/core/skills/deft-directive-refinement/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-swarm",
+        content: `---
+name: deft-directive-swarm
+description: >-
+  Parallel local agent orchestration. Use when running multiple agents
+  on roadmap items simultaneously — to select non-overlapping tasks, set up
+  isolated worktrees, launch agents with proven prompts, monitor progress,
+  handle stalled review cycles, and close out PRs cleanly.
+---
+
+Read and follow: .deft/core/skills/deft-directive-swarm/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-interview",
+        content: `---
+name: deft-directive-interview
+description: >-
+  Deterministic structured Q&A interview skill. Use when a skill or workflow
+  needs to collect structured answers from the user — one question per turn,
+  numbered options, default acceptance, and a confirmation gate.
+---
+
+Read and follow: .deft/core/skills/deft-directive-interview/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-pre-pr",
+        content: `---
+name: deft-directive-pre-pr
+description: >-
+  Iterative pre-PR quality loop (Read-Write-Lint-Diff-Loop). Use before
+  pushing a branch for PR creation — structured self-review that agents run
+  to catch issues before they reach the bot reviewer.
+---
+
+Read and follow: .deft/core/skills/deft-directive-pre-pr/SKILL.md
+`,
+    },
+    {
+        dir: "deft-directive-sync",
+        content: `---
+name: deft-directive-sync
+description: >-
+  Session-start framework sync skill. Use at the beginning of a session to
+  pull latest framework updates, validate project files, and confirm alignment
+  before starting work.
+---
+
+Read and follow: .deft/core/skills/deft-directive-sync/SKILL.md
+`,
+    },
+];
+/** Max bytes for a thin pointer body — fat full-skill copies fail this guard. */
+export const MAX_THIN_SKILL_POINTER_BYTES = 1200;
+/**
+ * True when content is a thin discovery pointer (not an inlined skill body).
+ * Managed deposit must stay pointer-shaped so updates do not rot full copies.
+ */
+export function isThinSkillPointer(content) {
+    if (content.length > MAX_THIN_SKILL_POINTER_BYTES)
+        return false;
+    if (!content.includes("Read and follow:"))
+        return false;
+    // Canonical consumer target lives under the deposited framework root.
+    if (!content.includes(".deft/core/"))
+        return false;
+    // Reject bodies that look like full skill process docs.
+    if (/\n##\s+Phase\b/i.test(content))
+        return false;
+    if (/\n##\s+Anti-?[Pp]atterns\b/i.test(content))
+        return false;
+    return true;
+}
+function projectionTarget(projectDir, ...relSegments) {
+    const target = join(projectDir, ...relSegments);
+    assertDestinationNotSymlink(projectDir, target);
+    return target;
+}
+function containedProjectWrite(projectDir, target, data) {
+    containedWrite({
+        root: resolve(projectDir),
+        target,
+        data,
+        mode: "replace",
+    });
+}
+/**
+ * Deposit thin skill discovery pointers into enabled multi-host paths.
+ * Idempotent: skips write when on-disk content already matches. Never creates
+ * symlinks (Windows-safe without elevation).
+ */
+export function writeMultiHostSkillDiscovery(projectDir, io, options = {}) {
+    const rawPolicy = options.policy !== undefined
+        ? options.policy
+        : loadHostSkillDiscoveryRawFromProject(projectDir);
+    // Production validation surface (#75 SLizard P1): report malformed opt-outs
+    // before resolving the deposit enablement map.
+    for (const err of validateHostSkillDiscovery(rawPolicy)) {
+        io.printf(`WARNING: ${err}\n`);
+    }
+    const resolved = resolveHostSkillDiscoveryPolicyDetailed(rawPolicy);
+    for (const warning of resolved.warnings) {
+        io.printf(`WARNING: ${warning}\n`);
+    }
+    if (resolved.refuseAll) {
+        return {
+            changed: false,
+            changedPaths: [],
+            hostsTouched: [],
+            hostsSkipped: [...listSkillDiscoveryHosts()],
+        };
+    }
+    // Prefer the public project-root loader when reading disk so policy inspection
+    // and deposit share one production call path (not test-only exports).
+    const policy = options.policy !== undefined
+        ? resolved.policy
+        : loadHostSkillDiscoveryPolicyFromProject(projectDir);
+    const inventory = options.inventory ?? CONSUMER_SKILL_DISCOVERY_INVENTORY;
+    for (const skill of inventory) {
+        if (!isThinSkillPointer(skill.content)) {
+            throw new Error(`skill discovery inventory entry "${skill.dir}" is not a thin pointer; ` +
+                `refusing multi-host deposit (#75 non-inlining).`);
+        }
+    }
+    const changedPaths = [];
+    const hostsTouched = new Set();
+    const hostsSkipped = [];
+    for (const hostId of listSkillDiscoveryHosts()) {
+        if (!isHostSkillDiscoveryEnabled(hostId, policy)) {
+            hostsSkipped.push(hostId);
+            continue;
+        }
+        for (const skill of inventory) {
+            const rel = hostSkillRelativePath(hostId, skill.dir);
+            const segments = rel.split("/");
+            const abs = projectionTarget(projectDir, ...segments);
+            let existing = null;
+            if (existsSync(abs)) {
+                try {
+                    existing = readFileSync(abs, "utf8");
+                }
+                catch {
+                    existing = null;
+                }
+            }
+            if (existing === skill.content) {
+                continue;
+            }
+            // Never clobber consumer-authored host skills. Only create missing
+            // files or rewrite prior managed thin pointers (#75 Greptile P1).
+            if (existing !== null && !isThinSkillPointer(existing)) {
+                io.printf(`Skill discovery (#75): preserving consumer skill at ${rel} (not a managed thin pointer).\n`);
+                continue;
+            }
+            containedProjectWrite(projectDir, abs, skill.content);
+            changedPaths.push(rel.replace(/\\/g, "/"));
+            hostsTouched.add(hostId);
+        }
+    }
+    if (hostsSkipped.length > 0) {
+        io.printf(`Skill discovery multi-host opt-out (plan.policy.hostSkillDiscovery): skipped ${hostsSkipped.join(", ")}\n`);
+    }
+    if (changedPaths.length > 0) {
+        const hostList = [...hostsTouched].join(", ");
+        io.printf(`Multi-host skill discovery deposit (#75): wrote ${changedPaths.length} thin pointer(s) for host(s): ${hostList}\n`);
+    }
+    else if (hostsSkipped.length < SKILL_DISCOVERY_HOSTS.length) {
+        io.printf("Multi-host skill discovery deposit (#75): already current — skipping.\n");
+    }
+    return {
+        changed: changedPaths.length > 0,
+        changedPaths,
+        hostsTouched: [...hostsTouched],
+        hostsSkipped,
+    };
+}
+/**
+ * Shared inventory helper for `.agents/skills/` (canonical) deposit.
+ * Returns true when any pointer was created (matching writeAgentsSkills).
+ */
+export function writeAgentsSkillsFromInventory(projectDir, io, inventory = CONSUMER_SKILL_DISCOVERY_INVENTORY) {
+    projectionTarget(projectDir, ".agents");
+    const allExist = inventory.every((skill) => existsSync(join(projectDir, ".agents", "skills", skill.dir, "SKILL.md")));
+    if (allExist) {
+        io.printf(".agents/skills/ already present — skipping.\n");
+        return false;
+    }
+    for (const skill of inventory) {
+        if (!isThinSkillPointer(skill.content)) {
+            throw new Error(`skill discovery inventory entry "${skill.dir}" is not a thin pointer (#75).`);
+        }
+        const path = projectionTarget(projectDir, ".agents", "skills", skill.dir, "SKILL.md");
+        if (existsSync(path))
+            continue;
+        containedProjectWrite(projectDir, path, skill.content);
+    }
+    io.printf(".agents/skills/ created — deft skills will be auto-discovered.\n");
+    return true;
+}
+//# sourceMappingURL=skill-discovery-deposit.js.map