@harness-engineering/cli 1.11.0 → 1.12.0

package/dist/{chunk-ZWC3MN5E.js → chunk-B5SBNH4S.js}

@@ -5,9 +5,10 @@ import {
   OutputFormatter,
   OutputMode,
   createCheckPhaseGateCommand,
+  findConfigFile,
   findFiles,
   resolveConfig
-} from "./chunk-2NCIKJES.js";
+} from "./chunk-ZU2UBYBY.js";
 import {
   createGenerateAgentDefinitionsCommand,
   generateAgentDefinitions
@@ -49,7 +50,7 @@ import {
   generateSlashCommands,
   handleGetImpact,
   handleOrphanDeletion
-} from "./chunk-I6JZYEGT.js";
+} from "./chunk-747VBPA4.js";
 import {
   VALID_PLATFORMS
 } from "./chunk-ZOAWBDWU.js";
@@ -79,11 +80,13 @@ import {
   ArchConfigSchema,
   BaselineManager,
   BlueprintGenerator,
+  BundleSchema,
   CriticalPathResolver,
   EntropyAnalyzer,
   ProjectScanner,
   SecurityScanner,
   TypeScriptParser,
+  addProvenance,
   appendLearning,
   applyFixes,
   archiveStream,
@@ -91,6 +94,7 @@ import {
   checkDocCoverage,
   createFixes,
   createStream,
+  deepMergeConstraints,
   defineLayer,
   detectCircularDepsInFiles,
   detectDeadCode,
@@ -104,6 +108,9 @@ import {
   parseDiff,
   parseManifest,
   parseSecurityConfig,
+  readLockfile,
+  removeContributions,
+  removeProvenance,
   requestPeerReview,
   resolveStreamPath,
   runAll,
@@ -113,15 +120,16 @@ import {
   validateAgentsMap,
   validateDependencies,
   validateKnowledgeMap,
-  writeConfig
-} from "./chunk-2YSQOUHO.js";
+  writeConfig,
+  writeLockfile
+} from "./chunk-AE2OWWDH.js";
 import {
   Err,
   Ok
 } from "./chunk-MHBMTPW7.js";
 
 // src/index.ts
-import { Command as Command51 } from "commander";
+import { Command as Command53 } from "commander";
 
 // src/commands/validate.ts
 import { Command } from "commander";
@@ -200,7 +208,7 @@ function createValidateCommand() {
       process.exit(result.error.exitCode);
     }
     if (opts.crossCheck) {
-      const { runCrossCheck: runCrossCheck2 } = await import("./validate-cross-check-DB7RIFFF.js");
+      const { runCrossCheck: runCrossCheck2 } = await import("./validate-cross-check-LJX65SBS.js");
       const cwd = process.cwd();
       const specsDir = path.join(cwd, "docs", "specs");
       const plansDir = path.join(cwd, "docs", "plans");
@@ -468,10 +476,10 @@ async function runCheckSecurity(cwd, options) {
   const projectRoot = path4.resolve(cwd);
   let configData = {};
   try {
-    const fs20 = await import("fs");
+    const fs23 = await import("fs");
     const configPath = path4.join(projectRoot, "harness.config.json");
-    if (fs20.existsSync(configPath)) {
-      const raw = fs20.readFileSync(configPath, "utf-8");
+    if (fs23.existsSync(configPath)) {
+      const raw = fs23.readFileSync(configPath, "utf-8");
       const parsed = JSON.parse(raw);
       configData = parsed.security ?? {};
     }
@@ -558,7 +566,7 @@ function createPerfCommand() {
   perf.command("bench [glob]").description("Run benchmarks via vitest bench").action(async (glob, _opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const cwd = process.cwd();
-    const { BenchmarkRunner } = await import("./dist-JVZ2MKBC.js");
+    const { BenchmarkRunner } = await import("./dist-IJ4J4C5G.js");
     const runner = new BenchmarkRunner();
     const benchFiles = runner.discover(cwd, glob);
     if (benchFiles.length === 0) {
@@ -627,7 +635,7 @@ Results (${result.results.length} benchmarks):`);
   baselines.command("update").description("Update baselines from latest benchmark run").action(async (_opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const cwd = process.cwd();
-    const { BenchmarkRunner } = await import("./dist-JVZ2MKBC.js");
+    const { BenchmarkRunner } = await import("./dist-IJ4J4C5G.js");
     const runner = new BenchmarkRunner();
     const manager = new BaselineManager(cwd);
     logger.info("Running benchmarks to update baselines...");
@@ -655,7 +663,7 @@ Results (${result.results.length} benchmarks):`);
   perf.command("report").description("Full performance report with metrics, trends, and hotspots").action(async (_opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const cwd = process.cwd();
-    const { EntropyAnalyzer: EntropyAnalyzer2 } = await import("./dist-JVZ2MKBC.js");
+    const { EntropyAnalyzer: EntropyAnalyzer2 } = await import("./dist-IJ4J4C5G.js");
     const analyzer = new EntropyAnalyzer2({
       rootDir: path5.resolve(cwd),
       analyze: { complexity: true, coupling: true }
@@ -1905,7 +1913,7 @@ function sortedStringify(obj) {
     2
   );
 }
-function readLockfile(filePath) {
+function readLockfile2(filePath) {
   if (!fs5.existsSync(filePath)) {
     return createEmptyLockfile();
   }
@@ -1925,7 +1933,7 @@ function readLockfile(filePath) {
   }
   return parsed;
 }
-function writeLockfile(filePath, lockfile) {
+function writeLockfile2(filePath, lockfile) {
   const dir = path14.dirname(filePath);
   fs5.mkdirSync(dir, { recursive: true });
   fs5.writeFileSync(filePath, sortedStringify(lockfile) + "\n", "utf-8");
@@ -1996,8 +2004,18 @@ function collectSkills(opts) {
     const globalDir = resolveGlobalSkillsDir();
     const skillsDir = path15.dirname(globalDir);
     const communityBase = path15.join(skillsDir, "community");
+    const communityPlatformDir = path15.join(communityBase, "claude-code");
     const lockfilePath = path15.join(communityBase, "skills-lock.json");
-    const lockfile = readLockfile(lockfilePath);
+    const lockfile = readLockfile2(lockfilePath);
+    const communitySkills = scanDirectory(communityPlatformDir, "community");
+    for (const skill of communitySkills) {
+      const pkgName = `@harness-skills/${skill.name}`;
+      const lockEntry = lockfile.skills[pkgName];
+      if (lockEntry) {
+        skill.version = lockEntry.version;
+      }
+    }
+    addUnique(communitySkills);
     for (const [pkgName, entry] of Object.entries(lockfile.skills)) {
       const shortName = pkgName.replace("@harness-skills/", "");
       if (!seen.has(shortName)) {
@@ -2393,6 +2411,9 @@ function createInfoCommand() {
 import { Command as Command25 } from "commander";
 
 // src/registry/npm-client.ts
+import * as fs10 from "fs";
+import * as path19 from "path";
+import * as os2 from "os";
 var NPM_REGISTRY = "https://registry.npmjs.org";
 var FETCH_TIMEOUT_MS = 3e4;
 var HARNESS_SKILLS_SCOPE = "@harness-skills/";
@@ -2411,12 +2432,37 @@ function extractSkillName(packageName) {
   }
   return packageName;
 }
-async function fetchPackageMetadata(packageName) {
+function readNpmrcToken(registryUrl) {
+  const { hostname, pathname } = new URL(registryUrl);
+  const registryPath = `//${hostname}${pathname.replace(/\/$/, "")}/:_authToken=`;
+  const candidates = [path19.join(process.cwd(), ".npmrc"), path19.join(os2.homedir(), ".npmrc")];
+  for (const npmrcPath of candidates) {
+    try {
+      const content = fs10.readFileSync(npmrcPath, "utf-8");
+      for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith(registryPath)) {
+          return trimmed.slice(registryPath.length).trim();
+        }
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+async function fetchPackageMetadata(packageName, registryUrl) {
+  const registry = registryUrl ?? NPM_REGISTRY;
+  const headers = {};
+  if (registryUrl) {
+    const token = readNpmrcToken(registryUrl);
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+  }
   const encodedName = encodeURIComponent(packageName);
-  const url = `${NPM_REGISTRY}/${encodedName}`;
+  const url = `${registry}/${encodedName}`;
   let response;
   try {
     response = await fetch(url, {
+      headers,
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
     });
   } catch {
@@ -2432,11 +2478,16 @@ async function fetchPackageMetadata(packageName) {
   }
   return await response.json();
 }
-async function downloadTarball(tarballUrl) {
+async function downloadTarball(tarballUrl, authToken) {
   let lastError;
+  const headers = {};
+  if (authToken) {
+    headers["Authorization"] = `Bearer ${authToken}`;
+  }
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const response = await fetch(tarballUrl, {
+        headers,
         signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
       });
       if (!response.ok) {
@@ -2450,12 +2501,19 @@ async function downloadTarball(tarballUrl) {
   }
   throw new Error(`Download failed for ${tarballUrl}. Try again. (${lastError?.message})`);
 }
-async function searchNpmRegistry(query) {
+async function searchNpmRegistry(query, registryUrl) {
+  const registry = registryUrl ?? NPM_REGISTRY;
+  const headers = {};
+  if (registryUrl) {
+    const token = readNpmrcToken(registryUrl);
+    if (token) headers["Authorization"] = `Bearer ${token}`;
+  }
   const searchText = encodeURIComponent(`scope:harness-skills ${query}`);
-  const url = `${NPM_REGISTRY}/-/v1/search?text=${searchText}&size=20`;
+  const url = `${registry}/-/v1/search?text=${searchText}&size=20`;
   let response;
   try {
     response = await fetch(url, {
+      headers,
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
     });
   } catch {
@@ -2476,7 +2534,7 @@ async function searchNpmRegistry(query) {
 
 // src/commands/skill/search.ts
 async function runSearch(query, opts) {
-  const results = await searchNpmRegistry(query);
+  const results = await searchNpmRegistry(query, opts.registry);
   return results.filter((r) => {
     if (opts.platform && !r.keywords.includes(opts.platform)) {
       return false;
@@ -2488,7 +2546,7 @@ async function runSearch(query, opts) {
   });
 }
 function createSearchCommand() {
-  return new Command25("search").description("Search for community skills on the @harness-skills registry").argument("<query>", "Search query").option("--platform <platform>", "Filter by platform (e.g., claude-code)").option("--trigger <trigger>", "Filter by trigger type (e.g., manual, automatic)").action(async (query, opts, cmd) => {
+  return new Command25("search").description("Search for community skills on the @harness-skills registry").argument("<query>", "Search query").option("--platform <platform>", "Filter by platform (e.g., claude-code)").option("--trigger <trigger>", "Filter by trigger type (e.g., manual, automatic)").option("--registry <url>", "Use a custom npm registry URL").action(async (query, opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     try {
       const results = await runSearch(query, opts);
@@ -2525,8 +2583,8 @@ Found ${results.length} skill(s):
 
 // src/commands/skill/create.ts
 import { Command as Command26 } from "commander";
-import * as path19 from "path";
-import * as fs10 from "fs";
+import * as path20 from "path";
+import * as fs11 from "fs";
 import YAML from "yaml";
 var KEBAB_CASE_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 function buildReadme(name, description) {
@@ -2610,22 +2668,22 @@ function runCreate(name, opts) {
   if (!KEBAB_CASE_RE.test(name)) {
     throw new Error(`Invalid skill name "${name}". Must be kebab-case (e.g., my-skill).`);
   }
-  const baseDir = opts.outputDir ?? path19.join(process.cwd(), "agents", "skills", "claude-code");
-  const skillDir = path19.join(baseDir, name);
-  if (fs10.existsSync(skillDir)) {
+  const baseDir = opts.outputDir ?? path20.join(process.cwd(), "agents", "skills", "claude-code");
+  const skillDir = path20.join(baseDir, name);
+  if (fs11.existsSync(skillDir)) {
     throw new Error(`Skill directory already exists: ${skillDir}`);
   }
-  fs10.mkdirSync(skillDir, { recursive: true });
+  fs11.mkdirSync(skillDir, { recursive: true });
   const description = opts.description || `A community skill: ${name}`;
   const skillYaml = buildSkillYaml(name, opts);
-  const skillYamlPath = path19.join(skillDir, "skill.yaml");
-  fs10.writeFileSync(skillYamlPath, YAML.stringify(skillYaml));
+  const skillYamlPath = path20.join(skillDir, "skill.yaml");
+  fs11.writeFileSync(skillYamlPath, YAML.stringify(skillYaml));
   const skillMd = buildSkillMd(name, description);
-  const skillMdPath = path19.join(skillDir, "SKILL.md");
-  fs10.writeFileSync(skillMdPath, skillMd);
+  const skillMdPath = path20.join(skillDir, "SKILL.md");
+  fs11.writeFileSync(skillMdPath, skillMd);
   const readme = buildReadme(name, description);
-  const readmePath = path19.join(skillDir, "README.md");
-  fs10.writeFileSync(readmePath, readme);
+  const readmePath = path20.join(skillDir, "README.md");
+  fs11.writeFileSync(readmePath, readme);
   return {
     name,
     directory: skillDir,
@@ -2653,7 +2711,7 @@ function createCreateCommand() {
         logger.info(`
 Next steps:`);
         logger.info(
-          `  1. Edit ${path19.join(result.directory, "SKILL.md")} with your skill content`
+          `  1. Edit ${path20.join(result.directory, "SKILL.md")} with your skill content`
         );
         logger.info(`  2. Run: harness skill validate ${name}`);
         logger.info(`  3. Run: harness skills publish`);
@@ -2667,27 +2725,28 @@ Next steps:`);
 
 // src/commands/skill/publish.ts
 import { Command as Command27 } from "commander";
-import * as fs13 from "fs";
-import * as path21 from "path";
+import * as fs14 from "fs";
+import * as path23 from "path";
 import { execFileSync as execFileSync3 } from "child_process";
 
 // src/registry/validator.ts
-import * as fs12 from "fs";
-import * as path20 from "path";
+import * as fs13 from "fs";
+import * as path22 from "path";
 import { parse as parse5 } from "yaml";
 import semver from "semver";
 
 // src/registry/bundled-skills.ts
-import * as fs11 from "fs";
+import * as fs12 from "fs";
+import * as path21 from "path";
 function getBundledSkillNames(bundledSkillsDir) {
-  if (!fs11.existsSync(bundledSkillsDir)) {
+  if (!fs12.existsSync(bundledSkillsDir)) {
     return /* @__PURE__ */ new Set();
   }
-  const entries = fs11.readdirSync(bundledSkillsDir);
+  const entries = fs12.readdirSync(bundledSkillsDir);
   const names = /* @__PURE__ */ new Set();
   for (const entry of entries) {
     try {
-      const stat = fs11.statSync(`${bundledSkillsDir}/${entry}`);
+      const stat = fs12.statSync(path21.join(bundledSkillsDir, String(entry)));
       if (stat.isDirectory()) {
         names.add(String(entry));
       }
@@ -2698,16 +2757,16 @@ function getBundledSkillNames(bundledSkillsDir) {
 }
 
 // src/registry/validator.ts
-async function validateForPublish(skillDir) {
+async function validateForPublish(skillDir, registryUrl) {
   const errors = [];
-  const skillYamlPath = path20.join(skillDir, "skill.yaml");
-  if (!fs12.existsSync(skillYamlPath)) {
+  const skillYamlPath = path22.join(skillDir, "skill.yaml");
+  if (!fs13.existsSync(skillYamlPath)) {
     errors.push("skill.yaml not found. Create one with: harness skill create <name>");
     return { valid: false, errors };
   }
   let skillMeta;
   try {
-    const raw = fs12.readFileSync(skillYamlPath, "utf-8");
+    const raw = fs13.readFileSync(skillYamlPath, "utf-8");
     const parsed = parse5(raw);
     const result = SkillMetadataSchema.safeParse(parsed);
     if (!result.success) {
@@ -2729,11 +2788,11 @@ async function validateForPublish(skillDir) {
   if (!skillMeta.triggers || skillMeta.triggers.length === 0) {
     errors.push("At least one trigger is required. Add triggers to skill.yaml.");
   }
-  const skillMdPath = path20.join(skillDir, "SKILL.md");
-  if (!fs12.existsSync(skillMdPath)) {
+  const skillMdPath = path22.join(skillDir, "SKILL.md");
+  if (!fs13.existsSync(skillMdPath)) {
     errors.push("SKILL.md not found. Create it with content describing your skill.");
   } else {
-    const content = fs12.readFileSync(skillMdPath, "utf-8");
+    const content = fs13.readFileSync(skillMdPath, "utf-8");
     if (!content.includes("## When to Use")) {
       errors.push('SKILL.md must contain a "## When to Use" section.');
     }
@@ -2750,21 +2809,25 @@ async function validateForPublish(skillDir) {
   }
   try {
     const packageName = resolvePackageName(skillMeta.name);
-    const metadata = await fetchPackageMetadata(packageName);
+    const metadata = await fetchPackageMetadata(packageName, registryUrl);
     const publishedVersion = metadata["dist-tags"]?.latest;
     if (publishedVersion && !semver.gt(skillMeta.version, publishedVersion)) {
       errors.push(
         `Version ${skillMeta.version} must be greater than published version ${publishedVersion}. Bump the version in skill.yaml.`
       );
     }
-  } catch {
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (!msg.includes("not found")) {
+      errors.push(`Cannot verify version against npm registry: ${msg}`);
+    }
   }
   if (skillMeta.depends_on && skillMeta.depends_on.length > 0) {
     for (const dep of skillMeta.depends_on) {
       if (bundledNames.has(dep)) continue;
       try {
         const depPkg = resolvePackageName(dep);
-        await fetchPackageMetadata(depPkg);
+        await fetchPackageMetadata(depPkg, registryUrl);
       } catch {
         errors.push(
           `Dependency "${dep}" not found on npm or as a bundled skill. Publish it first or remove from depends_on.`
@@ -2801,7 +2864,7 @@ function derivePackageJson(skill) {
 
 // src/commands/skill/publish.ts
 async function runPublish(skillDir, opts) {
-  const validation = await validateForPublish(skillDir);
+  const validation = await validateForPublish(skillDir, opts.registry);
   if (!validation.valid) {
     const errorList = validation.errors.map((e) => `  - ${e}`).join("\n");
     throw new Error(`Pre-publish validation failed:
@@ -2809,11 +2872,11 @@ ${errorList}`);
   }
   const meta = validation.skillMeta;
   const pkg = derivePackageJson(meta);
-  const pkgPath = path21.join(skillDir, "package.json");
-  fs13.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-  const readmePath = path21.join(skillDir, "README.md");
-  if (!fs13.existsSync(readmePath)) {
-    const skillMdContent = fs13.readFileSync(path21.join(skillDir, "SKILL.md"), "utf-8");
+  const pkgPath = path23.join(skillDir, "package.json");
+  fs14.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  const readmePath = path23.join(skillDir, "README.md");
+  if (!fs14.existsSync(readmePath)) {
+    const skillMdContent = fs14.readFileSync(path23.join(skillDir, "SKILL.md"), "utf-8");
     const readme = `# ${pkg.name}
 
 ${meta.description}
@@ -2827,7 +2890,7 @@ harness install ${meta.name}
 ---
 
 ${skillMdContent}`;
-    fs13.writeFileSync(readmePath, readme);
+    fs14.writeFileSync(readmePath, readme);
   }
   if (opts.dryRun) {
     return {
@@ -2837,7 +2900,11 @@ ${skillMdContent}`;
       dryRun: true
     };
   }
-  execFileSync3("npm", ["publish", "--access", "public"], {
+  const publishArgs = ["publish", "--access", "public"];
+  if (opts.registry) {
+    publishArgs.push("--registry", opts.registry);
+  }
+  execFileSync3("npm", publishArgs, {
     cwd: skillDir,
     stdio: "pipe",
     timeout: 6e4
@@ -2849,12 +2916,13 @@ ${skillMdContent}`;
   };
 }
 function createPublishCommand() {
-  return new Command27("publish").description("Validate and publish a skill to @harness-skills on npm").option("--dry-run", "Run validation and generate package.json without publishing").option("--dir <dir>", "Skill directory (default: current directory)").action(async (opts, cmd) => {
+  return new Command27("publish").description("Validate and publish a skill to @harness-skills on npm").option("--dry-run", "Run validation and generate package.json without publishing").option("--dir <dir>", "Skill directory (default: current directory)").option("--registry <url>", "Use a custom npm registry URL").action(async (opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
     const skillDir = opts.dir || process.cwd();
     try {
       const result = await runPublish(skillDir, {
-        dryRun: opts.dryRun
+        dryRun: opts.dryRun,
+        registry: opts.registry
       });
       if (globalOpts.json) {
         logger.raw(result);
@@ -2889,11 +2957,11 @@ import { Command as Command33 } from "commander";
 
 // src/commands/state/show.ts
 import { Command as Command29 } from "commander";
-import * as path22 from "path";
+import * as path24 from "path";
 function createShowCommand() {
   return new Command29("show").description("Show current project state").option("--path <path>", "Project root path", ".").option("--stream <name>", "Target a specific stream").action(async (opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
-    const projectPath = path22.resolve(opts.path);
+    const projectPath = path24.resolve(opts.path);
     const result = await loadState(projectPath, opts.stream);
     if (!result.ok) {
       logger.error(result.error.message);
@@ -2934,12 +3002,12 @@ Decisions: ${state.decisions.length}`);
 
 // src/commands/state/reset.ts
 import { Command as Command30 } from "commander";
-import * as fs14 from "fs";
-import * as path23 from "path";
+import * as fs15 from "fs";
+import * as path25 from "path";
 import * as readline from "readline";
 function createResetCommand() {
   return new Command30("reset").description("Reset project state (deletes .harness/state.json)").option("--path <path>", "Project root path", ".").option("--stream <name>", "Target a specific stream").option("--yes", "Skip confirmation prompt").action(async (opts, _cmd) => {
-    const projectPath = path23.resolve(opts.path);
+    const projectPath = path25.resolve(opts.path);
     let statePath;
     if (opts.stream) {
       const streamResult = await resolveStreamPath(projectPath, { stream: opts.stream });
@@ -2948,19 +3016,19 @@ function createResetCommand() {
         process.exit(ExitCode.ERROR);
         return;
       }
-      statePath = path23.join(streamResult.value, "state.json");
+      statePath = path25.join(streamResult.value, "state.json");
     } else {
-      statePath = path23.join(projectPath, ".harness", "state.json");
+      statePath = path25.join(projectPath, ".harness", "state.json");
     }
-    if (!fs14.existsSync(statePath)) {
+    if (!fs15.existsSync(statePath)) {
       logger.info("No state file found. Nothing to reset.");
       process.exit(ExitCode.SUCCESS);
       return;
     }
     if (!opts.yes) {
       const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-      const answer = await new Promise((resolve24) => {
-        rl.question("Reset project state? This cannot be undone. [y/N] ", resolve24);
+      const answer = await new Promise((resolve27) => {
+        rl.question("Reset project state? This cannot be undone. [y/N] ", resolve27);
       });
       rl.close();
       if (answer.toLowerCase() !== "y" && answer.toLowerCase() !== "yes") {
@@ -2970,7 +3038,7 @@ function createResetCommand() {
       }
     }
     try {
-      fs14.unlinkSync(statePath);
+      fs15.unlinkSync(statePath);
       logger.success("Project state reset.");
     } catch (e) {
       logger.error(`Failed to reset state: ${e instanceof Error ? e.message : String(e)}`);
@@ -2983,10 +3051,10 @@ function createResetCommand() {
 
 // src/commands/state/learn.ts
 import { Command as Command31 } from "commander";
-import * as path24 from "path";
+import * as path26 from "path";
 function createLearnCommand() {
   return new Command31("learn").description("Append a learning to .harness/learnings.md").argument("<message>", "The learning to record").option("--path <path>", "Project root path", ".").option("--stream <name>", "Target a specific stream").action(async (message, opts, _cmd) => {
-    const projectPath = path24.resolve(opts.path);
+    const projectPath = path26.resolve(opts.path);
     const result = await appendLearning(projectPath, message, void 0, void 0, opts.stream);
     if (!result.ok) {
       logger.error(result.error.message);
@@ -3000,12 +3068,12 @@ function createLearnCommand() {
 
 // src/commands/state/streams.ts
 import { Command as Command32 } from "commander";
-import * as path25 from "path";
+import * as path27 from "path";
 function createStreamsCommand() {
   const command = new Command32("streams").description("Manage state streams");
   command.command("list").description("List all known streams").option("--path <path>", "Project root path", ".").action(async (opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
-    const projectPath = path25.resolve(opts.path);
+    const projectPath = path27.resolve(opts.path);
     const indexResult = await loadStreamIndex(projectPath);
     const result = await listStreams(projectPath);
     if (!result.ok) {
@@ -3029,7 +3097,7 @@ function createStreamsCommand() {
     process.exit(ExitCode.SUCCESS);
   });
   command.command("create <name>").description("Create a new stream").option("--path <path>", "Project root path", ".").option("--branch <branch>", "Associate with a git branch").action(async (name, opts) => {
-    const projectPath = path25.resolve(opts.path);
+    const projectPath = path27.resolve(opts.path);
     const result = await createStream(projectPath, name, opts.branch);
     if (!result.ok) {
       logger.error(result.error.message);
@@ -3040,7 +3108,7 @@ function createStreamsCommand() {
     process.exit(ExitCode.SUCCESS);
   });
   command.command("archive <name>").description("Archive a stream").option("--path <path>", "Project root path", ".").action(async (name, opts) => {
-    const projectPath = path25.resolve(opts.path);
+    const projectPath = path27.resolve(opts.path);
     const result = await archiveStream(projectPath, name);
     if (!result.ok) {
       logger.error(result.error.message);
@@ -3051,7 +3119,7 @@ function createStreamsCommand() {
     process.exit(ExitCode.SUCCESS);
   });
   command.command("activate <name>").description("Set the active stream").option("--path <path>", "Project root path", ".").action(async (name, opts) => {
-    const projectPath = path25.resolve(opts.path);
+    const projectPath = path27.resolve(opts.path);
     const result = await setActiveStream(projectPath, name);
     if (!result.ok) {
       logger.error(result.error.message);
@@ -3163,8 +3231,8 @@ function createCheckCommand() {
 
 // src/commands/ci/init.ts
 import { Command as Command35 } from "commander";
-import * as fs15 from "fs";
-import * as path26 from "path";
+import * as fs16 from "fs";
+import * as path28 from "path";
 var ALL_CHECKS = [
   "validate",
   "deps",
@@ -3265,8 +3333,8 @@ function generateCIConfig(options) {
   });
 }
 function detectPlatform() {
-  if (fs15.existsSync(".github")) return "github";
-  if (fs15.existsSync(".gitlab-ci.yml")) return "gitlab";
+  if (fs16.existsSync(".github")) return "github";
+  if (fs16.existsSync(".gitlab-ci.yml")) return "gitlab";
   return null;
 }
 function createInitCommand2() {
@@ -3282,12 +3350,12 @@ function createInitCommand2() {
       process.exit(result.error.exitCode);
     }
     const { filename, content } = result.value;
-    const targetPath = path26.resolve(filename);
-    const dir = path26.dirname(targetPath);
-    fs15.mkdirSync(dir, { recursive: true });
-    fs15.writeFileSync(targetPath, content);
+    const targetPath = path28.resolve(filename);
+    const dir = path28.dirname(targetPath);
+    fs16.mkdirSync(dir, { recursive: true });
+    fs16.writeFileSync(targetPath, content);
     if (platform === "generic" && process.platform !== "win32") {
-      fs15.chmodSync(targetPath, "755");
+      fs16.chmodSync(targetPath, "755");
     }
     if (globalOpts.json) {
       console.log(JSON.stringify({ file: filename, platform }));
@@ -3367,10 +3435,10 @@ function prompt(question) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve24) => {
+  return new Promise((resolve27) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve24(answer.trim().toLowerCase());
+      resolve27(answer.trim().toLowerCase());
     });
   });
 }
@@ -3508,7 +3576,7 @@ function createGenerateCommand3() {
 
 // src/commands/graph/scan.ts
 import { Command as Command39 } from "commander";
-import * as path27 from "path";
+import * as path29 from "path";
 async function runScan(projectPath) {
   const { GraphStore, CodeIngestor, TopologicalLinker, KnowledgeIngestor, GitIngestor } = await import("./dist-M6BQODWC.js");
   const store = new GraphStore();
@@ -3521,13 +3589,13 @@ async function runScan(projectPath) {
     await new GitIngestor(store).ingest(projectPath);
   } catch {
   }
-  const graphDir = path27.join(projectPath, ".harness", "graph");
+  const graphDir = path29.join(projectPath, ".harness", "graph");
   await store.save(graphDir);
   return { nodeCount: store.nodeCount, edgeCount: store.edgeCount, durationMs: Date.now() - start };
 }
 function createScanCommand() {
   return new Command39("scan").description("Scan project and build knowledge graph").argument("[path]", "Project root path", ".").action(async (inputPath, _opts, cmd) => {
-    const projectPath = path27.resolve(inputPath);
+    const projectPath = path29.resolve(inputPath);
     const globalOpts = cmd.optsWithGlobals();
     try {
       const result = await runScan(projectPath);
@@ -3547,12 +3615,12 @@ function createScanCommand() {
 
 // src/commands/graph/ingest.ts
 import { Command as Command40 } from "commander";
-import * as path28 from "path";
+import * as path30 from "path";
 async function loadConnectorConfig(projectPath, source) {
   try {
-    const fs20 = await import("fs/promises");
-    const configPath = path28.join(projectPath, "harness.config.json");
-    const config = JSON.parse(await fs20.readFile(configPath, "utf-8"));
+    const fs23 = await import("fs/promises");
+    const configPath = path30.join(projectPath, "harness.config.json");
+    const config = JSON.parse(await fs23.readFile(configPath, "utf-8"));
     const connector = config.graph?.connectors?.find(
       (c) => c.source === source
     );
@@ -3592,7 +3660,7 @@ async function runIngest(projectPath, source, opts) {
     JiraConnector,
     SlackConnector
   } = await import("./dist-M6BQODWC.js");
-  const graphDir = path28.join(projectPath, ".harness", "graph");
+  const graphDir = path30.join(projectPath, ".harness", "graph");
   const store = new GraphStore();
   await store.load(graphDir);
   if (opts?.all) {
@@ -3659,7 +3727,7 @@ function createIngestCommand() {
       process.exit(1);
     }
     const globalOpts = cmd.optsWithGlobals();
-    const projectPath = path28.resolve(globalOpts.config ? path28.dirname(globalOpts.config) : ".");
+    const projectPath = path30.resolve(globalOpts.config ? path30.dirname(globalOpts.config) : ".");
     try {
       const result = await runIngest(projectPath, opts.source ?? "", {
         full: opts.full,
@@ -3682,11 +3750,11 @@ function createIngestCommand() {
 
 // src/commands/graph/query.ts
 import { Command as Command41 } from "commander";
-import * as path29 from "path";
+import * as path31 from "path";
 async function runQuery(projectPath, rootNodeId, opts) {
   const { GraphStore, ContextQL } = await import("./dist-M6BQODWC.js");
   const store = new GraphStore();
-  const graphDir = path29.join(projectPath, ".harness", "graph");
+  const graphDir = path31.join(projectPath, ".harness", "graph");
   const loaded = await store.load(graphDir);
   if (!loaded) throw new Error("No graph found. Run `harness scan` first.");
   const params = {
@@ -3702,7 +3770,7 @@ async function runQuery(projectPath, rootNodeId, opts) {
 function createQueryCommand() {
   return new Command41("query").description("Query the knowledge graph").argument("<rootNodeId>", "Starting node ID").option("--depth <n>", "Max traversal depth", "3").option("--types <types>", "Comma-separated node types to include").option("--edges <edges>", "Comma-separated edge types to include").option("--bidirectional", "Traverse both directions").action(async (rootNodeId, opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
-    const projectPath = path29.resolve(globalOpts.config ? path29.dirname(globalOpts.config) : ".");
+    const projectPath = path31.resolve(globalOpts.config ? path31.dirname(globalOpts.config) : ".");
     try {
       const result = await runQuery(projectPath, rootNodeId, {
         depth: parseInt(opts.depth),
@@ -3731,18 +3799,18 @@ function createQueryCommand() {
 import { Command as Command42 } from "commander";
 
 // src/commands/graph/status.ts
-import * as path30 from "path";
+import * as path32 from "path";
 async function runGraphStatus(projectPath) {
   const { GraphStore } = await import("./dist-M6BQODWC.js");
-  const graphDir = path30.join(projectPath, ".harness", "graph");
+  const graphDir = path32.join(projectPath, ".harness", "graph");
   const store = new GraphStore();
   const loaded = await store.load(graphDir);
   if (!loaded) return { status: "no_graph", message: "No graph found. Run `harness scan` first." };
-  const fs20 = await import("fs/promises");
-  const metaPath = path30.join(graphDir, "metadata.json");
+  const fs23 = await import("fs/promises");
+  const metaPath = path32.join(graphDir, "metadata.json");
   let lastScan = "unknown";
   try {
-    const meta = JSON.parse(await fs20.readFile(metaPath, "utf-8"));
+    const meta = JSON.parse(await fs23.readFile(metaPath, "utf-8"));
     lastScan = meta.lastScanTimestamp;
   } catch {
   }
@@ -3753,8 +3821,8 @@ async function runGraphStatus(projectPath) {
   }
   let connectorSyncStatus = {};
   try {
-    const syncMetaPath = path30.join(graphDir, "sync-metadata.json");
-    const syncMeta = JSON.parse(await fs20.readFile(syncMetaPath, "utf-8"));
+    const syncMetaPath = path32.join(graphDir, "sync-metadata.json");
+    const syncMeta = JSON.parse(await fs23.readFile(syncMetaPath, "utf-8"));
     for (const [name, data] of Object.entries(syncMeta.connectors ?? {})) {
       connectorSyncStatus[name] = data.lastSyncTimestamp;
     }
@@ -3771,10 +3839,10 @@ async function runGraphStatus(projectPath) {
 }
 
 // src/commands/graph/export.ts
-import * as path31 from "path";
+import * as path33 from "path";
 async function runGraphExport(projectPath, format) {
   const { GraphStore } = await import("./dist-M6BQODWC.js");
-  const graphDir = path31.join(projectPath, ".harness", "graph");
+  const graphDir = path33.join(projectPath, ".harness", "graph");
   const store = new GraphStore();
   const loaded = await store.load(graphDir);
   if (!loaded) throw new Error("No graph found. Run `harness scan` first.");
@@ -3803,13 +3871,13 @@ async function runGraphExport(projectPath, format) {
 }
 
 // src/commands/graph/index.ts
-import * as path32 from "path";
+import * as path34 from "path";
 function createGraphCommand() {
   const graph = new Command42("graph").description("Knowledge graph management");
   graph.command("status").description("Show graph statistics").action(async (_opts, cmd) => {
     try {
       const globalOpts = cmd.optsWithGlobals();
-      const projectPath = path32.resolve(globalOpts.config ? path32.dirname(globalOpts.config) : ".");
+      const projectPath = path34.resolve(globalOpts.config ? path34.dirname(globalOpts.config) : ".");
       const result = await runGraphStatus(projectPath);
       if (globalOpts.json) {
         console.log(JSON.stringify(result, null, 2));
@@ -3836,7 +3904,7 @@ function createGraphCommand() {
   });
   graph.command("export").description("Export graph").requiredOption("--format <format>", "Output format (json, mermaid)").action(async (opts, cmd) => {
     const globalOpts = cmd.optsWithGlobals();
-    const projectPath = path32.resolve(globalOpts.config ? path32.dirname(globalOpts.config) : ".");
+    const projectPath = path34.resolve(globalOpts.config ? path34.dirname(globalOpts.config) : ".");
     try {
       const output = await runGraphExport(projectPath, opts.format);
       console.log(output);
@@ -3852,7 +3920,7 @@ function createGraphCommand() {
 import { Command as Command43 } from "commander";
 function createMcpCommand() {
   return new Command43("mcp").description("Start the MCP (Model Context Protocol) server on stdio").action(async () => {
-    const { startServer: startServer2 } = await import("./mcp-MOKLYNZL.js");
+    const { startServer: startServer2 } = await import("./mcp-YM6QLHLZ.js");
     await startServer2();
   });
 }
@@ -3860,8 +3928,8 @@ function createMcpCommand() {
 // src/commands/impact-preview.ts
 import { Command as Command44 } from "commander";
 import { execSync as execSync3 } from "child_process";
-import * as path33 from "path";
-import * as fs16 from "fs";
+import * as path35 from "path";
+import * as fs17 from "fs";
 function getStagedFiles(cwd) {
   try {
     const output = execSync3("git diff --cached --name-only", {
@@ -3875,7 +3943,7 @@ function getStagedFiles(cwd) {
 }
 function graphExists(projectPath) {
   try {
-    return fs16.existsSync(path33.join(projectPath, ".harness", "graph", "graph.json"));
+    return fs17.existsSync(path35.join(projectPath, ".harness", "graph", "graph.json"));
   } catch {
     return false;
   }
@@ -3884,7 +3952,7 @@ function extractNodeName(id) {
   const parts = id.split(":");
   if (parts.length > 1) {
     const fullPath = parts.slice(1).join(":");
-    return path33.basename(fullPath);
+    return path35.basename(fullPath);
   }
   return id;
 }
@@ -4007,7 +4075,7 @@ function formatPerFile(perFileResults) {
   return lines.join("\n");
 }
 async function runImpactPreview(options) {
-  const projectPath = path33.resolve(options.path ?? process.cwd());
+  const projectPath = path35.resolve(options.path ?? process.cwd());
   const stagedFiles = getStagedFiles(projectPath);
   if (stagedFiles.length === 0) {
     return "Impact Preview: no staged changes";
@@ -4229,19 +4297,19 @@ function createCheckArchCommand() {
 
 // src/commands/blueprint.ts
 import { Command as Command46 } from "commander";
-import * as path34 from "path";
+import * as path36 from "path";
 function createBlueprintCommand() {
   return new Command46("blueprint").description("Generate a self-contained, interactive blueprint of the codebase").argument("[path]", "Path to the project root", ".").option("-o, --output <dir>", "Output directory", "docs/blueprint").action(async (projectPath, options) => {
     try {
-      const rootDir = path34.resolve(projectPath);
-      const outputDir = path34.resolve(options.output);
+      const rootDir = path36.resolve(projectPath);
+      const outputDir = path36.resolve(options.output);
       logger.info(`Scanning project at ${rootDir}...`);
       const scanner = new ProjectScanner(rootDir);
       const data = await scanner.scan();
       logger.info(`Generating blueprint to ${outputDir}...`);
       const generator = new BlueprintGenerator();
       await generator.generate(data, { outputDir });
-      logger.success(`Blueprint generated successfully at ${path34.join(outputDir, "index.html")}`);
+      logger.success(`Blueprint generated successfully at ${path36.join(outputDir, "index.html")}`);
     } catch (error) {
       logger.error(
         `Failed to generate blueprint: ${error instanceof Error ? error.message : String(error)}`
@@ -4253,15 +4321,15 @@ function createBlueprintCommand() {
 
 // src/commands/share.ts
 import { Command as Command47 } from "commander";
-import * as fs17 from "fs";
-import * as path35 from "path";
+import * as fs18 from "fs";
+import * as path37 from "path";
 import { parse as parseYaml } from "yaml";
 var MANIFEST_FILENAME = "constraints.yaml";
 function createShareCommand() {
   return new Command47("share").description("Extract and publish a constraints bundle from constraints.yaml").argument("[path]", "Path to the project root", ".").option("-o, --output <dir>", "Output directory for the bundle", ".").action(async (projectPath, options) => {
-    const rootDir = path35.resolve(projectPath);
-    const manifestPath = path35.join(rootDir, MANIFEST_FILENAME);
-    if (!fs17.existsSync(manifestPath)) {
+    const rootDir = path37.resolve(projectPath);
+    const manifestPath = path37.join(rootDir, MANIFEST_FILENAME);
+    if (!fs18.existsSync(manifestPath)) {
       logger.error(
         `No ${MANIFEST_FILENAME} found at ${manifestPath}.
 Create a constraints.yaml in your project root to define what to share.`
@@ -4270,7 +4338,7 @@ Create a constraints.yaml in your project root to define what to share.`
     }
     let parsed;
     try {
-      const raw = fs17.readFileSync(manifestPath, "utf-8");
+      const raw = fs18.readFileSync(manifestPath, "utf-8");
       parsed = parseYaml(raw);
     } catch (err) {
       logger.error(
@@ -4284,7 +4352,7 @@ Create a constraints.yaml in your project root to define what to share.`
       process.exit(1);
     }
     const manifest = manifestResult.value;
-    const configResult = resolveConfig(path35.join(rootDir, "harness.config.json"));
+    const configResult = resolveConfig(path37.join(rootDir, "harness.config.json"));
     if (!configResult.ok) {
       logger.error(configResult.error.message);
       process.exit(1);
@@ -4302,12 +4370,11 @@ Create a constraints.yaml in your project root to define what to share.`
       );
       process.exit(1);
     }
-    const outputDir = path35.resolve(options.output);
-    const outputPath = path35.join(outputDir, `${manifest.name}.harness-constraints.json`);
-    try {
-      await writeConfig(outputPath, bundle);
-    } catch (err) {
-      logger.error(`Failed to write bundle: ${err instanceof Error ? err.message : String(err)}`);
+    const outputDir = path37.resolve(options.output);
+    const outputPath = path37.join(outputDir, `${manifest.name}.harness-constraints.json`);
+    const writeResult = await writeConfig(outputPath, bundle);
+    if (!writeResult.ok) {
+      logger.error(`Failed to write bundle: ${writeResult.error.message}`);
       process.exit(1);
     }
     logger.success(`Bundle written to ${outputPath}`);
@@ -4315,25 +4382,25 @@ Create a constraints.yaml in your project root to define what to share.`
 }
 
 // src/commands/install.ts
-import * as fs19 from "fs";
-import * as path37 from "path";
+import * as fs20 from "fs";
+import * as path39 from "path";
 import { Command as Command48 } from "commander";
 import { parse as yamlParse } from "yaml";
 
 // src/registry/tarball.ts
-import * as fs18 from "fs";
-import * as path36 from "path";
-import * as os2 from "os";
+import * as fs19 from "fs";
+import * as path38 from "path";
+import * as os3 from "os";
 import { execFileSync as execFileSync5 } from "child_process";
 function extractTarball(tarballBuffer) {
-  const tmpDir = fs18.mkdtempSync(path36.join(os2.tmpdir(), "harness-skill-install-"));
-  const tarballPath = path36.join(tmpDir, "package.tgz");
+  const tmpDir = fs19.mkdtempSync(path38.join(os3.tmpdir(), "harness-skill-install-"));
+  const tarballPath = path38.join(tmpDir, "package.tgz");
   try {
-    fs18.writeFileSync(tarballPath, tarballBuffer);
+    fs19.writeFileSync(tarballPath, tarballBuffer);
     execFileSync5("tar", ["-xzf", tarballPath, "-C", tmpDir], {
       timeout: 3e4
     });
-    fs18.unlinkSync(tarballPath);
+    fs19.unlinkSync(tarballPath);
   } catch (err) {
     cleanupTempDir(tmpDir);
     throw new Error(
@@ -4344,37 +4411,37 @@ function extractTarball(tarballBuffer) {
   return tmpDir;
 }
 function placeSkillContent(extractedPkgDir, communityBaseDir, skillName, platforms) {
-  const files = fs18.readdirSync(extractedPkgDir);
+  const files = fs19.readdirSync(extractedPkgDir);
   for (const platform of platforms) {
-    const targetDir = path36.join(communityBaseDir, platform, skillName);
-    if (fs18.existsSync(targetDir)) {
-      fs18.rmSync(targetDir, { recursive: true, force: true });
+    const targetDir = path38.join(communityBaseDir, platform, skillName);
+    if (fs19.existsSync(targetDir)) {
+      fs19.rmSync(targetDir, { recursive: true, force: true });
     }
-    fs18.mkdirSync(targetDir, { recursive: true });
+    fs19.mkdirSync(targetDir, { recursive: true });
     for (const file of files) {
       if (file === "package.json" || file === "node_modules") continue;
-      const srcPath = path36.join(extractedPkgDir, file);
-      const destPath = path36.join(targetDir, file);
-      const stat = fs18.statSync(srcPath);
+      const srcPath = path38.join(extractedPkgDir, file);
+      const destPath = path38.join(targetDir, file);
+      const stat = fs19.statSync(srcPath);
       if (stat.isDirectory()) {
-        fs18.cpSync(srcPath, destPath, { recursive: true });
+        fs19.cpSync(srcPath, destPath, { recursive: true });
       } else {
-        fs18.copyFileSync(srcPath, destPath);
+        fs19.copyFileSync(srcPath, destPath);
       }
     }
   }
 }
 function removeSkillContent(communityBaseDir, skillName, platforms) {
   for (const platform of platforms) {
-    const targetDir = path36.join(communityBaseDir, platform, skillName);
-    if (fs18.existsSync(targetDir)) {
-      fs18.rmSync(targetDir, { recursive: true, force: true });
+    const targetDir = path38.join(communityBaseDir, platform, skillName);
+    if (fs19.existsSync(targetDir)) {
+      fs19.rmSync(targetDir, { recursive: true, force: true });
     }
   }
 }
 function cleanupTempDir(dirPath) {
   try {
-    fs18.rmSync(dirPath, { recursive: true, force: true });
+    fs19.rmSync(dirPath, { recursive: true, force: true });
   } catch {
   }
 }
@@ -4407,44 +4474,111 @@ function resolveVersion(metadata, versionRange) {
   return metadata.versions[matched];
 }
 function findDependentsOf(lockfile, targetPackageName) {
-  const entry = lockfile.skills[targetPackageName];
-  if (!entry?.dependencyOf) return [];
-  return [entry.dependencyOf];
+  const dependents = [];
+  const targetEntry = lockfile.skills[targetPackageName];
+  if (targetEntry?.dependencyOf) {
+    dependents.push(targetEntry.dependencyOf);
+  }
+  return dependents;
 }
 
 // src/commands/install.ts
 function validateSkillYaml(parsed) {
-  if (!parsed || typeof parsed !== "object" || !("name" in parsed) || !("version" in parsed) || !("platforms" in parsed)) {
-    throw new Error("contains invalid skill.yaml");
-  }
-  const obj = parsed;
-  if (typeof obj["name"] !== "string" || typeof obj["version"] !== "string" || !Array.isArray(obj["platforms"])) {
-    throw new Error("contains invalid skill.yaml");
+  const result = SkillMetadataSchema.safeParse(parsed);
+  if (!result.success) {
+    const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+    throw new Error(`contains invalid skill.yaml: ${issues}`);
   }
   return {
-    name: obj["name"],
-    version: obj["version"],
-    platforms: obj["platforms"],
-    depends_on: Array.isArray(obj["depends_on"]) ? obj["depends_on"] : []
+    name: result.data.name,
+    version: result.data.version,
+    platforms: result.data.platforms,
+    depends_on: result.data.depends_on ?? []
   };
 }
+async function runLocalInstall(fromPath, options) {
+  const resolvedPath = path39.resolve(fromPath);
+  if (!fs20.existsSync(resolvedPath)) {
+    throw new Error(`--from path does not exist: ${resolvedPath}`);
+  }
+  const stat = fs20.statSync(resolvedPath);
+  let extractDir = null;
+  let pkgDir;
+  if (stat.isDirectory()) {
+    pkgDir = resolvedPath;
+  } else if (resolvedPath.endsWith(".tgz") || resolvedPath.endsWith(".tar.gz")) {
+    const tarballBuffer = fs20.readFileSync(resolvedPath);
+    extractDir = extractTarball(tarballBuffer);
+    pkgDir = path39.join(extractDir, "package");
+  } else {
+    throw new Error(`--from path must be a directory or .tgz file. Got: ${resolvedPath}`);
+  }
+  try {
+    const skillYamlPath = path39.join(pkgDir, "skill.yaml");
+    if (!fs20.existsSync(skillYamlPath)) {
+      throw new Error(`No skill.yaml found at ${skillYamlPath}`);
+    }
+    const rawYaml = fs20.readFileSync(skillYamlPath, "utf-8");
+    const parsed = yamlParse(rawYaml);
+    const skillYaml = validateSkillYaml(parsed);
+    const shortName = skillYaml.name;
+    const globalDir = resolveGlobalSkillsDir();
+    const skillsDir = path39.dirname(globalDir);
+    const communityBase = path39.join(skillsDir, "community");
+    const lockfilePath = path39.join(communityBase, "skills-lock.json");
+    const bundledNames = getBundledSkillNames(globalDir);
+    if (bundledNames.has(shortName)) {
+      throw new Error(
+        `'${shortName}' is a bundled skill and cannot be overridden by community installs.`
+      );
+    }
+    placeSkillContent(pkgDir, communityBase, shortName, skillYaml.platforms);
+    const packageName = `@harness-skills/${shortName}`;
+    const lockfile = readLockfile2(lockfilePath);
+    const entry = {
+      version: skillYaml.version,
+      resolved: `local:${resolvedPath}`,
+      integrity: "",
+      platforms: skillYaml.platforms,
+      installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      dependencyOf: options._dependencyOf ?? null
+    };
+    const updatedLockfile = updateLockfileEntry(lockfile, packageName, entry);
+    writeLockfile2(lockfilePath, updatedLockfile);
+    return {
+      installed: true,
+      name: packageName,
+      version: skillYaml.version
+    };
+  } finally {
+    if (extractDir) {
+      cleanupTempDir(extractDir);
+    }
+  }
+}
 async function runInstall(skillName, options) {
+  if (options.from && options.registry) {
+    throw new Error("--from and --registry cannot be used together");
+  }
+  if (options.from) {
+    return runLocalInstall(options.from, options);
+  }
   const packageName = resolvePackageName(skillName);
   const shortName = extractSkillName(packageName);
   const globalDir = resolveGlobalSkillsDir();
-  const skillsDir = path37.dirname(globalDir);
-  const communityBase = path37.join(skillsDir, "community");
-  const lockfilePath = path37.join(communityBase, "skills-lock.json");
+  const skillsDir = path39.dirname(globalDir);
+  const communityBase = path39.join(skillsDir, "community");
+  const lockfilePath = path39.join(communityBase, "skills-lock.json");
   const bundledNames = getBundledSkillNames(globalDir);
   if (bundledNames.has(shortName)) {
     throw new Error(
       `'${shortName}' is a bundled skill and cannot be overridden by community installs.`
     );
   }
-  const metadata = await fetchPackageMetadata(packageName);
+  const metadata = await fetchPackageMetadata(packageName, options.registry);
   const versionInfo = resolveVersion(metadata, options.version);
   const resolvedVersion = versionInfo.version;
-  const lockfile = readLockfile(lockfilePath);
+  const lockfile = readLockfile2(lockfilePath);
   const existingEntry = lockfile.skills[packageName];
   const previousVersion = existingEntry?.version;
   if (existingEntry && existingEntry.version === resolvedVersion && !options.force) {
@@ -4455,16 +4589,17 @@ async function runInstall(skillName, options) {
       version: resolvedVersion
     };
   }
-  const tarballBuffer = await downloadTarball(versionInfo.dist.tarball);
+  const authToken = options.registry ? readNpmrcToken(options.registry) ?? void 0 : void 0;
+  const tarballBuffer = await downloadTarball(versionInfo.dist.tarball, authToken);
   const extractDir = extractTarball(tarballBuffer);
   let skillYaml;
   try {
-    const extractedPkgDir = path37.join(extractDir, "package");
-    const skillYamlPath = path37.join(extractedPkgDir, "skill.yaml");
-    if (!fs19.existsSync(skillYamlPath)) {
+    const extractedPkgDir = path39.join(extractDir, "package");
+    const skillYamlPath = path39.join(extractedPkgDir, "skill.yaml");
+    if (!fs20.existsSync(skillYamlPath)) {
       throw new Error(`contains invalid skill.yaml: file not found in package`);
     }
-    const rawYaml = fs19.readFileSync(skillYamlPath, "utf-8");
+    const rawYaml = fs20.readFileSync(skillYamlPath, "utf-8");
     const parsed = yamlParse(rawYaml);
     skillYaml = validateSkillYaml(parsed);
     placeSkillContent(extractedPkgDir, communityBase, shortName, skillYaml.platforms);
@@ -4479,10 +4614,10 @@ async function runInstall(skillName, options) {
     integrity: versionInfo.dist.integrity,
     platforms: skillYaml.platforms,
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    dependencyOf: null
+    dependencyOf: options._dependencyOf ?? null
   };
   let updatedLockfile = updateLockfileEntry(lockfile, packageName, entry);
-  writeLockfile(lockfilePath, updatedLockfile);
+  writeLockfile2(lockfilePath, updatedLockfile);
   const result = {
     installed: true,
     name: packageName,
@@ -4494,14 +4629,17 @@ async function runInstall(skillName, options) {
   }
   const deps = skillYaml.depends_on ?? [];
   for (const dep of deps) {
-    logger.info(`Installing dependency: ${dep}`);
-    await runInstall(dep, {});
+    logger.info(`Installing dependency: ${dep} (required by ${shortName})`);
+    await runInstall(dep, {
+      _dependencyOf: packageName,
+      ...options.registry !== void 0 ? { registry: options.registry } : {}
+    });
   }
   return result;
 }
 function createInstallCommand() {
   const cmd = new Command48("install");
-  cmd.description("Install a community skill from the @harness-skills registry").argument("<skill>", "Skill name or @harness-skills/scoped package name").option("--version <range>", "Semver range or exact version to install").option("--force", "Force reinstall even if same version is already installed").action(async (skill, opts) => {
+  cmd.description("Install a community skill from the @harness-skills registry").argument("<skill>", "Skill name or @harness-skills/scoped package name").option("--version <range>", "Semver range or exact version to install").option("--force", "Force reinstall even if same version is already installed").option("--from <path>", "Install from a local directory or .tgz file").option("--registry <url>", "Use a custom npm registry URL").action(async (skill, opts) => {
     try {
       const result = await runInstall(skill, opts);
       if (result.skipped) {
@@ -4523,17 +4661,377 @@ function createInstallCommand() {
   return cmd;
 }
 
-// src/commands/uninstall.ts
-import * as path38 from "path";
+// src/commands/install-constraints.ts
+import * as fs21 from "fs/promises";
+import * as path40 from "path";
 import { Command as Command49 } from "commander";
+import semver3 from "semver";
+async function runInstallConstraints(options) {
+  const { source, configPath, lockfilePath } = options;
+  let rawBundle;
+  try {
+    rawBundle = await fs21.readFile(source, "utf-8");
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT") {
+      return { ok: false, error: `Bundle file not found: ${source}` };
+    }
+    return {
+      ok: false,
+      error: `Failed to read bundle: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(rawBundle);
+  } catch {
+    return { ok: false, error: `Bundle file contains invalid JSON: ${source}` };
+  }
+  const bundleResult = BundleSchema.safeParse(parsedJson);
+  if (!bundleResult.success) {
+    const issues = bundleResult.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+    return { ok: false, error: `Bundle schema validation failed: ${issues}` };
+  }
+  const bundle = bundleResult.data;
+  if (bundle.minHarnessVersion) {
+    const installed = semver3.valid(semver3.coerce(CLI_VERSION));
+    const required = semver3.valid(semver3.coerce(bundle.minHarnessVersion));
+    if (installed && required && semver3.lt(installed, required)) {
+      return {
+        ok: false,
+        error: `Bundle requires harness version >= ${bundle.minHarnessVersion}, but installed version is ${CLI_VERSION}. Please upgrade.`
+      };
+    }
+  }
+  const constraintKeys = Object.keys(bundle.constraints).filter(
+    (k) => bundle.constraints[k] !== void 0
+  );
+  if (constraintKeys.length === 0) {
+    return {
+      ok: false,
+      error: "Bundle contains no constraints. Nothing to install."
+    };
+  }
+  let localConfig;
+  try {
+    const raw = await fs21.readFile(configPath, "utf-8");
+    localConfig = JSON.parse(raw);
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Failed to read local config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const lockfileResult = await readLockfile(lockfilePath);
+  if (!lockfileResult.ok) {
+    return { ok: false, error: lockfileResult.error };
+  }
+  const existingLockfile = lockfileResult.value ?? {
+    version: 1,
+    packages: {}
+  };
+  const existingEntry = existingLockfile.packages[bundle.name];
+  if (existingEntry && existingEntry.version === bundle.version) {
+    return {
+      ok: true,
+      value: {
+        installed: false,
+        packageName: bundle.name,
+        version: bundle.version,
+        contributionsCount: 0,
+        conflicts: [],
+        alreadyInstalled: true
+      }
+    };
+  }
+  if (existingEntry) {
+    const oldContributions = existingEntry.contributions ?? {};
+    localConfig = removeContributions(localConfig, oldContributions);
+  }
+  const mergeResult = deepMergeConstraints(localConfig, bundle.constraints);
+  if (mergeResult.conflicts.length > 0) {
+    if (options.forceLocal) {
+    } else if (options.forcePackage) {
+      for (const conflict of mergeResult.conflicts) {
+        applyPackageValue(mergeResult.config, conflict);
+        addConflictContribution(mergeResult.contributions, conflict);
+      }
+    } else if (!options.dryRun) {
+      return {
+        ok: false,
+        error: formatConflictsError(mergeResult.conflicts)
+      };
+    }
+  }
+  if (options.dryRun) {
+    return {
+      ok: true,
+      value: {
+        installed: false,
+        packageName: bundle.name,
+        version: bundle.version,
+        contributionsCount: Object.keys(mergeResult.contributions).length,
+        conflicts: mergeResult.conflicts,
+        dryRun: true
+      }
+    };
+  }
+  const writeResult = await writeConfig(configPath, mergeResult.config);
+  if (!writeResult.ok) {
+    return {
+      ok: false,
+      error: `Failed to write config: ${writeResult.error instanceof Error ? writeResult.error.message : String(writeResult.error)}`
+    };
+  }
+  const lockfileEntry = {
+    version: bundle.version,
+    source,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    contributions: mergeResult.contributions
+  };
+  const updatedLockfile = addProvenance(existingLockfile, bundle.name, lockfileEntry);
+  const lockfileWriteResult = await writeLockfile(lockfilePath, updatedLockfile);
+  if (!lockfileWriteResult.ok) {
+    return {
+      ok: false,
+      error: `Config was written but lockfile write failed: ${lockfileWriteResult.error.message}. Lockfile may be out of sync.`
+    };
+  }
+  return {
+    ok: true,
+    value: {
+      installed: true,
+      packageName: bundle.name,
+      version: bundle.version,
+      contributionsCount: Object.keys(mergeResult.contributions).length,
+      conflicts: mergeResult.conflicts
+    }
+  };
+}
+var sectionAppliers = {
+  layers(config, key, value) {
+    const layers = config.layers;
+    const idx = layers.findIndex((l) => l.name === key);
+    if (idx >= 0) layers[idx] = value;
+  },
+  forbiddenImports(config, key, value) {
+    const rules = config.forbiddenImports;
+    const idx = rules.findIndex((r) => r.from === key);
+    if (idx >= 0) rules[idx] = value;
+  },
+  "architecture.thresholds"(config, key, value) {
+    const arch = config.architecture;
+    if (arch?.thresholds) arch.thresholds[key] = value;
+  },
+  "architecture.modules"(config, key, value) {
+    const arch = config.architecture;
+    const [modulePath, category] = key.split(":");
+    if (arch?.modules && modulePath && category && arch.modules[modulePath]) {
+      arch.modules[modulePath][category] = value;
+    }
+  },
+  "security.rules"(config, key, value) {
+    const security = config.security;
+    if (security?.rules) security.rules[key] = value;
+  }
+};
+function applyPackageValue(config, conflict) {
+  const applier = sectionAppliers[conflict.section];
+  if (applier) applier(config, conflict.key, conflict.packageValue);
+}
+function addConflictContribution(contributions, conflict) {
+  const section = conflict.section;
+  const existing = contributions[section] ?? [];
+  existing.push(conflict.key);
+  contributions[section] = existing;
+}
+function formatConflictsError(conflicts) {
+  const lines = [
+    `${conflicts.length} conflict(s) detected. Resolve with --force-local or --force-package:`,
+    ""
+  ];
+  for (const c of conflicts) {
+    lines.push(`  [${c.section}] ${c.key}: ${c.description}`);
+    lines.push(`    Local:   ${JSON.stringify(c.localValue)}`);
+    lines.push(`    Package: ${JSON.stringify(c.packageValue)}`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function isNodeError(err) {
+  return err instanceof Error && "code" in err;
+}
+function resolveConfigPath(opts) {
+  if (opts.config) return path40.resolve(opts.config);
+  const found = findConfigFile();
+  if (!found.ok) {
+    logger.error(found.error.message);
+    process.exit(1);
+  }
+  return found.value;
+}
+function logInstallResult(val, opts) {
+  if (val.dryRun) {
+    logger.info(`[dry-run] Would install ${val.packageName}@${val.version}`);
+    logger.info(`[dry-run] ${val.contributionsCount} section(s) would be added`);
+    if (val.conflicts.length > 0) {
+      logger.warn(`[dry-run] ${val.conflicts.length} conflict(s) detected`);
+      for (const c of val.conflicts) {
+        logger.warn(`  [${c.section}] ${c.key}: ${c.description}`);
+      }
+    }
+    return;
+  }
+  if (val.alreadyInstalled) {
+    logger.info(`${val.packageName}@${val.version} is already installed. No changes made.`);
+    return;
+  }
+  logger.success(
+    `Installed ${val.packageName}@${val.version} (${val.contributionsCount} section(s) merged)`
+  );
+  if (val.conflicts.length > 0) {
+    logger.warn(
+      `${val.conflicts.length} conflict(s) resolved with ${opts.forceLocal ? "--force-local" : "--force-package"}`
+    );
+  }
+}
+async function handleInstallConstraints(source, opts) {
+  const configPath = resolveConfigPath(opts);
+  const projectRoot = path40.dirname(configPath);
+  const lockfilePath = path40.join(projectRoot, ".harness", "constraints.lock.json");
+  const resolvedSource = path40.resolve(source);
+  if (opts.forceLocal && opts.forcePackage) {
+    logger.error("Cannot use both --force-local and --force-package.");
+    process.exit(1);
+  }
+  const result = await runInstallConstraints({
+    source: resolvedSource,
+    configPath,
+    lockfilePath,
+    ...opts.forceLocal && { forceLocal: true },
+    ...opts.forcePackage && { forcePackage: true },
+    ...opts.dryRun && { dryRun: true }
+  });
+  if (!result.ok) {
+    logger.error(result.error);
+    process.exit(1);
+  }
+  logInstallResult(result.value, opts);
+}
+function createInstallConstraintsCommand() {
+  const cmd = new Command49("install-constraints");
+  cmd.description("Install a constraints bundle into the local harness config").argument("<source>", "Path to a .harness-constraints.json bundle file").option("--force-local", "Resolve all conflicts by keeping local values").option("--force-package", "Resolve all conflicts by using package values").option("--dry-run", "Show what would change without writing files").option("-c, --config <path>", "Path to harness.config.json").action(handleInstallConstraints);
+  return cmd;
+}
+
+// src/commands/uninstall-constraints.ts
+import * as fs22 from "fs/promises";
+import * as path41 from "path";
+import { Command as Command50 } from "commander";
+async function runUninstallConstraints(options) {
+  const { packageName, configPath, lockfilePath } = options;
+  const lockfileResult = await readLockfile(lockfilePath);
+  if (!lockfileResult.ok) {
+    return { ok: false, error: lockfileResult.error };
+  }
+  if (lockfileResult.value === null) {
+    return { ok: false, error: "No lockfile found. No constraint packages are installed." };
+  }
+  const lockfile = lockfileResult.value;
+  const entry = lockfile.packages[packageName];
+  if (!entry) {
+    return {
+      ok: false,
+      error: `Package '${packageName}' is not installed.`
+    };
+  }
+  let localConfig;
+  try {
+    const raw = await fs22.readFile(configPath, "utf-8");
+    localConfig = JSON.parse(raw);
+  } catch (err) {
+    return {
+      ok: false,
+      error: `Failed to read local config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const contributions = entry.contributions ?? {};
+  const sectionsRemoved = Object.keys(contributions);
+  const updatedConfig = removeContributions(localConfig, contributions);
+  const { lockfile: updatedLockfile } = removeProvenance(lockfile, packageName);
+  const writeResult = await writeConfig(configPath, updatedConfig);
+  if (!writeResult.ok) {
+    return {
+      ok: false,
+      error: `Failed to write config: ${writeResult.error instanceof Error ? writeResult.error.message : String(writeResult.error)}`
+    };
+  }
+  const lockfileWriteResult = await writeLockfile(lockfilePath, updatedLockfile);
+  if (!lockfileWriteResult.ok) {
+    return {
+      ok: false,
+      error: `Config was written but lockfile write failed: ${lockfileWriteResult.error.message}. Lockfile may be out of sync.`
+    };
+  }
+  return {
+    ok: true,
+    value: {
+      removed: true,
+      packageName,
+      version: entry.version,
+      sectionsRemoved
+    }
+  };
+}
+function createUninstallConstraintsCommand() {
+  const cmd = new Command50("uninstall-constraints");
+  cmd.description("Remove a previously installed constraints package").argument("<name>", "Name of the constraint package to uninstall").option("-c, --config <path>", "Path to harness.config.json").action(async (name, opts) => {
+    let configPath;
+    if (opts.config) {
+      configPath = path41.resolve(opts.config);
+    } else {
+      const found = findConfigFile();
+      if (!found.ok) {
+        logger.error(found.error.message);
+        process.exit(1);
+      }
+      configPath = found.value;
+    }
+    const projectRoot = path41.dirname(configPath);
+    const lockfilePath = path41.join(projectRoot, ".harness", "constraints.lock.json");
+    const result = await runUninstallConstraints({
+      packageName: name,
+      configPath,
+      lockfilePath
+    });
+    if (!result.ok) {
+      logger.error(result.error);
+      process.exit(1);
+    }
+    const val = result.value;
+    if (val.sectionsRemoved.length === 0) {
+      logger.success(
+        `Removed ${val.packageName}@${val.version} (no contributed rules to remove)`
+      );
+    } else {
+      logger.success(
+        `Removed ${val.packageName}@${val.version} (${val.sectionsRemoved.length} section(s): ${val.sectionsRemoved.join(", ")})`
+      );
+    }
+  });
+  return cmd;
+}
+
+// src/commands/uninstall.ts
+import * as path42 from "path";
+import { Command as Command51 } from "commander";
 async function runUninstall(skillName, options) {
   const packageName = resolvePackageName(skillName);
   const shortName = extractSkillName(packageName);
   const globalDir = resolveGlobalSkillsDir();
-  const skillsDir = path38.dirname(globalDir);
-  const communityBase = path38.join(skillsDir, "community");
-  const lockfilePath = path38.join(communityBase, "skills-lock.json");
-  const lockfile = readLockfile(lockfilePath);
+  const skillsDir = path42.dirname(globalDir);
+  const communityBase = path42.join(skillsDir, "community");
+  const lockfilePath = path42.join(communityBase, "skills-lock.json");
+  const lockfile = readLockfile2(lockfilePath);
   const entry = lockfile.skills[packageName];
   if (!entry) {
     throw new Error(`Skill '${shortName}' is not installed.`);
@@ -4550,7 +5048,7 @@ async function runUninstall(skillName, options) {
   }
   removeSkillContent(communityBase, shortName, entry.platforms);
   const updatedLockfile = removeLockfileEntry(lockfile, packageName);
-  writeLockfile(lockfilePath, updatedLockfile);
+  writeLockfile2(lockfilePath, updatedLockfile);
   const result = {
     removed: true,
     name: packageName,
@@ -4562,7 +5060,7 @@ async function runUninstall(skillName, options) {
   return result;
 }
 function createUninstallCommand() {
-  const cmd = new Command49("uninstall");
+  const cmd = new Command51("uninstall");
   cmd.description("Uninstall a community skill").argument("<skill>", "Skill name or @harness-skills/scoped package name").option("--force", "Remove even if other skills depend on this one").action(async (skill, opts) => {
     try {
       const result = await runUninstall(skill, opts);
@@ -4581,13 +5079,13 @@ function createUninstallCommand() {
 }
 
 // src/commands/orchestrator.ts
-import { Command as Command50 } from "commander";
-import * as path39 from "path";
+import { Command as Command52 } from "commander";
+import * as path43 from "path";
 import { Orchestrator, WorkflowLoader, launchTUI } from "@harness-engineering/orchestrator";
 function createOrchestratorCommand() {
-  const orchestrator = new Command50("orchestrator");
+  const orchestrator = new Command52("orchestrator");
   orchestrator.command("run").description("Run the orchestrator daemon").option("-w, --workflow <path>", "Path to WORKFLOW.md", "WORKFLOW.md").action(async (opts) => {
-    const workflowPath = path39.resolve(process.cwd(), opts.workflow);
+    const workflowPath = path43.resolve(process.cwd(), opts.workflow);
     const loader = new WorkflowLoader();
     const result = await loader.loadWorkflow(workflowPath);
     if (!result.ok) {
@@ -4612,7 +5110,7 @@ function createOrchestratorCommand() {
 
 // src/index.ts
 function createProgram() {
-  const program = new Command51();
+  const program = new Command53();
   program.name("harness").description("CLI for Harness Engineering toolkit").version(CLI_VERSION).option("-c, --config <path>", "Path to config file").option("--json", "Output as JSON").option("--verbose", "Verbose output").option("--quiet", "Minimal output");
   program.addCommand(createValidateCommand());
   program.addCommand(createCheckDepsCommand());
@@ -4647,6 +5145,8 @@ function createProgram() {
   program.addCommand(createBlueprintCommand());
   program.addCommand(createShareCommand());
   program.addCommand(createInstallCommand());
+  program.addCommand(createInstallConstraintsCommand());
+  program.addCommand(createUninstallConstraintsCommand());
   program.addCommand(createUninstallCommand());
   program.addCommand(createOrchestratorCommand());
   return program;
@@ -4662,6 +5162,8 @@ export {
   runImpactPreview,
   runCheckArch,
   runInstall,
+  runInstallConstraints,
+  runUninstallConstraints,
   runUninstall,
   createProgram
 };