@delorenj/pjangler 1.2.18 → 1.2.21

package/dist/index.js

@@ -2,8 +2,8 @@
 
 // src/index.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync7, statSync as statSync2 } from "node:fs";
-import { basename as basename4, join as join13, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync11, readFileSync as readFileSync8, statSync as statSync2 } from "node:fs";
+import { basename as basename4, join as join15, resolve as resolve3 } from "node:path";
 import { Command as Command3 } from "commander";
 
 // src/commands/hermes/types.ts
@@ -410,97 +410,284 @@ var AddMiseCodegraphScript = class extends Command {
       };
     }
     const content = `#!/usr/bin/env bash
-# Mise enter hook: ensure the CodeGraph CLI is available and initialize the
-# project index. If \`codegraph\` is not installed, this script installs it
-# non-interactively into the project-local .mise/bin directory and retries.
-#
-# This is intended to run from a mise enter hook so onboarding a new host is
-# fully automatic.
+# Auto-generated by pjangler
+
+REPO_ROOT="$(pwd)"
+PROJECT_NAME="$(basename "$REPO_ROOT")"
+CONTAINER_NAME="codegraph-mcp-$PROJECT_NAME"
+CACHE_DIR="$REPO_ROOT/.codegraph"
+
+# Deterministically generate a port based on the repository path
+PORT=$(echo -n "$REPO_ROOT" | md5sum | awk '{print $1}' | tr -d 'a-f' | cut -c1-4)
+# Ensure port is > 1024
+PORT=$(( (PORT % 60000) + 1025 ))
+
+if ! docker ps --format '{{.Names}}' | grep -q "^$CONTAINER_NAME$"; then
+  echo "\u{1F680} Starting CodeGraph MCP Server on port $PORT..."
+  
+  # Ensure the container isn't lingering in a stopped state
+  docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+
+  # Run the true Colby McHenry CodeGraph Docker image
+  # which we built locally as colbymchenry-codegraph-mcp:latest
+  docker run -d \\
+    --name "$CONTAINER_NAME" \\
+    --restart unless-stopped \\
+    -p "$PORT:8045" \\
+    -v "$REPO_ROOT:/repo" \\
+    colbymchenry-codegraph-mcp:latest >/dev/null
+
+  echo "\u2705 CodeGraph MCP running in background. SSE URL: http://localhost:$PORT/sse"
+fi
+
+# Run init inside the container to ensure the index is bootstrapped.
+# We run this using the standard codegraph CLI inside the container
+docker exec "$CONTAINER_NAME" codegraph init -i /repo >/dev/null 2>&1 || true
+
+# Wire up the MCP server to local agents
+WIRE_SCRIPT="$(dirname "$0")/codegraph-wire.sh"
+if [ -x "$WIRE_SCRIPT" ]; then
+  "$WIRE_SCRIPT"
+fi
+`;
+    this.writeFile(filePath, content);
+    if (!this.context.dryRun) {
+      chmodSync(join3(this.context.targetDir, filePath), 493);
+    }
+    return {
+      success: true,
+      message: this.formatMessage(this.context.dryRun ? "Would create .mise/scripts/codegraph.sh" : "\u2705 Created .mise/scripts/codegraph.sh"),
+      filePath
+    };
+  }
+};
+
+// src/commands/AddMiseCodegraphWireScript.ts
+import { chmodSync as chmodSync2 } from "fs";
+import { join as join4 } from "path";
+var AddMiseCodegraphWireScript = class extends Command {
+  async invoke() {
+    const filePath = ".mise/scripts/codegraph-wire.sh";
+    if (this.fileExists(filePath) && !this.context.force) {
+      return {
+        success: false,
+        message: this.formatMessage("\u26A0\uFE0F  .mise/scripts/codegraph-wire.sh already exists"),
+        filePath
+      };
+    }
+    const content = `#!/usr/bin/env bash
+# Mise enter hook: Auto-wire CodeGraph MCP Server to local agents.
+# Detects Claude Code, Codex, Gemini, Kimi, and OpenCode and configures
+# them to use the local SSE endpoint for the current project.
 
 set -euo pipefail
 
 REPO_ROOT="\${MISE_PROJECT_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)}"
-PROJECT_BIN_DIR="$REPO_ROOT/.mise/bin"
-mkdir -p "$PROJECT_BIN_DIR"
-
-# Install the CodeGraph CLI into the project-local bin directory.
-install_codegraph() {
-  echo "[mise] codegraph not found. Installing non-interactively..."
-  export CODEGRAPH_BIN_DIR="$PROJECT_BIN_DIR"
-  curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh
-
-  if [ -x "$PROJECT_BIN_DIR/codegraph" ]; then
-    export PATH="$PROJECT_BIN_DIR:$PATH"
-  else
-    echo "[mise] codegraph install did not place a binary at $PROJECT_BIN_DIR/codegraph" >&2
-    return 1
+
+# Compute the same port as the container script
+PORT_HASH=$(echo -n "$REPO_ROOT" | md5sum | awk '{print $1}')
+PORT_DEC=$(printf "%d" "0x\${PORT_HASH:0:4}")
+PORT=$(( 8045 + (PORT_DEC % 955) ))
+
+SSE_URL="http://localhost:$PORT/sse"
+
+inject_sse() {
+  local target="$1"
+  local agent="$2"
+  
+  if [ ! -f "$target" ]; then
+    mkdir -p "$(dirname "$target")"
+    echo '{"mcpServers": {}}' > "$target"
+  fi
+  
+  # Ensure the file is valid JSON (fail gracefully if it's garbled)
+  if ! jq . "$target" >/dev/null 2>&1; then
+    echo "[mise] WARNING: $target is not valid JSON, skipping $agent wiring" >&2
+    return
   fi
+
+  # Inject or update the codegraph server
+  jq --arg url "$SSE_URL" '.mcpServers.codegraph = {"type": "sse", "url": $url}' "$target" > "$target.tmp" && mv "$target.tmp" "$target"
+  echo "[mise] Wired CodeGraph SSE for $agent -> $target"
 }
 
-# Ensure a codegraph binary is available on PATH.
-ensure_codegraph() {
-  if command -v codegraph >/dev/null 2>&1; then
-    return 0
-  fi
+# 1. Claude Code (Project-scoped)
+inject_sse "$REPO_ROOT/.claude.json" "Claude Code"
 
-  # Check the project-local bin dir first (previous install from this hook).
-  if [ -x "$PROJECT_BIN_DIR/codegraph" ]; then
-    export PATH="$PROJECT_BIN_DIR:$PATH"
-    return 0
-  fi
+# 2. Codex (Global)
+inject_sse "$HOME/.codex/mcp.json" "Codex"
 
-  # Check typical user-level install locations before fetching anything.
-  for d in "$HOME/.local/bin" "$HOME/.codegraph/current/bin"; do
-    if [ -x "$d/codegraph" ]; then
-      export PATH="$d:$PATH"
-      return 0
-    fi
-  done
+# 3. Gemini (Global)
+inject_sse "$HOME/.gemini/config/mcp.json" "Gemini"
 
-  install_codegraph
-}
+# 4. Kimi (Global)
+inject_sse "$HOME/.kimi-code/mcp.json" "Kimi"
 
-# Attempt to initialize the project graph. If the command is missing, install
-# it and retry once.
-init_project() {
-  local err_file
-  err_file="$(mktemp)"
-  trap 'rm -f "$err_file"' RETURN
+# 5. OpenCode (Global)
+inject_sse "$HOME/.opencode/mcp.json" "OpenCode"
 
-  if codegraph init -i "$REPO_ROOT" 2>"$err_file"; then
-    return 0
-  fi
+# 6. Cursor (Global)
+inject_sse "$HOME/.cursor/mcp.json" "Cursor"
 
-  # If the failure looks like a missing binary, install and retry.
-  if grep -qiE 'command not found|not installed|No such file|executable file not found' "$err_file" 2>/dev/null; then
-    ensure_codegraph
-    codegraph init -i "$REPO_ROOT"
-    return 0
-  fi
+# 7. VSCode native MCP (Global)
+inject_sse "$HOME/.vscode/mcp.json" "VSCode"
 
-  cat "$err_file" >&2
-  return 1
-}
+# 8. Cline (VSCode extension)
+inject_sse "$HOME/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json" "Cline"
 
-init_project
+# 9. Roo (VSCode extension)
+inject_sse "$HOME/.config/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/mcp_settings.json" "Roo Code"
 `;
     this.writeFile(filePath, content);
     if (!this.context.dryRun) {
-      chmodSync(join3(this.context.targetDir, filePath), 493);
+      chmodSync2(join4(this.context.targetDir, filePath), 493);
     }
     return {
       success: true,
-      message: this.formatMessage(this.context.dryRun ? "Would create .mise/scripts/codegraph.sh" : "\u2705 Created .mise/scripts/codegraph.sh"),
+      message: this.formatMessage(this.context.dryRun ? "Would create .mise/scripts/codegraph-wire.sh" : "\u2705 Created .mise/scripts/codegraph-wire.sh"),
       filePath
     };
   }
 };
 
+// src/commands/WireMiseOpInject.ts
+import { join as join5 } from "node:path";
+import { existsSync as existsSync3, readFileSync, writeFileSync as writeFileSync3, chmodSync as chmodSync3 } from "node:fs";
+var WireMiseOpInject = class _WireMiseOpInject extends Command {
+  static MARKER = "# pjangler:op-inject";
+  static CR = "{{config_root}}";
+  async invoke() {
+    const scriptPath = ".mise/scripts/inject-op-secrets.sh";
+    const fullScriptPath = join5(this.context.targetDir, scriptPath);
+    const scriptContent = `#!/usr/bin/env bash
+# Resolve 1Password \`op://\` references in .env.op into .env.secrets, which mise
+# loads via \`_.file\`.
+#
+# Runs from the mise enter hook: fail-open and non-interactive.
+# No .env.op means no 1Password, so this exits before spending anything.
+
+set -euo pipefail
+
+REPO_ROOT="\${MISE_PROJECT_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)}"
+SRC="$REPO_ROOT/.env.op"
+OUT="$REPO_ROOT/.env.secrets"
+
+TTL_HOURS="\${OP_INJECT_TTL_HOURS:-12}"
+
+[[ -f "$SRC" ]] || exit 0
+command -v op >/dev/null 2>&1 || exit 0
+
+if [[ -f "$OUT" && "$SRC" -ot "$OUT" ]]; then
+  if [[ "$TTL_HOURS" != "0" ]] && [[ -z "$(find "$OUT" -mmin "+$((TTL_HOURS * 60))" 2>/dev/null)" ]]; then
+    exit 0
+  fi
+fi
+
+op account list >/dev/null 2>&1 || exit 0
+
+tmp="$(mktemp "\${OUT}.XXXXXX")"
+trap 'rm -f "$tmp"' EXIT
+chmod 600 "$tmp"
+
+if op inject -i "$SRC" -o "$tmp" --force >/dev/null 2>&1; then
+  mv "$tmp" "$OUT"
+  trap - EXIT
+else
+  echo "mise: op inject from .env.op failed \u2014 $(basename "$OUT") unchanged." >&2
+  echo "      Check 'op signin', or that .env.op's op:// items are readable." >&2
+  echo "      To disable: rm .env.op" >&2
+fi
+`;
+    this.writeFile(scriptPath, scriptContent);
+    if (!this.context.dryRun) {
+      chmodSync3(fullScriptPath, 493);
+    }
+    const misePath = join5(this.context.targetDir, "mise.toml");
+    if (!existsSync3(misePath)) {
+      return {
+        success: false,
+        message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pj init mise` first, then re-run."
+      };
+    }
+    let content = readFileSync(misePath, "utf8");
+    if (content.includes(_WireMiseOpInject.MARKER)) {
+      return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for op-inject") };
+    }
+    const cr = _WireMiseOpInject.CR;
+    const envRe = /\[env\]\s*\n([\s\S]*?(?=\n\[|$))/;
+    if (envRe.test(content)) {
+      content = content.replace(envRe, (m) => {
+        let block = m;
+        if (!block.includes("_.file")) {
+          block += `
+_.file = ['.env', '.env.secrets']
+`;
+        } else if (!block.includes(".env.secrets")) {
+          block = block.replace(/(_\.file\s*=\s*\[)([^\]]*?)(\])/, (m2, prefix, files, suffix) => {
+            const added = files.trim() ? `${files}, '.env.secrets'` : `'.env.secrets'`;
+            return `${prefix}${added}${suffix}`;
+          });
+        }
+        return block;
+      });
+    } else {
+      const envBlock = `[env]
+_.file = ['.env', '.env.secrets']
+
+`;
+      if (content.includes("[tools]")) {
+        content = content.replace(/(\[tools\][\s\S]*?(?=\n\[|$))/, `$1
+${envBlock}`);
+      } else {
+        content = envBlock + content;
+      }
+    }
+    const enterAdds = `  '${cr}/.mise/scripts/inject-op-secrets.sh',`;
+    const enterRe = /(enter\s*=\s*\[[\s\S]*?)(\n[ \t]*\])/;
+    if (enterRe.test(content)) {
+      content = content.replace(enterRe, (_m, head, close) => {
+        const sep = /[,[]\s*$/.test(head) ? "" : ",";
+        return `${head}${sep}
+${enterAdds}${close}`;
+      });
+    } else {
+      if (content.includes("[hooks]")) {
+        content = content.replace(/\[hooks\]/, `[hooks]
+enter = [
+${enterAdds}
+]`);
+      } else {
+        content += `
+[hooks]
+enter = [
+${enterAdds}
+]
+`;
+      }
+    }
+    const appended = [
+      "",
+      _WireMiseOpInject.MARKER,
+      "[tasks.secrets-inject]",
+      'description = "Re-resolve .env.op secrets from 1Password into .env.secrets"',
+      `run = "OP_INJECT_TTL_HOURS=0 .mise/scripts/inject-op-secrets.sh"`,
+      _WireMiseOpInject.MARKER + ":end",
+      ""
+    ].join("\n");
+    content = content.replace(/\n*$/, "\n") + appended;
+    if (!this.context.dryRun) writeFileSync3(misePath, content);
+    return {
+      success: true,
+      message: this.formatMessage("\u2705 Wired mise.toml for op-inject (_.file, [hooks] enter, tasks.secrets-inject)")
+    };
+  }
+};
+
 // src/recipes/MiseRecipe.ts
 var MiseRecipe = class extends Recipe {
   constructor(context) {
     super(context);
-    this.addIngredient(AddMiseToml).addIngredient(AddDotenv).addIngredient(AddMiseTasksStructure).addIngredient(AddMiseBaseToml).addIngredient(AddMiseBaseScript).addIngredient(AddMiseCodegraphScript);
+    this.addIngredient(AddMiseToml).addIngredient(AddDotenv).addIngredient(AddMiseTasksStructure).addIngredient(AddMiseBaseToml).addIngredient(AddMiseBaseScript).addIngredient(AddMiseCodegraphScript).addIngredient(AddMiseCodegraphWireScript).addIngredient(WireMiseOpInject);
   }
   printNextSteps() {
     console.log("\u{1F389} Mise subsystem initialized successfully!");
@@ -728,12 +915,12 @@ var NodeRecipe = class extends Recipe {
 };
 
 // src/commands/hermes/PromptForAgentConfig.ts
-import { basename, join as join4 } from "node:path";
-import { readFileSync } from "node:fs";
+import { basename, join as join6 } from "node:path";
+import { readFileSync as readFileSync2 } from "node:fs";
 import * as p from "@clack/prompts";
 function detectTicketProvider(targetDir) {
   try {
-    const t = JSON.parse(readFileSync(join4(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
+    const t = JSON.parse(readFileSync2(join6(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
     return t === "plane" || t === "trello" ? t : void 0;
   } catch {
     return void 0;
@@ -791,8 +978,8 @@ var PromptForAgentConfig = class extends Command {
 // src/commands/hermes/RunCopierTemplate.ts
 import { spawnSync } from "node:child_process";
 import { homedir as homedir2 } from "node:os";
-import { join as join5, dirname as dirname3 } from "node:path";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join7, dirname as dirname3 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import * as p2 from "@clack/prompts";
 function resolveVendoredTemplate(name) {
@@ -803,8 +990,8 @@ function resolveVendoredTemplate(name) {
     return void 0;
   }
   for (let i = 0; i < 8; i++) {
-    const candidate = join5(dir, "templates", name);
-    if (existsSync3(join5(candidate, "copier.yml"))) return candidate;
+    const candidate = join7(dir, "templates", name);
+    if (existsSync4(join7(candidate, "copier.yml"))) return candidate;
     const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
@@ -823,7 +1010,7 @@ var RunCopierTemplate = class extends Command {
         message: "PromptForAgentConfig must run before RunCopierTemplate (targetRepo/role unset)"
       };
     }
-    const roleDir = join5(ctx.targetDir, "agents", "hermes", role);
+    const roleDir = join7(ctx.targetDir, "agents", "hermes", role);
     ctx.roleDir = roleDir;
     ctx.runtimeRepo = `delorenj/agent-hm-${targetRepo}-${role}`;
     const which = spawnSync("which", ["copier"], { encoding: "utf8" });
@@ -833,7 +1020,7 @@ var RunCopierTemplate = class extends Command {
         message: "\u2717 copier not found on PATH.  Install with: `uv tool install copier` or `pip install copier`"
       };
     }
-    if (existsSync3(join5(roleDir, "role.yaml")) && !ctx.force) {
+    if (existsSync4(join7(roleDir, "role.yaml")) && !ctx.force) {
       if (ctx.yes) {
         ctx.force = true;
       } else {
@@ -860,9 +1047,9 @@ var RunCopierTemplate = class extends Command {
       SKIP_BLOODBANK: ctx.skipBloodbank ? "1" : "0",
       SKIP_SYSTEMD: ctx.skipSystemd ? "1" : "0"
     };
-    const LOCAL_TEMPLATE = join5(homedir2(), "code", "hermes-agent-template");
+    const LOCAL_TEMPLATE = join7(homedir2(), "code", "hermes-agent-template");
     const vendored = resolveVendoredTemplate("hermes-agent");
-    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync3(join5(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
+    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync4(join7(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
     const args = [
       "copy",
       templateSrc,
@@ -893,7 +1080,7 @@ var RunCopierTemplate = class extends Command {
         message: this.formatMessage(`Would run: copier ${args.join(" ")}`)
       };
     }
-    mkdirSync3(join5(ctx.targetDir, "agents", "hermes"), { recursive: true });
+    mkdirSync3(join7(ctx.targetDir, "agents", "hermes"), { recursive: true });
     const spinner4 = p2.spinner();
     spinner4.start(`Running copier copy  (target: agents/hermes/${role})`);
     const result = spawnSync("copier", args, {
@@ -917,14 +1104,14 @@ var RunCopierTemplate = class extends Command {
 };
 
 // src/commands/hermes/UntrackHermesRuntimes.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3, readdirSync } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4, readdirSync } from "fs";
+import { join as join8 } from "path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 var UntrackHermesRuntimes = class extends Command {
   async invoke() {
     const targetDir = this.context.targetDir;
-    const rolesDir = join6(targetDir, "agents", "hermes");
-    if (!existsSync4(rolesDir)) {
+    const rolesDir = join8(targetDir, "agents", "hermes");
+    if (!existsSync5(rolesDir)) {
       return {
         success: true,
         message: "No Hermes agents found (no agents/hermes directory)."
@@ -940,9 +1127,9 @@ var UntrackHermesRuntimes = class extends Command {
     let modifiedAny = false;
     const details = [];
     for (const role of roles) {
-      const roleDir = join6("agents", "hermes", role);
-      const runtimePath = join6(roleDir, "runtime");
-      const gitignorePath = join6(roleDir, ".gitignore");
+      const roleDir = join8("agents", "hermes", role);
+      const runtimePath = join8(roleDir, "runtime");
+      const gitignorePath = join8(roleDir, ".gitignore");
       let isTracked = false;
       const lsResult = spawnSync2("git", ["ls-files", "--stage", runtimePath], {
         cwd: targetDir,
@@ -952,9 +1139,9 @@ var UntrackHermesRuntimes = class extends Command {
         isTracked = true;
       }
       let isIgnored = false;
-      const fullGitignorePath = join6(targetDir, gitignorePath);
-      if (existsSync4(fullGitignorePath)) {
-        const content = readFileSync2(fullGitignorePath, "utf8");
+      const fullGitignorePath = join8(targetDir, gitignorePath);
+      if (existsSync5(fullGitignorePath)) {
+        const content = readFileSync3(fullGitignorePath, "utf8");
         const lines = content.split(/\r?\n/).map((line) => line.trim());
         isIgnored = lines.includes("runtime/") || lines.includes("runtime");
       }
@@ -979,14 +1166,14 @@ var UntrackHermesRuntimes = class extends Command {
           details.push(`ignore runtime/ in agents/hermes/${role}/.gitignore`);
           if (!this.context.dryRun) {
             let content = "";
-            if (existsSync4(fullGitignorePath)) {
-              content = readFileSync2(fullGitignorePath, "utf8");
+            if (existsSync5(fullGitignorePath)) {
+              content = readFileSync3(fullGitignorePath, "utf8");
             }
             if (content && !content.endsWith("\n")) {
               content += "\n";
             }
             content += "runtime/\n";
-            writeFileSync3(fullGitignorePath, content, "utf8");
+            writeFileSync4(fullGitignorePath, content, "utf8");
           }
         }
       }
@@ -1008,8 +1195,8 @@ ${details.map((d) => `  - ${d}`).join("\n")}`
 
 // src/commands/hermes/WireTelegram.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { join as join7 } from "node:path";
-import { existsSync as existsSync5, unlinkSync } from "node:fs";
+import { join as join9 } from "node:path";
+import { existsSync as existsSync6, unlinkSync } from "node:fs";
 import * as p3 from "@clack/prompts";
 var WireTelegram = class extends Command {
   async invoke() {
@@ -1097,15 +1284,15 @@ var WireTelegram = class extends Command {
     if (p3.isCancel(allowedAnswer)) {
       return { success: false, message: "\u2717 Aborted; Telegram step deferred." };
     }
-    const script = join7(roleDir, ".scripts", "30-telegram.sh");
-    if (!existsSync5(script)) {
+    const script = join9(roleDir, ".scripts", "30-telegram.sh");
+    if (!existsSync6(script)) {
       return {
         success: false,
         message: `\u2717 ${script} not found.  Did copier finish?  Re-run with --skip-runtime-repo=0 if you skipped it.`
       };
     }
-    const marker = join7(roleDir, ".scripts", ".done-30-telegram");
-    if (existsSync5(marker)) unlinkSync(marker);
+    const marker = join9(roleDir, ".scripts", ".done-30-telegram");
+    if (existsSync6(marker)) unlinkSync(marker);
     const spinner4 = p3.spinner();
     spinner4.start("Verifying token + wiring profile");
     const result = spawnSync3("bash", [script], {
@@ -1132,8 +1319,8 @@ function cap(s) {
 
 // src/commands/hermes/WireEmail.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { join as join8 } from "node:path";
-import { existsSync as existsSync6, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join10 } from "node:path";
+import { existsSync as existsSync7, unlinkSync as unlinkSync2 } from "node:fs";
 import * as p4 from "@clack/prompts";
 var WireEmail = class extends Command {
   async invoke() {
@@ -1148,8 +1335,8 @@ var WireEmail = class extends Command {
     if (!targetRepo || !role || !roleDir) {
       return { success: false, message: "Cannot wire email: missing target_repo/role/roleDir" };
     }
-    const script = join8(roleDir, ".scripts", "50-email.sh");
-    if (!existsSync6(script)) {
+    const script = join10(roleDir, ".scripts", "50-email.sh");
+    if (!existsSync7(script)) {
       return { success: false, message: `\u2717 ${script} not found` };
     }
     let token = process.env.CF_EMAIL_ROUTING_TOKEN;
@@ -1211,8 +1398,8 @@ var WireEmail = class extends Command {
         }
       }
     }
-    const marker = join8(roleDir, ".scripts", ".done-50-email");
-    if (existsSync6(marker)) unlinkSync2(marker);
+    const marker = join10(roleDir, ".scripts", ".done-50-email");
+    if (existsSync7(marker)) unlinkSync2(marker);
     const spinner4 = p4.spinner();
     spinner4.start("Creating Cloudflare Email Routing rule");
     const result = spawnSync4("bash", [script], {
@@ -1299,33 +1486,261 @@ var HermesAgentRecipe = class extends Recipe {
 
 // src/commands/AgentHooksCommands.ts
 import { homedir as homedir4 } from "node:os";
-import { join as join10, dirname as dirname5 } from "node:path";
-import { existsSync as existsSync8, cpSync, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join12, dirname as dirname5 } from "node:path";
+import { existsSync as existsSync9, cpSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/project/index.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, renameSync, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync, statSync, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename as basename2, delimiter, dirname as dirname4, join as join9, resolve } from "node:path";
+import { basename as basename2, delimiter, dirname as dirname4, join as join11, resolve } from "node:path";
+import YAML2 from "yaml";
+
+// src/project/RegistryStore.ts
+import { Pool } from "pg";
 import YAML from "yaml";
+function pgRegistryConfigFromEnv(env2 = process.env) {
+  return {
+    host: env2.PGHOST || "localhost",
+    port: parseInt(env2.PGPORT || "5432", 10),
+    user: env2.PGUSER || "delorenj",
+    password: env2.PGPASSWORD || "",
+    database: env2.PGDATABASE || "33god"
+  };
+}
+var PgRegistryStore = class {
+  pool;
+  constructor(config) {
+    this.pool = new Pool({
+      host: config.host,
+      port: config.port,
+      user: config.user,
+      password: config.password,
+      database: config.database
+    });
+  }
+  async load() {
+    const client = await this.pool.connect();
+    try {
+      const { rows } = await client.query(
+        `SELECT p.id, p.name, p.description, p.slug, p.status,
+                p.source_artifacts, p.template, p.automation,
+                p.created_at, p.updated_at,
+                r.id AS repo_id, r.local_path
+         FROM public.projects p
+         LEFT JOIN public.repos r ON r.project_id = p.id
+         WHERE p.slug IS NOT NULL`
+      );
+      const projects = {};
+      for (const row of rows) {
+        const slug = row.slug;
+        const ticketProvider = await this.loadTicketProvider(client, row.id);
+        const agents = await this.loadAgents(client, row.id, slug);
+        projects[slug] = {
+          name: row.name ?? "",
+          slug,
+          repo_path: row.local_path ?? "",
+          description: row.description ?? "",
+          status: row.status ?? "planned",
+          source_artifacts: row.source_artifacts ?? [],
+          template: row.template ?? {
+            commonproject: { enabled: false, primary_language: "python" }
+          },
+          ticket_provider: ticketProvider,
+          agents,
+          automation: row.automation ?? void 0,
+          created_at: row.created_at.toISOString(),
+          updated_at: row.updated_at.toISOString()
+        };
+      }
+      const registry = {
+        schema_version: PROJECT_REGISTRY_SCHEMA_VERSION,
+        projects
+      };
+      validateProjectRegistry(registry);
+      return registry;
+    } finally {
+      client.release();
+    }
+  }
+  async save(registry) {
+    validateProjectRegistry(registry);
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      for (const [slug, record] of Object.entries(registry.projects)) {
+        await this.upsertInTx(client, slug, record);
+      }
+      await client.query("COMMIT");
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    } finally {
+      client.release();
+    }
+  }
+  async upsert(slug, record) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await this.upsertInTx(client, slug, record);
+      await client.query("COMMIT");
+    } catch (err) {
+      await client.query("ROLLBACK");
+      throw err;
+    } finally {
+      client.release();
+    }
+  }
+  async getBySlug(slug) {
+    const registry = await this.load();
+    return registry.projects[slug];
+  }
+  async getByRepoPath(repoPath) {
+    const registry = await this.load();
+    return Object.values(registry.projects).find(
+      (p6) => p6.repo_path === repoPath
+    );
+  }
+  async close() {
+    await this.pool.end();
+  }
+  // --- private helpers ---
+  async upsertInTx(client, slug, record) {
+    if (!slug) throw new Error("PgRegistryStore.upsert: slug is required");
+    const projectResult = await client.query(
+      `INSERT INTO public.projects (name, description, slug, status, source_artifacts, template, automation)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (slug) WHERE slug IS NOT NULL
+       DO UPDATE SET
+         name = EXCLUDED.name,
+         description = EXCLUDED.description,
+         status = EXCLUDED.status,
+         source_artifacts = EXCLUDED.source_artifacts,
+         template = EXCLUDED.template,
+         automation = EXCLUDED.automation
+       RETURNING id`,
+      [
+        record.name,
+        record.description,
+        slug,
+        record.status,
+        JSON.stringify(record.source_artifacts),
+        JSON.stringify(record.template),
+        record.automation ? JSON.stringify(record.automation) : null
+      ]
+    );
+    const projectId = projectResult.rows[0]?.id;
+    if (!projectId) throw new Error(`Failed to upsert project: ${slug}`);
+    await client.query(
+      `INSERT INTO public.repos (project_id, local_path)
+       VALUES ($1, $2)
+       ON CONFLICT (local_path)
+       DO UPDATE SET project_id = EXCLUDED.project_id
+       RETURNING id`,
+      [projectId, record.repo_path]
+    );
+    const repoResult = await client.query(
+      `SELECT id FROM public.repos WHERE project_id = $1 AND local_path = $2`,
+      [projectId, record.repo_path]
+    );
+    const repoId = repoResult.rows[0]?.id;
+    if (!repoId) throw new Error(`Failed to find repo for project ${slug} at path ${record.repo_path}`);
+    await this.upsertTicketProvider(client, projectId, repoId, record.ticket_provider);
+    await client.query(
+      `DELETE FROM public.project_agents WHERE project_id = $1`,
+      [projectId]
+    );
+    for (const [agentKey, agent] of Object.entries(record.agents)) {
+      await client.query(
+        `INSERT INTO public.project_agents (repo_id, project_id, agent_key, role, role_dir, provisioning_state)
+         VALUES ($1, $2, $3, $4, $5, $6)`,
+        [repoId, projectId, agentKey, agent.role, agent.role_dir ?? null, agent.provisioning_state]
+      );
+    }
+  }
+  async loadTicketProvider(client, projectId) {
+    const { rows } = await client.query(
+      `SELECT provider_type, workspace, identifier, board_id, state
+       FROM public.project_ticket_boards
+       WHERE project_id = $1
+       LIMIT 1`,
+      [projectId]
+    );
+    if (!rows.length) {
+      return { type: "plane", workspace: "33god", identifier: "", board_id: "", state: "planned" };
+    }
+    const row = rows[0];
+    return {
+      type: row.provider_type,
+      workspace: row.workspace ?? void 0,
+      identifier: row.identifier ?? void 0,
+      board_id: row.board_id ?? void 0,
+      state: row.state ?? void 0
+    };
+  }
+  async loadAgents(client, projectId, slug) {
+    const { rows } = await client.query(
+      `SELECT agent_key, role, role_dir, provisioning_state
+       FROM public.project_agents
+       WHERE project_id = $1`,
+      [projectId]
+    );
+    const agents = {};
+    for (const row of rows) {
+      agents[row.agent_key] = {
+        role: row.role,
+        provisioning_state: row.provisioning_state,
+        role_dir: row.role_dir ?? void 0
+      };
+    }
+    return agents;
+  }
+  async upsertTicketProvider(client, projectId, repoId, tp) {
+    await client.query(
+      `DELETE FROM public.project_ticket_boards WHERE project_id = $1`,
+      [projectId]
+    );
+    await client.query(
+      `INSERT INTO public.project_ticket_boards
+         (repo_id, project_id, provider_type, workspace, identifier, board_id, state)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [
+        repoId,
+        projectId,
+        tp.type,
+        tp.workspace ?? null,
+        tp.identifier ?? null,
+        tp.board_id ?? null,
+        tp.state ?? null
+      ]
+    );
+  }
+};
+var PJ_REGISTRY_PG_ENV = "PJ_REGISTRY_PG";
+function isPgRegistryEnabled(env2 = process.env) {
+  return env2[PJ_REGISTRY_PG_ENV] === "1" || env2[PJ_REGISTRY_PG_ENV] === "true";
+}
+
+// src/project/index.ts
 var PROJECT_REGISTRY_ENV = "PJ_PROJECT_REGISTRY";
 var PROJECT_SOURCE_SKILL_ROOTS_ENV = "PJ_SOURCE_SKILL_ROOTS";
 var PROJECT_REGISTRY_SCHEMA_VERSION = 1;
 var DEFAULT_SOURCE_SKILL_ROOTS = [
   "/home/delorenj/code/skillex/all-skills",
-  join9(homedir3(), ".agents", "skills"),
-  join9(homedir3(), ".codex", "skills")
+  join11(homedir3(), ".agents", "skills"),
+  join11(homedir3(), ".codex", "skills")
 ];
 function projectRegistryPath(env2 = process.env) {
-  return expandHome(env2[PROJECT_REGISTRY_ENV] || join9(homedir3(), ".config", "pjangler", "projects.yaml"));
+  return expandHome(env2[PROJECT_REGISTRY_ENV] || join11(homedir3(), ".config", "pjangler", "projects.yaml"));
 }
 function emptyProjectRegistry() {
   return { schema_version: PROJECT_REGISTRY_SCHEMA_VERSION, projects: {} };
 }
 function loadProjectRegistry(path = projectRegistryPath()) {
-  if (!existsSync7(path)) return emptyProjectRegistry();
-  const raw = YAML.parse(readFileSync3(path, "utf8"));
+  if (!existsSync8(path)) return emptyProjectRegistry();
+  const raw = YAML2.parse(readFileSync4(path, "utf8"));
   if (raw == null) return emptyProjectRegistry();
   if (!isRecord(raw)) throw new Error(`Project registry must be a mapping: ${path}`);
   const registry = raw;
@@ -1340,7 +1755,7 @@ function saveProjectRegistry(registry, path = projectRegistryPath()) {
   validateProjectRegistry(registry);
   mkdirSync4(dirname4(path), { recursive: true });
   const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync4(temp, YAML.stringify(registry, { lineWidth: 0 }), "utf8");
+  writeFileSync5(temp, YAML2.stringify(registry, { lineWidth: 0 }), "utf8");
   renameSync(temp, path);
 }
 function validateProjectRegistry(registry) {
@@ -1422,7 +1837,7 @@ function resolveAgentHooksLayer(input, env2 = process.env) {
   const override = env2.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  return !existsSync7(join9(homedir3(), ".agents", "hooks"));
+  return !existsSync8(join11(homedir3(), ".agents", "hooks"));
 }
 function jsonStable(value) {
   return JSON.stringify(value);
@@ -1453,12 +1868,12 @@ function resolveSourceSkillPath(sourceSkill, env2 = process.env) {
   if (!sourceSkill) return void 0;
   const expanded = expandHome(sourceSkill);
   const direct = resolve(expanded);
-  if (existsSync7(direct)) return direct;
+  if (existsSync8(direct)) return direct;
   const name = basename2(sourceSkill);
   const roots = sourceSkillRoots(env2);
   for (const root of roots) {
-    const candidate = join9(root, name);
-    if (existsSync7(candidate)) return candidate;
+    const candidate = join11(root, name);
+    if (existsSync8(candidate)) return candidate;
   }
   const searched = roots.length ? ` Searched roots: ${roots.join(", ")}.` : "";
   const hint = `${searched} Add project-specific roots with ${PROJECT_SOURCE_SKILL_ROOTS_ENV}.`;
@@ -1539,7 +1954,7 @@ function planProjectInit(input) {
     }));
   }
   actions.push(
-    { kind: "project.write-manifest", path: join9(targetDir, ".project.json"), manifest },
+    { kind: "project.write-manifest", path: join11(targetDir, ".project.json"), manifest },
     {
       kind: "ticket-provider.create-or-link",
       enabled: live,
@@ -1567,7 +1982,7 @@ function planProjectInit(input) {
   );
   return { ok: true, apply, dryRun: !apply, live, registryPath: registryPath2, project, manifest, actions };
 }
-function executeProjectInitPlan(plan) {
+async function executeProjectInitPlan(plan) {
   const logs = [];
   const errors = [];
   const changedFiles = [];
@@ -1592,7 +2007,7 @@ function executeProjectInitPlan(plan) {
       }
       if (result.status !== 0) {
         errors.push(`copier exited with status ${result.status ?? "unknown"}`);
-        if (existsSync7(action.targetDir)) changedFiles.push(action.targetDir);
+        if (existsSync8(action.targetDir)) changedFiles.push(action.targetDir);
         break;
       }
       changedFiles.push(action.targetDir);
@@ -1600,9 +2015,9 @@ function executeProjectInitPlan(plan) {
       mkdirSync4(dirname4(action.path), { recursive: true });
       const next = `${JSON.stringify(action.manifest, null, 2)}
 `;
-      const current = existsSync7(action.path) ? readFileSync3(action.path, "utf8") : void 0;
+      const current = existsSync8(action.path) ? readFileSync4(action.path, "utf8") : void 0;
       if (current !== next) {
-        writeFileSync4(action.path, next, "utf8");
+        writeFileSync5(action.path, next, "utf8");
         changedFiles.push(action.path);
       }
     } else if (action.kind === "registry.upsert") {
@@ -1618,6 +2033,16 @@ function executeProjectInitPlan(plan) {
       registry.projects[pendingRegistryAction.slug] = pendingRegistryAction.project;
       saveProjectRegistry(registry, pendingRegistryAction.registryPath);
       changedFiles.push(pendingRegistryAction.registryPath);
+      if (isPgRegistryEnabled()) {
+        try {
+          const pgStore = new PgRegistryStore(pgRegistryConfigFromEnv());
+          await pgStore.upsert(pendingRegistryAction.slug, pendingRegistryAction.project);
+          await pgStore.close();
+          logs.push("registry: PG dual-write complete");
+        } catch (pgErr) {
+          logs.push(`registry: PG dual-write failed (yaml is authoritative): ${pgErr instanceof Error ? pgErr.message : pgErr}`);
+        }
+      }
     }
   }
   return { ok: errors.length === 0, plan, logs, errors, changedFiles };
@@ -1695,16 +2120,16 @@ function doctorProjectRegistry(registryPath2 = projectRegistryPath(), slug) {
   const registry = loadProjectRegistry(registryPath2);
   const projects = slug ? [[slug, getProject(registry, slug)]] : Object.entries(registry.projects);
   for (const [projectSlug, project] of projects) {
-    if (!existsSync7(project.repo_path)) {
+    if (!existsSync8(project.repo_path)) {
       issues.push({ level: "warn", slug: projectSlug, message: `repo_path does not exist: ${project.repo_path}` });
     } else if (!statSync(project.repo_path).isDirectory()) {
       issues.push({ level: "error", slug: projectSlug, message: `repo_path is not a directory: ${project.repo_path}` });
     } else {
-      const manifestPath = join9(project.repo_path, ".project.json");
-      if (!existsSync7(manifestPath)) issues.push({ level: "warn", slug: projectSlug, message: ".project.json is missing" });
+      const manifestPath = join11(project.repo_path, ".project.json");
+      if (!existsSync8(manifestPath)) issues.push({ level: "warn", slug: projectSlug, message: ".project.json is missing" });
     }
     for (const artifact of project.source_artifacts) {
-      if (artifact.path && !existsSync7(artifact.path)) {
+      if (artifact.path && !existsSync8(artifact.path)) {
         issues.push({ level: "warn", slug: projectSlug, message: `source artifact missing: ${artifact.path}` });
       }
     }
@@ -1717,7 +2142,7 @@ function doctorProjectRegistry(registryPath2 = projectRegistryPath(), slug) {
   };
 }
 function buildCommonProjectCopierAction(input) {
-  const templateDir = join9(input.pjanglerRoot, "templates", "commonproject");
+  const templateDir = join11(input.pjanglerRoot, "templates", "commonproject");
   const data = {
     project_name: input.projectName,
     project_description: input.projectDescription ?? "",
@@ -1746,7 +2171,7 @@ function buildCommonProjectCopierAction(input) {
 function resolvePjanglerRoot() {
   let dir = dirname4(new URL(import.meta.url).pathname);
   while (dir !== dirname4(dir)) {
-    if (existsSync7(join9(dir, "package.json")) && existsSync7(join9(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    if (existsSync8(join11(dir, "package.json")) && existsSync8(join11(dir, "templates", "commonproject", "copier.yml"))) return dir;
     dir = dirname4(dir);
   }
   return resolve(process.cwd());
@@ -1778,7 +2203,7 @@ function validateProjectRecord(project, key) {
 }
 function expandHome(path) {
   if (path === "~") return homedir3();
-  if (path.startsWith("~/")) return join9(homedir3(), path.slice(2));
+  if (path.startsWith("~/")) return join11(homedir3(), path.slice(2));
   return path;
 }
 function isRecord(value) {
@@ -1795,16 +2220,16 @@ function resolveTemplateRoot() {
   try {
     let dir = dirname5(fileURLToPath2(import.meta.url));
     for (let i = 0; i < 8; i++) {
-      candidates.push(join10(dir, "templates", "commonproject", "template"));
+      candidates.push(join12(dir, "templates", "commonproject", "template"));
       const parent = dirname5(dir);
       if (parent === dir) break;
       dir = parent;
     }
   } catch {
   }
-  candidates.push(join10(homedir4(), "code", "pjangler", "templates", "commonproject", "template"));
+  candidates.push(join12(homedir4(), "code", "pjangler", "templates", "commonproject", "template"));
   for (const c of candidates) {
-    if (existsSync8(join10(c, ".agents", "hooks", "hooks.master.json"))) return c;
+    if (existsSync9(join12(c, ".agents", "hooks", "hooks.master.json"))) return c;
   }
   throw new Error(
     "Could not locate the CommonProject template. Set PJANGLER_COMMONPROJECT_TEMPLATE to <repo>/templates/commonproject/template."
@@ -1823,18 +2248,17 @@ var CopyAgentHooksTree = class extends Command {
     }
     const items = [
       { rel: ".agents/hooks", dir: true },
+      { rel: ".agents/skills.json", dir: false },
       { rel: ".agents/local.example.json", dir: false },
-      { rel: ".mise/scripts/link-project-skills-to-clis.sh", dir: false },
-      { rel: ".mise/scripts/unlink-project-skills-from-clis.sh", dir: false },
       { rel: ".mise/scripts/hindsight-setup.sh", dir: false }
     ];
     const created = [];
     const skipped = [];
     for (const { rel, dir } of items) {
-      const src = join10(templateRoot, rel);
-      const dest = join10(this.context.targetDir, rel);
-      if (!existsSync8(src)) continue;
-      if (existsSync8(dest) && !this.context.force) {
+      const src = join12(templateRoot, rel);
+      const dest = join12(this.context.targetDir, rel);
+      if (!existsSync9(src)) continue;
+      if (existsSync9(dest) && !this.context.force) {
         skipped.push(rel);
         continue;
       }
@@ -1860,25 +2284,21 @@ var WireMiseAgentHooks = class _WireMiseAgentHooks extends Command {
     if (!resolveAgentHooksLayer()) {
       return { success: true, message: this.formatMessage(AGENT_HOOKS_SKIP_MESSAGE) };
     }
-    const misePath = join10(this.context.targetDir, "mise.toml");
-    if (!existsSync8(misePath)) {
+    const misePath = join12(this.context.targetDir, "mise.toml");
+    if (!existsSync9(misePath)) {
       return {
         success: false,
         message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pjangler init mise` first, then re-run."
       };
     }
-    let content = readFileSync4(misePath, "utf8");
+    let content = readFileSync5(misePath, "utf8");
     if (content.includes(_WireMiseAgentHooks.MARKER)) {
       return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for agent-hooks") };
     }
     const cr = _WireMiseAgentHooks.CR;
-    const enterAdds = [
-      `  "${cr}/.mise/scripts/link-project-skills-to-clis.sh",`,
-      `  "${cr}/.agents/hooks/sync.py --install --quiet",`
-    ].join("\n");
+    const enterAdds = [`  "sync-skills.py --scope project",`, `  "${cr}/.agents/hooks/sync.py --install --quiet",`].join("\n");
     const leaveBlock = [
       "leave = [",
-      `  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",`,
       `  "${cr}/.agents/hooks/sync.py --uninstall --quiet",`,
       "]"
     ].join("\n");
@@ -1895,7 +2315,6 @@ ${enterAdds}${close}`;
         content = content.replace(leaveRe, (_m, head, close) => {
           const sep = /[,[]\s*$/.test(head) ? "" : ",";
           return `${head}${sep}
-  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",
   "${cr}/.agents/hooks/sync.py --uninstall --quiet",${close}`;
         });
       } else {
@@ -1908,6 +2327,14 @@ ${leaveBlock}`);
       "",
       _WireMiseAgentHooks.MARKER + " (generated \u2014 see .agents/hooks/README.md)",
       "[[watch_files]]",
+      'patterns = [".agents/skills.json"]',
+      'task = "skills-sync"',
+      "",
+      "[tasks.skills-sync]",
+      'description = "Sync skills from manifest to local CLI dirs"',
+      'run = "sync-skills.py --scope project"',
+      "",
+      "[[watch_files]]",
       'patterns = [".agents/hooks/hooks.master.json"]',
       'task = "hooks-sync"',
       "",
@@ -1923,18 +2350,6 @@ ${leaveBlock}`);
       'description = "Remove per-user agent-hook injections (codex/kimi/hermes)"',
       `run = "${cr}/.agents/hooks/sync.py --uninstall"`,
       "",
-      "[tasks.link-project-skills-to-clis]",
-      'description = "Fan .agents/skills out to each agent CLI (honors local.json)"',
-      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
-      "",
-      "[tasks.unlink-project-skills-from-clis]",
-      'description = "Remove project skill symlinks from shared per-CLI dirs"',
-      `run = "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh"`,
-      "",
-      "[tasks.skills-relink]",
-      'description = "Re-fan the project skill set to all CLIs"',
-      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
-      "",
       "[tasks.hindsight-setup]",
       `description = "Provision this dev's shared project Hindsight key from 1Password into .env"`,
       `run = "${cr}/.mise/scripts/hindsight-setup.sh"`,
@@ -1943,7 +2358,7 @@ ${leaveBlock}`);
       ""
     ].join("\n");
     content = content.replace(/\n*$/, "\n") + appended;
-    if (!this.context.dryRun) writeFileSync5(misePath, content);
+    if (!this.context.dryRun) writeFileSync6(misePath, content);
     if (wiredHooks) {
       return { success: true, message: this.formatMessage("\u2705 Wired mise.toml ([hooks] enter/leave + tasks)") };
     }
@@ -1952,8 +2367,8 @@ ${leaveBlock}`);
       message: this.formatMessage(
         `\u2705 Added agent-hooks tasks to mise.toml.
    \u26A0\uFE0F  Could not find a [hooks].enter array to extend \u2014 add these to your [hooks] block manually:
-     enter += "${cr}/.mise/scripts/link-project-skills-to-clis.sh", "${cr}/.agents/hooks/sync.py --install --quiet"
-     leave += "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh", "${cr}/.agents/hooks/sync.py --uninstall --quiet"`
+     enter += "sync-skills.py --scope project", "${cr}/.agents/hooks/sync.py --install --quiet"
+     leave += "${cr}/.agents/hooks/sync.py --uninstall --quiet"`
       )
     };
   }
@@ -1968,10 +2383,25 @@ var AgentHooksRecipe = class extends Recipe {
   printNextSteps() {
     console.log("\u{1FA9D} Agent-hooks layer installed!");
     console.log("   Next steps:");
-    console.log("   1. mise run hooks-sync   # generate .claude/settings.json + inject codex/kimi/hermes");
-    console.log("   2. git add .claude/settings.json .agents/hooks && commit (codex/kimi/hermes are per-dev)");
-    console.log("   3. mise run hindsight-setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
-    console.log(`   4. If you run a global agent system: echo '{"skills":{"defer_to_global":true}}' > .agents/local.json`);
+    console.log("   1. mise run skills-sync  # sync .agents/skills.json into local CLI dirs");
+    console.log("   2. mise run hooks-sync   # generate .claude/settings.json + inject codex/kimi/hermes");
+    console.log("   3. git add .claude/settings.json .agents/hooks .agents/skills.json && commit (codex/kimi/hermes are per-dev)");
+    console.log("   4. mise run hindsight-setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
+    console.log("   5. Optional per-dev hook opt-out: copy .agents/local.example.json -> .agents/local.json");
+  }
+};
+
+// src/recipes/MiseOpInjectRecipe.ts
+var MiseOpInjectRecipe = class extends Recipe {
+  constructor(context) {
+    super(context);
+    this.addIngredient(WireMiseOpInject);
+  }
+  printNextSteps() {
+    console.log("\u{1F389} Wired up .env.op 1Password resolution via mise!");
+    console.log("   Next steps:");
+    console.log("   1. Create .env.op with your op:// secret references");
+    console.log("   2. Run `mise run secrets-inject` or simply cd out and back in to trigger the hook");
   }
 };
 
@@ -2014,6 +2444,12 @@ var RECIPE_REGISTRY = {
     description: "Retrofit the project-scoped agent-hooks + skill fan-out layer (Claude/Codex/Kimi/Hermes hooks via mise enter/leave)",
     class: AgentHooksRecipe,
     commands: ["CopyAgentHooksTree", "WireMiseAgentHooks"]
+  },
+  "mise-op-inject": {
+    name: "mise-op-inject",
+    description: "Wire up op-inject script to mise.toml for 1Password secret resolution",
+    class: MiseOpInjectRecipe,
+    commands: ["WireMiseOpInject"]
   }
 };
 var COMMAND_REGISTRY = {
@@ -2082,6 +2518,12 @@ var COMMAND_REGISTRY = {
     description: "Create .env.example file",
     group: "environment",
     class: AddDotenv
+  },
+  WireMiseOpInject: {
+    name: "WireMiseOpInject",
+    description: "Wire up op-inject script to mise.toml for 1Password secret resolution",
+    group: "mise",
+    class: WireMiseOpInject
   }
 };
 function getRecipeNames() {
@@ -2116,29 +2558,39 @@ function createRecipe(name, context) {
 import { cancel as cancel2, multiselect, text as text2, isCancel as isCancel5 } from "@clack/prompts";
 
 // src/parity/index.ts
-import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync6, readFileSync as readFileSync5, readlinkSync, readdirSync as readdirSync2, renameSync as renameSync2, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6, chmodSync as chmodSync2, copyFileSync } from "node:fs";
-import { basename as basename3, dirname as dirname6, join as join11, relative, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync6, readFileSync as readFileSync6, readlinkSync, readdirSync as readdirSync2, renameSync as renameSync2, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7, chmodSync as chmodSync4, copyFileSync, rmSync } from "node:fs";
+import { basename as basename3, dirname as dirname6, join as join13, relative, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { homedir as homedir5 } from "node:os";
 import { spawnSync as spawnSync6 } from "node:child_process";
-import YAML2 from "yaml";
+import YAML3 from "yaml";
 var LINK_AGENTFILES_SCRIPT = "'{{config_root}}/.mise/scripts/link-agentfiles.sh'";
 var OP_INJECT_SCRIPT = "op inject -i .env.op > .env";
+var SYNC_SKILLS_SCRIPT = "sync-skills.py --scope project";
 var CODEGRAPH_SCRIPT = "[ -f '{{config_root}}/.mise/scripts/codegraph.sh' ] && '{{config_root}}/.mise/scripts/codegraph.sh' || true";
+var SKILLS_REGISTRY_URL = "https://github.com/delorenj/skillex.git";
 var HOOKS_COMMENT_HEADER = `# This block will handle the linking of
 # agent files to the main AGENTS.md file.
 #
 # TODO: Ensure this works for all levels of nesting.
 # i.e. All linked agent files MUST be siblings at
 # any given level of nesting.`;
-var LINK_AGENTFILES_HOOK_ENTRIES = [LINK_AGENTFILES_SCRIPT, OP_INJECT_SCRIPT];
+var LINK_AGENTFILES_HOOK_ENTRIES = [LINK_AGENTFILES_SCRIPT, OP_INJECT_SCRIPT, SYNC_SKILLS_SCRIPT];
 var LINK_AGENTFILES_WATCH_TASK_BLOCK = `[[watch_files]]
 patterns = ["AGENTS.md"]
 task = "link-agentfiles"
 
+[[watch_files]]
+patterns = [".agents/skills.json"]
+task = "skills-sync"
+
 [tasks.link-agentfiles]
 description = "Symlink all agent files to AGENTS.md"
-run = "'{{config_root}}/.mise/scripts/link-agentfiles.sh'"`;
+run = "'{{config_root}}/.mise/scripts/link-agentfiles.sh'"
+
+[tasks.skills-sync]
+description = "Sync skills from manifest to local CLI dirs"
+run = "sync-skills.py --scope project"`;
 var VERSIONING_BLOCK = `# >>> mise-versioning >>>  (managed block \u2014 do not edit by hand; re-run init to update)
 [tasks."version"]
 description = "Print the current version (vX.Y.Z)"
@@ -2168,7 +2620,7 @@ run = "'{{config_root}}/.mise/scripts/versioning.sh' sync"
 function resolvePjanglerRoot2() {
   let dir = dirname6(fileURLToPath3(import.meta.url));
   while (dir !== dirname6(dir)) {
-    if (existsSync9(join11(dir, "package.json")) && existsSync9(join11(dir, "templates", "commonproject", "copier.yml"))) {
+    if (existsSync10(join13(dir, "package.json")) && existsSync10(join13(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
     dir = dirname6(dir);
@@ -2179,17 +2631,17 @@ function normalizeNewlines(value) {
   return value.replace(/\r\n/g, "\n");
 }
 function readText(path) {
-  return normalizeNewlines(readFileSync5(path, "utf8"));
+  return normalizeNewlines(readFileSync6(path, "utf8"));
 }
 function safeReadText(path) {
-  return existsSync9(path) ? readText(path) : null;
+  return existsSync10(path) ? readText(path) : null;
 }
 function ensureParent(path) {
   mkdirSync6(dirname6(path), { recursive: true });
 }
 function writeText(path, content) {
   ensureParent(path);
-  writeFileSync6(path, content);
+  writeFileSync7(path, content);
 }
 function tryParseJson(text3) {
   if (!text3) return null;
@@ -2206,7 +2658,7 @@ function titleCaseSlug(slug) {
   return slug.split(/[-_]/g).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 function readSymlinkTarget(path) {
-  if (!existsSync9(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
     return readlinkSync(path);
   } catch {
@@ -2214,7 +2666,7 @@ function readSymlinkTarget(path) {
   }
 }
 function ensureSymlink(path, target, dryRun) {
-  if (existsSync9(path)) {
+  if (existsSync10(path)) {
     const stat = lstatSync(path);
     if (stat.isSymbolicLink()) {
       const current = readSymlinkTarget(path);
@@ -2231,11 +2683,11 @@ function ensureSymlink(path, target, dryRun) {
   return { changed: true };
 }
 function bootstrapAgentsFile(repoRoot, dryRun) {
-  const agentsPath = join11(repoRoot, "AGENTS.md");
-  if (existsSync9(agentsPath)) return { changedFiles: [], details: [] };
+  const agentsPath = join13(repoRoot, "AGENTS.md");
+  if (existsSync10(agentsPath)) return { changedFiles: [], details: [] };
   for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-    const source = join11(repoRoot, file);
-    if (!existsSync9(source)) continue;
+    const source = join13(repoRoot, file);
+    if (!existsSync10(source)) continue;
     const stat = lstatSync(source);
     if (stat.isSymbolicLink()) continue;
     if (stat.isFile()) {
@@ -2244,8 +2696,8 @@ function bootstrapAgentsFile(repoRoot, dryRun) {
     }
     return { changedFiles: [], details: [], blocked: `${file} exists but is not a regular file; cannot promote to AGENTS.md` };
   }
-  const readmePath = join11(repoRoot, "README.md");
-  if (existsSync9(readmePath)) {
+  const readmePath = join13(repoRoot, "README.md");
+  if (existsSync10(readmePath)) {
     const stat = lstatSync(readmePath);
     if (!stat.isFile()) return { changedFiles: [], details: [], blocked: "README.md exists but is not a regular file; cannot copy to AGENTS.md" };
     if (!dryRun) copyFileSync(readmePath, agentsPath);
@@ -2284,12 +2736,12 @@ function yamlGet(text3, keyPath) {
   return "";
 }
 function discoverRoles(repoRoot) {
-  const rolesDir = join11(repoRoot, "agents", "hermes");
-  if (!existsSync9(rolesDir)) return [];
+  const rolesDir = join13(repoRoot, "agents", "hermes");
+  if (!existsSync10(rolesDir)) return [];
   return readdirSync2(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const roleDir = join11(rolesDir, entry.name);
-    const roleYamlPath = join11(roleDir, "role.yaml");
-    if (!existsSync9(roleYamlPath)) return null;
+    const roleDir = join13(rolesDir, entry.name);
+    const roleYamlPath = join13(roleDir, "role.yaml");
+    if (!existsSync10(roleYamlPath)) return null;
     const text3 = readText(roleYamlPath);
     const runtimeRepoRaw = yamlGet(text3, "runtime.github_repo");
     return {
@@ -2317,7 +2769,7 @@ function discoverRoles(repoRoot) {
   }).filter((value) => Boolean(value));
 }
 function registryPath(homeDir) {
-  return join11(homeDir, ".hermes", "agents-registry.yaml");
+  return join13(homeDir, ".hermes", "agents-registry.yaml");
 }
 function systemctlUser(args) {
   const result = spawnSync6("systemctl", ["--user", ...args], { encoding: "utf8" });
@@ -2328,8 +2780,8 @@ function systemctlUser(args) {
   };
 }
 function templateScript(ctx, name) {
-  const source = join11(ctx.pjanglerRoot, ".mise", "scripts", name);
-  return existsSync9(source) ? readText(source) : void 0;
+  const source = join13(ctx.pjanglerRoot, ".mise", "scripts", name);
+  return existsSync10(source) ? readText(source) : void 0;
 }
 function templateVersioningScript(ctx) {
   return templateScript(ctx, "versioning.sh");
@@ -2341,8 +2793,8 @@ function resolveAgentHooksLayer2(ctx) {
   const override = process.env.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  if (existsSync9(join11(ctx.repoRoot, ".agents", "hooks", "sync.py"))) return true;
-  return !existsSync9(join11(ctx.homeDir, ".agents", "hooks"));
+  if (existsSync10(join13(ctx.repoRoot, ".agents", "hooks", "sync.py"))) return true;
+  return !existsSync10(join13(ctx.homeDir, ".agents", "hooks"));
 }
 function evaluateMiseConditionals(template, agentHooksLayer) {
   const out = [];
@@ -2372,19 +2824,36 @@ function renderGeneratedProjectMiseToml(ctx, template) {
   return evaluateMiseConditionals(template, resolveAgentHooksLayer2(ctx)).replace(/\{%\s*raw\s*%\}([\s\S]*?)\{%\s*endraw\s*%\}/g, "$1").replace(/\{\{\s*project_name\s*\}\}/g, projectName);
 }
 function ensureMiseTomlFromTemplate(ctx, changedFiles) {
-  const targetPath = join11(ctx.repoRoot, "mise.toml");
-  if (existsSync9(targetPath)) return false;
-  const sourcePath = join11(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
-  if (!existsSync9(sourcePath)) return false;
+  const targetPath = join13(ctx.repoRoot, "mise.toml");
+  if (existsSync10(targetPath)) return false;
+  const sourcePath = join13(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
+  if (!existsSync10(sourcePath)) return false;
   changedFiles.push(targetPath);
   if (!ctx.dryRun) {
     writeText(targetPath, renderGeneratedProjectMiseToml(ctx, readText(sourcePath)));
   }
   return true;
 }
+function templateCommonProjectText(ctx, rel) {
+  const path = join13(ctx.pjanglerRoot, "templates", "commonproject", "template", rel);
+  return existsSync10(path) ? readText(path) : void 0;
+}
+function canonicalSkillsManifest() {
+  return `${JSON.stringify(
+    {
+      $schema: "https://raw.githubusercontent.com/skillex/schemas/main/skills.schema.json",
+      inherit_global: true,
+      registry: SKILLS_REGISTRY_URL,
+      skills: []
+    },
+    null,
+    2
+  )}
+`;
+}
 function templateVersionFilesConf(ctx, repoRoot) {
-  const packageJson = join11(repoRoot, "package.json");
-  return existsSync9(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
+  const packageJson = join13(repoRoot, "package.json");
+  return existsSync10(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
 }
 function replaceOrAppendManagedBlock(text3, startMarker, block, beforePattern) {
   if (startMarker.test(text3)) {
@@ -2408,7 +2877,7 @@ var CONDITIONAL_HERMES_PATHS = ["agents/hermes/pm/hermes", "agent/hermes/pm/herm
 function requiredMisePathEntries(ctx) {
   const required = [...BASE_MISE_PATH_ENTRIES];
   for (const candidate of CONDITIONAL_HERMES_PATHS) {
-    if (existsSync9(join11(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
+    if (existsSync10(join13(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
   }
   return required;
 }
@@ -2509,6 +2978,9 @@ function stripTomlStringsAndComments(line) {
 function isManagedHookEntry(value) {
   const trimmed = value.trim();
   if (trimmed === OP_INJECT_SCRIPT) return true;
+  if (trimmed === SYNC_SKILLS_SCRIPT) return true;
+  if (/link-project-skills-to-clis\.sh'?\s*$/.test(trimmed)) return true;
+  if (/unlink-project-skills-from-clis\.sh'?\s*$/.test(trimmed)) return true;
   return /link-agentfiles\.sh'?\s*$/.test(trimmed);
 }
 function normalizeHookScript(script) {
@@ -2611,12 +3083,17 @@ function upsertLinkAgentfilesHooks(text3) {
 function upsertLinkAgentfilesBlock(text3, ctx) {
   const withPath = upsertMisePath(text3, requiredMisePathEntries(ctx));
   let cleaned = removeTomlSection(withPath, /^\[tasks\.link-agentfiles\]$/, /link-agentfiles/, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.skills-sync\]$/, void 0, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.link-project-skills-to-clis\]$/, void 0, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.unlink-project-skills-from-clis\]$/, void 0, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.skills-relink\]$/, void 0, { includePrecedingComments: false });
   cleaned = removeTomlSection(cleaned, /^\[\[watch_files\]\]$/, /AGENTS\.md/, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[\[watch_files\]\]$/, /\.agents\/skills\.json/, { includePrecedingComments: false });
   cleaned = upsertLinkAgentfilesHooks(cleaned);
   return insertTomlBlockBeforeVersioning(cleaned, LINK_AGENTFILES_WATCH_TASK_BLOCK);
 }
 function readProjectJson(ctx) {
-  return tryParseJson(safeReadText(join11(ctx.repoRoot, ".project.json")));
+  return tryParseJson(safeReadText(join13(ctx.repoRoot, ".project.json")));
 }
 function boolSetting(value, fallback) {
   if (typeof value === "boolean") return value;
@@ -2691,12 +3168,12 @@ function canonicalProjectJson(ctx) {
   };
 }
 function projectJsonFinding(ctx) {
-  const projectPath = join11(ctx.repoRoot, ".project.json");
-  const planeJsonPath = join11(ctx.repoRoot, ".plane.json");
+  const projectPath = join13(ctx.repoRoot, ".project.json");
+  const planeJsonPath = join13(ctx.repoRoot, ".plane.json");
   const details = [];
   const data = readProjectJson(ctx);
   const roles = discoverRoles(ctx.repoRoot);
-  if (!existsSync9(projectPath)) {
+  if (!existsSync10(projectPath)) {
     return { id: "sot.project-json", title: "Canonical .project.json", status: "fail", summary: ".project.json missing", details: [], fixable: true };
   }
   if (!data) {
@@ -2731,7 +3208,7 @@ function projectJsonFinding(ctx) {
   for (const key of ["enabled", "grace_hours", "auto_review"]) {
     if (!(key in reconcile)) details.push(`automation.reconcile.${key} missing`);
   }
-  if (existsSync9(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
+  if (existsSync10(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
   return {
     id: "sot.project-json",
     title: "Canonical .project.json",
@@ -2812,17 +3289,17 @@ exec env HERMES_HOME="$HERMES_HOME" HERMES_FLEET_ENV="$FLEET_ENV"   HERMES_OAUTH
 `.replace(/\u0010/g, "$");
 }
 function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip) {
-  if (!existsSync9(sourceDir)) return;
+  if (!existsSync10(sourceDir)) return;
   mkdirSync6(targetDir, { recursive: true });
   for (const entry of readdirSync2(sourceDir, { withFileTypes: true })) {
-    const sourcePath = join11(sourceDir, entry.name);
+    const sourcePath = join13(sourceDir, entry.name);
     if (skip?.(sourcePath)) continue;
-    const targetPath = join11(targetDir, entry.name);
+    const targetPath = join13(targetDir, entry.name);
     if (entry.isDirectory()) {
       copyMissingRecursive(sourcePath, targetPath, changedFiles, dryRun, skip);
       continue;
     }
-    if (existsSync9(targetPath)) continue;
+    if (existsSync10(targetPath)) continue;
     changedFiles.push(targetPath);
     if (!dryRun) {
       ensureParent(targetPath);
@@ -2831,7 +3308,7 @@ function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip)
   }
 }
 function upsertSubmodule(repoRoot, role, changedFiles, dryRun) {
-  const gitmodulesPath = join11(repoRoot, ".gitmodules");
+  const gitmodulesPath = join13(repoRoot, ".gitmodules");
   const repoName = role.runtimeRepo || `agent-hm-${role.repo}-${role.role}`;
   const owner = role.runtimeOwner || "delorenj";
   const block = `[submodule "agents/hermes/${role.role}/runtime"]
@@ -2998,10 +3475,10 @@ function runBmadInstall(repoRoot) {
   return { ok: true };
 }
 function readInstalledBmadVersion(repoRoot) {
-  const raw = safeReadText(join11(repoRoot, "_bmad", "_config", "manifest.yaml"));
+  const raw = safeReadText(join13(repoRoot, "_bmad", "_config", "manifest.yaml"));
   if (!raw) return void 0;
   try {
-    const parsed = YAML2.parse(raw);
+    const parsed = YAML3.parse(raw);
     const version = parsed?.installation?.version;
     return typeof version === "string" && version.trim() ? version.trim() : void 0;
   } catch {
@@ -3009,8 +3486,8 @@ function readInstalledBmadVersion(repoRoot) {
   }
 }
 function bmadCachePath(homeDir) {
-  const cacheRoot = process.env.XDG_CACHE_HOME?.trim() || join11(homeDir, ".cache");
-  return join11(cacheRoot, "pjangler", "bmad-dist-tags.json");
+  const cacheRoot = process.env.XDG_CACHE_HOME?.trim() || join13(homeDir, ".cache");
+  return join13(cacheRoot, "pjangler", "bmad-dist-tags.json");
 }
 function readBmadDistTagsCache(homeDir) {
   const raw = safeReadText(bmadCachePath(homeDir));
@@ -3053,7 +3530,7 @@ function resolveBmadDistTags(homeDir) {
     try {
       const path = bmadCachePath(homeDir);
       mkdirSync6(dirname6(path), { recursive: true });
-      writeFileSync6(path, JSON.stringify({ fetchedAt: Date.now(), distTags: fetched }, null, 2));
+      writeFileSync7(path, JSON.stringify({ fetchedAt: Date.now(), distTags: fetched }, null, 2));
     } catch {
     }
     return { distTags: fetched, stale: false };
@@ -3098,14 +3575,14 @@ var RULES = [
     id: "mise.config-root",
     title: "mise config_root + AGENTS link hooks",
     audit: (ctx) => {
-      const misePath = join11(ctx.repoRoot, "mise.toml");
-      if (!existsSync9(misePath)) {
+      const misePath = join13(ctx.repoRoot, "mise.toml");
+      if (!existsSync10(misePath)) {
         return { id: "mise.config-root", title: "mise config_root + AGENTS link hooks", status: "fail", summary: "mise.toml missing", details: [], fixable: true };
       }
       const text3 = readText(misePath);
       const details = [];
-      const linkAgentfilesPath = join11(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
-      if (!existsSync9(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
+      const linkAgentfilesPath = join13(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      if (!existsSync10(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
       const pathValues = [...(text3.match(/^_\.path\s*=\s*\[([^\]]*)\]/m)?.[1] ?? "").matchAll(/"([^"]+)"/g)].map((match) => match[1]);
       const missingPathValues = requiredMisePathEntries(ctx).filter((value) => !pathValues.includes(value));
       if (missingPathValues.length) details.push(`[env]._.path should include ${missingPathValues.join(", ")}`);
@@ -3123,10 +3600,10 @@ var RULES = [
       };
     },
     migrate: (ctx, finding) => {
-      const path = join11(ctx.repoRoot, "mise.toml");
+      const path = join13(ctx.repoRoot, "mise.toml");
       const changedFiles = [];
       const details = [];
-      if (!existsSync9(path)) {
+      if (!existsSync10(path)) {
         if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
           return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
         }
@@ -3142,7 +3619,7 @@ var RULES = [
         if (!ctx.dryRun) writeText(path, next);
         text3 = next;
       }
-      const linkAgentfilesPath = join11(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      const linkAgentfilesPath = join13(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
       const expectedScript = templateLinkAgentfilesScript(ctx);
       if (expectedScript === void 0) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/link-agentfiles.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -3151,7 +3628,7 @@ var RULES = [
         changedFiles.push(linkAgentfilesPath);
         if (!ctx.dryRun) {
           writeText(linkAgentfilesPath, expectedScript);
-          chmodSync2(linkAgentfilesPath, 493);
+          chmodSync4(linkAgentfilesPath, 493);
         }
       }
       return {
@@ -3169,13 +3646,13 @@ var RULES = [
     title: "managed mise versioning block",
     audit: (ctx) => {
       const details = [];
-      const misePath = join11(ctx.repoRoot, "mise.toml");
-      const versioningPath = join11(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
-      const manifestPath = join11(ctx.repoRoot, ".mise", "version-files.conf");
+      const misePath = join13(ctx.repoRoot, "mise.toml");
+      const versioningPath = join13(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const manifestPath = join13(ctx.repoRoot, ".mise", "version-files.conf");
       const text3 = safeReadText(misePath);
       if (!text3?.includes("# >>> mise-versioning >>>")) details.push("mise versioning managed block missing");
-      if (!existsSync9(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
-      if (!existsSync9(manifestPath)) details.push(".mise/version-files.conf missing");
+      if (!existsSync10(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
+      if (!existsSync10(manifestPath)) details.push(".mise/version-files.conf missing");
       return {
         id: "mise.versioning",
         title: "managed mise versioning block",
@@ -3188,8 +3665,8 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const misePath = join11(ctx.repoRoot, "mise.toml");
-      if (!existsSync9(misePath)) {
+      const misePath = join13(ctx.repoRoot, "mise.toml");
+      if (!existsSync10(misePath)) {
         if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
           return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
         }
@@ -3213,7 +3690,7 @@ var RULES = [
         if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
         if (!ctx.dryRun) writeText(misePath, nextMise);
       }
-      const versioningPath = join11(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const versioningPath = join13(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
       const expectedScript = templateVersioningScript(ctx);
       if (expectedScript === void 0) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/versioning.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -3222,10 +3699,10 @@ var RULES = [
         changedFiles.push(versioningPath);
         if (!ctx.dryRun) {
           writeText(versioningPath, expectedScript);
-          chmodSync2(versioningPath, 493);
+          chmodSync4(versioningPath, 493);
         }
       }
-      const manifestPath = join11(ctx.repoRoot, ".mise", "version-files.conf");
+      const manifestPath = join13(ctx.repoRoot, ".mise", "version-files.conf");
       const expectedManifest = templateVersionFilesConf(ctx, ctx.repoRoot);
       if (safeReadText(manifestPath) !== expectedManifest) {
         changedFiles.push(manifestPath);
@@ -3241,13 +3718,125 @@ var RULES = [
       };
     }
   },
+  {
+    id: "skills.project-manifest",
+    title: "Skillex project skills manifest",
+    audit: (ctx) => {
+      const details = [];
+      const manifestPath = join13(ctx.repoRoot, ".agents", "skills.json");
+      const legacyDir = join13(ctx.repoRoot, ".agents", "skills");
+      const localExamplePath = join13(ctx.repoRoot, ".agents", "local.example.json");
+      const misePath = join13(ctx.repoRoot, "mise.toml");
+      let fixable = true;
+      const manifest = tryParseJson(safeReadText(manifestPath));
+      if (!manifest) {
+        details.push(".agents/skills.json missing or invalid JSON");
+      } else {
+        if (manifest.inherit_global !== true) details.push(".agents/skills.json should set inherit_global: true");
+        if (manifest.registry !== SKILLS_REGISTRY_URL) details.push(`.agents/skills.json should set registry to ${SKILLS_REGISTRY_URL}`);
+        if (!Array.isArray(manifest.skills)) details.push(".agents/skills.json should define a skills array");
+      }
+      if (existsSync10(legacyDir)) {
+        const entries = readdirSync2(legacyDir);
+        if (entries.length > 0) {
+          details.push(".agents/skills/ still contains legacy committed skills; map them into .agents/skills.json before migrating");
+          fixable = false;
+        } else {
+          details.push(".agents/skills/ legacy directory should be removed");
+        }
+      }
+      for (const rel of [".mise/scripts/link-project-skills-to-clis.sh", ".mise/scripts/unlink-project-skills-from-clis.sh"]) {
+        if (existsSync10(join13(ctx.repoRoot, rel))) details.push(`${rel} is a legacy symlink-era script and should be removed`);
+      }
+      const localExample = tryParseJson(safeReadText(localExamplePath));
+      if (localExample && Object.prototype.hasOwnProperty.call(localExample, "skills")) {
+        details.push(".agents/local.example.json still documents legacy skills overrides; drop the skills section");
+      }
+      const mise = safeReadText(misePath);
+      if (!mise?.includes(SYNC_SKILLS_SCRIPT)) details.push("mise.toml should run sync-skills.py --scope project on enter");
+      if (!mise?.includes('patterns = [".agents/skills.json"]')) details.push("mise.toml should watch .agents/skills.json");
+      if (!mise?.includes("[tasks.skills-sync]")) details.push("mise.toml should define a skills-sync task");
+      if (mise?.includes("link-project-skills-to-clis.sh") || mise?.includes("unlink-project-skills-from-clis.sh") || mise?.includes("[tasks.skills-relink]")) {
+        details.push("mise.toml still contains legacy skill-link wiring");
+      }
+      return {
+        id: "skills.project-manifest",
+        title: "Skillex project skills manifest",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "Skillex skills manifest parity verified" : `${details.length} Skillex migration issue(s) detected`,
+        details,
+        fixable
+      };
+    },
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      const details = [];
+      const manifestPath = join13(ctx.repoRoot, ".agents", "skills.json");
+      const legacyDir = join13(ctx.repoRoot, ".agents", "skills");
+      const localExamplePath = join13(ctx.repoRoot, ".agents", "local.example.json");
+      const misePath = join13(ctx.repoRoot, "mise.toml");
+      if (existsSync10(legacyDir)) {
+        const entries = readdirSync2(legacyDir);
+        if (entries.length > 0) {
+          return {
+            id: finding.id,
+            title: finding.title,
+            status: "blocked",
+            summary: "Legacy .agents/skills/ still contains committed skills; migrate them into .agents/skills.json manually first",
+            changedFiles,
+            details: entries.map((entry) => `.agents/skills/${entry}`)
+          };
+        }
+        changedFiles.push(legacyDir);
+        if (!ctx.dryRun) rmSync(legacyDir, { recursive: true, force: true });
+      }
+      const expectedManifest = canonicalSkillsManifest();
+      if (safeReadText(manifestPath) !== expectedManifest) {
+        changedFiles.push(manifestPath);
+        if (!ctx.dryRun) writeText(manifestPath, expectedManifest);
+        details.push("Wrote canonical .agents/skills.json manifest");
+      }
+      for (const rel of [".mise/scripts/link-project-skills-to-clis.sh", ".mise/scripts/unlink-project-skills-from-clis.sh"]) {
+        const path = join13(ctx.repoRoot, rel);
+        if (existsSync10(path)) {
+          changedFiles.push(path);
+          if (!ctx.dryRun) unlinkSync3(path);
+        }
+      }
+      const templateLocalExample = templateCommonProjectText(ctx, ".agents/local.example.json");
+      const currentLocalExample = safeReadText(localExamplePath);
+      if (templateLocalExample && currentLocalExample && currentLocalExample !== templateLocalExample) {
+        changedFiles.push(localExamplePath);
+        if (!ctx.dryRun) writeText(localExamplePath, templateLocalExample);
+      }
+      if (!existsSync10(misePath)) {
+        if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
+          return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details };
+        }
+      }
+      const currentMise = readText(misePath);
+      const nextMise = upsertLinkAgentfilesBlock(currentMise, ctx);
+      if (nextMise !== currentMise) {
+        if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
+        if (!ctx.dryRun) writeText(misePath, nextMise);
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "Skillex skills manifest contract normalized" : "No changes required",
+        changedFiles,
+        details
+      };
+    }
+  },
   {
     id: "sot.agent-symlinks",
     title: "AGENTS/CLAUDE/GEMINI symlink contract",
     audit: (ctx) => {
-      const agentsPath = join11(ctx.repoRoot, "AGENTS.md");
-      if (!existsSync9(agentsPath)) {
-        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync9(join11(ctx.repoRoot, file)));
+      const agentsPath = join13(ctx.repoRoot, "AGENTS.md");
+      if (!existsSync10(agentsPath)) {
+        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync10(join13(ctx.repoRoot, file)));
         if (fallbackSources.length === 0) {
           return { id: "sot.agent-symlinks", title: "AGENTS/CLAUDE/GEMINI symlink contract", status: "skip", summary: "AGENTS.md missing; symlink contract not applicable", details: [], fixable: false };
         }
@@ -3262,7 +3851,7 @@ var RULES = [
       }
       const details = [];
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join11(ctx.repoRoot, file);
+        const full = join13(ctx.repoRoot, file);
         const target = readSymlinkTarget(full);
         if (target !== "AGENTS.md") details.push(`${file} should be a symlink to AGENTS.md`);
       }
@@ -3286,7 +3875,7 @@ var RULES = [
         return { id: finding.id, title: finding.title, status: "blocked", summary: "AGENTS.md missing; cannot derive canonical agent file", changedFiles, details: [bootstrap.blocked] };
       }
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join11(ctx.repoRoot, file);
+        const full = join13(ctx.repoRoot, file);
         const result = ensureSymlink(full, "AGENTS.md", ctx.dryRun);
         if (result.blocked) blockedDetails.push(result.blocked);
         if (result.changed) changedFiles.push(full);
@@ -3308,7 +3897,7 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const path = join11(ctx.repoRoot, ".project.json");
+      const path = join13(ctx.repoRoot, ".project.json");
       const existing = readProjectJson(ctx) ?? {};
       const canonical = canonicalProjectJson(ctx);
       const merged = { ...existing, ...canonical };
@@ -3318,10 +3907,10 @@ var RULES = [
         changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, expected);
       }
-      const planeJson = join11(ctx.repoRoot, ".plane.json");
-      if (existsSync9(planeJson)) {
+      const planeJson = join13(ctx.repoRoot, ".plane.json");
+      if (existsSync10(planeJson)) {
         const backup = `${planeJson}.migrated-backup`;
-        if (existsSync9(backup)) {
+        if (existsSync10(backup)) {
           details.push(`cannot back up .plane.json because ${relative(ctx.repoRoot, backup)} already exists`);
         } else {
           changedFiles.push(backup);
@@ -3343,8 +3932,8 @@ var RULES = [
     title: ".env.op + gitignore secrets contract",
     audit: (ctx) => {
       const details = [];
-      const envOp = safeReadText(join11(ctx.repoRoot, ".env.op"));
-      const gitignore = safeReadText(join11(ctx.repoRoot, ".gitignore"));
+      const envOp = safeReadText(join13(ctx.repoRoot, ".env.op"));
+      const gitignore = safeReadText(join13(ctx.repoRoot, ".gitignore"));
       if (!envOp) {
         details.push(".env.op missing");
       } else {
@@ -3370,12 +3959,12 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const envOpPath = join11(ctx.repoRoot, ".env.op");
-      if (!existsSync9(envOpPath)) {
+      const envOpPath = join13(ctx.repoRoot, ".env.op");
+      if (!existsSync10(envOpPath)) {
         changedFiles.push(envOpPath);
-        if (!ctx.dryRun) writeText(envOpPath, readText(join11(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
+        if (!ctx.dryRun) writeText(envOpPath, readText(join13(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
       }
-      const gitignorePath = join11(ctx.repoRoot, ".gitignore");
+      const gitignorePath = join13(ctx.repoRoot, ".gitignore");
       const gitignore = safeReadText(gitignorePath) ?? "";
       const requiredBlock = `# Secrets \u2014 .env is materialized by \`op inject -i .env.op > .env\` on mise enter.
 # NEVER commit it. .env.op holds only 1Password references or safe literals and IS committed.
@@ -3402,7 +3991,7 @@ var RULES = [
     title: ".copier-answers.yml provenance + drift report",
     audit: (ctx) => {
       const details = [];
-      const path = join11(ctx.repoRoot, ".copier-answers.yml");
+      const path = join13(ctx.repoRoot, ".copier-answers.yml");
       const text3 = safeReadText(path);
       const project = readProjectJson(ctx);
       if (!text3) {
@@ -3433,12 +4022,12 @@ var RULES = [
       const changedFiles = [];
       const project = canonicalProjectJson(ctx);
       const text3 = `# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_src_path: ${join11(ctx.pjanglerRoot, "templates", "commonproject")}
+_src_path: ${join13(ctx.pjanglerRoot, "templates", "commonproject")}
 project_description: ${String(project.project_description)}
 project_name: ${String(project.project_name)}
 ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
 `;
-      const path = join11(ctx.repoRoot, ".copier-answers.yml");
+      const path = join13(ctx.repoRoot, ".copier-answers.yml");
       if (safeReadText(path) !== text3) {
         changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, text3);
@@ -3457,14 +4046,14 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
     id: "bmad.scaffold",
     title: "BMAD modules/docs scaffold",
     audit: (ctx) => {
-      const targetRoot = join11(ctx.repoRoot, "_bmad");
+      const targetRoot = join13(ctx.repoRoot, "_bmad");
       const sentinels = [
-        join11("core", "config.yaml"),
-        join11("config.toml"),
-        join11("_config", "manifest.yaml"),
-        join11("bmm", "config.yaml")
+        join13("core", "config.yaml"),
+        join13("config.toml"),
+        join13("_config", "manifest.yaml"),
+        join13("bmm", "config.yaml")
       ];
-      const missing = sentinels.filter((file) => !existsSync9(join11(targetRoot, file)));
+      const missing = sentinels.filter((file) => !existsSync10(join13(targetRoot, file)));
       return {
         id: "bmad.scaffold",
         title: "BMAD modules/docs scaffold",
@@ -3478,7 +4067,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       const changedFiles = [];
       if (ctx.dryRun) {
         for (const detail of finding.details) {
-          changedFiles.push(join11(ctx.repoRoot, detail));
+          changedFiles.push(join13(ctx.repoRoot, detail));
         }
         return {
           id: finding.id,
@@ -3503,8 +4092,8 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         };
       }
       for (const detail of finding.details) {
-        if (existsSync9(join11(ctx.repoRoot, detail))) {
-          changedFiles.push(join11(ctx.repoRoot, detail));
+        if (existsSync10(join13(ctx.repoRoot, detail))) {
+          changedFiles.push(join13(ctx.repoRoot, detail));
         }
       }
       return {
@@ -3527,7 +4116,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
           id: "bmad.version",
           title: "BMAD version currency",
           status: "skip",
-          summary: existsSync9(join11(ctx.repoRoot, "_bmad")) ? "BMAD installed but version manifest unreadable" : "No BMAD install present",
+          summary: existsSync10(join13(ctx.repoRoot, "_bmad")) ? "BMAD installed but version manifest unreadable" : "No BMAD install present",
           details: [],
           fixable: false
         };
@@ -3582,7 +4171,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       }
       const installed = readInstalledBmadVersion(ctx.repoRoot);
       const available = resolveBmadDistTags(ctx.homeDir)?.distTags?.[BMAD_TARGET_CHANNEL];
-      const manifestPath = join11(ctx.repoRoot, "_bmad", "_config", "manifest.yaml");
+      const manifestPath = join13(ctx.repoRoot, "_bmad", "_config", "manifest.yaml");
       if (ctx.dryRun) {
         return {
           id: finding.id,
@@ -3629,11 +4218,11 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       }
       const details = [];
       for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/70-systemd.sh", ".scripts/heartbeat.sh", ".scripts/checkpoint.sh", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md", "runtime/bloodbank-consumer.py"]) {
-        if (!existsSync9(join11(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join11(role.roleDir, rel))}`);
+        if (!existsSync10(join13(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join13(role.roleDir, rel))}`);
       }
-      const gitmodules = safeReadText(join11(ctx.repoRoot, ".gitmodules")) ?? "";
+      const gitmodules = safeReadText(join13(ctx.repoRoot, ".gitmodules")) ?? "";
       if (!gitmodules.includes(`agents/hermes/${role.role}/runtime`)) details.push(".gitmodules missing pm runtime submodule entry");
-      if (!profileMetaInheritsDefault(join11(role.roleDir, "runtime", "profile.yaml"))) {
+      if (!profileMetaInheritsDefault(join13(role.roleDir, "runtime", "profile.yaml"))) {
         details.push("runtime/profile.yaml missing inherited default config metadata");
       }
       const registry = safeReadText(registryPath(ctx.homeDir));
@@ -3654,21 +4243,21 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       if (!role) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "No pm role present", changedFiles, details: [] };
       }
-      const templateRoleDir = join11(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
-      writeIfDifferent(join11(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
-      writeIfDifferent(join11(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
-      writeIfDifferent(join11(role.roleDir, ".gitignore"), readText(join11(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
-      copyMissingRecursive(join11(templateRoleDir, ".runtime-scaffold"), join11(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join11(templateRoleDir, ".runtime-scaffold"), join11(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join11(templateRoleDir, ".scripts"), join11(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
-      const promptSource = join11(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
-      const promptTarget = join11(role.roleDir, ".scripts", "sentinel.prompt.md");
-      if (existsSync9(promptSource) && !existsSync9(promptTarget)) {
+      const templateRoleDir = join13(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
+      writeIfDifferent(join13(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
+      writeIfDifferent(join13(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
+      writeIfDifferent(join13(role.roleDir, ".gitignore"), readText(join13(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
+      copyMissingRecursive(join13(templateRoleDir, ".runtime-scaffold"), join13(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join13(templateRoleDir, ".runtime-scaffold"), join13(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join13(templateRoleDir, ".scripts"), join13(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
+      const promptSource = join13(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
+      const promptTarget = join13(role.roleDir, ".scripts", "sentinel.prompt.md");
+      if (existsSync10(promptSource) && !existsSync10(promptTarget)) {
         const prompt = readText(promptSource).replace(/\{\{ agent_id \}\}/g, role.agentId).replace(/\{\{ role \}\}/g, role.role).replace(/\{\{ target_repo \}\}/g, role.repo).replace(/\{\{ display_name \}\}/g, role.displayName || role.agentId);
         writeIfDifferent(promptTarget, prompt, ctx.dryRun, changedFiles);
       }
       upsertSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
-      const profileMetaUpdated = upsertInheritedProfileMeta(join11(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
+      const profileMetaUpdated = upsertInheritedProfileMeta(join13(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
       if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
       const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
       if (registryUpdated) details.push(`updated ${registryUpdated}`);
@@ -3700,7 +4289,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       const details = [];
       for (const role of roles) {
         const roleRelDir = relative(ctx.repoRoot, role.roleDir);
-        const runtimeRelPath = join11(roleRelDir, "runtime");
+        const runtimeRelPath = join13(roleRelDir, "runtime");
         const lsResult = spawnSync6("git", ["ls-files", "--stage", runtimeRelPath], {
           cwd: ctx.repoRoot,
           encoding: "utf8"
@@ -3708,8 +4297,8 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         if (lsResult.status === 0 && lsResult.stdout.trim().length > 0) {
           details.push(`submodule runtime is tracked in Git index at ${runtimeRelPath}`);
         }
-        const gitignorePath = join11(role.roleDir, ".gitignore");
-        if (existsSync9(gitignorePath)) {
+        const gitignorePath = join13(role.roleDir, ".gitignore");
+        if (existsSync10(gitignorePath)) {
           const content = safeReadText(gitignorePath) ?? "";
           const lines = content.split(/\r?\n/).map((line) => line.trim());
           if (!lines.includes("runtime/") && !lines.includes("runtime")) {
@@ -3734,7 +4323,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       const details = [];
       for (const role of roles) {
         const roleRelDir = relative(ctx.repoRoot, role.roleDir);
-        const runtimeRelPath = join11(roleRelDir, "runtime");
+        const runtimeRelPath = join13(roleRelDir, "runtime");
         const lsResult = spawnSync6("git", ["ls-files", "--stage", runtimeRelPath], {
           cwd: ctx.repoRoot,
           encoding: "utf8"
@@ -3749,10 +4338,10 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
             });
           }
         }
-        const gitignorePath = join11(role.roleDir, ".gitignore");
+        const gitignorePath = join13(role.roleDir, ".gitignore");
         let content = "";
         let isIgnored = false;
-        if (existsSync9(gitignorePath)) {
+        if (existsSync10(gitignorePath)) {
           content = safeReadText(gitignorePath) ?? "";
           const lines = content.split(/\r?\n/).map((line) => line.trim());
           isIgnored = lines.includes("runtime/") || lines.includes("runtime");
@@ -3819,9 +4408,9 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         return { id: finding.id, title: finding.title, status: "blocked", summary: "systemd --user unavailable on this host", changedFiles, details };
       }
       for (const role of roles) {
-        const sysDir = join11(ctx.homeDir, ".config", "systemd", "user");
+        const sysDir = join13(ctx.homeDir, ".config", "systemd", "user");
         const units = [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-heartbeat.timer`];
-        const allUnitsPresent = units.every((unit) => existsSync9(join11(sysDir, unit)));
+        const allUnitsPresent = units.every((unit) => existsSync10(join13(sysDir, unit)));
         if (allUnitsPresent) {
           if (ctx.dryRun) {
             details.push(`would run: systemctl --user enable --now ${units.join(" ")}`);
@@ -3833,8 +4422,8 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
           }
           continue;
         }
-        for (const script of [join11(role.roleDir, ".scripts", "70-systemd.sh")]) {
-          if (!script || !existsSync9(script)) continue;
+        for (const script of [join13(role.roleDir, ".scripts", "70-systemd.sh")]) {
+          if (!script || !existsSync10(script)) continue;
           if (ctx.dryRun) {
             details.push(`would run: bash ${script}`);
           } else {
@@ -3861,7 +4450,7 @@ function writeIfDifferent(path, content, dryRun, changedFiles, mode) {
   changedFiles.push(path);
   if (!dryRun) {
     writeText(path, normalized);
-    if (mode) chmodSync2(path, mode);
+    if (mode) chmodSync4(path, mode);
   }
 }
 function getParityRuleIds() {
@@ -3973,15 +4562,15 @@ function formatMigrationReport(report) {
 }
 
 // src/utils/version.ts
-import { readFileSync as readFileSync6 } from "node:fs";
-import { dirname as dirname7, join as join12 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { dirname as dirname7, join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var PJANGLER_VERSION = (() => {
   try {
     let dir = dirname7(fileURLToPath4(import.meta.url));
     for (let i = 0; i < 4; i++) {
       try {
-        const raw = readFileSync6(join12(dir, "package.json"), "utf8");
+        const raw = readFileSync7(join14(dir, "package.json"), "utf8");
         return JSON.parse(raw).version ?? "0.0.0";
       } catch {
         const parent = dirname7(dir);
@@ -4024,9 +4613,9 @@ async function promptForRuleIds(rules) {
   return selected;
 }
 function readJson(path) {
-  if (!existsSync10(path)) return void 0;
+  if (!existsSync11(path)) return void 0;
   try {
-    const parsed = JSON.parse(readFileSync7(path, "utf8"));
+    const parsed = JSON.parse(readFileSync8(path, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
   } catch {
     return void 0;
@@ -4043,8 +4632,8 @@ function packageNameToProjectName(value) {
   return name.replace(/[-_]+/g, " ").replace(/\b\w/g, (letter) => letter.toUpperCase()).trim();
 }
 function deriveProjectDefaults(targetDir) {
-  const manifest = readJson(join13(targetDir, ".project.json"));
-  const pkg = readJson(join13(targetDir, "package.json"));
+  const manifest = readJson(join15(targetDir, ".project.json"));
+  const pkg = readJson(join15(targetDir, "package.json"));
   const name = String(manifest?.project_name ?? "").trim() || packageNameToProjectName(typeof pkg?.name === "string" ? pkg.name : void 0) || packageNameToProjectName(basename4(targetDir)) || "Project";
   const ticketProvider = manifest?.ticket_provider && typeof manifest.ticket_provider === "object" ? manifest.ticket_provider : {};
   return {
@@ -4100,7 +4689,7 @@ function actionNeedsRun(plan, kind, syncMode) {
     if (!action || action.kind !== "project.write-manifest") return false;
     const next = `${JSON.stringify(action.manifest, null, 2)}
 `;
-    return !existsSync10(action.path) || readFileSync7(action.path, "utf8") !== next;
+    return !existsSync11(action.path) || readFileSync8(action.path, "utf8") !== next;
   }
   if (kind === "copier.copy.commonproject") return true;
   if (kind === "ticket-provider.create-or-link") return plan.actions.some((action) => action.kind === kind && action.enabled);
@@ -4155,7 +4744,7 @@ async function resolveProjectInitTarget(name, options) {
   if (!targetDir && interactive) {
     const defaultName = name ?? basename4(cwd);
     const promptedName = name ?? await promptTextValue("Project name", packageNameToProjectName(defaultName));
-    const defaultDir = join13(cwd, promptedName.replace(/[^A-Za-z0-9._-]/g, "") || promptedName.toLowerCase().replace(/[^a-z0-9]+/g, "-"));
+    const defaultDir = join15(cwd, promptedName.replace(/[^A-Za-z0-9._-]/g, "") || promptedName.toLowerCase().replace(/[^a-z0-9]+/g, "-"));
     targetDir = await promptTextValue("Project directory", defaultDir);
     name = promptedName;
   }
@@ -4163,7 +4752,7 @@ async function resolveProjectInitTarget(name, options) {
     if (!name) throw new Error("Project name or --target-dir is required when project init is not run inside a git repo");
     targetDir = resolve3(process.cwd(), name.replace(/[^A-Za-z0-9._-]/g, "") || name.toLowerCase().replace(/[^a-z0-9]+/g, "-"));
   }
-  const targetExists = existsSync10(targetDir);
+  const targetExists = existsSync11(targetDir);
   if (targetExists && !statSync2(targetDir).isDirectory()) throw new Error(`Target path is not a directory: ${targetDir}`);
   const targetGitRoot = targetExists ? findGitRoot(targetDir) : void 0;
   const syncMode = Boolean(targetGitRoot && resolve3(targetGitRoot) === resolve3(targetDir));
@@ -4298,7 +4887,7 @@ async function runProjectInit(name, options) {
       }
       return;
     }
-    const initResult = selectedPlan.actions.length ? executeProjectInitPlan(selectedPlan) : { ok: true, plan: selectedPlan, logs: [], errors: [], changedFiles: [] };
+    const initResult = selectedPlan.actions.length ? await executeProjectInitPlan(selectedPlan) : { ok: true, plan: selectedPlan, logs: [], errors: [], changedFiles: [] };
     const migrationReport = selection.selectedParityRules.length ? runMigrationForRules(selection.selectedParityRules, target.targetDir, false) : void 0;
     const migrationErrors = migrationReport?.results.filter((result2) => result2.status === "blocked").map((result2) => `${result2.id}: ${result2.summary}`) ?? [];
     const changedFiles = Array.from(/* @__PURE__ */ new Set([