@fased/fased 0.1.61 → 0.1.64

package/dist/plugin-sdk/sat-runtime.js

@@ -1,16 +1,16 @@
-import { $n as enforceWalletCustodyForAutonomousSend, Ar as loadOrCreateDeviceIdentity, Er as callGatewayScoped, Kn as readWalletStatusSnapshot, Mr as signDevicePayload, Nr as verifyDeviceSignature, Or as ErrorCodes, Sr as tryResolveSatRuntimeIds, _r as SAT_RUNTIME_DEFAULTS, ar as readWalletProviderRegistry, br as resolveSatMintProgramIdFromEnv, cr as callLocalSocketSigner, dr as resolveLocalSignerSocketPath, er as createWalletProviderAdapter, fr as resolveWalletRuntimeConfig, gr as syncSatMainnetRuntimeIds, hr as getSatMainnetSyncStatus, ir as resolveWalletRolePolicyProfile, j as resolveModel, jr as publicKeyRawBase64UrlFromPem, kr as errorShape, lr as probeLocalSocketSignerHealth, mr as buildAttestation, nr as loadWalletProviderSecret, or as resolveWalletUserRole, pr as fetchSolanaWalletAssetsViaRpc, qn as createOrExecuteWalletSend, rr as resolveWalletPolicyConfig, sr as upsertNamedWallet, tr as resolveWalletProviderId, ur as requireLocalSocketSignerPath, vr as resolveSatBondProgramIdFromEnv, xr as resolveSatProgramIdFromEnv, yr as resolveSatMintAddressFromEnv } from "./config-schema-CGW6J3Pv.js";
-import "./runtime-Bb6KRnCC.js";
+import { Ar as errorShape, Cr as tryResolveSatRuntimeIds, Dr as callGatewayScoped, Jn as createSignerReviewApprovalRequest, Kn as readWalletStatusSnapshot, Mr as publicKeyRawBase64UrlFromPem, Nr as signDevicePayload, Pr as verifyDeviceSignature, Sr as resolveSatProgramIdFromEnv, _r as syncSatMainnetRuntimeIds, ar as readWalletProviderRegistry, br as resolveSatMintAddressFromEnv, cr as LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE, dr as requireLocalSocketSignerPath, er as resolveWalletPolicyConfig, fr as resolveLocalSignerSocketPath, gr as getSatMainnetSyncStatus, hr as buildAttestation, ir as loadWalletProviderSecret, j as resolveModel, jr as loadOrCreateDeviceIdentity, kr as ErrorCodes, lr as callLocalSocketSigner, mr as fetchSolanaWalletAssetsViaRpc, nr as createWalletProviderAdapter, or as resolveWalletUserRole, pr as resolveWalletRuntimeConfig, qn as createOrExecuteWalletSend, rr as resolveWalletProviderId, sr as upsertNamedWallet, tr as resolveWalletRolePolicyProfile, ur as probeLocalSocketSignerHealth, vr as SAT_RUNTIME_DEFAULTS, xr as resolveSatMintProgramIdFromEnv, yr as resolveSatBondProgramIdFromEnv } from "./config-schema-BOT7kHb6.js";
+import "./runtime-2B9_WKoI.js";
 import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
 import { w as resolvePreferredFasedAgentTmpDir } from "./globals-B_jjtAje.js";
-import { i as resolveGatewayPort } from "./paths-BEmvSyOV.js";
+import { i as resolveGatewayPort, s as resolveStateDir } from "./paths-BEmvSyOV.js";
 import "./utils-CYk9EKoq.js";
-import { Bt as buildModelAliasIndex, Jt as resolveConfiguredModelRef, Yt as resolveDefaultModelForAgent, Zt as resolveModelRefFromString, an as getApiKeyForModel, n as loadConfig, na as DEFAULT_PROVIDER, sn as requireApiKey } from "./config-mxULv0fQ.js";
+import { $i as DEFAULT_PROVIDER, Qt as resolveModelRefFromString, Vt as buildModelAliasIndex, Xt as resolveDefaultModelForAgent, Yt as resolveConfiguredModelRef, cn as requireApiKey, ma as withFileLock, on as getApiKeyForModel, r as loadConfig } from "./config-DlWVeLFB.js";
 import { a as resolveAgentDir, i as resolveAgentConfig, o as resolveAgentEffectiveModelPrimary, u as resolveDefaultAgentId } from "./agent-scope-CCjfjKoO.js";
 import "./accounts-RHZyaB73.js";
 import "./accounts-CuqIKU8X.js";
 import "./logger-BbFvCoKk.js";
 import "./exec-DQ8j4Fm3.js";
-import "./accounts-DxblobYM.js";
+import "./accounts-Brn3-uWN.js";
 import "./allow-list-DyAxs4yw.js";
 import "./redact-Bm8vu_ju.js";
 import "./github-copilot-token-CUK__1s1.js";
@@ -18,41 +18,41 @@ import "./retry-DstNBhDW.js";
 import "./paths-CTZ2RS_E.js";
 import "./ssrf-fG4UHKBw.js";
 import "./fetch-guard-CeG6u6ld.js";
-import "./send-D-uDKGIq.js";
-import "./helpers-BXbdgs5H.js";
-import "./wsl-C4DGFkOd.js";
-import "./pairing-store-CQikgIbw.js";
-import "./chunk-B0FUGc5A.js";
+import "./send-CFzGKJXo.js";
+import "./helpers-DMBU4oTo.js";
+import "./wsl-J-HscWxS.js";
+import "./pairing-store-BChahgI2.js";
+import "./chunk-CyoyqpbG.js";
 import "./tailscale-status-DwpNdO3Z.js";
 import "./reply-prefix-CeVw7Mn2.js";
 import "./tokens-BbnqfVuu.js";
 import "./pairing-token-Cs3BRKc0.js";
 import "./diagnostic-DLL_zekv.js";
 import "./diagnostic-session-state-DqgfGYqZ.js";
-import "./optional-runtime-dependency-DdMbxS24.js";
-import "./image-ops-D7jPxaph.js";
-import "./memory-search-DTjIMw8J.js";
-import "./manager-Y2S_5IlI.js";
-import "./query-expansion-CAI2kKLQ.js";
-import "./common-CfUOowOp.js";
-import "./commands-registry-DmDRhRAU.js";
-import "./runtime-dependency-DLDmB94f.js";
+import "./optional-runtime-dependency-0dznm3ZO.js";
+import "./image-ops-DQi0n_Tt.js";
+import "./memory-search-CrFPOeTH.js";
+import "./manager-BegWxNYX.js";
+import "./query-expansion-BG3FgzF7.js";
+import "./common-HCcXU-NR.js";
+import "./commands-registry-BfqdEWdF.js";
+import "./runtime-dependency-DczkvPxn.js";
 import "./path-alias-guards-DjgDArrp.js";
 import "./fs-safe-g4g7GT02.js";
-import "./markdown-tables-DHLFQqaF.js";
-import "./media-Czo4carg.js";
-import "./send-C4k4JuJN.js";
-import "./outbound-attachment-BqFjcypb.js";
+import "./media-CAdQF5TG.js";
+import "./markdown-tables-DCOXEUfZ.js";
+import "./send-B6KkGKZD.js";
+import "./outbound-attachment-QqTnIhZL.js";
 import "./fetch-BtmoPIlf.js";
-import "./thread-bindings.state-CQpk44Hq.js";
-import "./skill-commands-CFAlXWHk.js";
+import "./thread-bindings.state-D9hg_M1c.js";
+import "./skill-commands-FKEPLS7T.js";
 import "./sandbox-paths-Dx2lUqCu.js";
 import "./directory-live-CSuYxdwk.js";
-import "./targets-DH7a9lKB.js";
-import "./pi-model-discovery-CY3m5zJP.js";
-import "./resolve-route-CDl74O19.js";
+import "./targets-CtSbTxYX.js";
+import "./pi-model-discovery-BX_JLcEJ.js";
+import "./resolve-route-C8tvQm8Z.js";
 import "./render-e7fENCYH.js";
-import "./tables-bFXyRpkx.js";
+import "./tables-B3jr0Pvq.js";
 import "./shared-CBgp_GBw.js";
 
 //#region src/plugin-sdk/sat-runtime.ts
@@ -61,4 +61,4 @@ async function fetchWithSsrFGuard(params) {
 }
 
 //#endregion
-export { DEFAULT_PROVIDER, ErrorCodes, SAT_RUNTIME_DEFAULTS, buildAttestation, buildModelAliasIndex, callGatewayScoped, callLocalSocketSigner, createOrExecuteWalletSend, createSubsystemLogger, createWalletProviderAdapter, enforceWalletCustodyForAutonomousSend, errorShape, fetchSolanaWalletAssetsViaRpc, fetchWithSsrFGuard, getApiKeyForModel, getSatMainnetSyncStatus, loadConfig, loadOrCreateDeviceIdentity, loadWalletProviderSecret, probeLocalSocketSignerHealth, publicKeyRawBase64UrlFromPem, readWalletProviderRegistry, readWalletStatusSnapshot, requireApiKey, requireLocalSocketSignerPath, resolveAgentConfig, resolveAgentDir, resolveAgentEffectiveModelPrimary, resolveConfiguredModelRef, resolveDefaultAgentId, resolveDefaultModelForAgent, resolveGatewayPort, resolveLocalSignerSocketPath, resolveModel, resolveModelRefFromString, resolvePreferredFasedAgentTmpDir, resolveSatBondProgramIdFromEnv, resolveSatMintAddressFromEnv, resolveSatMintProgramIdFromEnv, resolveSatProgramIdFromEnv, resolveWalletPolicyConfig, resolveWalletProviderId, resolveWalletRolePolicyProfile, resolveWalletRuntimeConfig, resolveWalletUserRole, signDevicePayload, syncSatMainnetRuntimeIds, tryResolveSatRuntimeIds, upsertNamedWallet, verifyDeviceSignature };
+export { DEFAULT_PROVIDER, ErrorCodes, LEGACY_EMBEDDED_KEYSTORE_MIGRATION_MESSAGE, SAT_RUNTIME_DEFAULTS, buildAttestation, buildModelAliasIndex, callGatewayScoped, callLocalSocketSigner, createOrExecuteWalletSend, createSignerReviewApprovalRequest, createSubsystemLogger, createWalletProviderAdapter, errorShape, fetchSolanaWalletAssetsViaRpc, fetchWithSsrFGuard, getApiKeyForModel, getSatMainnetSyncStatus, loadConfig, loadOrCreateDeviceIdentity, loadWalletProviderSecret, probeLocalSocketSignerHealth, publicKeyRawBase64UrlFromPem, readWalletProviderRegistry, readWalletStatusSnapshot, requireApiKey, requireLocalSocketSignerPath, resolveAgentConfig, resolveAgentDir, resolveAgentEffectiveModelPrimary, resolveConfiguredModelRef, resolveDefaultAgentId, resolveDefaultModelForAgent, resolveGatewayPort, resolveLocalSignerSocketPath, resolveModel, resolveModelRefFromString, resolvePreferredFasedAgentTmpDir, resolveSatBondProgramIdFromEnv, resolveSatMintAddressFromEnv, resolveSatMintProgramIdFromEnv, resolveSatProgramIdFromEnv, resolveStateDir, resolveWalletPolicyConfig, resolveWalletProviderId, resolveWalletRolePolicyProfile, resolveWalletRuntimeConfig, resolveWalletUserRole, signDevicePayload, syncSatMainnetRuntimeIds, tryResolveSatRuntimeIds, upsertNamedWallet, verifyDeviceSignature, withFileLock };

package/dist/plugin-sdk/{send-C4k4JuJN.js → send-B6KkGKZD.js}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { fn as resolveSignalAccount } from "./runtime-Bb6KRnCC.js";
-import { n as loadConfig } from "./config-mxULv0fQ.js";
+import { fn as resolveSignalAccount } from "./runtime-2B9_WKoI.js";
+import { r as loadConfig } from "./config-DlWVeLFB.js";
 import { n as fetchWithTimeout } from "./fetch-timeout-l_6RdoMw.js";
 import { n as generateSecureUuid } from "./secure-random-BIkG-k4s.js";
-import { v as mediaKindFromMime } from "./image-ops-D7jPxaph.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-DHLFQqaF.js";
-import { c as markdownToIR, s as chunkMarkdownIR } from "./media-Czo4carg.js";
-import { t as resolveOutboundAttachmentFromUrl } from "./outbound-attachment-BqFjcypb.js";
+import { v as mediaKindFromMime } from "./image-ops-DQi0n_Tt.js";
+import { o as chunkMarkdownIR, s as markdownToIR } from "./media-CAdQF5TG.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-DCOXEUfZ.js";
+import { t as resolveOutboundAttachmentFromUrl } from "./outbound-attachment-QqTnIhZL.js";
 import { t as resolveFetch } from "./fetch-BtmoPIlf.js";
 
 //#region src/signal/format.ts

package/dist/plugin-sdk/{send-D-uDKGIq.js → send-CFzGKJXo.js}

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { hn as resolveIMessageAccount } from "./runtime-Bb6KRnCC.js";
+import { hn as resolveIMessageAccount } from "./runtime-2B9_WKoI.js";
 import { d as normalizeE164, h as resolveUserPath } from "./utils-CYk9EKoq.js";
-import { n as loadConfig } from "./config-mxULv0fQ.js";
-import { v as mediaKindFromMime } from "./image-ops-D7jPxaph.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-DHLFQqaF.js";
-import { t as resolveOutboundAttachmentFromUrl } from "./outbound-attachment-BqFjcypb.js";
-import { t as convertMarkdownTables } from "./tables-bFXyRpkx.js";
+import { r as loadConfig } from "./config-DlWVeLFB.js";
+import { v as mediaKindFromMime } from "./image-ops-DQi0n_Tt.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-DCOXEUfZ.js";
+import { t as resolveOutboundAttachmentFromUrl } from "./outbound-attachment-QqTnIhZL.js";
+import { t as convertMarkdownTables } from "./tables-B3jr0Pvq.js";
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
 

package/dist/plugin-sdk/{send-Du8ykP1k.js → send-DCO441U7.js}

@@ -1,17 +1,17 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { w as resolvePreferredFasedAgentTmpDir } from "./globals-B_jjtAje.js";
-import { n as loadConfig } from "./config-mxULv0fQ.js";
+import { r as loadConfig } from "./config-DlWVeLFB.js";
 import { a as resolveDiscordAccount } from "./accounts-RHZyaB73.js";
 import { t as normalizeDiscordToken } from "./token-D4-H0ByG.js";
-import { c as resolveChunkMode, i as chunkMarkdownTextWithMode } from "./chunk-B0FUGc5A.js";
-import { _ as maxBytesForKind, l as extensionForMime } from "./image-ops-D7jPxaph.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-DHLFQqaF.js";
-import { n as loadWebMedia, r as loadWebMediaRaw } from "./media-Czo4carg.js";
-import { r as resolveDiscordTarget, t as parseDiscordTarget } from "./targets-DH7a9lKB.js";
+import { c as resolveChunkMode, i as chunkMarkdownTextWithMode } from "./chunk-CyoyqpbG.js";
+import { _ as maxBytesForKind, l as extensionForMime } from "./image-ops-DQi0n_Tt.js";
+import { n as loadWebMedia, r as loadWebMediaRaw } from "./media-CAdQF5TG.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-DCOXEUfZ.js";
+import { r as resolveDiscordTarget, t as parseDiscordTarget } from "./targets-CtSbTxYX.js";
 import { n as normalizePollInput, t as normalizePollDurationHours } from "./polls-DKQXVfJp.js";
-import { t as convertMarkdownTables } from "./tables-bFXyRpkx.js";
+import { t as convertMarkdownTables } from "./tables-B3jr0Pvq.js";
 import { n as recordChannelActivity } from "./channel-activity-DBDMQ3yI.js";
-import { t as createDiscordRetryRunner } from "./retry-policy-D4uiqUOG.js";
+import { t as createDiscordRetryRunner } from "./retry-policy-C6SjKjQA.js";
 import path from "node:path";
 import { promisify } from "node:util";
 import fs from "node:fs/promises";

package/dist/plugin-sdk/{send-5nFktR1n.js → send-gDoGA-7e.js}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { bt as parseSlackTarget } from "./runtime-Bb6KRnCC.js";
+import { bt as parseSlackTarget } from "./runtime-2B9_WKoI.js";
 import { i as logVerbose } from "./globals-B_jjtAje.js";
-import { n as loadConfig } from "./config-mxULv0fQ.js";
+import { r as loadConfig } from "./config-DlWVeLFB.js";
 import { i as resolveSlackAccount, s as resolveSlackBotToken } from "./accounts-CuqIKU8X.js";
-import { c as resolveChunkMode, i as chunkMarkdownTextWithMode, l as resolveTextChunkLimit } from "./chunk-B0FUGc5A.js";
+import { c as resolveChunkMode, i as chunkMarkdownTextWithMode, l as resolveTextChunkLimit } from "./chunk-CyoyqpbG.js";
 import { i as isSilentReplyText } from "./tokens-BbnqfVuu.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-DHLFQqaF.js";
-import { c as markdownToIR, n as loadWebMedia, s as chunkMarkdownIR } from "./media-Czo4carg.js";
+import { n as loadWebMedia, o as chunkMarkdownIR, s as markdownToIR } from "./media-CAdQF5TG.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-DCOXEUfZ.js";
 import { t as renderMarkdownWithMarkers } from "./render-e7fENCYH.js";
 import { n as validateSlackBlocksArray } from "./blocks-input-Bg-8S2pl.js";
 import { n as createSlackWebClient } from "./client-pI228AVT.js";

package/dist/plugin-sdk/{send-Bfzf11VY.js → send-q9HXrSwK.js}

@@ -1,19 +1,19 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
-import { in as resolveTelegramAccount } from "./runtime-Bb6KRnCC.js";
+import { in as resolveTelegramAccount } from "./runtime-2B9_WKoI.js";
 import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
 import { i as logVerbose, t as danger } from "./globals-B_jjtAje.js";
-import { Ca as isTruthyEnvValue, a as readConfigFileSnapshotForWrite, da as formatUncaughtError, la as extractErrorCode, n as loadConfig, s as writeConfigFile, ua as formatErrorMessage } from "./config-mxULv0fQ.js";
+import { c as writeConfigFile, ca as formatUncaughtError, o as readConfigFileSnapshotForWrite, oa as extractErrorCode, r as loadConfig, sa as formatErrorMessage, wa as isTruthyEnvValue } from "./config-DlWVeLFB.js";
 import { n as redactSensitiveText } from "./redact-Bm8vu_ju.js";
-import { M as isTelegramVoiceCompatibleAudio, a as resolveCronStorePath, i as loadCronStore, o as saveCronStore, p as buildTelegramThreadParams, t as isWSL2Sync } from "./wsl-C4DGFkOd.js";
+import { M as isTelegramVoiceCompatibleAudio, a as resolveCronStorePath, i as loadCronStore, o as saveCronStore, p as buildTelegramThreadParams, t as isWSL2Sync } from "./wsl-J-HscWxS.js";
 import { n as normalizeTelegramLookupTarget, r as parseTelegramTarget, t as normalizeTelegramChatId } from "./targets-CoMJ1ry1.js";
-import { p as isGifMedia, v as mediaKindFromMime } from "./image-ops-D7jPxaph.js";
-import { n as resolveMarkdownTableMode } from "./markdown-tables-DHLFQqaF.js";
-import { c as markdownToIR, n as loadWebMedia, s as chunkMarkdownIR } from "./media-Czo4carg.js";
+import { p as isGifMedia, v as mediaKindFromMime } from "./image-ops-DQi0n_Tt.js";
+import { n as loadWebMedia, o as chunkMarkdownIR, s as markdownToIR } from "./media-CAdQF5TG.js";
+import { n as resolveMarkdownTableMode } from "./markdown-tables-DCOXEUfZ.js";
 import { t as resolveFetch } from "./fetch-BtmoPIlf.js";
 import { n as normalizePollInput } from "./polls-DKQXVfJp.js";
 import { t as renderMarkdownWithMarkers } from "./render-e7fENCYH.js";
 import { n as recordChannelActivity } from "./channel-activity-DBDMQ3yI.js";
-import { n as createTelegramRetryRunner } from "./retry-policy-D4uiqUOG.js";
+import { n as createTelegramRetryRunner } from "./retry-policy-C6SjKjQA.js";
 import { t as makeProxyFetch } from "./proxy-DWpYcsvR.js";
 import process$1 from "node:process";
 import { Agent, setGlobalDispatcher } from "undici";

package/dist/plugin-sdk/{session-CS-Td9EM.js → session-DHD4ZKyG.js}

@@ -1,7 +1,7 @@
 import { _ as toPinoLikeLogger, c as success, p as getChildLogger, t as danger } from "./globals-B_jjtAje.js";
 import { a as ensureDir, h as resolveUserPath } from "./utils-CYk9EKoq.js";
-import { ra as VERSION, xa as formatCliCommand } from "./config-mxULv0fQ.js";
-import { f as readCredsJsonRaw, g as resolveWebCredsPath, h as resolveWebCredsBackupPath, m as resolveDefaultWebAuthDir, u as maybeRestoreCredsFromBackup } from "./accounts-DxblobYM.js";
+import { Sa as formatCliCommand, ea as VERSION } from "./config-DlWVeLFB.js";
+import { f as readCredsJsonRaw, g as resolveWebCredsPath, h as resolveWebCredsBackupPath, m as resolveDefaultWebAuthDir, u as maybeRestoreCredsFromBackup } from "./accounts-Brn3-uWN.js";
 import { n as redactSensitiveText } from "./redact-Bm8vu_ju.js";
 import { n as redactSensitiveUrlLikeString } from "./redact-sensitive-url-g-ukZjwA.js";
 import fs from "node:fs";

package/dist/plugin-sdk/{skill-commands-CFAlXWHk.js → skill-commands-FKEPLS7T.js}

@@ -1,18 +1,19 @@
 import { t as __exportAll } from "./rolldown-runtime-Cbj13DAv.js";
 import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
 import { h as resolveUserPath, t as CONFIG_DIR } from "./utils-CYk9EKoq.js";
-import { Da as normalizePluginsConfig, Oa as resolveEffectiveEnableState, Un as loadPluginManifestRegistry, _a as isDangerousHostEnvVarName, ca as MANIFEST_KEY, ka as resolveMemorySlotDecision, wa as parseBooleanValue } from "./config-mxULv0fQ.js";
+import { Aa as resolveMemorySlotDecision, Mi as loadPluginManifestRegistry, Oa as normalizePluginsConfig, Ta as parseBooleanValue, aa as MANIFEST_KEY, ka as resolveEffectiveEnableState, n as getRuntimeConfigSnapshot, va as isDangerousHostEnvVarName } from "./config-DlWVeLFB.js";
 import { B as normalizeSkillFilter, O as resolveFasedAgentPackageRootSync, l as resolveAgentWorkspaceDir, q as normalizeStringEntries, r as listAgentIds, z as resolveEffectiveAgentSkillFilter } from "./agent-scope-CCjfjKoO.js";
 import { o as createAsyncLock } from "./pairing-token-Cs3BRKc0.js";
-import { a as listChatCommands } from "./commands-registry-DmDRhRAU.js";
+import { a as listChatCommands } from "./commands-registry-BfqdEWdF.js";
 import { i as resolveSandboxPath } from "./sandbox-paths-Dx2lUqCu.js";
 import path from "node:path";
 import fs from "node:fs";
 import os from "node:os";
 import JSON5 from "json5";
 import { fileURLToPath } from "node:url";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { formatSkillsForPrompt, loadSkillsFromDir } from "@mariozechner/pi-coding-agent";
+import { AsyncLocalStorage } from "node:async_hooks";
 import chokidar from "chokidar";
 import YAML from "yaml";
 
@@ -502,10 +503,80 @@ function sanitizeEnvVars(envVars, options = {}) {
 	};
 }
 
+//#endregion
+//#region src/agents/skills/trust.ts
+const MARKETPLACE_ORIGIN_DIRS = [".clawhub", ".clawdhub"];
+function hasMarketplaceOriginMarker(root) {
+	return MARKETPLACE_ORIGIN_DIRS.some((dir) => fs.existsSync(path.join(root, dir, "origin.json")));
+}
+function isTrackedMarketplaceSkill(root) {
+	const skillsDir = path.dirname(root);
+	if (path.basename(skillsDir) !== "skills") return false;
+	const slug = path.basename(root);
+	const workspaceDir = path.dirname(skillsDir);
+	for (const directory of MARKETPLACE_ORIGIN_DIRS) try {
+		const lock = JSON.parse(fs.readFileSync(path.join(workspaceDir, directory, "lock.json"), "utf8"));
+		if (lock.version === 1 && lock.skills?.[slug]) return true;
+	} catch {}
+	return false;
+}
+function computeSkillContentSha256Sync(skillDir) {
+	try {
+		const digest = createHash("sha256");
+		const queue = [path.resolve(skillDir)];
+		while (queue.length > 0) {
+			const current = queue.shift();
+			if (!current) continue;
+			const entries = fs.readdirSync(current, { withFileTypes: true }).toSorted((left, right) => left.name.localeCompare(right.name));
+			for (const entry of entries) {
+				if (entry.name.startsWith(".")) continue;
+				const fullPath = path.join(current, entry.name);
+				if (entry.isDirectory() && !entry.isSymbolicLink()) {
+					queue.push(fullPath);
+					continue;
+				}
+				if (!entry.isFile() || entry.isSymbolicLink()) return null;
+				digest.update(path.relative(skillDir, fullPath).split(path.sep).join("/"));
+				digest.update("\n");
+				digest.update(fs.readFileSync(fullPath));
+				digest.update("\n");
+			}
+		}
+		return digest.digest("hex");
+	} catch {
+		return null;
+	}
+}
+function marketplaceSkillProvenanceMatchesContent(skillDir) {
+	const root = skillDir.trim();
+	if (!root) return false;
+	for (const directory of MARKETPLACE_ORIGIN_DIRS) try {
+		const origin = JSON.parse(fs.readFileSync(path.join(root, directory, "origin.json"), "utf8"));
+		if (origin.version === 1 && origin.archiveIntegrityVerified === true && typeof origin.archiveSha256 === "string" && /^[a-f0-9]{64}$/u.test(origin.archiveSha256) && typeof origin.contentSha256 === "string" && /^[a-f0-9]{64}$/u.test(origin.contentSha256) && computeSkillContentSha256Sync(root) === origin.contentSha256) return true;
+	} catch {}
+	return false;
+}
+function isMarketplaceSkillDir(skillDir) {
+	const root = skillDir.trim();
+	return Boolean(root && (hasMarketplaceOriginMarker(root) || isTrackedMarketplaceSkill(root)));
+}
+function marketplaceSkillIdsFromEntries(entries) {
+	return [...new Set(entries.filter((entry) => isMarketplaceSkillDir(entry.skill.baseDir)).map((entry) => entry.skill.name.trim()).filter(Boolean))].toSorted();
+}
+function marketplaceSkillIdsFromSnapshot(snapshot) {
+	if (!snapshot) return [];
+	if (snapshot.marketplaceSkillIds) return [...new Set(snapshot.marketplaceSkillIds.map((id) => id.trim()).filter(Boolean))].toSorted();
+	return [...new Set((snapshot.resolvedSkills ?? []).filter((skill) => isMarketplaceSkillDir(skill.baseDir)).map((skill) => skill.name.trim()).filter(Boolean))].toSorted();
+}
+
 //#endregion
 //#region src/agents/skills/env-overrides.ts
 const log$3 = createSubsystemLogger("env-overrides");
-const activeSkillEnvKeys = /* @__PURE__ */ new Set();
+const skillEnvStorage = new AsyncLocalStorage();
+/** Trusted, invocation-scoped env consumed by exec without mutating process.env. */
+function getActiveSkillEnvOverrides() {
+	return skillEnvStorage.getStore() ?? {};
+}
 const SKILL_ALWAYS_BLOCKED_ENV_PATTERNS = [/^OPENSSL_CONF$/i];
 function matchesAnyPattern(value, patterns) {
 	return patterns.some((pattern) => pattern.test(value));
@@ -554,7 +625,7 @@ function sanitizeSkillEnvOverrides(params) {
 	};
 }
 function applySkillConfigEnvOverrides(params) {
-	const { updates, skillConfig, primaryEnv, requiredEnv, skillKey } = params;
+	const { overrides, skillConfig, primaryEnv, requiredEnv, skillKey } = params;
 	const allowedSensitiveKeys = /* @__PURE__ */ new Set();
 	const normalizedPrimaryEnv = primaryEnv?.trim();
 	if (normalizedPrimaryEnv) allowedSensitiveKeys.add(normalizedPrimaryEnv);
@@ -580,56 +651,57 @@ function applySkillConfigEnvOverrides(params) {
 	if (sanitized.warnings.length > 0) log$3.warn(`Suspicious skill env overrides for ${skillKey}: ${sanitized.warnings.join(", ")}`);
 	for (const [envKey, envValue] of Object.entries(sanitized.allowed)) {
 		if (process.env[envKey]) continue;
-		updates.push({
-			key: envKey,
-			prev: process.env[envKey]
-		});
-		process.env[envKey] = envValue;
-		activeSkillEnvKeys.add(envKey);
+		overrides[envKey] = envValue;
 	}
 }
-function createEnvReverter(updates) {
+function activateSkillEnv(overrides) {
+	const previous = skillEnvStorage.getStore();
+	skillEnvStorage.enterWith(Object.freeze({
+		...previous ?? {},
+		...overrides
+	}));
 	return () => {
-		for (const update of updates) {
-			if (update.prev === void 0) delete process.env[update.key];
-			else process.env[update.key] = update.prev;
-			activeSkillEnvKeys.delete(update.key);
-		}
+		skillEnvStorage.enterWith(previous ?? Object.freeze({}));
 	};
 }
 function applySkillEnvOverrides(params) {
-	const { skills, config } = params;
-	const updates = [];
+	const skills = params.skills;
+	const config = getRuntimeConfigSnapshot() ?? params.config;
+	const overrides = {};
 	for (const entry of skills) {
+		if (params.excludeMarketplace !== false && isMarketplaceSkillDir(entry.skill.baseDir)) continue;
 		const skillKey = resolveSkillKey(entry.skill, entry);
 		const skillConfig = resolveSkillConfig(config, skillKey);
 		if (!skillConfig) continue;
 		applySkillConfigEnvOverrides({
-			updates,
+			overrides,
 			skillConfig,
 			primaryEnv: entry.metadata?.primaryEnv,
 			requiredEnv: entry.metadata?.requires?.env,
 			skillKey
 		});
 	}
-	return createEnvReverter(updates);
+	return activateSkillEnv(overrides);
 }
 function applySkillEnvOverridesFromSnapshot(params) {
-	const { snapshot, config } = params;
+	const snapshot = params.snapshot;
+	const config = getRuntimeConfigSnapshot() ?? params.config;
 	if (!snapshot) return () => {};
-	const updates = [];
+	const overrides = {};
+	const marketplaceSkills = new Set(params.excludeMarketplace === false ? [] : snapshot.marketplaceSkillIds ?? []);
 	for (const skill of snapshot.skills) {
+		if (marketplaceSkills.has(skill.name)) continue;
 		const skillConfig = resolveSkillConfig(config, skill.name);
 		if (!skillConfig) continue;
 		applySkillConfigEnvOverrides({
-			updates,
+			overrides,
 			skillConfig,
 			primaryEnv: skill.primaryEnv,
 			requiredEnv: skill.requiredEnv,
 			skillKey: skill.name
 		});
 	}
-	return createEnvReverter(updates);
+	return activateSkillEnv(overrides);
 }
 
 //#endregion
@@ -750,6 +822,7 @@ async function serializeByKey(key, task) {
 const fsp = fs.promises;
 const skillsLogger = createSubsystemLogger("skills");
 const skillCommandDebugOnce = /* @__PURE__ */ new Set();
+const CLAUDE_BUNDLE_MANIFEST_MAX_BYTES = 64 * 1024;
 /**
 * Replace the user's home directory prefix with `~` in skill file paths
 * to reduce system prompt token usage. Models understand `~` expansion,
@@ -1048,6 +1121,7 @@ function buildWorkspaceSkillSnapshot(workspaceDir, opts) {
 		})),
 		...skillFilter === void 0 ? {} : { skillFilter },
 		resolvedSkills,
+		marketplaceSkillIds: marketplaceSkillIdsFromEntries(eligible),
 		version: opts?.snapshotVersion
 	};
 }
@@ -1058,6 +1132,92 @@ function resolveEffectiveSkillFilter(opts) {
 	if (opts?.skillFilter !== void 0) return normalizeSkillFilter(opts.skillFilter) ?? [];
 	if (opts?.agentId !== void 0) return resolveEffectiveAgentSkillFilter(opts.config, opts.agentId);
 }
+function isExplicitlyEnabledClaudeBundle(pluginId, config) {
+	const plugins = config?.plugins;
+	if (plugins?.enabled === false || plugins?.deny?.includes(pluginId)) return false;
+	if (plugins?.allow?.length && !plugins.allow.includes(pluginId)) return false;
+	return plugins?.entries?.[pluginId]?.enabled === true;
+}
+function stripMarkdownFrontmatter(content) {
+	const normalized = content.replace(/\r\n?/gu, "\n");
+	if (!normalized.startsWith("---\n")) return normalized.trim();
+	const end = normalized.indexOf("\n---", 4);
+	if (end < 0) return "";
+	return normalized.slice(end + 4).replace(/^\n/u, "").trim();
+}
+function listImmediateDirectories(root) {
+	try {
+		return fs.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).map((entry) => path.join(root, entry.name));
+	} catch {
+		return [];
+	}
+}
+function loadClaudeBundleCommandSpecs(params) {
+	const roots = [
+		...listImmediateDirectories(path.join(CONFIG_DIR, "extensions")),
+		...listImmediateDirectories(path.join(params.workspaceDir, ".fased", "extensions")),
+		...(params.config?.plugins?.load?.paths ?? []).map((entry) => resolveUserPath(entry))
+	];
+	const seen = /* @__PURE__ */ new Set();
+	const specs = [];
+	for (const unresolvedRoot of roots) {
+		let root;
+		try {
+			const stat = fs.lstatSync(unresolvedRoot);
+			if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
+			root = fs.realpathSync(unresolvedRoot);
+		} catch {
+			continue;
+		}
+		if (seen.has(root) || isMarketplaceSkillDir(root)) continue;
+		seen.add(root);
+		const manifestPath = path.join(root, ".claude-plugin", "plugin.json");
+		let pluginId = "";
+		try {
+			const stat = fs.lstatSync(manifestPath);
+			if (!stat.isFile() || stat.isSymbolicLink() || stat.size <= 0 || stat.size > CLAUDE_BUNDLE_MANIFEST_MAX_BYTES) continue;
+			const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+			pluginId = typeof manifest.name === "string" ? manifest.name.trim() : "";
+		} catch {
+			continue;
+		}
+		if (!pluginId || !isExplicitlyEnabledClaudeBundle(pluginId, params.config)) continue;
+		const commandsDir = path.join(root, "commands");
+		let entries;
+		try {
+			const stat = fs.lstatSync(commandsDir);
+			if (!stat.isDirectory() || stat.isSymbolicLink()) continue;
+			entries = fs.readdirSync(commandsDir, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries.filter((candidate) => candidate.isFile() && !candidate.isSymbolicLink()).toSorted((left, right) => left.name.localeCompare(right.name)).slice(0, params.maxCandidates)) {
+			if (path.extname(entry.name).toLowerCase() !== ".md") continue;
+			const filePath = path.join(commandsDir, entry.name);
+			let content;
+			try {
+				const stat = fs.lstatSync(filePath);
+				if (stat.size <= 0 || stat.size > params.maxFileBytes) continue;
+				content = fs.readFileSync(filePath, "utf8");
+			} catch {
+				continue;
+			}
+			const frontmatter = parseFrontmatter(content);
+			const skillName = frontmatter.name?.trim();
+			const description = frontmatter.description?.trim();
+			const promptTemplate = stripMarkdownFrontmatter(content);
+			if (!skillName || !description || !promptTemplate) continue;
+			specs.push({
+				name: sanitizeSkillCommandName(skillName),
+				skillName,
+				description: description.length > SKILL_COMMAND_DESCRIPTION_MAX_LENGTH ? `${description.slice(0, SKILL_COMMAND_DESCRIPTION_MAX_LENGTH - 1)}…` : description,
+				promptTemplate,
+				sourceFilePath: filePath
+			});
+		}
+	}
+	return specs;
+}
 function resolveWorkspaceSkillPromptState(workspaceDir, opts) {
 	const eligible = filterSkillEntries(opts?.entries ?? loadSkillEntries(workspaceDir, opts), opts?.config, resolveEffectiveSkillFilter(opts), opts?.eligibility);
 	const promptEntries = eligible.filter((entry) => entry.invocation?.disableModelInvocation !== true);
@@ -1221,9 +1381,24 @@ function buildWorkspaceSkillCommandSpecs(workspaceDir, opts) {
 			name: unique,
 			skillName: rawName,
 			description,
+			sourceFilePath: entry.skill.filePath,
 			...dispatch ? { dispatch } : {}
 		});
 	}
+	const limits = resolveSkillsLimits(opts?.config);
+	for (const bundleCommand of loadClaudeBundleCommandSpecs({
+		workspaceDir,
+		config: opts?.config,
+		maxCandidates: limits.maxCandidatesPerRoot,
+		maxFileBytes: limits.maxSkillFileBytes
+	})) {
+		const unique = resolveUniqueSkillCommandName(bundleCommand.name, used);
+		used.add(unique.toLowerCase());
+		specs.push({
+			...bundleCommand,
+			name: unique
+		});
+	}
 	return specs;
 }
 
@@ -1511,4 +1686,4 @@ function resolveSkillCommandInvocation(params) {
 }
 
 //#endregion
-export { skill_commands_exports as a, getSkillsSnapshotVersion as c, resolveSkillsPromptForRun as d, syncSkillsToWorkspace as f, sanitizeEnvVars as h, resolveSkillCommandInvocation as i, buildWorkspaceSkillSnapshot as l, applySkillEnvOverridesFromSnapshot as m, listSkillCommandsForAgents as n, getRemoteSkillEligibility as o, applySkillEnvOverrides as p, listSkillCommandsForWorkspace as r, ensureSkillsWatcher as s, listReservedChatSlashCommandNames as t, loadWorkspaceSkillEntries as u };
+export { marketplaceSkillIdsFromEntries as _, skill_commands_exports as a, sanitizeEnvVars as b, getSkillsSnapshotVersion as c, resolveSkillsPromptForRun as d, syncSkillsToWorkspace as f, isMarketplaceSkillDir as g, getActiveSkillEnvOverrides as h, resolveSkillCommandInvocation as i, buildWorkspaceSkillSnapshot as l, applySkillEnvOverridesFromSnapshot as m, listSkillCommandsForAgents as n, getRemoteSkillEligibility as o, applySkillEnvOverrides as p, listSkillCommandsForWorkspace as r, ensureSkillsWatcher as s, listReservedChatSlashCommandNames as t, loadWorkspaceSkillEntries as u, marketplaceSkillIdsFromSnapshot as v, marketplaceSkillProvenanceMatchesContent as y };