@delorenj/pjangler 1.2.19 → 1.2.21

package/dist/mcp-server.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/mcp-server.ts
-import { existsSync as existsSync10, statSync as statSync2 } from "node:fs";
-import { basename as basename4, dirname as dirname8, join as join13, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync11, statSync as statSync2 } from "node:fs";
+import { basename as basename4, dirname as dirname8, join as join15, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -285,97 +285,284 @@ var AddMiseCodegraphScript = class extends Command {
       };
     }
     const content = `#!/usr/bin/env bash
-# Mise enter hook: ensure the CodeGraph CLI is available and initialize the
-# project index. If \`codegraph\` is not installed, this script installs it
-# non-interactively into the project-local .mise/bin directory and retries.
-#
-# This is intended to run from a mise enter hook so onboarding a new host is
-# fully automatic.
+# Auto-generated by pjangler
+
+REPO_ROOT="$(pwd)"
+PROJECT_NAME="$(basename "$REPO_ROOT")"
+CONTAINER_NAME="codegraph-mcp-$PROJECT_NAME"
+CACHE_DIR="$REPO_ROOT/.codegraph"
+
+# Deterministically generate a port based on the repository path
+PORT=$(echo -n "$REPO_ROOT" | md5sum | awk '{print $1}' | tr -d 'a-f' | cut -c1-4)
+# Ensure port is > 1024
+PORT=$(( (PORT % 60000) + 1025 ))
+
+if ! docker ps --format '{{.Names}}' | grep -q "^$CONTAINER_NAME$"; then
+  echo "\u{1F680} Starting CodeGraph MCP Server on port $PORT..."
+  
+  # Ensure the container isn't lingering in a stopped state
+  docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+
+  # Run the true Colby McHenry CodeGraph Docker image
+  # which we built locally as colbymchenry-codegraph-mcp:latest
+  docker run -d \\
+    --name "$CONTAINER_NAME" \\
+    --restart unless-stopped \\
+    -p "$PORT:8045" \\
+    -v "$REPO_ROOT:/repo" \\
+    colbymchenry-codegraph-mcp:latest >/dev/null
+
+  echo "\u2705 CodeGraph MCP running in background. SSE URL: http://localhost:$PORT/sse"
+fi
+
+# Run init inside the container to ensure the index is bootstrapped.
+# We run this using the standard codegraph CLI inside the container
+docker exec "$CONTAINER_NAME" codegraph init -i /repo >/dev/null 2>&1 || true
+
+# Wire up the MCP server to local agents
+WIRE_SCRIPT="$(dirname "$0")/codegraph-wire.sh"
+if [ -x "$WIRE_SCRIPT" ]; then
+  "$WIRE_SCRIPT"
+fi
+`;
+    this.writeFile(filePath, content);
+    if (!this.context.dryRun) {
+      chmodSync(join2(this.context.targetDir, filePath), 493);
+    }
+    return {
+      success: true,
+      message: this.formatMessage(this.context.dryRun ? "Would create .mise/scripts/codegraph.sh" : "\u2705 Created .mise/scripts/codegraph.sh"),
+      filePath
+    };
+  }
+};
+
+// src/commands/AddMiseCodegraphWireScript.ts
+import { chmodSync as chmodSync2 } from "fs";
+import { join as join3 } from "path";
+var AddMiseCodegraphWireScript = class extends Command {
+  async invoke() {
+    const filePath = ".mise/scripts/codegraph-wire.sh";
+    if (this.fileExists(filePath) && !this.context.force) {
+      return {
+        success: false,
+        message: this.formatMessage("\u26A0\uFE0F  .mise/scripts/codegraph-wire.sh already exists"),
+        filePath
+      };
+    }
+    const content = `#!/usr/bin/env bash
+# Mise enter hook: Auto-wire CodeGraph MCP Server to local agents.
+# Detects Claude Code, Codex, Gemini, Kimi, and OpenCode and configures
+# them to use the local SSE endpoint for the current project.
 
 set -euo pipefail
 
 REPO_ROOT="\${MISE_PROJECT_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)}"
-PROJECT_BIN_DIR="$REPO_ROOT/.mise/bin"
-mkdir -p "$PROJECT_BIN_DIR"
 
-# Install the CodeGraph CLI into the project-local bin directory.
-install_codegraph() {
-  echo "[mise] codegraph not found. Installing non-interactively..."
-  export CODEGRAPH_BIN_DIR="$PROJECT_BIN_DIR"
-  curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh
+# Compute the same port as the container script
+PORT_HASH=$(echo -n "$REPO_ROOT" | md5sum | awk '{print $1}')
+PORT_DEC=$(printf "%d" "0x\${PORT_HASH:0:4}")
+PORT=$(( 8045 + (PORT_DEC % 955) ))
 
-  if [ -x "$PROJECT_BIN_DIR/codegraph" ]; then
-    export PATH="$PROJECT_BIN_DIR:$PATH"
-  else
-    echo "[mise] codegraph install did not place a binary at $PROJECT_BIN_DIR/codegraph" >&2
-    return 1
+SSE_URL="http://localhost:$PORT/sse"
+
+inject_sse() {
+  local target="$1"
+  local agent="$2"
+  
+  if [ ! -f "$target" ]; then
+    mkdir -p "$(dirname "$target")"
+    echo '{"mcpServers": {}}' > "$target"
+  fi
+  
+  # Ensure the file is valid JSON (fail gracefully if it's garbled)
+  if ! jq . "$target" >/dev/null 2>&1; then
+    echo "[mise] WARNING: $target is not valid JSON, skipping $agent wiring" >&2
+    return
   fi
+
+  # Inject or update the codegraph server
+  jq --arg url "$SSE_URL" '.mcpServers.codegraph = {"type": "sse", "url": $url}' "$target" > "$target.tmp" && mv "$target.tmp" "$target"
+  echo "[mise] Wired CodeGraph SSE for $agent -> $target"
 }
 
-# Ensure a codegraph binary is available on PATH.
-ensure_codegraph() {
-  if command -v codegraph >/dev/null 2>&1; then
-    return 0
-  fi
+# 1. Claude Code (Project-scoped)
+inject_sse "$REPO_ROOT/.claude.json" "Claude Code"
 
-  # Check the project-local bin dir first (previous install from this hook).
-  if [ -x "$PROJECT_BIN_DIR/codegraph" ]; then
-    export PATH="$PROJECT_BIN_DIR:$PATH"
-    return 0
-  fi
+# 2. Codex (Global)
+inject_sse "$HOME/.codex/mcp.json" "Codex"
 
-  # Check typical user-level install locations before fetching anything.
-  for d in "$HOME/.local/bin" "$HOME/.codegraph/current/bin"; do
-    if [ -x "$d/codegraph" ]; then
-      export PATH="$d:$PATH"
-      return 0
-    fi
-  done
+# 3. Gemini (Global)
+inject_sse "$HOME/.gemini/config/mcp.json" "Gemini"
 
-  install_codegraph
-}
+# 4. Kimi (Global)
+inject_sse "$HOME/.kimi-code/mcp.json" "Kimi"
 
-# Attempt to initialize the project graph. If the command is missing, install
-# it and retry once.
-init_project() {
-  local err_file
-  err_file="$(mktemp)"
-  trap 'rm -f "$err_file"' RETURN
+# 5. OpenCode (Global)
+inject_sse "$HOME/.opencode/mcp.json" "OpenCode"
 
-  if codegraph init -i "$REPO_ROOT" 2>"$err_file"; then
-    return 0
-  fi
+# 6. Cursor (Global)
+inject_sse "$HOME/.cursor/mcp.json" "Cursor"
 
-  # If the failure looks like a missing binary, install and retry.
-  if grep -qiE 'command not found|not installed|No such file|executable file not found' "$err_file" 2>/dev/null; then
-    ensure_codegraph
-    codegraph init -i "$REPO_ROOT"
-    return 0
-  fi
+# 7. VSCode native MCP (Global)
+inject_sse "$HOME/.vscode/mcp.json" "VSCode"
 
-  cat "$err_file" >&2
-  return 1
-}
+# 8. Cline (VSCode extension)
+inject_sse "$HOME/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json" "Cline"
 
-init_project
+# 9. Roo (VSCode extension)
+inject_sse "$HOME/.config/Code/User/globalStorage/rooveterinaryinc.roo-cline/settings/mcp_settings.json" "Roo Code"
 `;
     this.writeFile(filePath, content);
     if (!this.context.dryRun) {
-      chmodSync(join2(this.context.targetDir, filePath), 493);
+      chmodSync2(join3(this.context.targetDir, filePath), 493);
     }
     return {
       success: true,
-      message: this.formatMessage(this.context.dryRun ? "Would create .mise/scripts/codegraph.sh" : "\u2705 Created .mise/scripts/codegraph.sh"),
+      message: this.formatMessage(this.context.dryRun ? "Would create .mise/scripts/codegraph-wire.sh" : "\u2705 Created .mise/scripts/codegraph-wire.sh"),
       filePath
     };
   }
 };
 
+// src/commands/WireMiseOpInject.ts
+import { join as join4 } from "node:path";
+import { existsSync as existsSync2, readFileSync, writeFileSync as writeFileSync2, chmodSync as chmodSync3 } from "node:fs";
+var WireMiseOpInject = class _WireMiseOpInject extends Command {
+  static MARKER = "# pjangler:op-inject";
+  static CR = "{{config_root}}";
+  async invoke() {
+    const scriptPath = ".mise/scripts/inject-op-secrets.sh";
+    const fullScriptPath = join4(this.context.targetDir, scriptPath);
+    const scriptContent = `#!/usr/bin/env bash
+# Resolve 1Password \`op://\` references in .env.op into .env.secrets, which mise
+# loads via \`_.file\`.
+#
+# Runs from the mise enter hook: fail-open and non-interactive.
+# No .env.op means no 1Password, so this exits before spending anything.
+
+set -euo pipefail
+
+REPO_ROOT="\${MISE_PROJECT_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)}"
+SRC="$REPO_ROOT/.env.op"
+OUT="$REPO_ROOT/.env.secrets"
+
+TTL_HOURS="\${OP_INJECT_TTL_HOURS:-12}"
+
+[[ -f "$SRC" ]] || exit 0
+command -v op >/dev/null 2>&1 || exit 0
+
+if [[ -f "$OUT" && "$SRC" -ot "$OUT" ]]; then
+  if [[ "$TTL_HOURS" != "0" ]] && [[ -z "$(find "$OUT" -mmin "+$((TTL_HOURS * 60))" 2>/dev/null)" ]]; then
+    exit 0
+  fi
+fi
+
+op account list >/dev/null 2>&1 || exit 0
+
+tmp="$(mktemp "\${OUT}.XXXXXX")"
+trap 'rm -f "$tmp"' EXIT
+chmod 600 "$tmp"
+
+if op inject -i "$SRC" -o "$tmp" --force >/dev/null 2>&1; then
+  mv "$tmp" "$OUT"
+  trap - EXIT
+else
+  echo "mise: op inject from .env.op failed \u2014 $(basename "$OUT") unchanged." >&2
+  echo "      Check 'op signin', or that .env.op's op:// items are readable." >&2
+  echo "      To disable: rm .env.op" >&2
+fi
+`;
+    this.writeFile(scriptPath, scriptContent);
+    if (!this.context.dryRun) {
+      chmodSync3(fullScriptPath, 493);
+    }
+    const misePath = join4(this.context.targetDir, "mise.toml");
+    if (!existsSync2(misePath)) {
+      return {
+        success: false,
+        message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pj init mise` first, then re-run."
+      };
+    }
+    let content = readFileSync(misePath, "utf8");
+    if (content.includes(_WireMiseOpInject.MARKER)) {
+      return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for op-inject") };
+    }
+    const cr = _WireMiseOpInject.CR;
+    const envRe = /\[env\]\s*\n([\s\S]*?(?=\n\[|$))/;
+    if (envRe.test(content)) {
+      content = content.replace(envRe, (m) => {
+        let block = m;
+        if (!block.includes("_.file")) {
+          block += `
+_.file = ['.env', '.env.secrets']
+`;
+        } else if (!block.includes(".env.secrets")) {
+          block = block.replace(/(_\.file\s*=\s*\[)([^\]]*?)(\])/, (m2, prefix, files, suffix) => {
+            const added = files.trim() ? `${files}, '.env.secrets'` : `'.env.secrets'`;
+            return `${prefix}${added}${suffix}`;
+          });
+        }
+        return block;
+      });
+    } else {
+      const envBlock = `[env]
+_.file = ['.env', '.env.secrets']
+
+`;
+      if (content.includes("[tools]")) {
+        content = content.replace(/(\[tools\][\s\S]*?(?=\n\[|$))/, `$1
+${envBlock}`);
+      } else {
+        content = envBlock + content;
+      }
+    }
+    const enterAdds = `  '${cr}/.mise/scripts/inject-op-secrets.sh',`;
+    const enterRe = /(enter\s*=\s*\[[\s\S]*?)(\n[ \t]*\])/;
+    if (enterRe.test(content)) {
+      content = content.replace(enterRe, (_m, head, close) => {
+        const sep = /[,[]\s*$/.test(head) ? "" : ",";
+        return `${head}${sep}
+${enterAdds}${close}`;
+      });
+    } else {
+      if (content.includes("[hooks]")) {
+        content = content.replace(/\[hooks\]/, `[hooks]
+enter = [
+${enterAdds}
+]`);
+      } else {
+        content += `
+[hooks]
+enter = [
+${enterAdds}
+]
+`;
+      }
+    }
+    const appended = [
+      "",
+      _WireMiseOpInject.MARKER,
+      "[tasks.secrets-inject]",
+      'description = "Re-resolve .env.op secrets from 1Password into .env.secrets"',
+      `run = "OP_INJECT_TTL_HOURS=0 .mise/scripts/inject-op-secrets.sh"`,
+      _WireMiseOpInject.MARKER + ":end",
+      ""
+    ].join("\n");
+    content = content.replace(/\n*$/, "\n") + appended;
+    if (!this.context.dryRun) writeFileSync2(misePath, content);
+    return {
+      success: true,
+      message: this.formatMessage("\u2705 Wired mise.toml for op-inject (_.file, [hooks] enter, tasks.secrets-inject)")
+    };
+  }
+};
+
 // src/recipes/MiseRecipe.ts
 var MiseRecipe = class extends Recipe {
   constructor(context) {
     super(context);
-    this.addIngredient(AddMiseToml).addIngredient(AddDotenv).addIngredient(AddMiseTasksStructure).addIngredient(AddMiseBaseToml).addIngredient(AddMiseBaseScript).addIngredient(AddMiseCodegraphScript);
+    this.addIngredient(AddMiseToml).addIngredient(AddDotenv).addIngredient(AddMiseTasksStructure).addIngredient(AddMiseBaseToml).addIngredient(AddMiseBaseScript).addIngredient(AddMiseCodegraphScript).addIngredient(AddMiseCodegraphWireScript).addIngredient(WireMiseOpInject);
   }
   printNextSteps() {
     console.log("\u{1F389} Mise subsystem initialized successfully!");
@@ -604,34 +791,34 @@ var NodeRecipe = class extends Recipe {
 
 // src/commands/hermes/EnsureTemplateConfig.ts
 import { homedir, platform } from "node:os";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join3, dirname as dirname2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join5, dirname as dirname2 } from "node:path";
 function resolveTemplateConfigPath() {
   const fromEnv = process.env.HERMES_TEMPLATE_CONFIG;
   if (fromEnv && fromEnv.trim()) return fromEnv.trim();
   const xdg = process.env.XDG_CONFIG_HOME?.trim();
-  const base = xdg && xdg.length ? xdg : join3(homedir(), ".config");
-  return join3(base, "hermes-agent-template", "config.toml");
+  const base = xdg && xdg.length ? xdg : join5(homedir(), ".config");
+  return join5(base, "hermes-agent-template", "config.toml");
 }
 function detectHermesBin(home) {
   const candidates = [
-    join3(home, "code", "hermes-agent", "venv", "bin", "hermes"),
-    join3(home, "code", "hermes-agent", ".venv", "bin", "hermes"),
-    join3(home, ".local", "bin", "hermes")
+    join5(home, "code", "hermes-agent", "venv", "bin", "hermes"),
+    join5(home, "code", "hermes-agent", ".venv", "bin", "hermes"),
+    join5(home, ".local", "bin", "hermes")
   ];
   for (const c of candidates) {
-    if (existsSync2(c)) return c;
+    if (existsSync3(c)) return c;
   }
   return candidates[0];
 }
 function renderHostConfig() {
   const home = homedir();
   const hermesBin = detectHermesBin(home);
-  const hermesRepo = join3(home, "code", "hermes-agent");
-  const scaffoldDir = join3(home, "code", "hermes-agent-template", "runtime-scaffold");
-  const skillsDir = join3(home, ".agents", "skills");
-  const pmExternalSkillGlobalDir = join3(home, "code", "skillex", "skill-sets", "global", ".system");
-  const pmExternalSkillBmadDir = join3(home, "code", "skillex", "packs", "bmad", "6.10.2");
+  const hermesRepo = join5(home, "code", "hermes-agent");
+  const scaffoldDir = join5(home, "code", "hermes-agent-template", "runtime-scaffold");
+  const skillsDir = join5(home, ".agents", "skills");
+  const pmExternalSkillGlobalDir = join5(home, "code", "skillex", "skill-sets", "global", ".system");
+  const pmExternalSkillBmadDir = join5(home, "code", "skillex", "packs", "bmad", "6.10.2");
   return `# hermes-agent-template \u2014 host configuration
 # Bootstrapped by \`pjangler config bootstrap\` for $HOME=${home} (platform=${platform()}).
 #
@@ -680,7 +867,7 @@ var EnsureTemplateConfig = class extends Command {
     const ctx = this.context;
     const force = ctx.forceConfig === true || process.env.PJANGLER_FORCE_CONFIG === "1";
     const path = resolveTemplateConfigPath();
-    const exists = existsSync2(path);
+    const exists = existsSync3(path);
     if (exists && !force) {
       console.log(`\u2713 Config present: ${path}`);
       return { success: true, message: "" };
@@ -691,7 +878,7 @@ var EnsureTemplateConfig = class extends Command {
     }
     try {
       mkdirSync2(dirname2(path), { recursive: true });
-      writeFileSync2(path, renderHostConfig());
+      writeFileSync3(path, renderHostConfig());
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       return { success: false, message: `\u2717 Failed to write ${path}: ${msg}` };
@@ -703,8 +890,8 @@ var EnsureTemplateConfig = class extends Command {
 };
 
 // src/commands/hermes/PromptForAgentConfig.ts
-import { basename, join as join4 } from "node:path";
-import { readFileSync } from "node:fs";
+import { basename, join as join6 } from "node:path";
+import { readFileSync as readFileSync2 } from "node:fs";
 import * as p from "@clack/prompts";
 
 // src/commands/hermes/types.ts
@@ -719,7 +906,7 @@ function deriveProfileName(repo, role) {
 // src/commands/hermes/PromptForAgentConfig.ts
 function detectTicketProvider(targetDir) {
   try {
-    const t = JSON.parse(readFileSync(join4(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
+    const t = JSON.parse(readFileSync2(join6(targetDir, ".project.json"), "utf8"))?.ticket_provider?.type;
     return t === "plane" || t === "trello" ? t : void 0;
   } catch {
     return void 0;
@@ -777,8 +964,8 @@ var PromptForAgentConfig = class extends Command {
 // src/commands/hermes/RunCopierTemplate.ts
 import { spawnSync } from "node:child_process";
 import { homedir as homedir2 } from "node:os";
-import { join as join5, dirname as dirname3 } from "node:path";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join7, dirname as dirname3 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3 } from "node:fs";
 import { fileURLToPath } from "node:url";
 import * as p2 from "@clack/prompts";
 function resolveVendoredTemplate(name) {
@@ -789,8 +976,8 @@ function resolveVendoredTemplate(name) {
     return void 0;
   }
   for (let i = 0; i < 8; i++) {
-    const candidate = join5(dir, "templates", name);
-    if (existsSync3(join5(candidate, "copier.yml"))) return candidate;
+    const candidate = join7(dir, "templates", name);
+    if (existsSync4(join7(candidate, "copier.yml"))) return candidate;
     const parent = dirname3(dir);
     if (parent === dir) break;
     dir = parent;
@@ -809,7 +996,7 @@ var RunCopierTemplate = class extends Command {
         message: "PromptForAgentConfig must run before RunCopierTemplate (targetRepo/role unset)"
       };
     }
-    const roleDir = join5(ctx.targetDir, "agents", "hermes", role);
+    const roleDir = join7(ctx.targetDir, "agents", "hermes", role);
     ctx.roleDir = roleDir;
     ctx.runtimeRepo = `delorenj/agent-hm-${targetRepo}-${role}`;
     const which = spawnSync("which", ["copier"], { encoding: "utf8" });
@@ -819,7 +1006,7 @@ var RunCopierTemplate = class extends Command {
         message: "\u2717 copier not found on PATH.  Install with: `uv tool install copier` or `pip install copier`"
       };
     }
-    if (existsSync3(join5(roleDir, "role.yaml")) && !ctx.force) {
+    if (existsSync4(join7(roleDir, "role.yaml")) && !ctx.force) {
       if (ctx.yes) {
         ctx.force = true;
       } else {
@@ -846,9 +1033,9 @@ var RunCopierTemplate = class extends Command {
       SKIP_BLOODBANK: ctx.skipBloodbank ? "1" : "0",
       SKIP_SYSTEMD: ctx.skipSystemd ? "1" : "0"
     };
-    const LOCAL_TEMPLATE = join5(homedir2(), "code", "hermes-agent-template");
+    const LOCAL_TEMPLATE = join7(homedir2(), "code", "hermes-agent-template");
     const vendored = resolveVendoredTemplate("hermes-agent");
-    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync3(join5(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
+    const templateSrc = process.env.PJANGLER_HERMES_TEMPLATE || vendored || (existsSync4(join7(LOCAL_TEMPLATE, "copier.yml")) ? LOCAL_TEMPLATE : HERMES_AGENT_TEMPLATE);
     const args = [
       "copy",
       templateSrc,
@@ -879,7 +1066,7 @@ var RunCopierTemplate = class extends Command {
         message: this.formatMessage(`Would run: copier ${args.join(" ")}`)
       };
     }
-    mkdirSync3(join5(ctx.targetDir, "agents", "hermes"), { recursive: true });
+    mkdirSync3(join7(ctx.targetDir, "agents", "hermes"), { recursive: true });
     const spinner4 = p2.spinner();
     spinner4.start(`Running copier copy  (target: agents/hermes/${role})`);
     const result = spawnSync("copier", args, {
@@ -903,14 +1090,14 @@ var RunCopierTemplate = class extends Command {
 };
 
 // src/commands/hermes/UntrackHermesRuntimes.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync3, readdirSync } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4, readdirSync } from "fs";
+import { join as join8 } from "path";
 import { spawnSync as spawnSync2 } from "node:child_process";
 var UntrackHermesRuntimes = class extends Command {
   async invoke() {
     const targetDir = this.context.targetDir;
-    const rolesDir = join6(targetDir, "agents", "hermes");
-    if (!existsSync4(rolesDir)) {
+    const rolesDir = join8(targetDir, "agents", "hermes");
+    if (!existsSync5(rolesDir)) {
       return {
         success: true,
         message: "No Hermes agents found (no agents/hermes directory)."
@@ -926,9 +1113,9 @@ var UntrackHermesRuntimes = class extends Command {
     let modifiedAny = false;
     const details = [];
     for (const role of roles) {
-      const roleDir = join6("agents", "hermes", role);
-      const runtimePath = join6(roleDir, "runtime");
-      const gitignorePath = join6(roleDir, ".gitignore");
+      const roleDir = join8("agents", "hermes", role);
+      const runtimePath = join8(roleDir, "runtime");
+      const gitignorePath = join8(roleDir, ".gitignore");
       let isTracked = false;
       const lsResult = spawnSync2("git", ["ls-files", "--stage", runtimePath], {
         cwd: targetDir,
@@ -938,9 +1125,9 @@ var UntrackHermesRuntimes = class extends Command {
         isTracked = true;
       }
       let isIgnored = false;
-      const fullGitignorePath = join6(targetDir, gitignorePath);
-      if (existsSync4(fullGitignorePath)) {
-        const content = readFileSync2(fullGitignorePath, "utf8");
+      const fullGitignorePath = join8(targetDir, gitignorePath);
+      if (existsSync5(fullGitignorePath)) {
+        const content = readFileSync3(fullGitignorePath, "utf8");
         const lines = content.split(/\r?\n/).map((line) => line.trim());
         isIgnored = lines.includes("runtime/") || lines.includes("runtime");
       }
@@ -965,14 +1152,14 @@ var UntrackHermesRuntimes = class extends Command {
           details.push(`ignore runtime/ in agents/hermes/${role}/.gitignore`);
           if (!this.context.dryRun) {
             let content = "";
-            if (existsSync4(fullGitignorePath)) {
-              content = readFileSync2(fullGitignorePath, "utf8");
+            if (existsSync5(fullGitignorePath)) {
+              content = readFileSync3(fullGitignorePath, "utf8");
             }
             if (content && !content.endsWith("\n")) {
               content += "\n";
             }
             content += "runtime/\n";
-            writeFileSync3(fullGitignorePath, content, "utf8");
+            writeFileSync4(fullGitignorePath, content, "utf8");
           }
         }
       }
@@ -994,8 +1181,8 @@ ${details.map((d) => `  - ${d}`).join("\n")}`
 
 // src/commands/hermes/WireTelegram.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { join as join7 } from "node:path";
-import { existsSync as existsSync5, unlinkSync } from "node:fs";
+import { join as join9 } from "node:path";
+import { existsSync as existsSync6, unlinkSync } from "node:fs";
 import * as p3 from "@clack/prompts";
 var WireTelegram = class extends Command {
   async invoke() {
@@ -1083,15 +1270,15 @@ var WireTelegram = class extends Command {
     if (p3.isCancel(allowedAnswer)) {
       return { success: false, message: "\u2717 Aborted; Telegram step deferred." };
     }
-    const script = join7(roleDir, ".scripts", "30-telegram.sh");
-    if (!existsSync5(script)) {
+    const script = join9(roleDir, ".scripts", "30-telegram.sh");
+    if (!existsSync6(script)) {
       return {
         success: false,
         message: `\u2717 ${script} not found.  Did copier finish?  Re-run with --skip-runtime-repo=0 if you skipped it.`
       };
     }
-    const marker = join7(roleDir, ".scripts", ".done-30-telegram");
-    if (existsSync5(marker)) unlinkSync(marker);
+    const marker = join9(roleDir, ".scripts", ".done-30-telegram");
+    if (existsSync6(marker)) unlinkSync(marker);
     const spinner4 = p3.spinner();
     spinner4.start("Verifying token + wiring profile");
     const result = spawnSync3("bash", [script], {
@@ -1118,8 +1305,8 @@ function cap(s) {
 
 // src/commands/hermes/WireEmail.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { join as join8 } from "node:path";
-import { existsSync as existsSync6, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join10 } from "node:path";
+import { existsSync as existsSync7, unlinkSync as unlinkSync2 } from "node:fs";
 import * as p4 from "@clack/prompts";
 var WireEmail = class extends Command {
   async invoke() {
@@ -1134,8 +1321,8 @@ var WireEmail = class extends Command {
     if (!targetRepo || !role || !roleDir) {
       return { success: false, message: "Cannot wire email: missing target_repo/role/roleDir" };
     }
-    const script = join8(roleDir, ".scripts", "50-email.sh");
-    if (!existsSync6(script)) {
+    const script = join10(roleDir, ".scripts", "50-email.sh");
+    if (!existsSync7(script)) {
       return { success: false, message: `\u2717 ${script} not found` };
     }
     let token = process.env.CF_EMAIL_ROUTING_TOKEN;
@@ -1197,8 +1384,8 @@ var WireEmail = class extends Command {
         }
       }
     }
-    const marker = join8(roleDir, ".scripts", ".done-50-email");
-    if (existsSync6(marker)) unlinkSync2(marker);
+    const marker = join10(roleDir, ".scripts", ".done-50-email");
+    if (existsSync7(marker)) unlinkSync2(marker);
     const spinner4 = p4.spinner();
     spinner4.start("Creating Cloudflare Email Routing rule");
     const result = spawnSync4("bash", [script], {
@@ -1285,15 +1472,15 @@ var HermesAgentRecipe = class extends Recipe {
 
 // src/commands/AgentHooksCommands.ts
 import { homedir as homedir4 } from "node:os";
-import { join as join10, dirname as dirname5 } from "node:path";
-import { existsSync as existsSync8, cpSync, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join12, dirname as dirname5 } from "node:path";
+import { existsSync as existsSync9, cpSync, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/project/index.ts
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync3, renameSync, statSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync4, renameSync, statSync, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename as basename2, delimiter, dirname as dirname4, join as join9, resolve } from "node:path";
+import { basename as basename2, delimiter, dirname as dirname4, join as join11, resolve } from "node:path";
 import YAML2 from "yaml";
 
 // src/project/RegistryStore.ts
@@ -1528,18 +1715,18 @@ var PROJECT_SOURCE_SKILL_ROOTS_ENV = "PJ_SOURCE_SKILL_ROOTS";
 var PROJECT_REGISTRY_SCHEMA_VERSION = 1;
 var DEFAULT_SOURCE_SKILL_ROOTS = [
   "/home/delorenj/code/skillex/all-skills",
-  join9(homedir3(), ".agents", "skills"),
-  join9(homedir3(), ".codex", "skills")
+  join11(homedir3(), ".agents", "skills"),
+  join11(homedir3(), ".codex", "skills")
 ];
 function projectRegistryPath(env2 = process.env) {
-  return expandHome(env2[PROJECT_REGISTRY_ENV] || join9(homedir3(), ".config", "pjangler", "projects.yaml"));
+  return expandHome(env2[PROJECT_REGISTRY_ENV] || join11(homedir3(), ".config", "pjangler", "projects.yaml"));
 }
 function emptyProjectRegistry() {
   return { schema_version: PROJECT_REGISTRY_SCHEMA_VERSION, projects: {} };
 }
 function loadProjectRegistry(path = projectRegistryPath()) {
-  if (!existsSync7(path)) return emptyProjectRegistry();
-  const raw = YAML2.parse(readFileSync3(path, "utf8"));
+  if (!existsSync8(path)) return emptyProjectRegistry();
+  const raw = YAML2.parse(readFileSync4(path, "utf8"));
   if (raw == null) return emptyProjectRegistry();
   if (!isRecord(raw)) throw new Error(`Project registry must be a mapping: ${path}`);
   const registry = raw;
@@ -1554,7 +1741,7 @@ function saveProjectRegistry(registry, path = projectRegistryPath()) {
   validateProjectRegistry(registry);
   mkdirSync4(dirname4(path), { recursive: true });
   const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync4(temp, YAML2.stringify(registry, { lineWidth: 0 }), "utf8");
+  writeFileSync5(temp, YAML2.stringify(registry, { lineWidth: 0 }), "utf8");
   renameSync(temp, path);
 }
 function validateProjectRegistry(registry) {
@@ -1636,7 +1823,7 @@ function resolveAgentHooksLayer(input, env2 = process.env) {
   const override = env2.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  return !existsSync7(join9(homedir3(), ".agents", "hooks"));
+  return !existsSync8(join11(homedir3(), ".agents", "hooks"));
 }
 function jsonStable(value) {
   return JSON.stringify(value);
@@ -1667,12 +1854,12 @@ function resolveSourceSkillPath(sourceSkill, env2 = process.env) {
   if (!sourceSkill) return void 0;
   const expanded = expandHome(sourceSkill);
   const direct = resolve(expanded);
-  if (existsSync7(direct)) return direct;
+  if (existsSync8(direct)) return direct;
   const name = basename2(sourceSkill);
   const roots = sourceSkillRoots(env2);
   for (const root of roots) {
-    const candidate = join9(root, name);
-    if (existsSync7(candidate)) return candidate;
+    const candidate = join11(root, name);
+    if (existsSync8(candidate)) return candidate;
   }
   const searched = roots.length ? ` Searched roots: ${roots.join(", ")}.` : "";
   const hint = `${searched} Add project-specific roots with ${PROJECT_SOURCE_SKILL_ROOTS_ENV}.`;
@@ -1753,7 +1940,7 @@ function planProjectInit(input) {
     }));
   }
   actions.push(
-    { kind: "project.write-manifest", path: join9(targetDir, ".project.json"), manifest },
+    { kind: "project.write-manifest", path: join11(targetDir, ".project.json"), manifest },
     {
       kind: "ticket-provider.create-or-link",
       enabled: live,
@@ -1806,7 +1993,7 @@ async function executeProjectInitPlan(plan) {
       }
       if (result.status !== 0) {
         errors.push(`copier exited with status ${result.status ?? "unknown"}`);
-        if (existsSync7(action.targetDir)) changedFiles.push(action.targetDir);
+        if (existsSync8(action.targetDir)) changedFiles.push(action.targetDir);
         break;
       }
       changedFiles.push(action.targetDir);
@@ -1814,9 +2001,9 @@ async function executeProjectInitPlan(plan) {
       mkdirSync4(dirname4(action.path), { recursive: true });
       const next = `${JSON.stringify(action.manifest, null, 2)}
 `;
-      const current = existsSync7(action.path) ? readFileSync3(action.path, "utf8") : void 0;
+      const current = existsSync8(action.path) ? readFileSync4(action.path, "utf8") : void 0;
       if (current !== next) {
-        writeFileSync4(action.path, next, "utf8");
+        writeFileSync5(action.path, next, "utf8");
         changedFiles.push(action.path);
       }
     } else if (action.kind === "registry.upsert") {
@@ -1879,7 +2066,7 @@ function getProject(registry, slug) {
   return project;
 }
 function buildCommonProjectCopierAction(input) {
-  const templateDir = join9(input.pjanglerRoot, "templates", "commonproject");
+  const templateDir = join11(input.pjanglerRoot, "templates", "commonproject");
   const data = {
     project_name: input.projectName,
     project_description: input.projectDescription ?? "",
@@ -1908,7 +2095,7 @@ function buildCommonProjectCopierAction(input) {
 function resolvePjanglerRoot() {
   let dir = dirname4(new URL(import.meta.url).pathname);
   while (dir !== dirname4(dir)) {
-    if (existsSync7(join9(dir, "package.json")) && existsSync7(join9(dir, "templates", "commonproject", "copier.yml"))) return dir;
+    if (existsSync8(join11(dir, "package.json")) && existsSync8(join11(dir, "templates", "commonproject", "copier.yml"))) return dir;
     dir = dirname4(dir);
   }
   return resolve(process.cwd());
@@ -1940,7 +2127,7 @@ function validateProjectRecord(project, key) {
 }
 function expandHome(path) {
   if (path === "~") return homedir3();
-  if (path.startsWith("~/")) return join9(homedir3(), path.slice(2));
+  if (path.startsWith("~/")) return join11(homedir3(), path.slice(2));
   return path;
 }
 function isRecord(value) {
@@ -1957,16 +2144,16 @@ function resolveTemplateRoot() {
   try {
     let dir = dirname5(fileURLToPath2(import.meta.url));
     for (let i = 0; i < 8; i++) {
-      candidates.push(join10(dir, "templates", "commonproject", "template"));
+      candidates.push(join12(dir, "templates", "commonproject", "template"));
       const parent = dirname5(dir);
       if (parent === dir) break;
       dir = parent;
     }
   } catch {
   }
-  candidates.push(join10(homedir4(), "code", "pjangler", "templates", "commonproject", "template"));
+  candidates.push(join12(homedir4(), "code", "pjangler", "templates", "commonproject", "template"));
   for (const c of candidates) {
-    if (existsSync8(join10(c, ".agents", "hooks", "hooks.master.json"))) return c;
+    if (existsSync9(join12(c, ".agents", "hooks", "hooks.master.json"))) return c;
   }
   throw new Error(
     "Could not locate the CommonProject template. Set PJANGLER_COMMONPROJECT_TEMPLATE to <repo>/templates/commonproject/template."
@@ -1985,18 +2172,17 @@ var CopyAgentHooksTree = class extends Command {
     }
     const items = [
       { rel: ".agents/hooks", dir: true },
+      { rel: ".agents/skills.json", dir: false },
       { rel: ".agents/local.example.json", dir: false },
-      { rel: ".mise/scripts/link-project-skills-to-clis.sh", dir: false },
-      { rel: ".mise/scripts/unlink-project-skills-from-clis.sh", dir: false },
       { rel: ".mise/scripts/hindsight-setup.sh", dir: false }
     ];
     const created = [];
     const skipped = [];
     for (const { rel, dir } of items) {
-      const src = join10(templateRoot, rel);
-      const dest = join10(this.context.targetDir, rel);
-      if (!existsSync8(src)) continue;
-      if (existsSync8(dest) && !this.context.force) {
+      const src = join12(templateRoot, rel);
+      const dest = join12(this.context.targetDir, rel);
+      if (!existsSync9(src)) continue;
+      if (existsSync9(dest) && !this.context.force) {
         skipped.push(rel);
         continue;
       }
@@ -2022,25 +2208,21 @@ var WireMiseAgentHooks = class _WireMiseAgentHooks extends Command {
     if (!resolveAgentHooksLayer()) {
       return { success: true, message: this.formatMessage(AGENT_HOOKS_SKIP_MESSAGE) };
     }
-    const misePath = join10(this.context.targetDir, "mise.toml");
-    if (!existsSync8(misePath)) {
+    const misePath = join12(this.context.targetDir, "mise.toml");
+    if (!existsSync9(misePath)) {
       return {
         success: false,
         message: "\u26A0\uFE0F  No mise.toml found \u2014 run `pjangler init mise` first, then re-run."
       };
     }
-    let content = readFileSync4(misePath, "utf8");
+    let content = readFileSync5(misePath, "utf8");
     if (content.includes(_WireMiseAgentHooks.MARKER)) {
       return { success: true, message: this.formatMessage("\u2713 mise.toml already wired for agent-hooks") };
     }
     const cr = _WireMiseAgentHooks.CR;
-    const enterAdds = [
-      `  "${cr}/.mise/scripts/link-project-skills-to-clis.sh",`,
-      `  "${cr}/.agents/hooks/sync.py --install --quiet",`
-    ].join("\n");
+    const enterAdds = [`  "sync-skills.py --scope project",`, `  "${cr}/.agents/hooks/sync.py --install --quiet",`].join("\n");
     const leaveBlock = [
       "leave = [",
-      `  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",`,
       `  "${cr}/.agents/hooks/sync.py --uninstall --quiet",`,
       "]"
     ].join("\n");
@@ -2057,7 +2239,6 @@ ${enterAdds}${close}`;
         content = content.replace(leaveRe, (_m, head, close) => {
           const sep = /[,[]\s*$/.test(head) ? "" : ",";
           return `${head}${sep}
-  "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh",
   "${cr}/.agents/hooks/sync.py --uninstall --quiet",${close}`;
         });
       } else {
@@ -2070,6 +2251,14 @@ ${leaveBlock}`);
       "",
       _WireMiseAgentHooks.MARKER + " (generated \u2014 see .agents/hooks/README.md)",
       "[[watch_files]]",
+      'patterns = [".agents/skills.json"]',
+      'task = "skills-sync"',
+      "",
+      "[tasks.skills-sync]",
+      'description = "Sync skills from manifest to local CLI dirs"',
+      'run = "sync-skills.py --scope project"',
+      "",
+      "[[watch_files]]",
       'patterns = [".agents/hooks/hooks.master.json"]',
       'task = "hooks-sync"',
       "",
@@ -2085,18 +2274,6 @@ ${leaveBlock}`);
       'description = "Remove per-user agent-hook injections (codex/kimi/hermes)"',
       `run = "${cr}/.agents/hooks/sync.py --uninstall"`,
       "",
-      "[tasks.link-project-skills-to-clis]",
-      'description = "Fan .agents/skills out to each agent CLI (honors local.json)"',
-      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
-      "",
-      "[tasks.unlink-project-skills-from-clis]",
-      'description = "Remove project skill symlinks from shared per-CLI dirs"',
-      `run = "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh"`,
-      "",
-      "[tasks.skills-relink]",
-      'description = "Re-fan the project skill set to all CLIs"',
-      `run = "${cr}/.mise/scripts/link-project-skills-to-clis.sh"`,
-      "",
       "[tasks.hindsight-setup]",
       `description = "Provision this dev's shared project Hindsight key from 1Password into .env"`,
       `run = "${cr}/.mise/scripts/hindsight-setup.sh"`,
@@ -2105,7 +2282,7 @@ ${leaveBlock}`);
       ""
     ].join("\n");
     content = content.replace(/\n*$/, "\n") + appended;
-    if (!this.context.dryRun) writeFileSync5(misePath, content);
+    if (!this.context.dryRun) writeFileSync6(misePath, content);
     if (wiredHooks) {
       return { success: true, message: this.formatMessage("\u2705 Wired mise.toml ([hooks] enter/leave + tasks)") };
     }
@@ -2114,8 +2291,8 @@ ${leaveBlock}`);
       message: this.formatMessage(
         `\u2705 Added agent-hooks tasks to mise.toml.
    \u26A0\uFE0F  Could not find a [hooks].enter array to extend \u2014 add these to your [hooks] block manually:
-     enter += "${cr}/.mise/scripts/link-project-skills-to-clis.sh", "${cr}/.agents/hooks/sync.py --install --quiet"
-     leave += "${cr}/.mise/scripts/unlink-project-skills-from-clis.sh", "${cr}/.agents/hooks/sync.py --uninstall --quiet"`
+     enter += "sync-skills.py --scope project", "${cr}/.agents/hooks/sync.py --install --quiet"
+     leave += "${cr}/.agents/hooks/sync.py --uninstall --quiet"`
       )
     };
   }
@@ -2130,10 +2307,25 @@ var AgentHooksRecipe = class extends Recipe {
   printNextSteps() {
     console.log("\u{1FA9D} Agent-hooks layer installed!");
     console.log("   Next steps:");
-    console.log("   1. mise run hooks-sync   # generate .claude/settings.json + inject codex/kimi/hermes");
-    console.log("   2. git add .claude/settings.json .agents/hooks && commit (codex/kimi/hermes are per-dev)");
-    console.log("   3. mise run hindsight-setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
-    console.log(`   4. If you run a global agent system: echo '{"skills":{"defer_to_global":true}}' > .agents/local.json`);
+    console.log("   1. mise run skills-sync  # sync .agents/skills.json into local CLI dirs");
+    console.log("   2. mise run hooks-sync   # generate .claude/settings.json + inject codex/kimi/hermes");
+    console.log("   3. git add .claude/settings.json .agents/hooks .agents/skills.json && commit (codex/kimi/hermes are per-dev)");
+    console.log("   4. mise run hindsight-setup   # set HINDSIGHT_OP_KEY_REF to your 1Password item first");
+    console.log("   5. Optional per-dev hook opt-out: copy .agents/local.example.json -> .agents/local.json");
+  }
+};
+
+// src/recipes/MiseOpInjectRecipe.ts
+var MiseOpInjectRecipe = class extends Recipe {
+  constructor(context) {
+    super(context);
+    this.addIngredient(WireMiseOpInject);
+  }
+  printNextSteps() {
+    console.log("\u{1F389} Wired up .env.op 1Password resolution via mise!");
+    console.log("   Next steps:");
+    console.log("   1. Create .env.op with your op:// secret references");
+    console.log("   2. Run `mise run secrets-inject` or simply cd out and back in to trigger the hook");
   }
 };
 
@@ -2176,6 +2368,12 @@ var RECIPE_REGISTRY = {
     description: "Retrofit the project-scoped agent-hooks + skill fan-out layer (Claude/Codex/Kimi/Hermes hooks via mise enter/leave)",
     class: AgentHooksRecipe,
     commands: ["CopyAgentHooksTree", "WireMiseAgentHooks"]
+  },
+  "mise-op-inject": {
+    name: "mise-op-inject",
+    description: "Wire up op-inject script to mise.toml for 1Password secret resolution",
+    class: MiseOpInjectRecipe,
+    commands: ["WireMiseOpInject"]
   }
 };
 var COMMAND_REGISTRY = {
@@ -2244,6 +2442,12 @@ var COMMAND_REGISTRY = {
     description: "Create .env.example file",
     group: "environment",
     class: AddDotenv
+  },
+  WireMiseOpInject: {
+    name: "WireMiseOpInject",
+    description: "Wire up op-inject script to mise.toml for 1Password secret resolution",
+    group: "mise",
+    class: WireMiseOpInject
   }
 };
 function getRecipeNames() {
@@ -2259,15 +2463,15 @@ function createRecipe(name, context) {
 }
 
 // src/utils/version.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import { dirname as dirname6, join as join11 } from "node:path";
+import { readFileSync as readFileSync6 } from "node:fs";
+import { dirname as dirname6, join as join13 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var PJANGLER_VERSION = (() => {
   try {
     let dir = dirname6(fileURLToPath3(import.meta.url));
     for (let i = 0; i < 4; i++) {
       try {
-        const raw = readFileSync5(join11(dir, "package.json"), "utf8");
+        const raw = readFileSync6(join13(dir, "package.json"), "utf8");
         return JSON.parse(raw).version ?? "0.0.0";
       } catch {
         const parent = dirname6(dir);
@@ -2281,29 +2485,39 @@ var PJANGLER_VERSION = (() => {
 })();
 
 // src/parity/index.ts
-import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync6, readFileSync as readFileSync6, readlinkSync, readdirSync as readdirSync2, renameSync as renameSync2, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6, chmodSync as chmodSync2, copyFileSync } from "node:fs";
-import { basename as basename3, dirname as dirname7, join as join12, relative, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync6, readFileSync as readFileSync7, readlinkSync, readdirSync as readdirSync2, renameSync as renameSync2, symlinkSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7, chmodSync as chmodSync4, copyFileSync, rmSync } from "node:fs";
+import { basename as basename3, dirname as dirname7, join as join14, relative, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { homedir as homedir5 } from "node:os";
 import { spawnSync as spawnSync6 } from "node:child_process";
 import YAML3 from "yaml";
 var LINK_AGENTFILES_SCRIPT = "'{{config_root}}/.mise/scripts/link-agentfiles.sh'";
 var OP_INJECT_SCRIPT = "op inject -i .env.op > .env";
+var SYNC_SKILLS_SCRIPT = "sync-skills.py --scope project";
 var CODEGRAPH_SCRIPT = "[ -f '{{config_root}}/.mise/scripts/codegraph.sh' ] && '{{config_root}}/.mise/scripts/codegraph.sh' || true";
+var SKILLS_REGISTRY_URL = "https://github.com/delorenj/skillex.git";
 var HOOKS_COMMENT_HEADER = `# This block will handle the linking of
 # agent files to the main AGENTS.md file.
 #
 # TODO: Ensure this works for all levels of nesting.
 # i.e. All linked agent files MUST be siblings at
 # any given level of nesting.`;
-var LINK_AGENTFILES_HOOK_ENTRIES = [LINK_AGENTFILES_SCRIPT, OP_INJECT_SCRIPT];
+var LINK_AGENTFILES_HOOK_ENTRIES = [LINK_AGENTFILES_SCRIPT, OP_INJECT_SCRIPT, SYNC_SKILLS_SCRIPT];
 var LINK_AGENTFILES_WATCH_TASK_BLOCK = `[[watch_files]]
 patterns = ["AGENTS.md"]
 task = "link-agentfiles"
 
+[[watch_files]]
+patterns = [".agents/skills.json"]
+task = "skills-sync"
+
 [tasks.link-agentfiles]
 description = "Symlink all agent files to AGENTS.md"
-run = "'{{config_root}}/.mise/scripts/link-agentfiles.sh'"`;
+run = "'{{config_root}}/.mise/scripts/link-agentfiles.sh'"
+
+[tasks.skills-sync]
+description = "Sync skills from manifest to local CLI dirs"
+run = "sync-skills.py --scope project"`;
 var VERSIONING_BLOCK = `# >>> mise-versioning >>>  (managed block \u2014 do not edit by hand; re-run init to update)
 [tasks."version"]
 description = "Print the current version (vX.Y.Z)"
@@ -2333,7 +2547,7 @@ run = "'{{config_root}}/.mise/scripts/versioning.sh' sync"
 function resolvePjanglerRoot2() {
   let dir = dirname7(fileURLToPath4(import.meta.url));
   while (dir !== dirname7(dir)) {
-    if (existsSync9(join12(dir, "package.json")) && existsSync9(join12(dir, "templates", "commonproject", "copier.yml"))) {
+    if (existsSync10(join14(dir, "package.json")) && existsSync10(join14(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
     dir = dirname7(dir);
@@ -2344,17 +2558,17 @@ function normalizeNewlines(value) {
   return value.replace(/\r\n/g, "\n");
 }
 function readText(path) {
-  return normalizeNewlines(readFileSync6(path, "utf8"));
+  return normalizeNewlines(readFileSync7(path, "utf8"));
 }
 function safeReadText(path) {
-  return existsSync9(path) ? readText(path) : null;
+  return existsSync10(path) ? readText(path) : null;
 }
 function ensureParent(path) {
   mkdirSync6(dirname7(path), { recursive: true });
 }
 function writeText(path, content) {
   ensureParent(path);
-  writeFileSync6(path, content);
+  writeFileSync7(path, content);
 }
 function tryParseJson(text2) {
   if (!text2) return null;
@@ -2371,7 +2585,7 @@ function titleCaseSlug(slug) {
   return slug.split(/[-_]/g).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 function readSymlinkTarget(path) {
-  if (!existsSync9(path)) return null;
+  if (!existsSync10(path)) return null;
   try {
     return readlinkSync(path);
   } catch {
@@ -2379,7 +2593,7 @@ function readSymlinkTarget(path) {
   }
 }
 function ensureSymlink(path, target, dryRun) {
-  if (existsSync9(path)) {
+  if (existsSync10(path)) {
     const stat = lstatSync(path);
     if (stat.isSymbolicLink()) {
       const current = readSymlinkTarget(path);
@@ -2396,11 +2610,11 @@ function ensureSymlink(path, target, dryRun) {
   return { changed: true };
 }
 function bootstrapAgentsFile(repoRoot, dryRun) {
-  const agentsPath = join12(repoRoot, "AGENTS.md");
-  if (existsSync9(agentsPath)) return { changedFiles: [], details: [] };
+  const agentsPath = join14(repoRoot, "AGENTS.md");
+  if (existsSync10(agentsPath)) return { changedFiles: [], details: [] };
   for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-    const source = join12(repoRoot, file);
-    if (!existsSync9(source)) continue;
+    const source = join14(repoRoot, file);
+    if (!existsSync10(source)) continue;
     const stat = lstatSync(source);
     if (stat.isSymbolicLink()) continue;
     if (stat.isFile()) {
@@ -2409,8 +2623,8 @@ function bootstrapAgentsFile(repoRoot, dryRun) {
     }
     return { changedFiles: [], details: [], blocked: `${file} exists but is not a regular file; cannot promote to AGENTS.md` };
   }
-  const readmePath = join12(repoRoot, "README.md");
-  if (existsSync9(readmePath)) {
+  const readmePath = join14(repoRoot, "README.md");
+  if (existsSync10(readmePath)) {
     const stat = lstatSync(readmePath);
     if (!stat.isFile()) return { changedFiles: [], details: [], blocked: "README.md exists but is not a regular file; cannot copy to AGENTS.md" };
     if (!dryRun) copyFileSync(readmePath, agentsPath);
@@ -2449,12 +2663,12 @@ function yamlGet(text2, keyPath) {
   return "";
 }
 function discoverRoles(repoRoot) {
-  const rolesDir = join12(repoRoot, "agents", "hermes");
-  if (!existsSync9(rolesDir)) return [];
+  const rolesDir = join14(repoRoot, "agents", "hermes");
+  if (!existsSync10(rolesDir)) return [];
   return readdirSync2(rolesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => {
-    const roleDir = join12(rolesDir, entry.name);
-    const roleYamlPath = join12(roleDir, "role.yaml");
-    if (!existsSync9(roleYamlPath)) return null;
+    const roleDir = join14(rolesDir, entry.name);
+    const roleYamlPath = join14(roleDir, "role.yaml");
+    if (!existsSync10(roleYamlPath)) return null;
     const text2 = readText(roleYamlPath);
     const runtimeRepoRaw = yamlGet(text2, "runtime.github_repo");
     return {
@@ -2482,7 +2696,7 @@ function discoverRoles(repoRoot) {
   }).filter((value) => Boolean(value));
 }
 function registryPath(homeDir) {
-  return join12(homeDir, ".hermes", "agents-registry.yaml");
+  return join14(homeDir, ".hermes", "agents-registry.yaml");
 }
 function systemctlUser(args) {
   const result = spawnSync6("systemctl", ["--user", ...args], { encoding: "utf8" });
@@ -2493,8 +2707,8 @@ function systemctlUser(args) {
   };
 }
 function templateScript(ctx, name) {
-  const source = join12(ctx.pjanglerRoot, ".mise", "scripts", name);
-  return existsSync9(source) ? readText(source) : void 0;
+  const source = join14(ctx.pjanglerRoot, ".mise", "scripts", name);
+  return existsSync10(source) ? readText(source) : void 0;
 }
 function templateVersioningScript(ctx) {
   return templateScript(ctx, "versioning.sh");
@@ -2506,8 +2720,8 @@ function resolveAgentHooksLayer2(ctx) {
   const override = process.env.PJ_AGENT_HOOKS_LAYER;
   if (override === "0" || override === "false") return false;
   if (override === "1" || override === "true") return true;
-  if (existsSync9(join12(ctx.repoRoot, ".agents", "hooks", "sync.py"))) return true;
-  return !existsSync9(join12(ctx.homeDir, ".agents", "hooks"));
+  if (existsSync10(join14(ctx.repoRoot, ".agents", "hooks", "sync.py"))) return true;
+  return !existsSync10(join14(ctx.homeDir, ".agents", "hooks"));
 }
 function evaluateMiseConditionals(template, agentHooksLayer) {
   const out = [];
@@ -2537,19 +2751,36 @@ function renderGeneratedProjectMiseToml(ctx, template) {
   return evaluateMiseConditionals(template, resolveAgentHooksLayer2(ctx)).replace(/\{%\s*raw\s*%\}([\s\S]*?)\{%\s*endraw\s*%\}/g, "$1").replace(/\{\{\s*project_name\s*\}\}/g, projectName);
 }
 function ensureMiseTomlFromTemplate(ctx, changedFiles) {
-  const targetPath = join12(ctx.repoRoot, "mise.toml");
-  if (existsSync9(targetPath)) return false;
-  const sourcePath = join12(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
-  if (!existsSync9(sourcePath)) return false;
+  const targetPath = join14(ctx.repoRoot, "mise.toml");
+  if (existsSync10(targetPath)) return false;
+  const sourcePath = join14(ctx.pjanglerRoot, "templates", "commonproject", "template", "mise.toml.jinja");
+  if (!existsSync10(sourcePath)) return false;
   changedFiles.push(targetPath);
   if (!ctx.dryRun) {
     writeText(targetPath, renderGeneratedProjectMiseToml(ctx, readText(sourcePath)));
   }
   return true;
 }
+function templateCommonProjectText(ctx, rel) {
+  const path = join14(ctx.pjanglerRoot, "templates", "commonproject", "template", rel);
+  return existsSync10(path) ? readText(path) : void 0;
+}
+function canonicalSkillsManifest() {
+  return `${JSON.stringify(
+    {
+      $schema: "https://raw.githubusercontent.com/skillex/schemas/main/skills.schema.json",
+      inherit_global: true,
+      registry: SKILLS_REGISTRY_URL,
+      skills: []
+    },
+    null,
+    2
+  )}
+`;
+}
 function templateVersionFilesConf(ctx, repoRoot) {
-  const packageJson = join12(repoRoot, "package.json");
-  return existsSync9(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
+  const packageJson = join14(repoRoot, "package.json");
+  return existsSync10(packageJson) ? "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\njson package.json\ngittag .\n" : "# mise-versioning manifest: <type> <path>\n# types: json toml cargo csproj gradle plain gittag\ngittag .\n";
 }
 function replaceOrAppendManagedBlock(text2, startMarker, block, beforePattern) {
   if (startMarker.test(text2)) {
@@ -2573,7 +2804,7 @@ var CONDITIONAL_HERMES_PATHS = ["agents/hermes/pm/hermes", "agent/hermes/pm/herm
 function requiredMisePathEntries(ctx) {
   const required = [...BASE_MISE_PATH_ENTRIES];
   for (const candidate of CONDITIONAL_HERMES_PATHS) {
-    if (existsSync9(join12(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
+    if (existsSync10(join14(ctx.repoRoot, candidate)) && !required.includes(candidate)) required.push(candidate);
   }
   return required;
 }
@@ -2674,6 +2905,9 @@ function stripTomlStringsAndComments(line) {
 function isManagedHookEntry(value) {
   const trimmed = value.trim();
   if (trimmed === OP_INJECT_SCRIPT) return true;
+  if (trimmed === SYNC_SKILLS_SCRIPT) return true;
+  if (/link-project-skills-to-clis\.sh'?\s*$/.test(trimmed)) return true;
+  if (/unlink-project-skills-from-clis\.sh'?\s*$/.test(trimmed)) return true;
   return /link-agentfiles\.sh'?\s*$/.test(trimmed);
 }
 function normalizeHookScript(script) {
@@ -2776,12 +3010,17 @@ function upsertLinkAgentfilesHooks(text2) {
 function upsertLinkAgentfilesBlock(text2, ctx) {
   const withPath = upsertMisePath(text2, requiredMisePathEntries(ctx));
   let cleaned = removeTomlSection(withPath, /^\[tasks\.link-agentfiles\]$/, /link-agentfiles/, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.skills-sync\]$/, void 0, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.link-project-skills-to-clis\]$/, void 0, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.unlink-project-skills-from-clis\]$/, void 0, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[tasks\.skills-relink\]$/, void 0, { includePrecedingComments: false });
   cleaned = removeTomlSection(cleaned, /^\[\[watch_files\]\]$/, /AGENTS\.md/, { includePrecedingComments: false });
+  cleaned = removeTomlSection(cleaned, /^\[\[watch_files\]\]$/, /\.agents\/skills\.json/, { includePrecedingComments: false });
   cleaned = upsertLinkAgentfilesHooks(cleaned);
   return insertTomlBlockBeforeVersioning(cleaned, LINK_AGENTFILES_WATCH_TASK_BLOCK);
 }
 function readProjectJson(ctx) {
-  return tryParseJson(safeReadText(join12(ctx.repoRoot, ".project.json")));
+  return tryParseJson(safeReadText(join14(ctx.repoRoot, ".project.json")));
 }
 function boolSetting(value, fallback) {
   if (typeof value === "boolean") return value;
@@ -2856,12 +3095,12 @@ function canonicalProjectJson(ctx) {
   };
 }
 function projectJsonFinding(ctx) {
-  const projectPath = join12(ctx.repoRoot, ".project.json");
-  const planeJsonPath = join12(ctx.repoRoot, ".plane.json");
+  const projectPath = join14(ctx.repoRoot, ".project.json");
+  const planeJsonPath = join14(ctx.repoRoot, ".plane.json");
   const details = [];
   const data = readProjectJson(ctx);
   const roles = discoverRoles(ctx.repoRoot);
-  if (!existsSync9(projectPath)) {
+  if (!existsSync10(projectPath)) {
     return { id: "sot.project-json", title: "Canonical .project.json", status: "fail", summary: ".project.json missing", details: [], fixable: true };
   }
   if (!data) {
@@ -2896,7 +3135,7 @@ function projectJsonFinding(ctx) {
   for (const key of ["enabled", "grace_hours", "auto_review"]) {
     if (!(key in reconcile)) details.push(`automation.reconcile.${key} missing`);
   }
-  if (existsSync9(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
+  if (existsSync10(planeJsonPath)) details.push(".plane.json should not exist once .project.json is canonical");
   return {
     id: "sot.project-json",
     title: "Canonical .project.json",
@@ -2977,17 +3216,17 @@ exec env HERMES_HOME="$HERMES_HOME" HERMES_FLEET_ENV="$FLEET_ENV"   HERMES_OAUTH
 `.replace(/\u0010/g, "$");
 }
 function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip) {
-  if (!existsSync9(sourceDir)) return;
+  if (!existsSync10(sourceDir)) return;
   mkdirSync6(targetDir, { recursive: true });
   for (const entry of readdirSync2(sourceDir, { withFileTypes: true })) {
-    const sourcePath = join12(sourceDir, entry.name);
+    const sourcePath = join14(sourceDir, entry.name);
     if (skip?.(sourcePath)) continue;
-    const targetPath = join12(targetDir, entry.name);
+    const targetPath = join14(targetDir, entry.name);
     if (entry.isDirectory()) {
       copyMissingRecursive(sourcePath, targetPath, changedFiles, dryRun, skip);
       continue;
     }
-    if (existsSync9(targetPath)) continue;
+    if (existsSync10(targetPath)) continue;
     changedFiles.push(targetPath);
     if (!dryRun) {
       ensureParent(targetPath);
@@ -2996,7 +3235,7 @@ function copyMissingRecursive(sourceDir, targetDir, changedFiles, dryRun, skip)
   }
 }
 function upsertSubmodule(repoRoot, role, changedFiles, dryRun) {
-  const gitmodulesPath = join12(repoRoot, ".gitmodules");
+  const gitmodulesPath = join14(repoRoot, ".gitmodules");
   const repoName = role.runtimeRepo || `agent-hm-${role.repo}-${role.role}`;
   const owner = role.runtimeOwner || "delorenj";
   const block = `[submodule "agents/hermes/${role.role}/runtime"]
@@ -3163,7 +3402,7 @@ function runBmadInstall(repoRoot) {
   return { ok: true };
 }
 function readInstalledBmadVersion(repoRoot) {
-  const raw = safeReadText(join12(repoRoot, "_bmad", "_config", "manifest.yaml"));
+  const raw = safeReadText(join14(repoRoot, "_bmad", "_config", "manifest.yaml"));
   if (!raw) return void 0;
   try {
     const parsed = YAML3.parse(raw);
@@ -3174,8 +3413,8 @@ function readInstalledBmadVersion(repoRoot) {
   }
 }
 function bmadCachePath(homeDir) {
-  const cacheRoot = process.env.XDG_CACHE_HOME?.trim() || join12(homeDir, ".cache");
-  return join12(cacheRoot, "pjangler", "bmad-dist-tags.json");
+  const cacheRoot = process.env.XDG_CACHE_HOME?.trim() || join14(homeDir, ".cache");
+  return join14(cacheRoot, "pjangler", "bmad-dist-tags.json");
 }
 function readBmadDistTagsCache(homeDir) {
   const raw = safeReadText(bmadCachePath(homeDir));
@@ -3218,7 +3457,7 @@ function resolveBmadDistTags(homeDir) {
     try {
       const path = bmadCachePath(homeDir);
       mkdirSync6(dirname7(path), { recursive: true });
-      writeFileSync6(path, JSON.stringify({ fetchedAt: Date.now(), distTags: fetched }, null, 2));
+      writeFileSync7(path, JSON.stringify({ fetchedAt: Date.now(), distTags: fetched }, null, 2));
     } catch {
     }
     return { distTags: fetched, stale: false };
@@ -3263,14 +3502,14 @@ var RULES = [
     id: "mise.config-root",
     title: "mise config_root + AGENTS link hooks",
     audit: (ctx) => {
-      const misePath = join12(ctx.repoRoot, "mise.toml");
-      if (!existsSync9(misePath)) {
+      const misePath = join14(ctx.repoRoot, "mise.toml");
+      if (!existsSync10(misePath)) {
         return { id: "mise.config-root", title: "mise config_root + AGENTS link hooks", status: "fail", summary: "mise.toml missing", details: [], fixable: true };
       }
       const text2 = readText(misePath);
       const details = [];
-      const linkAgentfilesPath = join12(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
-      if (!existsSync9(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
+      const linkAgentfilesPath = join14(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      if (!existsSync10(linkAgentfilesPath)) details.push(".mise/scripts/link-agentfiles.sh missing");
       const pathValues = [...(text2.match(/^_\.path\s*=\s*\[([^\]]*)\]/m)?.[1] ?? "").matchAll(/"([^"]+)"/g)].map((match) => match[1]);
       const missingPathValues = requiredMisePathEntries(ctx).filter((value) => !pathValues.includes(value));
       if (missingPathValues.length) details.push(`[env]._.path should include ${missingPathValues.join(", ")}`);
@@ -3288,10 +3527,10 @@ var RULES = [
       };
     },
     migrate: (ctx, finding) => {
-      const path = join12(ctx.repoRoot, "mise.toml");
+      const path = join14(ctx.repoRoot, "mise.toml");
       const changedFiles = [];
       const details = [];
-      if (!existsSync9(path)) {
+      if (!existsSync10(path)) {
         if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
           return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
         }
@@ -3307,7 +3546,7 @@ var RULES = [
         if (!ctx.dryRun) writeText(path, next);
         text2 = next;
       }
-      const linkAgentfilesPath = join12(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
+      const linkAgentfilesPath = join14(ctx.repoRoot, ".mise", "scripts", "link-agentfiles.sh");
       const expectedScript = templateLinkAgentfilesScript(ctx);
       if (expectedScript === void 0) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/link-agentfiles.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -3316,7 +3555,7 @@ var RULES = [
         changedFiles.push(linkAgentfilesPath);
         if (!ctx.dryRun) {
           writeText(linkAgentfilesPath, expectedScript);
-          chmodSync2(linkAgentfilesPath, 493);
+          chmodSync4(linkAgentfilesPath, 493);
         }
       }
       return {
@@ -3334,13 +3573,13 @@ var RULES = [
     title: "managed mise versioning block",
     audit: (ctx) => {
       const details = [];
-      const misePath = join12(ctx.repoRoot, "mise.toml");
-      const versioningPath = join12(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
-      const manifestPath = join12(ctx.repoRoot, ".mise", "version-files.conf");
+      const misePath = join14(ctx.repoRoot, "mise.toml");
+      const versioningPath = join14(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const manifestPath = join14(ctx.repoRoot, ".mise", "version-files.conf");
       const text2 = safeReadText(misePath);
       if (!text2?.includes("# >>> mise-versioning >>>")) details.push("mise versioning managed block missing");
-      if (!existsSync9(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
-      if (!existsSync9(manifestPath)) details.push(".mise/version-files.conf missing");
+      if (!existsSync10(versioningPath)) details.push(".mise/scripts/versioning.sh missing");
+      if (!existsSync10(manifestPath)) details.push(".mise/version-files.conf missing");
       return {
         id: "mise.versioning",
         title: "managed mise versioning block",
@@ -3353,8 +3592,8 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const misePath = join12(ctx.repoRoot, "mise.toml");
-      if (!existsSync9(misePath)) {
+      const misePath = join14(ctx.repoRoot, "mise.toml");
+      if (!existsSync10(misePath)) {
         if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
           return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details: [] };
         }
@@ -3378,7 +3617,7 @@ var RULES = [
         if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
         if (!ctx.dryRun) writeText(misePath, nextMise);
       }
-      const versioningPath = join12(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
+      const versioningPath = join14(ctx.repoRoot, ".mise", "scripts", "versioning.sh");
       const expectedScript = templateVersioningScript(ctx);
       if (expectedScript === void 0) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "pjangler install is missing .mise/scripts/versioning.sh \u2014 update @delorenj/pjangler (broken package)", changedFiles, details: [] };
@@ -3387,10 +3626,10 @@ var RULES = [
         changedFiles.push(versioningPath);
         if (!ctx.dryRun) {
           writeText(versioningPath, expectedScript);
-          chmodSync2(versioningPath, 493);
+          chmodSync4(versioningPath, 493);
         }
       }
-      const manifestPath = join12(ctx.repoRoot, ".mise", "version-files.conf");
+      const manifestPath = join14(ctx.repoRoot, ".mise", "version-files.conf");
       const expectedManifest = templateVersionFilesConf(ctx, ctx.repoRoot);
       if (safeReadText(manifestPath) !== expectedManifest) {
         changedFiles.push(manifestPath);
@@ -3406,13 +3645,125 @@ var RULES = [
       };
     }
   },
+  {
+    id: "skills.project-manifest",
+    title: "Skillex project skills manifest",
+    audit: (ctx) => {
+      const details = [];
+      const manifestPath = join14(ctx.repoRoot, ".agents", "skills.json");
+      const legacyDir = join14(ctx.repoRoot, ".agents", "skills");
+      const localExamplePath = join14(ctx.repoRoot, ".agents", "local.example.json");
+      const misePath = join14(ctx.repoRoot, "mise.toml");
+      let fixable = true;
+      const manifest = tryParseJson(safeReadText(manifestPath));
+      if (!manifest) {
+        details.push(".agents/skills.json missing or invalid JSON");
+      } else {
+        if (manifest.inherit_global !== true) details.push(".agents/skills.json should set inherit_global: true");
+        if (manifest.registry !== SKILLS_REGISTRY_URL) details.push(`.agents/skills.json should set registry to ${SKILLS_REGISTRY_URL}`);
+        if (!Array.isArray(manifest.skills)) details.push(".agents/skills.json should define a skills array");
+      }
+      if (existsSync10(legacyDir)) {
+        const entries = readdirSync2(legacyDir);
+        if (entries.length > 0) {
+          details.push(".agents/skills/ still contains legacy committed skills; map them into .agents/skills.json before migrating");
+          fixable = false;
+        } else {
+          details.push(".agents/skills/ legacy directory should be removed");
+        }
+      }
+      for (const rel of [".mise/scripts/link-project-skills-to-clis.sh", ".mise/scripts/unlink-project-skills-from-clis.sh"]) {
+        if (existsSync10(join14(ctx.repoRoot, rel))) details.push(`${rel} is a legacy symlink-era script and should be removed`);
+      }
+      const localExample = tryParseJson(safeReadText(localExamplePath));
+      if (localExample && Object.prototype.hasOwnProperty.call(localExample, "skills")) {
+        details.push(".agents/local.example.json still documents legacy skills overrides; drop the skills section");
+      }
+      const mise = safeReadText(misePath);
+      if (!mise?.includes(SYNC_SKILLS_SCRIPT)) details.push("mise.toml should run sync-skills.py --scope project on enter");
+      if (!mise?.includes('patterns = [".agents/skills.json"]')) details.push("mise.toml should watch .agents/skills.json");
+      if (!mise?.includes("[tasks.skills-sync]")) details.push("mise.toml should define a skills-sync task");
+      if (mise?.includes("link-project-skills-to-clis.sh") || mise?.includes("unlink-project-skills-from-clis.sh") || mise?.includes("[tasks.skills-relink]")) {
+        details.push("mise.toml still contains legacy skill-link wiring");
+      }
+      return {
+        id: "skills.project-manifest",
+        title: "Skillex project skills manifest",
+        status: details.length === 0 ? "pass" : "fail",
+        summary: details.length === 0 ? "Skillex skills manifest parity verified" : `${details.length} Skillex migration issue(s) detected`,
+        details,
+        fixable
+      };
+    },
+    migrate: (ctx, finding) => {
+      const changedFiles = [];
+      const details = [];
+      const manifestPath = join14(ctx.repoRoot, ".agents", "skills.json");
+      const legacyDir = join14(ctx.repoRoot, ".agents", "skills");
+      const localExamplePath = join14(ctx.repoRoot, ".agents", "local.example.json");
+      const misePath = join14(ctx.repoRoot, "mise.toml");
+      if (existsSync10(legacyDir)) {
+        const entries = readdirSync2(legacyDir);
+        if (entries.length > 0) {
+          return {
+            id: finding.id,
+            title: finding.title,
+            status: "blocked",
+            summary: "Legacy .agents/skills/ still contains committed skills; migrate them into .agents/skills.json manually first",
+            changedFiles,
+            details: entries.map((entry) => `.agents/skills/${entry}`)
+          };
+        }
+        changedFiles.push(legacyDir);
+        if (!ctx.dryRun) rmSync(legacyDir, { recursive: true, force: true });
+      }
+      const expectedManifest = canonicalSkillsManifest();
+      if (safeReadText(manifestPath) !== expectedManifest) {
+        changedFiles.push(manifestPath);
+        if (!ctx.dryRun) writeText(manifestPath, expectedManifest);
+        details.push("Wrote canonical .agents/skills.json manifest");
+      }
+      for (const rel of [".mise/scripts/link-project-skills-to-clis.sh", ".mise/scripts/unlink-project-skills-from-clis.sh"]) {
+        const path = join14(ctx.repoRoot, rel);
+        if (existsSync10(path)) {
+          changedFiles.push(path);
+          if (!ctx.dryRun) unlinkSync3(path);
+        }
+      }
+      const templateLocalExample = templateCommonProjectText(ctx, ".agents/local.example.json");
+      const currentLocalExample = safeReadText(localExamplePath);
+      if (templateLocalExample && currentLocalExample && currentLocalExample !== templateLocalExample) {
+        changedFiles.push(localExamplePath);
+        if (!ctx.dryRun) writeText(localExamplePath, templateLocalExample);
+      }
+      if (!existsSync10(misePath)) {
+        if (!ensureMiseTomlFromTemplate(ctx, changedFiles)) {
+          return { id: finding.id, title: finding.title, status: "blocked", summary: "mise.toml missing and no generated-project mise template available to initialize from", changedFiles, details };
+        }
+      }
+      const currentMise = readText(misePath);
+      const nextMise = upsertLinkAgentfilesBlock(currentMise, ctx);
+      if (nextMise !== currentMise) {
+        if (!changedFiles.includes(misePath)) changedFiles.push(misePath);
+        if (!ctx.dryRun) writeText(misePath, nextMise);
+      }
+      return {
+        id: finding.id,
+        title: finding.title,
+        status: changedFiles.length ? "applied" : "noop",
+        summary: changedFiles.length ? "Skillex skills manifest contract normalized" : "No changes required",
+        changedFiles,
+        details
+      };
+    }
+  },
   {
     id: "sot.agent-symlinks",
     title: "AGENTS/CLAUDE/GEMINI symlink contract",
     audit: (ctx) => {
-      const agentsPath = join12(ctx.repoRoot, "AGENTS.md");
-      if (!existsSync9(agentsPath)) {
-        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync9(join12(ctx.repoRoot, file)));
+      const agentsPath = join14(ctx.repoRoot, "AGENTS.md");
+      if (!existsSync10(agentsPath)) {
+        const fallbackSources = ["CLAUDE.md", "GEMINI.md", "README.md"].filter((file) => existsSync10(join14(ctx.repoRoot, file)));
         if (fallbackSources.length === 0) {
           return { id: "sot.agent-symlinks", title: "AGENTS/CLAUDE/GEMINI symlink contract", status: "skip", summary: "AGENTS.md missing; symlink contract not applicable", details: [], fixable: false };
         }
@@ -3427,7 +3778,7 @@ var RULES = [
       }
       const details = [];
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join12(ctx.repoRoot, file);
+        const full = join14(ctx.repoRoot, file);
         const target = readSymlinkTarget(full);
         if (target !== "AGENTS.md") details.push(`${file} should be a symlink to AGENTS.md`);
       }
@@ -3451,7 +3802,7 @@ var RULES = [
         return { id: finding.id, title: finding.title, status: "blocked", summary: "AGENTS.md missing; cannot derive canonical agent file", changedFiles, details: [bootstrap.blocked] };
       }
       for (const file of ["CLAUDE.md", "GEMINI.md"]) {
-        const full = join12(ctx.repoRoot, file);
+        const full = join14(ctx.repoRoot, file);
         const result = ensureSymlink(full, "AGENTS.md", ctx.dryRun);
         if (result.blocked) blockedDetails.push(result.blocked);
         if (result.changed) changedFiles.push(full);
@@ -3473,7 +3824,7 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const path = join12(ctx.repoRoot, ".project.json");
+      const path = join14(ctx.repoRoot, ".project.json");
       const existing = readProjectJson(ctx) ?? {};
       const canonical = canonicalProjectJson(ctx);
       const merged = { ...existing, ...canonical };
@@ -3483,10 +3834,10 @@ var RULES = [
         changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, expected);
       }
-      const planeJson = join12(ctx.repoRoot, ".plane.json");
-      if (existsSync9(planeJson)) {
+      const planeJson = join14(ctx.repoRoot, ".plane.json");
+      if (existsSync10(planeJson)) {
         const backup = `${planeJson}.migrated-backup`;
-        if (existsSync9(backup)) {
+        if (existsSync10(backup)) {
           details.push(`cannot back up .plane.json because ${relative(ctx.repoRoot, backup)} already exists`);
         } else {
           changedFiles.push(backup);
@@ -3508,8 +3859,8 @@ var RULES = [
     title: ".env.op + gitignore secrets contract",
     audit: (ctx) => {
       const details = [];
-      const envOp = safeReadText(join12(ctx.repoRoot, ".env.op"));
-      const gitignore = safeReadText(join12(ctx.repoRoot, ".gitignore"));
+      const envOp = safeReadText(join14(ctx.repoRoot, ".env.op"));
+      const gitignore = safeReadText(join14(ctx.repoRoot, ".gitignore"));
       if (!envOp) {
         details.push(".env.op missing");
       } else {
@@ -3535,12 +3886,12 @@ var RULES = [
     migrate: (ctx, finding) => {
       const changedFiles = [];
       const details = [];
-      const envOpPath = join12(ctx.repoRoot, ".env.op");
-      if (!existsSync9(envOpPath)) {
+      const envOpPath = join14(ctx.repoRoot, ".env.op");
+      if (!existsSync10(envOpPath)) {
         changedFiles.push(envOpPath);
-        if (!ctx.dryRun) writeText(envOpPath, readText(join12(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
+        if (!ctx.dryRun) writeText(envOpPath, readText(join14(ctx.pjanglerRoot, "templates", "commonproject", "template", ".env.op")));
       }
-      const gitignorePath = join12(ctx.repoRoot, ".gitignore");
+      const gitignorePath = join14(ctx.repoRoot, ".gitignore");
       const gitignore = safeReadText(gitignorePath) ?? "";
       const requiredBlock = `# Secrets \u2014 .env is materialized by \`op inject -i .env.op > .env\` on mise enter.
 # NEVER commit it. .env.op holds only 1Password references or safe literals and IS committed.
@@ -3567,7 +3918,7 @@ var RULES = [
     title: ".copier-answers.yml provenance + drift report",
     audit: (ctx) => {
       const details = [];
-      const path = join12(ctx.repoRoot, ".copier-answers.yml");
+      const path = join14(ctx.repoRoot, ".copier-answers.yml");
       const text2 = safeReadText(path);
       const project = readProjectJson(ctx);
       if (!text2) {
@@ -3598,12 +3949,12 @@ var RULES = [
       const changedFiles = [];
       const project = canonicalProjectJson(ctx);
       const text2 = `# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
-_src_path: ${join12(ctx.pjanglerRoot, "templates", "commonproject")}
+_src_path: ${join14(ctx.pjanglerRoot, "templates", "commonproject")}
 project_description: ${String(project.project_description)}
 project_name: ${String(project.project_name)}
 ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
 `;
-      const path = join12(ctx.repoRoot, ".copier-answers.yml");
+      const path = join14(ctx.repoRoot, ".copier-answers.yml");
       if (safeReadText(path) !== text2) {
         changedFiles.push(path);
         if (!ctx.dryRun) writeText(path, text2);
@@ -3622,14 +3973,14 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
     id: "bmad.scaffold",
     title: "BMAD modules/docs scaffold",
     audit: (ctx) => {
-      const targetRoot = join12(ctx.repoRoot, "_bmad");
+      const targetRoot = join14(ctx.repoRoot, "_bmad");
       const sentinels = [
-        join12("core", "config.yaml"),
-        join12("config.toml"),
-        join12("_config", "manifest.yaml"),
-        join12("bmm", "config.yaml")
+        join14("core", "config.yaml"),
+        join14("config.toml"),
+        join14("_config", "manifest.yaml"),
+        join14("bmm", "config.yaml")
       ];
-      const missing = sentinels.filter((file) => !existsSync9(join12(targetRoot, file)));
+      const missing = sentinels.filter((file) => !existsSync10(join14(targetRoot, file)));
       return {
         id: "bmad.scaffold",
         title: "BMAD modules/docs scaffold",
@@ -3643,7 +3994,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       const changedFiles = [];
       if (ctx.dryRun) {
         for (const detail of finding.details) {
-          changedFiles.push(join12(ctx.repoRoot, detail));
+          changedFiles.push(join14(ctx.repoRoot, detail));
         }
         return {
           id: finding.id,
@@ -3668,8 +4019,8 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         };
       }
       for (const detail of finding.details) {
-        if (existsSync9(join12(ctx.repoRoot, detail))) {
-          changedFiles.push(join12(ctx.repoRoot, detail));
+        if (existsSync10(join14(ctx.repoRoot, detail))) {
+          changedFiles.push(join14(ctx.repoRoot, detail));
         }
       }
       return {
@@ -3692,7 +4043,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
           id: "bmad.version",
           title: "BMAD version currency",
           status: "skip",
-          summary: existsSync9(join12(ctx.repoRoot, "_bmad")) ? "BMAD installed but version manifest unreadable" : "No BMAD install present",
+          summary: existsSync10(join14(ctx.repoRoot, "_bmad")) ? "BMAD installed but version manifest unreadable" : "No BMAD install present",
           details: [],
           fixable: false
         };
@@ -3747,7 +4098,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       }
       const installed = readInstalledBmadVersion(ctx.repoRoot);
       const available = resolveBmadDistTags(ctx.homeDir)?.distTags?.[BMAD_TARGET_CHANNEL];
-      const manifestPath = join12(ctx.repoRoot, "_bmad", "_config", "manifest.yaml");
+      const manifestPath = join14(ctx.repoRoot, "_bmad", "_config", "manifest.yaml");
       if (ctx.dryRun) {
         return {
           id: finding.id,
@@ -3794,11 +4145,11 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       }
       const details = [];
       for (const rel of ["role.yaml", "SOUL.md", "hermes", ".gitignore", ".scripts/70-systemd.sh", ".scripts/heartbeat.sh", ".scripts/checkpoint.sh", ".runtime-scaffold/README.md", "runtime/memories/MEMORY.md", "runtime/bloodbank-consumer.py"]) {
-        if (!existsSync9(join12(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join12(role.roleDir, rel))}`);
+        if (!existsSync10(join14(role.roleDir, rel))) details.push(`missing ${relative(ctx.repoRoot, join14(role.roleDir, rel))}`);
       }
-      const gitmodules = safeReadText(join12(ctx.repoRoot, ".gitmodules")) ?? "";
+      const gitmodules = safeReadText(join14(ctx.repoRoot, ".gitmodules")) ?? "";
       if (!gitmodules.includes(`agents/hermes/${role.role}/runtime`)) details.push(".gitmodules missing pm runtime submodule entry");
-      if (!profileMetaInheritsDefault(join12(role.roleDir, "runtime", "profile.yaml"))) {
+      if (!profileMetaInheritsDefault(join14(role.roleDir, "runtime", "profile.yaml"))) {
         details.push("runtime/profile.yaml missing inherited default config metadata");
       }
       const registry = safeReadText(registryPath(ctx.homeDir));
@@ -3819,21 +4170,21 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       if (!role) {
         return { id: finding.id, title: finding.title, status: "blocked", summary: "No pm role present", changedFiles, details: [] };
       }
-      const templateRoleDir = join12(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
-      writeIfDifferent(join12(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
-      writeIfDifferent(join12(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
-      writeIfDifferent(join12(role.roleDir, ".gitignore"), readText(join12(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
-      copyMissingRecursive(join12(templateRoleDir, ".runtime-scaffold"), join12(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join12(templateRoleDir, ".runtime-scaffold"), join12(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
-      copyMissingRecursive(join12(templateRoleDir, ".scripts"), join12(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
-      const promptSource = join12(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
-      const promptTarget = join12(role.roleDir, ".scripts", "sentinel.prompt.md");
-      if (existsSync9(promptSource) && !existsSync9(promptTarget)) {
+      const templateRoleDir = join14(ctx.pjanglerRoot, "templates", "hermes-agent", "template");
+      writeIfDifferent(join14(role.roleDir, "SOUL.md"), renderSoul(role), ctx.dryRun, changedFiles);
+      writeIfDifferent(join14(role.roleDir, "hermes"), renderHermesWrapper(role), ctx.dryRun, changedFiles, 493);
+      writeIfDifferent(join14(role.roleDir, ".gitignore"), readText(join14(templateRoleDir, ".gitignore.jinja")).replace(/\{\{ role \}\}/g, role.role), ctx.dryRun, changedFiles);
+      copyMissingRecursive(join14(templateRoleDir, ".runtime-scaffold"), join14(role.roleDir, ".runtime-scaffold"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join14(templateRoleDir, ".runtime-scaffold"), join14(role.roleDir, "runtime"), changedFiles, ctx.dryRun);
+      copyMissingRecursive(join14(templateRoleDir, ".scripts"), join14(role.roleDir, ".scripts"), changedFiles, ctx.dryRun, (source) => source.endsWith("sentinel.prompt.md.jinja"));
+      const promptSource = join14(templateRoleDir, ".scripts", "sentinel.prompt.md.jinja");
+      const promptTarget = join14(role.roleDir, ".scripts", "sentinel.prompt.md");
+      if (existsSync10(promptSource) && !existsSync10(promptTarget)) {
         const prompt = readText(promptSource).replace(/\{\{ agent_id \}\}/g, role.agentId).replace(/\{\{ role \}\}/g, role.role).replace(/\{\{ target_repo \}\}/g, role.repo).replace(/\{\{ display_name \}\}/g, role.displayName || role.agentId);
         writeIfDifferent(promptTarget, prompt, ctx.dryRun, changedFiles);
       }
       upsertSubmodule(ctx.repoRoot, role, changedFiles, ctx.dryRun);
-      const profileMetaUpdated = upsertInheritedProfileMeta(join12(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
+      const profileMetaUpdated = upsertInheritedProfileMeta(join14(role.roleDir, "runtime", "profile.yaml"), changedFiles, ctx.dryRun);
       if (profileMetaUpdated) details.push(`updated ${profileMetaUpdated}`);
       const registryUpdated = upsertRegistryEntry(role, ctx.homeDir, changedFiles, ctx.dryRun);
       if (registryUpdated) details.push(`updated ${registryUpdated}`);
@@ -3865,7 +4216,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       const details = [];
       for (const role of roles) {
         const roleRelDir = relative(ctx.repoRoot, role.roleDir);
-        const runtimeRelPath = join12(roleRelDir, "runtime");
+        const runtimeRelPath = join14(roleRelDir, "runtime");
         const lsResult = spawnSync6("git", ["ls-files", "--stage", runtimeRelPath], {
           cwd: ctx.repoRoot,
           encoding: "utf8"
@@ -3873,8 +4224,8 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         if (lsResult.status === 0 && lsResult.stdout.trim().length > 0) {
           details.push(`submodule runtime is tracked in Git index at ${runtimeRelPath}`);
         }
-        const gitignorePath = join12(role.roleDir, ".gitignore");
-        if (existsSync9(gitignorePath)) {
+        const gitignorePath = join14(role.roleDir, ".gitignore");
+        if (existsSync10(gitignorePath)) {
           const content = safeReadText(gitignorePath) ?? "";
           const lines = content.split(/\r?\n/).map((line) => line.trim());
           if (!lines.includes("runtime/") && !lines.includes("runtime")) {
@@ -3899,7 +4250,7 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
       const details = [];
       for (const role of roles) {
         const roleRelDir = relative(ctx.repoRoot, role.roleDir);
-        const runtimeRelPath = join12(roleRelDir, "runtime");
+        const runtimeRelPath = join14(roleRelDir, "runtime");
         const lsResult = spawnSync6("git", ["ls-files", "--stage", runtimeRelPath], {
           cwd: ctx.repoRoot,
           encoding: "utf8"
@@ -3914,10 +4265,10 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
             });
           }
         }
-        const gitignorePath = join12(role.roleDir, ".gitignore");
+        const gitignorePath = join14(role.roleDir, ".gitignore");
         let content = "";
         let isIgnored = false;
-        if (existsSync9(gitignorePath)) {
+        if (existsSync10(gitignorePath)) {
           content = safeReadText(gitignorePath) ?? "";
           const lines = content.split(/\r?\n/).map((line) => line.trim());
           isIgnored = lines.includes("runtime/") || lines.includes("runtime");
@@ -3984,9 +4335,9 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
         return { id: finding.id, title: finding.title, status: "blocked", summary: "systemd --user unavailable on this host", changedFiles, details };
       }
       for (const role of roles) {
-        const sysDir = join12(ctx.homeDir, ".config", "systemd", "user");
+        const sysDir = join14(ctx.homeDir, ".config", "systemd", "user");
         const units = [`hermes-${role.agentId}-gateway.service`, `hermes-${role.agentId}-consumer.service`, `hermes-${role.agentId}-heartbeat.timer`];
-        const allUnitsPresent = units.every((unit) => existsSync9(join12(sysDir, unit)));
+        const allUnitsPresent = units.every((unit) => existsSync10(join14(sysDir, unit)));
         if (allUnitsPresent) {
           if (ctx.dryRun) {
             details.push(`would run: systemctl --user enable --now ${units.join(" ")}`);
@@ -3998,8 +4349,8 @@ ticket_provider: ${String(project.ticket_provider?.type ?? "plane")}
           }
           continue;
         }
-        for (const script of [join12(role.roleDir, ".scripts", "70-systemd.sh")]) {
-          if (!script || !existsSync9(script)) continue;
+        for (const script of [join14(role.roleDir, ".scripts", "70-systemd.sh")]) {
+          if (!script || !existsSync10(script)) continue;
           if (ctx.dryRun) {
             details.push(`would run: bash ${script}`);
           } else {
@@ -4026,7 +4377,7 @@ function writeIfDifferent(path, content, dryRun, changedFiles, mode) {
   changedFiles.push(path);
   if (!dryRun) {
     writeText(path, normalized);
-    if (mode) chmodSync2(path, mode);
+    if (mode) chmodSync4(path, mode);
   }
 }
 function getParityRuleIds() {
@@ -4123,7 +4474,7 @@ var server = new McpServer({
 var TICKET_PROVIDER_SCHEMA = z.enum(["plane", "trello"]);
 function resolveTargetDir(targetDir) {
   const dir = resolve3(targetDir ?? process.cwd());
-  if (!existsSync10(dir)) {
+  if (!existsSync11(dir)) {
     throw new Error(`Target directory does not exist: ${dir}`);
   }
   if (!statSync2(dir).isDirectory()) {
@@ -4134,7 +4485,7 @@ function resolveTargetDir(targetDir) {
 function resolvePjanglerRoot3() {
   let dir = dirname8(fileURLToPath5(import.meta.url));
   while (dir !== dirname8(dir)) {
-    if (existsSync10(join13(dir, "package.json")) && existsSync10(join13(dir, "templates", "commonproject", "copier.yml"))) {
+    if (existsSync11(join15(dir, "package.json")) && existsSync11(join15(dir, "templates", "commonproject", "copier.yml"))) {
       return dir;
     }
     dir = dirname8(dir);
@@ -4336,8 +4687,8 @@ server.registerTool(
       const pjanglerRoot = resolvePjanglerRoot3();
       const projectSlug = input.projectSlug ?? slugify(input.projectName);
       const parentDir = resolve3(input.parentDir ?? process.cwd());
-      if (!existsSync10(parentDir) || !statSync2(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
-      const targetDir = resolve3(input.targetDir ?? join13(parentDir, projectSlug));
+      if (!existsSync11(parentDir) || !statSync2(parentDir).isDirectory()) throw new Error(`Parent directory does not exist: ${parentDir}`);
+      const targetDir = resolve3(input.targetDir ?? join15(parentDir, projectSlug));
       const overwrite = input.overwrite ?? input.force ?? false;
       const dryRun = input.dryRun ?? true;
       const local = input.local ?? true;
@@ -4347,7 +4698,7 @@ server.registerTool(
       if (!skipPlane && ticketProvider === "plane" && !boardId) {
         throw new Error("boardId or planeProjectId is required when skipPlane=false for Plane; keep skipPlane=true for safe local bootstrap");
       }
-      if (!dryRun && existsSync10(targetDir) && !overwrite) throw new Error(`Target already exists: ${targetDir} (set force/overwrite=true to re-render)`);
+      if (!dryRun && existsSync11(targetDir) && !overwrite) throw new Error(`Target already exists: ${targetDir} (set force/overwrite=true to re-render)`);
       const plan = planProjectInit({
         name: input.projectName,
         description: input.projectDescription,