@genspark/cli 1.0.23 → 1.0.25

package/dist/commands/mesh.d.ts

@@ -23,6 +23,12 @@ import { Command } from 'commander';
  * `argv` is process.argv.slice(2) (no node/script prefix).
  */
 export declare function getMeshInvocation(argv: string[]): string[] | null;
+/**
+ * Insert the wrapper-only `upgrade` entry at the end of the native help's
+ * "Commands:" block. If the block can't be located (native help format
+ * changed), append a short note instead so `upgrade` stays documented.
+ */
+export declare function augmentMeshHelp(nativeHelp: string): string;
 /**
  * Handle a `gsk mesh ...` invocation end-to-end. Dispatches:
  *   - `upgrade`        → TS-side version negotiation + download

package/dist/commands/mesh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mesh.d.ts","sourceRoot":"","sources":["../../src/commands/mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAmBnC;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAyBjE;AA6CD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCrF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe1D"}
+{"version":3,"file":"mesh.d.ts","sourceRoot":"","sources":["../../src/commands/mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAmBnC;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAyBjE;AA6DD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAgB1D;AAiCD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CrF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe1D"}

package/dist/commands/mesh.js

@@ -104,6 +104,72 @@ function spawnNative(bin, args) {
     // execNative never returns normally — the process exits via the handlers.
     return new Promise(() => { });
 }
+// Top-level `gsk mesh` help requests. `gsk mesh help ssh` / `gsk mesh ssh --help`
+// are subcommand help and must pass through untouched, so we only match the
+// single-token forms.
+const HELP_TOKENS = new Set(['--help', '-h', 'help']);
+function isTopLevelMeshHelp(args) {
+    return args.length === 1 && HELP_TOKENS.has(args[0]);
+}
+// The `upgrade` subcommand is handled by this wrapper (see runMesh), not by the
+// native binary, so it never appears in the native `--help`. We splice this
+// line into the native help's Commands block. Indentation matches the native
+// clap layout (2-space indent, descriptions aligned at column 11).
+const WRAPPER_UPGRADE_HELP_LINE = '  upgrade  Check for and install a newer gsk-mesh release (run `gsk mesh upgrade --help`)';
+/**
+ * Insert the wrapper-only `upgrade` entry at the end of the native help's
+ * "Commands:" block. If the block can't be located (native help format
+ * changed), append a short note instead so `upgrade` stays documented.
+ */
+export function augmentMeshHelp(nativeHelp) {
+    if (/^\s+upgrade\b/m.test(nativeHelp)) {
+        return nativeHelp; // already present — don't double-insert
+    }
+    const lines = nativeHelp.split('\n');
+    const cmdHeader = lines.findIndex(l => /^Commands:/.test(l));
+    if (cmdHeader !== -1) {
+        // End of the commands block = first blank line after the header.
+        let end = cmdHeader + 1;
+        while (end < lines.length && lines[end].trim() !== '')
+            end++;
+        lines.splice(end, 0, WRAPPER_UPGRADE_HELP_LINE);
+        return lines.join('\n');
+    }
+    // Fallback: couldn't find the block; append a note.
+    const sep = nativeHelp.endsWith('\n') ? '' : '\n';
+    return `${nativeHelp}${sep}\nWrapper-added command:\n${WRAPPER_UPGRADE_HELP_LINE}\n`;
+}
+/**
+ * Spawn native gsk-mesh for a top-level `--help`, capturing stdout so we can
+ * splice in the wrapper-only `upgrade` command. On any spawn error we exit like
+ * spawnNative; the captured help is printed verbatim-plus-`upgrade` on exit.
+ *
+ * We key off `close`, not `exit`: `exit` can fire while stdout `data` events are
+ * still queued, which would augment a truncated buffer. `close` is emitted only
+ * after the child has ended AND its stdio streams have been fully drained, so
+ * `out` holds the complete native help by then.
+ */
+function spawnNativeHelpAugmented(bin, args) {
+    const child = spawn(bin, args, { stdio: ['inherit', 'pipe', 'inherit'] });
+    let out = '';
+    child.stdout?.on('data', (chunk) => {
+        out += chunk.toString();
+    });
+    child.on('error', err => {
+        logError(`Failed to launch gsk-mesh: ${err.message}`);
+        process.exit(1);
+    });
+    child.on('close', (code, signal) => {
+        process.stdout.write(augmentMeshHelp(out));
+        if (signal) {
+            process.kill(process.pid, signal);
+        }
+        else {
+            process.exit(code ?? 0);
+        }
+    });
+    return new Promise(() => { });
+}
 /**
  * Handle a `gsk mesh ...` invocation end-to-end. Dispatches:
  *   - `upgrade`        → TS-side version negotiation + download
@@ -140,6 +206,12 @@ export async function runMesh(args, baseUrlOverride) {
     // automatically when no binary is installed yet or auto-update is disabled.
     // Safe to run now: ensureMeshBinary has finished, so no concurrent install.
     void maybeAutoUpgradeMesh(baseUrlOverride).catch(err => debug(`mesh autorun: ${err.message}`));
+    // Top-level help: capture the native help and splice in the wrapper-only
+    // `upgrade` command so it's discoverable from `gsk mesh --help`.
+    if (isTopLevelMeshHelp(args)) {
+        await spawnNativeHelpAugmented(bin, args);
+        return;
+    }
     await spawnNative(bin, args);
 }
 /**

package/dist/commands/mesh.js.map

@@ -1 +1 @@
-{"version":3,"file":"mesh.js","sourceRoot":"","sources":["../../src/commands/mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAE7D,+EAA+E;AAC/E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,WAAW;IACX,YAAY;IACZ,cAAc;IACd,WAAW;IACX,UAAU;IACV,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,iEAAiE;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACvB,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAClD,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA,CAAC,6BAA6B;gBACjC,SAAQ;YACV,CAAC;YACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,CAAC,IAAI,CAAC,CAAA,CAAC,0BAA0B;gBACjC,SAAQ;YACV,CAAC;YACD,CAAC,EAAE,CAAA,CAAC,qDAAqD;YACzD,SAAQ;QACV,CAAC;QACD,0CAA0C;QAC1C,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,EAAE;IACF,iDAAiD;IACjD,EAAE;IACF,UAAU;IACV,kEAAkE;IAClE,qDAAqD;IACrD,iCAAiC;CAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,yDAAyD;AACzD,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,eAAwB;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,aAAa,CAAC,CAAA;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IACvE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,0FAA0F;AAC1F,SAAS,WAAW,CAAC,GAAW,EAAE,IAAc;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACpD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,QAAQ,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,6DAA6D;YAC7D,uCAAuC;YACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,0EAA0E;IAC1E,OAAO,IAAI,OAAO,CAAQ,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,eAAwB;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAEnB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAA;QACnD,OAAM;IACR,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,mCAAmC;QACnC,IAAI,CAAC,+EAA+E,CAAC,CAAA;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAA;QAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,KAAK,oBAAoB,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CACrD,KAAK,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CACjD,CAAA;IAED,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,0EAA0E;QACxE,sGAAsG,CACzG;SACA,kBAAkB,CAAC,IAAI,CAAC;SACxB,UAAU,CAAC,KAAK,CAAC;SACjB,QAAQ,CAAC,WAAW,EAAE,kDAAkD,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,EAAE;QAC/B,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACN,CAAC"}
+{"version":3,"file":"mesh.js","sourceRoot":"","sources":["../../src/commands/mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AAE7D,+EAA+E;AAC/E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,WAAW;IACX,YAAY;IACZ,cAAc;IACd,WAAW;IACX,UAAU;IACV,UAAU;CACX,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,iEAAiE;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACvB,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAClD,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,CAAC,EAAE,CAAA,CAAC,6BAA6B;gBACjC,SAAQ;YACV,CAAC;YACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,CAAC,IAAI,CAAC,CAAA,CAAC,0BAA0B;gBACjC,SAAQ;YACV,CAAC;YACD,CAAC,EAAE,CAAA,CAAC,qDAAqD;YACzD,SAAQ;QACV,CAAC;QACD,0CAA0C;QAC1C,OAAO,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,mCAAmC;IACnC,EAAE;IACF,iDAAiD;IACjD,EAAE;IACF,UAAU;IACV,kEAAkE;IAClE,qDAAqD;IACrD,iCAAiC;CAClC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,yDAAyD;AACzD,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,eAAwB;IACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,aAAa,CAAC,CAAA;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IACvE,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,0FAA0F;AAC1F,SAAS,WAAW,CAAC,GAAW,EAAE,IAAc;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IACpD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,QAAQ,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,6DAA6D;YAC7D,uCAAuC;YACvC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,0EAA0E;IAC1E,OAAO,IAAI,OAAO,CAAQ,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACrC,CAAC;AAED,kFAAkF;AAClF,4EAA4E;AAC5E,sBAAsB;AACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAErD,SAAS,kBAAkB,CAAC,IAAc;IACxC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,yBAAyB,GAC7B,2FAA2F,CAAA;AAE7F;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAA,CAAC,wCAAwC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5D,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,iEAAiE;QACjE,IAAI,GAAG,GAAG,SAAS,GAAG,CAAC,CAAA;QACvB,OAAO,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,GAAG,EAAE,CAAA;QAC5D,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,yBAAyB,CAAC,CAAA;QAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IACD,oDAAoD;IACpD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACjD,OAAO,GAAG,UAAU,GAAG,GAAG,6BAA6B,yBAAyB,IAAI,CAAA;AACtF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAAC,GAAW,EAAE,IAAc;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;IACzE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,GAAG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;IACzB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,QAAQ,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;QACzB,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,OAAO,CAAQ,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,eAAwB;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAEnB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAA;QACnD,OAAM;IACR,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,mCAAmC;QACnC,IAAI,CAAC,+EAA+E,CAAC,CAAA;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAE,GAAa,CAAC,OAAO,CAAC,CAAA;QAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,4EAA4E;IAC5E,KAAK,oBAAoB,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CACrD,KAAK,CAAC,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CACjD,CAAA;IAED,yEAAyE;IACzE,iEAAiE;IACjE,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzC,OAAM;IACR,CAAC;IAED,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,0EAA0E;QACxE,sGAAsG,CACzG;SACA,kBAAkB,CAAC,IAAI,CAAC;SACxB,UAAU,CAAC,KAAK,CAAC;SACjB,QAAQ,CAAC,WAAW,EAAE,kDAAkD,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,IAAc,EAAE,EAAE;QAC/B,yEAAyE;QACzE,oCAAoC;QACpC,MAAM,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;AACN,CAAC"}

package/dist/commands/skills-pull.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `gsk skills pull <ref> --out <dir>` — client-side writer for the backend
+ * `skills_pull` action.
+ *
+ * Why client-side: an HTTP/JSON tool can't materialise a file tree on the
+ * user's machine. The backend `skills_pull` action returns the skill's files
+ * as `{ path, content_base64 }` rows; this helper decodes them and writes the
+ * tree to disk — same split as `sb-git clone-url --execute` — plus a
+ * `.genspark-skill.json` provenance sidecar so the tree stays identifiable
+ * and refresh-able. Pull is an authoring/export flow (pull → edit → re-upload),
+ * not a runtime mount path.
+ */
+/** Skill-slug shape the backend enforces (single path component, no separators
+ * or `..`). Defined here — the lowest module in the skills-CLI import graph
+ * (skills-sync imports `safeJoin` from it) — and re-used by skills-sync so the
+ * client can't drift from the server's slug contract. */
+export declare const SLUG_RE: RegExp;
+/** One file row from the backend `skills_pull` response. */
+export interface SkillFile {
+    path: string;
+    size?: number;
+    content_base64: string;
+}
+/** Shape of the `data` field returned by the backend `skills_pull` action. */
+export interface SkillPullData {
+    slug: string;
+    ref?: string;
+    owner?: string;
+    publisher_type?: string;
+    name?: string;
+    commit?: string;
+    file_count?: number;
+    total_bytes?: number;
+    files: SkillFile[];
+}
+/**
+ * Provenance sidecar written next to the pulled files. This is what turns a
+ * pulled tree from an anonymous file dump into a managed artifact: it records
+ * WHICH skill (owner/slug) at WHICH commit landed here, so a later pull of the
+ * same skill can refresh the directory in place instead of being refused.
+ */
+export declare const SIDECAR_FILENAME = ".genspark-skill.json";
+export interface SkillSidecar {
+    ref?: string;
+    owner?: string;
+    slug?: string;
+    commit?: string;
+    publisher_type?: string;
+    pulled_at?: string;
+    file_count?: number;
+    content_hash?: string;
+}
+/** Parse the sidecar in `dest`, or null when absent/unreadable. */
+export declare function readSidecar(dest: string): SkillSidecar | null;
+/** Hash the tree currently on disk under `dir`, excluding the sidecar file. */
+export declare function hashTree(dir: string): string;
+/**
+ * Resolve the destination directory and decide whether this pull is a
+ * sidecar-matched in-place REFRESH. Default dest: the slug in the current
+ * directory; an explicit `--out` is honored (with `~` expansion).
+ *
+ * A non-empty existing directory is refused UNLESS its sidecar attests it
+ * holds a previous pull of the SAME skill (slug match, and owner match when
+ * both sides carry one) AND that pull is PRISTINE — the on-disk tree still
+ * hashes to what the sidecar recorded. A pristine match refreshes in place; an
+ * edited tree (or a same-skill dir with no recorded hash) is refused so a
+ * re-pull never silently destroys local edits (the pull → edit → re-upload
+ * authoring flow). A non-matching dir is refused so a pull never merges into an
+ * unrelated tree.
+ */
+export declare function resolvePullDest(slug: string, explicit: string | undefined, pulled?: {
+    slug: string;
+    owner?: string;
+}): {
+    dest: string;
+    refresh: boolean;
+};
+/**
+ * Resolve a server-provided relative file path against `dest`, rejecting any
+ * path that would escape the destination (absolute paths, `..` traversal).
+ * The backend already constrains paths to the skill subtree; this is
+ * defense-in-depth so a crafted response can't write outside `--out`.
+ */
+export declare function safeJoin(dest: string, relPath: string): string;
+/**
+ * Write a `skills_pull` response to disk. Returns 0 on success, non-zero on
+ * any failure (matches the exit-code contract the caller propagates via
+ * `process.exit`).
+ */
+export declare function writeSkillFiles(data: SkillPullData, explicitDest: string | undefined): number;
+//# sourceMappingURL=skills-pull.d.ts.map

package/dist/commands/skills-pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-pull.d.ts","sourceRoot":"","sources":["../../src/commands/skills-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH;;;yDAGyD;AACzD,eAAO,MAAM,OAAO,QAAqC,CAAA;AAEzD,4DAA4D;AAC5D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,SAAS,EAAE,CAAA;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,yBAAyB,CAAA;AAEtD,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IAInB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAW7D;AAqCD,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe5C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAgCpC;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAiB9D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAmHR"}

package/dist/commands/skills-pull.js

@@ -0,0 +1,275 @@
+/**
+ * `gsk skills pull <ref> --out <dir>` — client-side writer for the backend
+ * `skills_pull` action.
+ *
+ * Why client-side: an HTTP/JSON tool can't materialise a file tree on the
+ * user's machine. The backend `skills_pull` action returns the skill's files
+ * as `{ path, content_base64 }` rows; this helper decodes them and writes the
+ * tree to disk — same split as `sb-git clone-url --execute` — plus a
+ * `.genspark-skill.json` provenance sidecar so the tree stays identifiable
+ * and refresh-able. Pull is an authoring/export flow (pull → edit → re-upload),
+ * not a runtime mount path.
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { info, error as logError } from '../logger.js';
+/** Skill-slug shape the backend enforces (single path component, no separators
+ * or `..`). Defined here — the lowest module in the skills-CLI import graph
+ * (skills-sync imports `safeJoin` from it) — and re-used by skills-sync so the
+ * client can't drift from the server's slug contract. */
+export const SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/**
+ * Provenance sidecar written next to the pulled files. This is what turns a
+ * pulled tree from an anonymous file dump into a managed artifact: it records
+ * WHICH skill (owner/slug) at WHICH commit landed here, so a later pull of the
+ * same skill can refresh the directory in place instead of being refused.
+ */
+export const SIDECAR_FILENAME = '.genspark-skill.json';
+/** Parse the sidecar in `dest`, or null when absent/unreadable. */
+export function readSidecar(dest) {
+    try {
+        const raw = fs.readFileSync(path.join(dest, SIDECAR_FILENAME), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // absent or corrupt → treated as "no sidecar" (caller refuses the dir)
+    }
+    return null;
+}
+/**
+ * Content hash of a set of skill files, canonicalized so the write-time hash
+ * (over the payload) and the re-pull-time hash (over the on-disk tree) are
+ * directly comparable: POSIX-separator relative paths, sorted, each contributes
+ * `path\0<bytes>\0`. The sidecar itself is never part of the hash.
+ */
+function hashFiles(entries) {
+    const hash = crypto.createHash('sha256');
+    // Canonicalize the key BEFORE sorting so the write-time hash (payload paths)
+    // and the re-pull hash (on-disk paths) agree regardless of platform:
+    //   - separator: on-disk paths join with the OS separator (`\` on Windows);
+    //     payload paths are `/`. Sorting on the raw separator orders the two
+    //     differently (`/` and `\` are different code points), so a pristine
+    //     Windows tree would never match its own recorded hash.
+    //   - Unicode form: a normalizing filesystem (legacy HFS+, some SMB mounts)
+    //     returns filenames in NFD while the backend emits NFC, so the same name
+    //     hashes differently on write vs re-pull → a pristine tree read as edited.
+    // Normalize both (POSIX separators + NFC) and sort AND hash on that key.
+    const normalized = entries
+        .map(e => ({
+        key: e.relPath.split(path.sep).join('/').normalize('NFC'),
+        bytes: e.bytes,
+    }))
+        .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+    for (const { key, bytes } of normalized) {
+        hash.update(key);
+        hash.update('\0');
+        hash.update(bytes);
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+/** Hash the tree currently on disk under `dir`, excluding the sidecar file. */
+export function hashTree(dir) {
+    const entries = [];
+    const walk = (abs, rel) => {
+        for (const name of fs.readdirSync(abs)) {
+            const childAbs = path.join(abs, name);
+            const childRel = rel ? path.join(rel, name) : name;
+            if (fs.statSync(childAbs).isDirectory()) {
+                walk(childAbs, childRel);
+            }
+            else if (!(rel === '' && name === SIDECAR_FILENAME)) {
+                entries.push({ relPath: childRel, bytes: fs.readFileSync(childAbs) });
+            }
+        }
+    };
+    walk(dir, '');
+    return hashFiles(entries);
+}
+/**
+ * Resolve the destination directory and decide whether this pull is a
+ * sidecar-matched in-place REFRESH. Default dest: the slug in the current
+ * directory; an explicit `--out` is honored (with `~` expansion).
+ *
+ * A non-empty existing directory is refused UNLESS its sidecar attests it
+ * holds a previous pull of the SAME skill (slug match, and owner match when
+ * both sides carry one) AND that pull is PRISTINE — the on-disk tree still
+ * hashes to what the sidecar recorded. A pristine match refreshes in place; an
+ * edited tree (or a same-skill dir with no recorded hash) is refused so a
+ * re-pull never silently destroys local edits (the pull → edit → re-upload
+ * authoring flow). A non-matching dir is refused so a pull never merges into an
+ * unrelated tree.
+ */
+export function resolvePullDest(slug, explicit, pulled) {
+    const dest = explicit
+        ? path.resolve(explicit.replace(/^~(?=\/|$)/, os.homedir()))
+        : path.resolve(process.cwd(), slug);
+    if (fs.existsSync(dest) && fs.readdirSync(dest).length > 0) {
+        const sidecar = readSidecar(dest);
+        const sameSkill = sidecar != null &&
+            sidecar.slug === (pulled?.slug ?? slug) &&
+            (!sidecar.owner || !pulled?.owner || sidecar.owner === pulled.owner);
+        if (!sameSkill) {
+            throw new Error(`Refusing to write into ${dest}: directory exists and is not empty ` +
+                `(no ${SIDECAR_FILENAME} matching this skill). ` +
+                `Remove it or pass --out <new-path>.`);
+        }
+        // Same skill, but only refresh a PRISTINE tree. An edited tree (or one
+        // written before content hashing) must not be silently wiped.
+        const pristine = typeof sidecar.content_hash === 'string' &&
+            sidecar.content_hash === hashTree(dest);
+        if (!pristine) {
+            throw new Error(`Refusing to overwrite ${dest}: it holds local changes since the last ` +
+                `pull of this skill (or was pulled before edit-detection). Save your ` +
+                `edits, remove the directory, or pass --out <new-path>.`);
+        }
+        return { dest, refresh: true };
+    }
+    return { dest, refresh: false };
+}
+/**
+ * Resolve a server-provided relative file path against `dest`, rejecting any
+ * path that would escape the destination (absolute paths, `..` traversal).
+ * The backend already constrains paths to the skill subtree; this is
+ * defense-in-depth so a crafted response can't write outside `--out`.
+ */
+export function safeJoin(dest, relPath) {
+    // Backend emits POSIX git-tree paths, so a backslash or Windows
+    // drive/UNC prefix can only be a crafted payload — reject before
+    // path.normalize (whose semantics differ per platform) sees it.
+    if (relPath.includes('\\') || /^[a-zA-Z]:/.test(relPath)) {
+        throw new Error(`Unsafe file path in skill payload: ${relPath}`);
+    }
+    const normalized = path.normalize(relPath);
+    if (path.isAbsolute(normalized) || normalized.split(path.sep)[0] === '..') {
+        throw new Error(`Unsafe file path in skill payload: ${relPath}`);
+    }
+    const target = path.resolve(dest, normalized);
+    const destWithSep = dest.endsWith(path.sep) ? dest : dest + path.sep;
+    if (target !== dest && !target.startsWith(destWithSep)) {
+        throw new Error(`Unsafe file path in skill payload: ${relPath}`);
+    }
+    return target;
+}
+/**
+ * Write a `skills_pull` response to disk. Returns 0 on success, non-zero on
+ * any failure (matches the exit-code contract the caller propagates via
+ * `process.exit`).
+ */
+export function writeSkillFiles(data, explicitDest) {
+    if (!data || !Array.isArray(data.files) || data.files.length === 0) {
+        logError('skills pull: response contained no files.');
+        return 1;
+    }
+    if (typeof data.slug !== 'string' || !data.slug.trim()) {
+        logError('skills pull: response is missing a skill slug.');
+        return 1;
+    }
+    // The slug computes the default destination dir, so validate its shape the
+    // same way the backend does (single path component, no separators / `..`).
+    // safeJoin only guards the per-file paths; an unsanitised slug would let a
+    // crafted response escape the destination root before the per-file check.
+    if (!SLUG_RE.test(data.slug)) {
+        logError(`skills pull: response has an unsafe skill slug: ${data.slug}`);
+        return 1;
+    }
+    // The provenance sidecar owns the root SIDECAR_FILENAME. If the skill itself
+    // ships a root-level file by that name, writing the sidecar would clobber it
+    // and the pristine check (which excludes the root sidecar) would silently
+    // drop it — so refuse rather than corrupt the skill. A same-named file in a
+    // SUBDIR is fine (only the root sidecar is reserved).
+    if (data.files.some(f => f.path === SIDECAR_FILENAME)) {
+        logError(`skills pull: skill ships a reserved root file ${SIDECAR_FILENAME}; ` +
+            `cannot materialize it without clobbering the provenance sidecar.`);
+        return 1;
+    }
+    let dest;
+    let refresh;
+    try {
+        ;
+        ({ dest, refresh } = resolvePullDest(data.slug, explicitDest, {
+            slug: data.slug,
+            owner: data.owner,
+        }));
+    }
+    catch (e) {
+        logError(e.message);
+        return 1;
+    }
+    const destExisted = fs.existsSync(dest);
+    // A sidecar-matched refresh REPLACES the previous pull: clear the directory
+    // first so files deleted upstream don't linger as stale strays. The old
+    // content is by definition a previous served snapshot of this same skill
+    // (that is what the sidecar attests), so wiping it loses nothing local.
+    if (refresh) {
+        try {
+            for (const entry of fs.readdirSync(dest)) {
+                fs.rmSync(path.join(dest, entry), { recursive: true, force: true });
+            }
+        }
+        catch (e) {
+            logError(`skills pull: failed to clear ${dest} for refresh: ${e.message}`);
+            return 1;
+        }
+    }
+    // Roll back partial writes on failure so a mid-loop error (a crafted
+    // traversal/NUL path, disk-full) never leaves a half-written tree that then
+    // permanently fails the next retry on resolvePullDest's non-empty-dir guard.
+    try {
+        const written = [];
+        for (const file of data.files) {
+            if (!file.path)
+                continue; // skip a degenerate empty path (would resolve to dest itself)
+            const target = safeJoin(dest, file.path);
+            const bytes = Buffer.from(file.content_base64, 'base64');
+            fs.mkdirSync(path.dirname(target), { recursive: true });
+            fs.writeFileSync(target, bytes);
+            written.push({ relPath: file.path, bytes });
+        }
+        // Sidecar last, after every file landed — a crash mid-write must never
+        // leave a sidecar attesting a complete pull over a partial tree. The
+        // content_hash pins this exact tree so a later re-pull can tell a pristine
+        // directory (safe to refresh) from one the user has edited.
+        const sidecar = {
+            ref: data.ref ?? (data.owner ? `${data.owner}/${data.slug}` : data.slug),
+            owner: data.owner,
+            slug: data.slug,
+            commit: data.commit,
+            publisher_type: data.publisher_type,
+            pulled_at: new Date().toISOString(),
+            file_count: data.files.length,
+            content_hash: hashFiles(written),
+        };
+        fs.writeFileSync(path.join(dest, SIDECAR_FILENAME), JSON.stringify(sidecar, null, 2) + '\n');
+    }
+    catch (e) {
+        try {
+            if (!destExisted) {
+                fs.rmSync(dest, { recursive: true, force: true }); // we created it → remove fully
+            }
+            else {
+                // dest pre-existed as either EMPTY (guard-proven) or a refresh we
+                // already cleared — every entry now under it is ours. Clear it back to
+                // empty (leaving empty subdirs would trip the non-empty-dir guard and
+                // brick every retry). A failed refresh thus ends EMPTY, not restored —
+                // inherent to refresh-in-place; the next pull rebuilds it.
+                for (const entry of fs.readdirSync(dest)) {
+                    fs.rmSync(path.join(dest, entry), { recursive: true, force: true });
+                }
+            }
+        }
+        catch {
+            // best-effort cleanup; the original write error below is what matters
+        }
+        logError(`skills pull: failed to write files: ${e.message}`);
+        return 1;
+    }
+    info(`${refresh ? 'Refreshed' : 'Pulled'} ${data.files.length} file(s) for ${data.slug} → ${dest}`);
+    return 0;
+}
+//# sourceMappingURL=skills-pull.js.map

package/dist/commands/skills-pull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-pull.js","sourceRoot":"","sources":["../../src/commands/skills-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEtD;;;yDAGyD;AACzD,MAAM,CAAC,MAAM,OAAO,GAAG,kCAAkC,CAAA;AAsBzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAA;AAgBtD,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAA;QACtE,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAsB,CAAA;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAChB,OAA0D;IAE1D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;IACxC,6EAA6E;IAC7E,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,4DAA4D;IAC5D,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACT,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;QACzD,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/D,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,OAAO,GAAyC,EAAE,CAAA;IACxD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,GAAW,EAAQ,EAAE;QAC9C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAClD,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC1B,CAAC;iBAAM,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;gBACtD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACvE,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACb,OAAO,SAAS,CAAC,OAAO,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,QAA4B,EAC5B,MAAyC;IAEzC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,SAAS,GACb,OAAO,IAAI,IAAI;YACf,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC;YACvC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,sCAAsC;gBAClE,OAAO,gBAAgB,yBAAyB;gBAChD,qCAAqC,CACxC,CAAA;QACH,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,QAAQ,GACZ,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACxC,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,0CAA0C;gBACrE,sEAAsE;gBACtE,wDAAwD,CAC3D,CAAA;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAe;IACpD,gEAAgE;IAChE,iEAAiE;IACjE,gEAAgE;IAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAA;IACpE,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAmB,EACnB,YAAgC;IAEhC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,QAAQ,CAAC,2CAA2C,CAAC,CAAA;QACrD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,gDAAgD,CAAC,CAAA;QAC1D,OAAO,CAAC,CAAA;IACV,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,mDAAmD,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACxE,OAAO,CAAC,CAAA;IACV,CAAC;IACD,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,sDAAsD;IACtD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;QACtD,QAAQ,CACN,iDAAiD,gBAAgB,IAAI;YACnE,kEAAkE,CACrE,CAAA;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IACD,IAAI,IAAY,CAAA;IAChB,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE;YAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,CAAA;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAE,CAAW,CAAC,OAAO,CAAC,CAAA;QAC9B,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACvC,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACrE,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CACN,gCAAgC,IAAI,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAC5E,CAAA;YACD,OAAO,CAAC,CAAA;QACV,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,CAAC;QACH,MAAM,OAAO,GAAyC,EAAE,CAAA;QACxD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,SAAQ,CAAC,8DAA8D;YACvF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;YACxD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACvD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;YAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAiB;YAC5B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACxE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YAC7B,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC;SACjC,CAAA;QACD,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CACxC,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA,CAAC,+BAA+B;YACnF,CAAC;iBAAM,CAAC;gBACN,kEAAkE;gBAClE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,2DAA2D;gBAC3D,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACrE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;QACD,QAAQ,CAAC,uCAAwC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;QACvE,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,CACF,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,gBAAgB,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAC9F,CAAA;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/commands/skills-save.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `gsk skills save [path]` — client-side directory collector for the backend
+ * `skills_save` action.
+ *
+ * Why client-side: `skills_save` takes `files: [{path, content_base64}]` in
+ * its request body (the inverse of `skills_pull`'s response shape) — an
+ * HTTP/JSON tool has no way to walk a local directory itself, so the CLI
+ * reads the tree and ships the encoded bytes. This is the sentinel-protocol
+ * successor referenced in `gsk_tool_adaptor.py`'s `_action_save`: SAS used to
+ * drop a `.save_to_self` file for the sandbox host to notice and zip
+ * out-of-band; here the CLI does the same walk itself, synchronously, before
+ * the request goes out.
+ */
+export interface CollectedFiles {
+    files: Array<{
+        path: string;
+        content_base64: string;
+    }>;
+    totalBytes: number;
+    sidecarOwner?: string;
+}
+/**
+ * Walk `dir` and collect every real file into a `skills_save` payload.
+ *
+ * - Symlinks are never followed (skipped outright) — a save must not escape
+ *   `dir` or loop on a cyclic link.
+ * - At the root only, dotfiles are excluded except `.gitignore` (ordinary
+ *   authoring content) and the pull provenance sidecar `.genspark-skill.json`
+ *   (metadata, not a skill file). Dotfiles in subdirectories are kept as-is.
+ * - Requires a root `SKILL.md`: the server rejects a save without one
+ *   anyway (frontmatter validation), so failing fast here saves a round trip.
+ * - Throws once the running byte total exceeds `maxBytes`.
+ *
+ * Returns the sidecar's recorded `owner` (if any) so the caller can warn the
+ * user before saving into someone else's pulled skill forks it into their
+ * own catalog.
+ */
+export declare function collectSkillDir(dir: string, maxBytes?: number): CollectedFiles;
+//# sourceMappingURL=skills-save.d.ts.map

package/dist/commands/skills-save.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-save.d.ts","sourceRoot":"","sources":["../../src/commands/skills-save.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAA0B,GACnC,cAAc,CA2DhB"}

package/dist/commands/skills-save.js

@@ -0,0 +1,93 @@
+/**
+ * `gsk skills save [path]` — client-side directory collector for the backend
+ * `skills_save` action.
+ *
+ * Why client-side: `skills_save` takes `files: [{path, content_base64}]` in
+ * its request body (the inverse of `skills_pull`'s response shape) — an
+ * HTTP/JSON tool has no way to walk a local directory itself, so the CLI
+ * reads the tree and ships the encoded bytes. This is the sentinel-protocol
+ * successor referenced in `gsk_tool_adaptor.py`'s `_action_save`: SAS used to
+ * drop a `.save_to_self` file for the sandbox host to notice and zip
+ * out-of-band; here the CLI does the same walk itself, synchronously, before
+ * the request goes out.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { readSidecar, SIDECAR_FILENAME } from './skills-pull.js';
+/** Mirrors the backend's `_MAX_SAVE_BYTES` (gsk_tool_adaptor.py) so a save
+ * that would be rejected server-side fails locally without a round trip. */
+const DEFAULT_MAX_BYTES = 25 * 1024 * 1024;
+/**
+ * Walk `dir` and collect every real file into a `skills_save` payload.
+ *
+ * - Symlinks are never followed (skipped outright) — a save must not escape
+ *   `dir` or loop on a cyclic link.
+ * - At the root only, dotfiles are excluded except `.gitignore` (ordinary
+ *   authoring content) and the pull provenance sidecar `.genspark-skill.json`
+ *   (metadata, not a skill file). Dotfiles in subdirectories are kept as-is.
+ * - Requires a root `SKILL.md`: the server rejects a save without one
+ *   anyway (frontmatter validation), so failing fast here saves a round trip.
+ * - Throws once the running byte total exceeds `maxBytes`.
+ *
+ * Returns the sidecar's recorded `owner` (if any) so the caller can warn the
+ * user before saving into someone else's pulled skill forks it into their
+ * own catalog.
+ */
+export function collectSkillDir(dir, maxBytes = DEFAULT_MAX_BYTES) {
+    const skillMdPath = path.join(dir, 'SKILL.md');
+    if (!fs.existsSync(skillMdPath) || !fs.statSync(skillMdPath).isFile()) {
+        throw new Error(`${dir} has no SKILL.md at its root — not a skill directory`);
+    }
+    const files = [];
+    let totalBytes = 0;
+    const walk = (abs, rel) => {
+        const isRoot = rel === '';
+        for (const dirent of fs.readdirSync(abs, { withFileTypes: true })) {
+            if (dirent.isSymbolicLink())
+                continue;
+            if (isRoot &&
+                (dirent.name === SIDECAR_FILENAME ||
+                    (dirent.name.startsWith('.') && dirent.name !== '.gitignore'))) {
+                continue;
+            }
+            const childAbs = path.join(abs, dirent.name);
+            const childRel = rel ? path.join(rel, dirent.name) : dirent.name;
+            if (dirent.isDirectory()) {
+                // Never walk or ship dependency / VCS trees, at ANY depth — they are
+                // never part of a skill, can be enormous (blowing the byte cap on
+                // junk), and `.git` would leak history. Root `.git` is already caught
+                // by the dotfile filter above; this also covers nested ones and
+                // `node_modules` (not a dotfile, so otherwise walked).
+                if (dirent.name === 'node_modules' || dirent.name === '.git')
+                    continue;
+                walk(childAbs, childRel);
+                continue;
+            }
+            if (!dirent.isFile())
+                continue;
+            // Cap-check on the stat size BEFORE reading: an over-cap file yields a
+            // clean cap error without ballooning memory or tripping Node's
+            // ERR_FS_FILE_TOO_LARGE on a huge readFileSync.
+            const size = fs.statSync(childAbs).size;
+            if (totalBytes + size > maxBytes) {
+                throw new Error(`skill directory exceeds the ${maxBytes} byte cap`);
+            }
+            const bytes = fs.readFileSync(childAbs);
+            totalBytes += bytes.length;
+            files.push({
+                path: childRel.split(path.sep).join('/'),
+                content_base64: bytes.toString('base64'),
+            });
+        }
+    };
+    walk(dir, '');
+    if (files.length === 0) {
+        throw new Error(`${dir} contains no files to save`);
+    }
+    return {
+        files,
+        totalBytes,
+        sidecarOwner: readSidecar(dir)?.owner,
+    };
+}
+//# sourceMappingURL=skills-save.js.map