@fased/fased 0.1.62 → 0.1.64

package/dist/agents/pi-embedded-runner/compact.js

@@ -19,6 +19,7 @@ import { enqueueCommandInLane } from "../../process/command-queue.js";
 import { resolveSignalReactionLevel } from "../../signal/reaction-level.js";
 import { resolveTelegramInlineButtonsScope } from "../../telegram/inline-buttons.js";
 import { resolveTelegramReactionLevel } from "../../telegram/reaction-level.js";
+import { marketplaceSkillIdsFromEntries, marketplaceSkillIdsFromSnapshot } from "../skills/trust.js";
 import { formatUserTime, resolveUserTimeFormat, resolveUserTimezone } from "../date-time.js";
 import { buildModelAliasLines } from "../model-alias-lines.js";
 import { resolveModelForExecution } from "./model.js";
@@ -29,13 +30,13 @@ import { listChannelSupportedActions, resolveChannelMessageToolHints } from "../
 import { resolveFasedAgentDocsPath } from "../docs-path.js";
 import { createPreparedEmbeddedPiSettingsManager } from "../pi-project-settings.js";
 import { detectRuntimeShell } from "../shell-utils.js";
+import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../skills/env-overrides.js";
 import { createFasedAgentCodingTools } from "../pi-tools.js";
 import { registerProviderStreamForModel } from "../provider-stream.js";
 import { repairSessionFileIfNeeded } from "../session-file-repair.js";
 import { log } from "./logger.js";
 import { sanitizeToolUseResultPairing } from "../session-transcript-repair.js";
 import { guardSessionManager } from "../session-tool-result-guard-wrapper.js";
-import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../skills/env-overrides.js";
 import { loadWorkspaceSkillEntries, resolveSkillsPromptForRun } from "../skills/workspace.js";
 import "../skills.js";
 import { resolveTranscriptPolicy } from "../transcript-policy.js";
@@ -205,10 +206,14 @@ async function compactEmbeddedPiSessionDirect(params) {
 	}
 	await fs.mkdir(resolvedWorkspace, { recursive: true });
 	const sandboxSessionKey = params.sessionKey?.trim() || params.sessionId;
+	const sourceSkillEntries = params.skillsSnapshot ? [] : loadWorkspaceSkillEntries(resolvedWorkspace, { config: params.config });
+	const marketplaceSkillIds = params.skillsSnapshot ? marketplaceSkillIdsFromSnapshot(params.skillsSnapshot) : marketplaceSkillIdsFromEntries(sourceSkillEntries);
+	const hasUntrustedSkillContent = marketplaceSkillIds.length > 0;
 	const sandbox = await resolveSandboxContext({
 		config: params.config,
 		sessionKey: sandboxSessionKey,
-		workspaceDir: resolvedWorkspace
+		workspaceDir: resolvedWorkspace,
+		forceUntrustedIsolation: hasUntrustedSkillContent
 	});
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
 	await fs.mkdir(effectiveWorkspace, { recursive: true });
@@ -224,10 +229,12 @@ async function compactEmbeddedPiSessionDirect(params) {
 		const skillEntries = shouldLoadSkillEntries ? loadWorkspaceSkillEntries(effectiveWorkspace) : [];
 		restoreSkillEnv = params.skillsSnapshot ? applySkillEnvOverridesFromSnapshot({
 			snapshot: params.skillsSnapshot,
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		}) : applySkillEnvOverrides({
 			skills: skillEntries ?? [],
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		});
 		const skillsPrompt = resolveSkillsPromptForRun({
 			skillsSnapshot: params.skillsSnapshot,
@@ -265,7 +272,8 @@ async function compactEmbeddedPiSessionDirect(params) {
 			modelProvider: model.provider,
 			modelId,
 			modelContextWindowTokens: model.contextWindow,
-			modelAuthMode: resolveModelAuthMode(model.provider, params.config)
+			modelAuthMode: resolveModelAuthMode(model.provider, params.config),
+			untrustedSkillContent: hasUntrustedSkillContent
 		});
 		const tools = sanitizeToolsForGoogle({
 			tools: toolsRaw,
@@ -433,7 +441,7 @@ async function compactEmbeddedPiSessionDirect(params) {
 				});
 				await resourceLoader.reload();
 			}
-			const { builtInTools, customTools } = splitSdkTools({
+			const { activeToolNames, customTools } = splitSdkTools({
 				tools,
 				sandboxEnabled: !!sandbox?.enabled
 			});
@@ -452,7 +460,7 @@ async function compactEmbeddedPiSessionDirect(params) {
 				modelRegistry,
 				model,
 				thinkingLevel: mapThinkingLevel(params.thinkLevel),
-				tools: builtInTools,
+				tools: activeToolNames,
 				customTools,
 				sessionManager,
 				settingsManager,

package/dist/agents/pi-embedded-runner/model.js

@@ -1,9 +1,9 @@
-import { isOpenAISignInRuntimeModelSupported } from "../../providers/registry.js";
 import { DEFAULT_CONTEXT_TOKENS } from "../defaults.js";
 import { isPrivateNetworkBaseUrl } from "../../utils/private-network-url.js";
 import { resolveFasedAgentAgentDir } from "../agent-paths.js";
 import { ensureAuthProfileStore } from "../auth-profiles/store.js";
 import "../auth-profiles.js";
+import { isOpenAISignInRuntimeModelSupported } from "../../providers/registry.js";
 import { normalizeProviderId } from "../model-selection.js";
 import { discoverAuthStorage, discoverModels } from "../pi-model-discovery.js";
 import { resolveAuthenticatedModelCatalog } from "../authenticated-model-catalog.js";

package/dist/agents/pi-embedded-runner/run/attempt.js

@@ -20,6 +20,7 @@ import { resolveTelegramInlineButtonsScope } from "../../../telegram/inline-butt
 import { resolveTelegramReactionLevel } from "../../../telegram/reaction-level.js";
 import { MAX_IMAGE_BYTES } from "../../../media/constants.js";
 import { resolveImageSanitizationLimits } from "../../image-sanitization.js";
+import { marketplaceSkillIdsFromEntries, marketplaceSkillIdsFromSnapshot } from "../../skills/trust.js";
 import { buildModelAliasLines } from "../../model-alias-lines.js";
 import "../model.js";
 import { buildTtsSystemPromptHint } from "../../../tts/tts.js";
@@ -29,6 +30,7 @@ import { listChannelSupportedActions, resolveChannelMessageToolHints } from "../
 import { resolveFasedAgentDocsPath } from "../../docs-path.js";
 import { createPreparedEmbeddedPiSettingsManager } from "../../pi-project-settings.js";
 import { detectRuntimeShell } from "../../shell-utils.js";
+import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../../skills/env-overrides.js";
 import { isTimeoutError } from "../../failover-error.js";
 import { resolveSandboxRuntimeStatus } from "../../sandbox/runtime-status.js";
 import { resolveEffectiveToolFsWorkspaceOnly } from "../../tool-fs-policy.js";
@@ -39,7 +41,6 @@ import { log } from "../logger.js";
 import { sanitizeToolCallIdsForCloudCodeAssist } from "../../tool-call-id.js";
 import { sanitizeToolUseResultPairing } from "../../session-transcript-repair.js";
 import { guardSessionManager } from "../../session-tool-result-guard-wrapper.js";
-import { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot } from "../../skills/env-overrides.js";
 import { loadWorkspaceSkillEntries, resolveSkillsPromptForRun } from "../../skills/workspace.js";
 import "../../skills.js";
 import { resolveTranscriptPolicy } from "../../transcript-policy.js";
@@ -245,10 +246,17 @@ async function runEmbeddedAttempt(params) {
 	log.debug(`embedded run start: runId=${params.runId} sessionId=${params.sessionId} provider=${params.provider} model=${params.modelId} thinking=${params.thinkLevel} messageChannel=${params.messageChannel ?? params.messageProvider ?? "unknown"}`);
 	await fs.mkdir(resolvedWorkspace, { recursive: true });
 	const sandboxSessionKey = params.sessionKey?.trim() || params.sessionId;
+	const sourceSkillEntries = params.skillsSnapshot ? [] : loadWorkspaceSkillEntries(resolvedWorkspace, {
+		config: params.config,
+		agentId: params.agentId
+	});
+	const marketplaceSkillIds = params.skillsSnapshot ? marketplaceSkillIdsFromSnapshot(params.skillsSnapshot) : marketplaceSkillIdsFromEntries(sourceSkillEntries);
+	const hasUntrustedSkillContent = marketplaceSkillIds.length > 0;
 	const sandbox = await resolveSandboxContext({
 		config: params.config,
 		sessionKey: sandboxSessionKey,
-		workspaceDir: resolvedWorkspace
+		workspaceDir: resolvedWorkspace,
+		forceUntrustedIsolation: hasUntrustedSkillContent
 	});
 	const effectiveWorkspace = sandbox?.enabled ? sandbox.workspaceAccess === "rw" ? resolvedWorkspace : sandbox.workspaceDir : resolvedWorkspace;
 	await fs.mkdir(effectiveWorkspace, { recursive: true });
@@ -260,10 +268,12 @@ async function runEmbeddedAttempt(params) {
 		const skillEntries = shouldLoadSkillEntries ? loadWorkspaceSkillEntries(effectiveWorkspace) : [];
 		restoreSkillEnv = params.skillsSnapshot ? applySkillEnvOverridesFromSnapshot({
 			snapshot: params.skillsSnapshot,
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		}) : applySkillEnvOverrides({
 			skills: skillEntries ?? [],
-			config: params.config
+			config: params.config,
+			excludeMarketplace: true
 		});
 		const skillsPrompt = resolveSkillsPromptForRun({
 			skillsSnapshot: params.skillsSnapshot,
@@ -333,9 +343,10 @@ async function runEmbeddedAttempt(params) {
 			modelHasVision,
 			requireExplicitMessageTarget: params.requireExplicitMessageTarget ?? isSubagentSessionKey(params.sessionKey),
 			disableMessageTool: params.disableMessageTool,
-			disabledToolNames: params.disabledToolNames
+			disabledToolNames: params.disabledToolNames,
+			untrustedSkillContent: hasUntrustedSkillContent
 		});
-		if (!toolsDisabled) {
+		if (!toolsDisabled && !hasUntrustedSkillContent) {
 			bundleMcpRuntime = await createBundleMcpToolRuntime({
 				workspaceDir: effectiveWorkspace,
 				cfg: params.config,
@@ -561,10 +572,6 @@ async function runEmbeddedAttempt(params) {
 				await resourceLoader.reload();
 			}
 			const hookRunner = getGlobalHookRunner();
-			const { builtInTools, customTools } = splitSdkTools({
-				tools,
-				sandboxEnabled: !!sandbox?.enabled
-			});
 			let clientToolCallDetected = null;
 			const clientToolLoopDetection = resolveToolLoopDetectionConfig({
 				cfg: params.config,
@@ -580,7 +587,11 @@ async function runEmbeddedAttempt(params) {
 				sessionKey: params.sessionKey,
 				loopDetection: clientToolLoopDetection
 			}) : [];
-			const allCustomTools = [...customTools, ...clientToolDefs];
+			const { activeToolNames, customTools } = splitSdkTools({
+				tools,
+				clientTools: clientToolDefs,
+				sandboxEnabled: !!sandbox?.enabled
+			});
 			if (params.model.api === "ollama") {
 				registerProviderStreamForModel({
 					model: params.model,
@@ -596,8 +607,8 @@ async function runEmbeddedAttempt(params) {
 				modelRegistry: params.modelRegistry,
 				model: params.model,
 				thinkingLevel: mapThinkingLevel(params.thinkLevel),
-				tools: builtInTools,
-				customTools: allCustomTools,
+				tools: activeToolNames,
+				customTools,
 				sessionManager,
 				settingsManager,
 				resourceLoader

package/dist/agents/pi-embedded-runner/run.js

@@ -460,7 +460,9 @@ async function runEmbeddedPiAgent(params) {
 					skillsSnapshot: params.skillsSnapshot,
 					prompt,
 					images: params.images,
+					clientTools: params.clientTools,
 					disableTools: params.disableTools,
+					disabledToolNames: params.disabledToolNames,
 					provider,
 					modelId,
 					model,

package/dist/agents/pi-embedded-runner/tool-split.js

@@ -1,11 +1,49 @@
+import { isKnownCoreToolId } from "../tool-catalog.js";
+import { normalizeToolName } from "../tool-policy-shared.js";
+import "../tool-policy.js";
 import { toToolDefinitions } from "../pi-tool-definition-adapter.js";
 
 //#region src/agents/pi-embedded-runner/tool-split.ts
+const SDK_BUILT_IN_TOOL_NAMES = new Set([
+	"read",
+	"bash",
+	"edit",
+	"write",
+	"grep",
+	"find",
+	"ls"
+].map(normalizeToolName));
+function validateClientToolDefinitions(params) {
+	const fasedToolNames = new Set(params.fasedTools.map((tool) => normalizeToolName(tool.name)));
+	const clientToolNames = new Set();
+	for (const tool of params.clientTools) {
+		const name = tool.name;
+		const trimmedName = name.trim();
+		if (!trimmedName || trimmedName !== name) {
+			throw new Error("Client tool names must be non-empty and must not contain outer whitespace");
+		}
+		const normalizedName = normalizeToolName(name);
+		if (SDK_BUILT_IN_TOOL_NAMES.has(normalizedName) || isKnownCoreToolId(normalizedName) || fasedToolNames.has(normalizedName)) {
+			throw new Error(`Client tool name "${name}" is reserved by Fased`);
+		}
+		if (clientToolNames.has(normalizedName)) {
+			throw new Error(`Duplicate client tool name: "${name}"`);
+		}
+		clientToolNames.add(normalizedName);
+	}
+}
 function splitSdkTools(options) {
 	const { tools } = options;
+	const fasedTools = toToolDefinitions(tools);
+	const clientTools = options.clientTools ?? [];
+	validateClientToolDefinitions({
+		fasedTools,
+		clientTools
+	});
+	const customTools = [...fasedTools, ...clientTools];
 	return {
-		builtInTools: [],
-		customTools: toToolDefinitions(tools)
+		activeToolNames: customTools.map((tool) => tool.name),
+		customTools
 	};
 }
 

package/dist/agents/pi-tool-definition-adapter.js

@@ -41,6 +41,20 @@ function stringifyToolPayload(payload) {
 	} catch {}
 	return String(payload);
 }
+function normalizeClientToolParams(params) {
+	if (isPlainObject(params)) {
+		return params;
+	}
+	if (typeof params !== "string") {
+		return {};
+	}
+	try {
+		const parsed = JSON.parse(params.trim());
+		return isPlainObject(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
 function normalizeToolExecutionResult(params) {
 	const { toolName, result } = params;
 	if (result && typeof result === "object") {
@@ -185,9 +199,10 @@ function toClientToolDefinitions(tools, onClientToolCall, hookContext) {
 			parameters: func.parameters,
 			execute: async (...args) => {
 				const { toolCallId, params } = splitToolExecuteArgs(args);
+				const normalizedParams = normalizeClientToolParams(params);
 				const outcome = await runBeforeToolCallHook({
 					toolName: func.name,
-					params,
+					params: normalizedParams,
 					toolCallId,
 					ctx: hookContext
 				});

package/dist/agents/pi-tools.js

@@ -332,7 +332,8 @@ function createFasedAgentCodingTools(options) {
 			senderIsOwner: options?.senderIsOwner
 		})
 	];
-	const toolsForMessageProvider = applyMessageProviderToolPolicy(tools, options?.messageProvider);
+	const provenanceSafeTools = options?.untrustedSkillContent ? tools.filter((tool) => tool.name === "read") : tools;
+	const toolsForMessageProvider = applyMessageProviderToolPolicy(provenanceSafeTools, options?.messageProvider);
 	const senderIsOwner = options?.senderIsOwner === true;
 	const toolsByAuthorization = applyOwnerOnlyToolPolicy(toolsForMessageProvider, senderIsOwner);
 	const subagentFiltered = applyToolPolicyPipeline({

package/dist/agents/sandbox/config.js

@@ -34,7 +34,7 @@ function resolveSandboxScope(params) {
 	if (typeof params.perSession === "boolean") {
 		return params.perSession ? "session" : "shared";
 	}
-	return "agent";
+	return "session";
 }
 function resolveSandboxDockerConfig(params) {
 	const agentDocker = params.scope === "shared" ? undefined : params.agentDocker;

package/dist/agents/sandbox/context.js

@@ -80,10 +80,35 @@ function resolveSandboxSession(params) {
 		cfg: params.config,
 		sessionKey: rawSessionKey
 	});
-	if (!runtime.sandboxed) {
+	if (!runtime.sandboxed && !params.forceUntrustedIsolation) {
 		return null;
 	}
-	const cfg = resolveSandboxConfigForAgent(params.config, runtime.agentId);
+	const resolvedConfig = resolveSandboxConfigForAgent(params.config, runtime.agentId);
+	const cfg = params.forceUntrustedIsolation ? {
+		...resolvedConfig,
+		mode: "all",
+		scope: "session",
+		workspaceAccess: "none",
+		docker: {
+			...resolvedConfig.docker,
+			readOnlyRoot: true,
+			network: "none",
+			capDrop: ["ALL"],
+			binds: undefined,
+			dangerouslyAllowReservedContainerTargets: false,
+			dangerouslyAllowExternalBindSources: false,
+			dangerouslyAllowContainerNamespaceJoin: false
+		},
+		browser: {
+			...resolvedConfig.browser,
+			enabled: false,
+			allowHostControl: false
+		},
+		tools: {
+			allow: ["read"],
+			deny: []
+		}
+	} : resolvedConfig;
 	return {
 		rawSessionKey,
 		runtime,

package/dist/agents/skills/env-overrides.js

@@ -1,14 +1,22 @@
 import { createSubsystemLogger } from "../../logging/subsystem.js";
 import { isDangerousHostEnvVarName } from "../../infra/host-env-security.js";
+import { getRuntimeConfigSnapshot } from "../../config/io.js";
+import "../../config/config.js";
+import { isMarketplaceSkillDir } from "./trust.js";
+import { sanitizeEnvVars, validateEnvVarValue } from "../sandbox/sanitize-env-vars.js";
 import { resolveSkillKey } from "./frontmatter.js";
 import { resolveSkillConfig } from "./config.js";
-import { sanitizeEnvVars, validateEnvVarValue } from "../sandbox/sanitize-env-vars.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 
 //#region src/agents/skills/env-overrides.ts
 const log = createSubsystemLogger("env-overrides");
-const activeSkillEnvKeys = new Set();
+const skillEnvStorage = new AsyncLocalStorage();
 function getActiveSkillEnvKeys() {
-	return activeSkillEnvKeys;
+	return new Set(Object.keys(skillEnvStorage.getStore() ?? {}));
+}
+/** Trusted, invocation-scoped env consumed by exec without mutating process.env. */
+function getActiveSkillEnvOverrides() {
+	return skillEnvStorage.getStore() ?? {};
 }
 const SKILL_ALWAYS_BLOCKED_ENV_PATTERNS = [/^OPENSSL_CONF$/i];
 function matchesAnyPattern(value, patterns) {
@@ -62,7 +70,7 @@ function sanitizeSkillEnvOverrides(params) {
 	};
 }
 function applySkillConfigEnvOverrides(params) {
-	const { updates, skillConfig, primaryEnv, requiredEnv, skillKey } = params;
+	const { overrides, skillConfig, primaryEnv, requiredEnv, skillKey } = params;
 	const allowedSensitiveKeys = new Set();
 	const normalizedPrimaryEnv = primaryEnv?.trim();
 	if (normalizedPrimaryEnv) {
@@ -104,66 +112,68 @@ function applySkillConfigEnvOverrides(params) {
 		if (process.env[envKey]) {
 			continue;
 		}
-		updates.push({
-			key: envKey,
-			prev: process.env[envKey]
-		});
-		process.env[envKey] = envValue;
-		activeSkillEnvKeys.add(envKey);
+		overrides[envKey] = envValue;
 	}
 }
-function createEnvReverter(updates) {
+function activateSkillEnv(overrides) {
+	const previous = skillEnvStorage.getStore();
+	skillEnvStorage.enterWith(Object.freeze({
+		...previous ?? {},
+		...overrides
+	}));
 	return () => {
-		for (const update of updates) {
-			if (update.prev === undefined) {
-				delete process.env[update.key];
-			} else {
-				process.env[update.key] = update.prev;
-			}
-			activeSkillEnvKeys.delete(update.key);
-		}
+		skillEnvStorage.enterWith(previous ?? Object.freeze({}));
 	};
 }
 function applySkillEnvOverrides(params) {
-	const { skills, config } = params;
-	const updates = [];
+	const skills = params.skills;
+	const config = getRuntimeConfigSnapshot() ?? params.config;
+	const overrides = {};
 	for (const entry of skills) {
+		if (params.excludeMarketplace !== false && isMarketplaceSkillDir(entry.skill.baseDir)) {
+			continue;
+		}
 		const skillKey = resolveSkillKey(entry.skill, entry);
 		const skillConfig = resolveSkillConfig(config, skillKey);
 		if (!skillConfig) {
 			continue;
 		}
 		applySkillConfigEnvOverrides({
-			updates,
+			overrides,
 			skillConfig,
 			primaryEnv: entry.metadata?.primaryEnv,
 			requiredEnv: entry.metadata?.requires?.env,
 			skillKey
 		});
 	}
-	return createEnvReverter(updates);
+	return activateSkillEnv(overrides);
 }
 function applySkillEnvOverridesFromSnapshot(params) {
-	const { snapshot, config } = params;
+	const snapshot = params.snapshot;
+	const config = getRuntimeConfigSnapshot() ?? params.config;
 	if (!snapshot) {
 		return () => {};
 	}
-	const updates = [];
+	const overrides = {};
+	const marketplaceSkills = new Set(params.excludeMarketplace === false ? [] : snapshot.marketplaceSkillIds ?? []);
 	for (const skill of snapshot.skills) {
+		if (marketplaceSkills.has(skill.name)) {
+			continue;
+		}
 		const skillConfig = resolveSkillConfig(config, skill.name);
 		if (!skillConfig) {
 			continue;
 		}
 		applySkillConfigEnvOverrides({
-			updates,
+			overrides,
 			skillConfig,
 			primaryEnv: skill.primaryEnv,
 			requiredEnv: skill.requiredEnv,
 			skillKey: skill.name
 		});
 	}
-	return createEnvReverter(updates);
+	return activateSkillEnv(overrides);
 }
 
 //#endregion
-export { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot };
+export { applySkillEnvOverrides, applySkillEnvOverridesFromSnapshot, getActiveSkillEnvOverrides };

package/dist/agents/skills/trust.js

@@ -0,0 +1,93 @@
+import syncFs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+
+//#region src/agents/skills/trust.ts
+const MARKETPLACE_ORIGIN_DIRS = [".clawhub", ".clawdhub"];
+function hasMarketplaceOriginMarker(root) {
+	return MARKETPLACE_ORIGIN_DIRS.some((dir) => syncFs.existsSync(path.join(root, dir, "origin.json")));
+}
+function isTrackedMarketplaceSkill(root) {
+	const skillsDir = path.dirname(root);
+	if (path.basename(skillsDir) !== "skills") {
+		return false;
+	}
+	const slug = path.basename(root);
+	const workspaceDir = path.dirname(skillsDir);
+	for (const directory of MARKETPLACE_ORIGIN_DIRS) {
+		try {
+			const lock = JSON.parse(syncFs.readFileSync(path.join(workspaceDir, directory, "lock.json"), "utf8"));
+			if (lock.version === 1 && lock.skills?.[slug]) {
+				return true;
+			}
+		} catch {}
+	}
+	return false;
+}
+function computeSkillContentSha256Sync(skillDir) {
+	try {
+		const digest = createHash("sha256");
+		const queue = [path.resolve(skillDir)];
+		while (queue.length > 0) {
+			const current = queue.shift();
+			if (!current) {
+				continue;
+			}
+			const entries = syncFs.readdirSync(current, { withFileTypes: true }).toSorted((left, right) => left.name.localeCompare(right.name));
+			for (const entry of entries) {
+				if (entry.name.startsWith(".")) {
+					continue;
+				}
+				const fullPath = path.join(current, entry.name);
+				if (entry.isDirectory() && !entry.isSymbolicLink()) {
+					queue.push(fullPath);
+					continue;
+				}
+				if (!entry.isFile() || entry.isSymbolicLink()) {
+					return null;
+				}
+				digest.update(path.relative(skillDir, fullPath).split(path.sep).join("/"));
+				digest.update("\n");
+				digest.update(syncFs.readFileSync(fullPath));
+				digest.update("\n");
+			}
+		}
+		return digest.digest("hex");
+	} catch {
+		return null;
+	}
+}
+function marketplaceSkillProvenanceMatchesContent(skillDir) {
+	const root = skillDir.trim();
+	if (!root) {
+		return false;
+	}
+	for (const directory of MARKETPLACE_ORIGIN_DIRS) {
+		try {
+			const origin = JSON.parse(syncFs.readFileSync(path.join(root, directory, "origin.json"), "utf8"));
+			if (origin.version === 1 && origin.archiveIntegrityVerified === true && typeof origin.archiveSha256 === "string" && /^[a-f0-9]{64}$/u.test(origin.archiveSha256) && typeof origin.contentSha256 === "string" && /^[a-f0-9]{64}$/u.test(origin.contentSha256) && computeSkillContentSha256Sync(root) === origin.contentSha256) {
+				return true;
+			}
+		} catch {}
+	}
+	return false;
+}
+function isMarketplaceSkillDir(skillDir) {
+	const root = skillDir.trim();
+	return Boolean(root && (hasMarketplaceOriginMarker(root) || isTrackedMarketplaceSkill(root)));
+}
+function marketplaceSkillIdsFromEntries(entries) {
+	return [...new Set(entries.filter((entry) => isMarketplaceSkillDir(entry.skill.baseDir)).map((entry) => entry.skill.name.trim()).filter(Boolean))].toSorted();
+}
+function marketplaceSkillIdsFromSnapshot(snapshot) {
+	if (!snapshot) {
+		return [];
+	}
+	if (snapshot.marketplaceSkillIds) {
+		return [...new Set(snapshot.marketplaceSkillIds.map((id) => id.trim()).filter(Boolean))].toSorted();
+	}
+	return [...new Set((snapshot.resolvedSkills ?? []).filter((skill) => isMarketplaceSkillDir(skill.baseDir)).map((skill) => skill.name.trim()).filter(Boolean))].toSorted();
+}
+
+//#endregion
+export { isMarketplaceSkillDir, marketplaceSkillIdsFromEntries, marketplaceSkillIdsFromSnapshot, marketplaceSkillProvenanceMatchesContent };