@hasna/instructions 0.7.2 → 0.7.4

package/dist/cli/index.js

@@ -9,14 +9,14 @@ import {
   syncKnown,
   syncProject,
   syncToDisk
-} from "../chunks/index-18j7x3xw.js";
+} from "../chunks/index-axs3yftz.js";
 import {
   applyConfigsWithReport,
   compactPathForConfigHome,
   expandPath,
   normalizeTargetPath,
   sessionRenderOwnsPath
-} from "../chunks/index-y8410ve0.js";
+} from "../chunks/index-6sbmg1vc.js";
 import {
   CODEWITH_NATIVE_IMPORTS_ENV,
   CloudConfigStore,
@@ -69,7 +69,7 @@ import {
   truncateText,
   withProjectContextSessionGuard,
   writeProjectContextCoordinatedFile
-} from "../chunks/index-n6nh6f5r.js";
+} from "../chunks/index-enh4yv85.js";
 import {
   ConfigNotFoundError,
   INSTRUCTIONS_DOMAIN_ARCHIVE_SCHEMA,
@@ -3795,9 +3795,162 @@ var {
 
 // src/cli/index.tsx
 import chalk from "chalk";
-import { existsSync as existsSync11, lstatSync as lstatSync5, mkdirSync as mkdirSync6, readFileSync as readFileSync8, readSync, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync5, writeSync } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename2, dirname as dirname7, join as join11, resolve as resolve7 } from "path";
+import { existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync7, readSync, renameSync, unlinkSync, writeFileSync as writeFileSync4, writeSync } from "fs";
+import { homedir as homedir5 } from "os";
+
+// src/lib/harness-discovery.ts
+import { accessSync, constants, lstatSync, realpathSync, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { delimiter, dirname, isAbsolute, join as join3, resolve as resolve2 } from "path";
+var HARNESS_DISCOVERY_SCHEMA = "hasna.instructions.harness-discovery/v1";
+var DISCOVERABLE_HARNESSES = ["claude", "codex", "opencode", "sumi"];
+function pathInput(value, home) {
+  if (!value || value !== value.trim() || /[\x00-\x1f\x7f]/.test(value))
+    throw new Error("Harness paths must be nonempty and contain no surrounding whitespace or control characters.");
+  if (value.split("/").some((segment) => segment === "." || segment === ".."))
+    throw new Error("Harness paths must not contain dot segments; normalizing them can change a symlink destination.");
+  let path = value;
+  if (home) {
+    for (const prefix of ["~", "{{HOME}}", "{{HOME_DIR}}", "${HOME}"]) {
+      if (path === prefix)
+        path = home;
+      else if (path.startsWith(`${prefix}/`))
+        path = join3(home, path.slice(prefix.length + 1));
+    }
+  }
+  if (!isAbsolute(path))
+    throw new Error("Harness paths must be absolute or explicitly relative to the owner home (~/ or {{HOME_DIR}}/).");
+  return resolve2(path);
+}
+function observe(path) {
+  let symlink = false;
+  let viaSymlink = false;
+  for (let parent = dirname(path);parent !== dirname(parent); parent = dirname(parent)) {
+    try {
+      if (lstatSync(parent).isSymbolicLink()) {
+        viaSymlink = true;
+        break;
+      }
+    } catch {}
+  }
+  try {
+    symlink = lstatSync(path).isSymbolicLink();
+    const stat = statSync(path);
+    return { path, state: "present", realPath: realpathSync(path), symlink, viaSymlink: viaSymlink || symlink, type: stat.isFile() ? "file" : stat.isDirectory() ? "directory" : "other" };
+  } catch (error) {
+    const missing = error.code === "ENOENT";
+    return { path, state: missing ? symlink ? "dangling-symlink" : "missing" : "unreadable", realPath: null, symlink, viaSymlink: viaSymlink || symlink, type: null };
+  }
+}
+function executableAt(path) {
+  const observation = observe(path);
+  if (observation.type !== "file")
+    return null;
+  try {
+    accessSync(path, constants.X_OK);
+    return observation;
+  } catch {
+    return null;
+  }
+}
+function configSelection(tool, home, env, override) {
+  if (override !== undefined)
+    return { path: pathInput(override, home), source: "override" };
+  const key = { claude: "CLAUDE_CONFIG_DIR", codex: "CODEX_HOME", opencode: "OPENCODE_CONFIG_DIR", sumi: "SUMI_CONFIG_DIR" }[tool];
+  const nativePath = (value, selector) => {
+    try {
+      return pathInput(value);
+    } catch {
+      throw new Error(`${selector} is present but is not an unambiguous absolute native path; supply the reviewed runtime path explicitly.`);
+    }
+  };
+  if (env[key] !== undefined && !(tool === "codex" && env[key] === ""))
+    return { path: nativePath(env[key], key), source: key };
+  if (tool === "claude" || tool === "codex")
+    return { path: join3(home, `.${tool}`), source: "native-default" };
+  if (env.XDG_CONFIG_HOME !== undefined)
+    return { path: join3(nativePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME"), tool), source: "XDG_CONFIG_HOME" };
+  if (tool === "sumi") {
+    if (env.SUMI_HOME !== undefined)
+      return { path: join3(nativePath(env.SUMI_HOME, "SUMI_HOME"), "config"), source: "SUMI_HOME" };
+    return null;
+  }
+  return { path: join3(home, ".config", tool), source: "native-default" };
+}
+function discoverHarnesses(options = {}) {
+  const env = options.env ?? process.env;
+  const home = pathInput(options.ownerHome ?? env.HOME ?? env.USERPROFILE ?? homedir2());
+  const project = options.projectRoot === undefined ? null : observe(pathInput(options.projectRoot, home));
+  const variables = { HOME_DIR: home };
+  if (project)
+    variables.PROJECT_ROOT = project.path;
+  const tools = DISCOVERABLE_HARNESSES.map((tool) => {
+    const diagnostics = [];
+    const override = options.overrides?.[tool];
+    let executable = null;
+    let executableSource = null;
+    if (override?.executable !== undefined) {
+      executable = executableAt(pathInput(override.executable, home));
+      executableSource = "override";
+      if (!executable)
+        diagnostics.push("Explicit executable is missing, unreadable, not a file, or not executable; PATH fallback is disabled.");
+    } else {
+      for (const directory of (env.PATH ?? "").split(delimiter)) {
+        if (!isAbsolute(directory)) {
+          const warning = "Relative or empty PATH entries were ignored; this is an absolute-path candidate inventory, not proof of the launcher's selected executable.";
+          if (!diagnostics.includes(warning))
+            diagnostics.push(warning);
+          continue;
+        }
+        let validated;
+        try {
+          validated = pathInput(directory);
+        } catch {
+          diagnostics.push("An ambiguous PATH directory was ignored; use an explicit executable override after reviewing its native path.");
+          continue;
+        }
+        executable = executableAt(join3(validated, tool));
+        if (executable) {
+          executableSource = "PATH";
+          break;
+        }
+      }
+    }
+    let selected = null;
+    let configError = false;
+    try {
+      selected = configSelection(tool, home, env, override?.configDir);
+    } catch (error) {
+      if (override?.configDir !== undefined)
+        throw error;
+      configError = true;
+      diagnostics.push(`Config root unresolved: ${error.message}`);
+    }
+    const config = selected ? { ...observe(selected.path), source: selected.source } : null;
+    const filename = tool === "claude" ? "CLAUDE.md" : "AGENTS.md";
+    const globalPrompt = config ? observe(join3(config.path, filename)) : null;
+    const promptOverrides = tool === "codex" ? [...new Set([config?.path, project?.path].filter((path) => !!path))].map((path) => observe(join3(path, "AGENTS.override.md"))) : [];
+    if (!config && !configError)
+      diagnostics.push("Config root unresolved: supply the actual `sumi debug paths config` result as a configDir override; no runtime or migration was invoked.");
+    if (executable) {
+      variables[`${tool.toUpperCase()}_EXECUTABLE`] = executable.path;
+      if (config)
+        variables[`${tool.toUpperCase()}_CONFIG_DIR`] = config.path;
+    }
+    const linkedGlobal = !!globalPrompt?.viaSymlink || !!config?.viaSymlink;
+    const hasOverride = promptOverrides.some((path) => path.state !== "missing" || path.viaSymlink);
+    const scopeReviewRequired = linkedGlobal || hasOverride;
+    if (linkedGlobal)
+      diagnostics.push("Global config or prompt resolves through a symlink; preserve its lexical path and review the destination scope before planning writes.");
+    if (hasOverride)
+      diagnostics.push("A Codex AGENTS.override.md candidate may take precedence; review its native loader behavior and scope before applying AGENTS.md.");
+    return { tool, status: executable ? "executable-found" : "absent", executable, executableSource, versionEvidence: "not-probed", config, globalPrompt, projectPrompt: project ? observe(join3(project.path, filename)) : null, promptOverrides, scopeReviewRequired, diagnostics };
+  });
+  return { schema: HARNESS_DISCOVERY_SCHEMA, ownerHome: observe(home), projectRoot: project, tools, templateVariables: variables };
+}
+
+// src/cli/index.tsx
+import { basename as basename2, dirname as dirname7, join as join12, resolve as resolve8 } from "path";
 
 // src/lib/config-target-identity.ts
 function findConfigsByTargetPath(configs, targetPath) {
@@ -3838,7 +3991,7 @@ function findDuplicateTargetPathGroups(configs) {
 // src/lib/export.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync3, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
-import { dirname, join as join3, resolve as resolve2 } from "path";
+import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
 import { tmpdir } from "os";
 var ARCHIVE_EXCLUSIONS = [
   {
@@ -4174,13 +4327,13 @@ async function exportConfigs(outputPath, opts = {}) {
     integrity,
     exclusions: ARCHIVE_EXCLUSIONS
   };
-  const absOutput = resolve2(outputPath);
-  mkdirSync(dirname(absOutput), { recursive: true });
-  const stagingDir = mkdtempSync(join3(tmpdir(), "instructions-domain-export-"));
+  const absOutput = resolve3(outputPath);
+  mkdirSync(dirname2(absOutput), { recursive: true });
+  const stagingDir = mkdtempSync(join5(tmpdir(), "instructions-domain-export-"));
   try {
-    writeFileSync(join3(stagingDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+    writeFileSync(join5(stagingDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `, "utf-8");
-    writeFileSync(join3(stagingDir, "domain.json"), payload, "utf-8");
+    writeFileSync(join5(stagingDir, "domain.json"), payload, "utf-8");
     const proc = Bun.spawn(["tar", "czf", absOutput, "-C", stagingDir, "manifest.json", "domain.json"], {
       stdout: "pipe",
       stderr: "pipe"
@@ -4199,7 +4352,7 @@ async function exportConfigs(outputPath, opts = {}) {
 
 // src/lib/import.ts
 import { createHash as createHash2 } from "crypto";
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 function compareText2(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -4487,7 +4640,7 @@ async function importV1(reader, manifest, store, conflict) {
 async function importConfigs(bundlePath, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const conflict = opts.conflict ?? "skip";
-  const reader = await openArchive(resolve3(bundlePath));
+  const reader = await openArchive(resolve4(bundlePath));
   const manifestText = await reader.read("manifest.json");
   let manifest;
   try {
@@ -4513,13 +4666,13 @@ async function importConfigs(bundlePath, opts = {}) {
 import { createHash as createHash3, randomUUID as randomUUID3 } from "crypto";
 import {
   existsSync as existsSync5,
-  lstatSync,
+  lstatSync as lstatSync2,
   mkdirSync as mkdirSync2,
   readFileSync,
   readdirSync,
-  statSync
+  statSync as statSync2
 } from "fs";
-import { dirname as dirname2, isAbsolute, join as join5, parse, relative, resolve as resolve4 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join6, parse, posix, relative, resolve as resolve5 } from "path";
 class SessionApplyError extends Error {
   constructor(message) {
     super(message);
@@ -4549,13 +4702,15 @@ function applySessionRenderUnlocked(plan, options, coordination) {
   const adoptedHashes = new Map(adoptions.map((entry) => [entry.relativePath, entry.preimageSha256]));
   const reconciliations = validateFileReconciliations(plan, targetHome, previousManifest, options);
   const reconciledHashes = new Map(reconciliations.map((entry) => [entry.relativePath, entry.preimageSha256]));
-  const manifestFile = manifestWithFileProvenance(plan, previousManifest, adoptions, reconciliations);
+  const retirements = validateFileRetirements(plan, targetHome, previousManifest, options);
+  const retiredHashes = new Map(retirements.map((entry) => [entry.relativePath, entry.preimageSha256]));
+  const manifestFile = manifestWithFileProvenance(plan, previousManifest, adoptions, reconciliations, retirements);
   const files = [...payloadFiles, manifestFile];
   const currentRelativePaths = new Set(files.map((file) => file.relativePath));
   const drift = checkSessionRenderDrift(targetHome, manifestPath);
   const results = [
     ...files.map((file) => planFileResult(plan, file, targetHome, previousHashes, previousManifest, options, adoptedHashes, reconciledHashes)),
-    ...planStaleFileResults(plan, targetHome, previousManifest, currentRelativePaths, options)
+    ...planStaleFileResults(plan, targetHome, previousManifest, currentRelativePaths, options, retiredHashes)
   ];
   assertNotSilentManagedWipeout(plan, results);
   const conflicts = results.filter((result) => result.action === "conflict");
@@ -4579,7 +4734,8 @@ function applySessionRenderUnlocked(plan, options, coordination) {
       conflicts,
       drift,
       adoptions,
-      reconciliations
+      reconciliations,
+      retirements
     };
   }
   let snapshotPath = null;
@@ -4594,10 +4750,14 @@ function applySessionRenderUnlocked(plan, options, coordination) {
     const forcePortableFileOps = options.test_hooks?.force_portable_file_ops ?? false;
     assertManifestPrecondition(manifestPath, targetHome, options.expectedManifestSha256);
     ensureSessionTargetHome(targetHome);
-    rollback = writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps, adoptions, reconciliations);
+    rollback = writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps, adoptions, reconciliations, retirements);
     snapshotPath = rollback.snapshotPath;
     options.test_hooks?.before_apply_writes?.({ plan, results });
     assertManifestPrecondition(manifestPath, targetHome, options.expectedManifestSha256);
+    for (const result of results) {
+      assertExpectedSessionFileHash(result.path, targetHome, result.previousSha256);
+      coordination?.assert_held();
+    }
     const resultsByPath = new Map(results.map((result) => [result.path, result]));
     for (const file of payloadFiles) {
       applyPlannedFile(plan, file, targetHome, resultsByPath, coordination, allowPortableFallback, forcePortableFileOps);
@@ -4633,7 +4793,8 @@ function applySessionRenderUnlocked(plan, options, coordination) {
     conflicts,
     drift,
     adoptions,
-    reconciliations
+    reconciliations,
+    retirements
   };
 }
 function assertManifestPrecondition(path, targetHome, expected) {
@@ -4662,7 +4823,7 @@ function validateFileAdoptions(plan, targetHome, previousHashes, options) {
       throw new SessionApplyError(`Duplicate file adoption target: ${request.relativePath}`);
     }
     seen.add(request.relativePath);
-    const candidates = plan.files.filter((file2) => file2.relativePath === request.relativePath);
+    const candidates = exactPreimageCandidates(plan).filter((file2) => file2.relativePath === request.relativePath);
     if (candidates.length !== 1 || candidates[0].role === "manifest") {
       throw new SessionApplyError(`File adoption target is not a unique planned instruction output: ${request.relativePath}`);
     }
@@ -4681,6 +4842,10 @@ function validateFileAdoptions(plan, targetHome, previousHashes, options) {
     };
   });
 }
+function exactPreimageCandidates(plan) {
+  const customAgentPaths = new Set((plan.assetPlan?.assets ?? []).filter((asset) => asset.kind === "custom-agent" && asset.support === "supported" && asset.action === "write" && asset.destination.strategy === "emit-file").map((asset) => posix.normalize(asset.destination.relativePath)));
+  return [...plan.files, ...(plan.assetFiles ?? []).filter((file) => customAgentPaths.has(file.relativePath))];
+}
 function readExactFilePreimage(path, targetHome, request, operation) {
   if (currentSessionFileHash(path, targetHome) === null) {
     throw new SessionApplyError(`File ${operation} target does not exist: ${request.relativePath}`);
@@ -4718,7 +4883,7 @@ function validateFileReconciliations(plan, targetHome, previousManifest, options
       throw new SessionApplyError(`Duplicate file reconciliation target: ${request.relativePath}`);
     }
     seen.add(request.relativePath);
-    const candidates = plan.files.filter((file2) => file2.relativePath === request.relativePath);
+    const candidates = exactPreimageCandidates(plan).filter((file2) => file2.relativePath === request.relativePath);
     if (candidates.length !== 1 || candidates[0].role === "manifest") {
       throw new SessionApplyError(`File reconciliation target is not a unique planned instruction output: ${request.relativePath}`);
     }
@@ -4745,8 +4910,47 @@ function validateFileReconciliations(plan, targetHome, previousManifest, options
     };
   });
 }
-function manifestWithFileProvenance(plan, previousManifest, adoptions, reconciliations) {
-  if (adoptions.length === 0 && previousManifest?.adoptions === undefined && reconciliations.length === 0 && previousManifest?.reconciliations === undefined)
+function validateFileRetirements(plan, targetHome, previousManifest, options) {
+  const requests = options.retireFiles ?? [];
+  if (!Array.isArray(requests))
+    throw new SessionApplyError("Session file retirements must be an array.");
+  if (requests.length === 0)
+    return [];
+  if (options.force)
+    throw new SessionApplyError("Exact file retirement cannot be combined with force.");
+  if (options.expectedManifestSha256 === undefined) {
+    throw new SessionApplyError("Exact file retirement requires an expected manifest SHA-256 precondition.");
+  }
+  if (!previousManifest || previousManifest.targetOwner?.writer?.id !== SESSION_RENDERER_OWNER_ID || previousManifest.tool !== plan.tool || previousManifest.targetHome !== targetHome) {
+    throw new SessionApplyError("File retirement requires this renderer's manifest for the same tool and target home.");
+  }
+  const seen = new Set;
+  return requests.map((request) => {
+    if (!request || typeof request.relativePath !== "string" || typeof request.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(request.sha256)) {
+      throw new SessionApplyError("Each file retirement requires a plan-relative path and a 64-character lowercase SHA-256.");
+    }
+    if (seen.has(request.relativePath))
+      throw new SessionApplyError(`Duplicate file retirement target: ${request.relativePath}`);
+    seen.add(request.relativePath);
+    if (plan.allFiles.some((file) => file.relativePath === request.relativePath)) {
+      throw new SessionApplyError(`File retirement target is retained by the new plan: ${request.relativePath}`);
+    }
+    const owned = previousManifest.files.filter((entry) => entry.relativePath === request.relativePath);
+    const path = resolveManifestRelativePath(request.relativePath, targetHome);
+    if (owned.length !== 1 || owned[0].path !== path || !/^[a-f0-9]{64}$/.test(owned[0].sha256) || !Array.isArray(owned[0].sourceIds) || owned[0].sourceIds.some((id) => typeof id !== "string") || !isPlanManagedFile(plan, request.relativePath, owned[0].role) && owned[0].role !== "asset") {
+      throw new SessionApplyError(`File retirement target is not an obsolete managed fragment, rule, or asset: ${request.relativePath}`);
+    }
+    return {
+      path,
+      relativePath: request.relativePath,
+      preimageSha256: readExactFilePreimage(path, targetHome, request, "retirement"),
+      previousManagedSha256: owned[0].sha256,
+      sourceIds: [...owned[0].sourceIds]
+    };
+  });
+}
+function manifestWithFileProvenance(plan, previousManifest, adoptions, reconciliations, retirements) {
+  if (adoptions.length === 0 && previousManifest?.adoptions === undefined && reconciliations.length === 0 && previousManifest?.reconciliations === undefined && retirements.length === 0 && previousManifest?.retirements === undefined)
     return plan.manifestFile;
   if (previousManifest?.adoptions !== undefined && !Array.isArray(previousManifest.adoptions)) {
     throw new SessionApplyError("Previous session manifest adoption provenance is invalid.");
@@ -4787,10 +4991,28 @@ function manifestWithFileProvenance(plan, previousManifest, adoptions, reconcili
     };
     reconciledEntries.set(JSON.stringify(canonical), canonical);
   }
+  if (previousManifest?.retirements !== undefined && !Array.isArray(previousManifest.retirements)) {
+    throw new SessionApplyError("Previous session manifest retirement provenance is invalid.");
+  }
+  const retiredEntries = new Map;
+  for (const entry of [...previousManifest?.retirements ?? [], ...retirements.map(({ path: _path, ...receipt }) => receipt)]) {
+    if (!entry || typeof entry.relativePath !== "string" || !/^[a-f0-9]{64}$/.test(entry.preimageSha256) || !/^[a-f0-9]{64}$/.test(entry.previousManagedSha256) || !Array.isArray(entry.sourceIds) || entry.sourceIds.some((id) => typeof id !== "string")) {
+      throw new SessionApplyError("Previous session manifest retirement provenance is invalid.");
+    }
+    resolveManifestRelativePath(entry.relativePath, plan.targetHome);
+    const canonical = {
+      relativePath: entry.relativePath,
+      preimageSha256: entry.preimageSha256,
+      previousManagedSha256: entry.previousManagedSha256,
+      sourceIds: [...entry.sourceIds]
+    };
+    retiredEntries.set(JSON.stringify(canonical), canonical);
+  }
   const manifest = {
     ...plan.manifest,
     ...adoptions.length > 0 || previousManifest?.adoptions !== undefined ? { adoptions: [...entries.values()] } : {},
-    ...reconciliations.length > 0 || previousManifest?.reconciliations !== undefined ? { reconciliations: [...reconciledEntries.values()] } : {}
+    ...reconciliations.length > 0 || previousManifest?.reconciliations !== undefined ? { reconciliations: [...reconciledEntries.values()] } : {},
+    ...retirements.length > 0 || previousManifest?.retirements !== undefined ? { retirements: [...retiredEntries.values()] } : {}
   };
   const content = `${JSON.stringify(manifest, null, 2)}
 `;
@@ -4828,7 +5050,7 @@ function ensureSessionTargetHome(targetHome) {
 }
 function checkSessionRenderDrift(targetHome, manifestPath) {
   const safeTargetHome = assertSafeTargetHome(targetHome);
-  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative(safeTargetHome, resolve4(manifestPath)), safeTargetHome) : resolve4(safeTargetHome, ".hasna", "session-render-manifest.json");
+  const resolvedManifestPath = manifestPath ? resolveManifestRelativePath(relative(safeTargetHome, resolve5(manifestPath)), safeTargetHome) : resolve5(safeTargetHome, ".hasna", "session-render-manifest.json");
   const checkedAt = new Date().toISOString();
   const previousManifest = readPreviousManifest(resolvedManifestPath);
   if (!previousManifest) {
@@ -4878,13 +5100,13 @@ function checkSessionRenderDrift(targetHome, manifestPath) {
 function restoreSessionRenderSnapshot(snapshotPath, options = {}) {
   const snapshot = readSessionRenderSnapshot(snapshotPath);
   const targetHome = assertSafeTargetHome(snapshot.targetHome);
-  const resolvedSnapshotPath = resolve4(snapshotPath);
+  const resolvedSnapshotPath = resolve5(snapshotPath);
   const snapshotDir = getSessionRenderSnapshotDir(targetHome);
   const snapshotDirRelative = relative(snapshotDir, resolvedSnapshotPath);
-  const insideSnapshotDir = snapshotDirRelative !== ".." && !snapshotDirRelative.startsWith("../") && !isAbsolute(snapshotDirRelative);
+  const insideSnapshotDir = snapshotDirRelative !== ".." && !snapshotDirRelative.startsWith("../") && !isAbsolute2(snapshotDirRelative);
   if (!insideSnapshotDir) {
     const snapshotRelativePath = relative(targetHome, resolvedSnapshotPath);
-    if (snapshotRelativePath === "" || snapshotRelativePath === ".." || snapshotRelativePath.startsWith("../") || isAbsolute(snapshotRelativePath)) {
+    if (snapshotRelativePath === "" || snapshotRelativePath === ".." || snapshotRelativePath.startsWith("../") || isAbsolute2(snapshotRelativePath)) {
       throw new SessionApplyError("Session snapshot must be stored inside its session-render snapshot location.");
     }
   }
@@ -5001,14 +5223,14 @@ function requiredRestoreHash(file) {
   return file.previousSha256;
 }
 function readSessionRenderSnapshot(snapshotPath) {
-  const resolved = resolve4(snapshotPath);
+  const resolved = resolve5(snapshotPath);
   if (!existsSync5(resolved))
     throw new SessionApplyError(`Session snapshot not found: ${snapshotPath}`);
-  const stat = lstatSync(resolved);
+  const stat = lstatSync2(resolved);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session snapshot is not a regular file: ${snapshotPath}`);
   }
-  if (statSync(resolved).size > 32 * 1024 * 1024) {
+  if (statSync2(resolved).size > 32 * 1024 * 1024) {
     throw new SessionApplyError(`Session snapshot exceeds the 32 MiB restore limit: ${snapshotPath}`);
   }
   let parsed;
@@ -5082,7 +5304,7 @@ function readSessionRenderSnapshot(snapshotPath) {
 }
 function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previousManifestFiles, targetHome, snapshotPath) {
   assertNoNewerSessionSnapshot(snapshotPath, snapshot.createdAt, targetHome);
-  const manifestPath = resolve4(snapshot.manifestPath);
+  const manifestPath = resolve5(snapshot.manifestPath);
   const manifestRelativePath = relative(targetHome, manifestPath).replaceAll("\\", "/");
   resolveSnapshotFilePath(manifestRelativePath, snapshot.manifestPath, targetHome);
   const manifestSha256 = currentSessionFileHash(manifestPath, targetHome);
@@ -5099,7 +5321,7 @@ function reconstructPreRollbackLegacyV1Snapshot(snapshot, previousFiles, previou
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest is invalid: ${snapshotPath}`);
   }
   const appliedManifest = parsedManifest;
-  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve4(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
+  if (appliedManifest.schema !== SESSION_RENDER_SCHEMA || appliedManifest.tool !== snapshot.tool || appliedManifest.profile !== snapshot.profile || typeof appliedManifest.targetHome !== "string" || resolve5(appliedManifest.targetHome) !== targetHome || appliedManifest.targetKind !== "session-home" && appliedManifest.targetKind !== "project-root" || !Array.isArray(appliedManifest.files)) {
     throw new SessionApplyError(`Pre-rollback legacy v1 applied manifest does not match its snapshot: ${snapshotPath}`);
   }
   const afterFiles = [];
@@ -5183,17 +5405,17 @@ function assertNoNewerSessionSnapshot(snapshotPath, createdAt, targetHome) {
   if (!Number.isFinite(createdAtMs)) {
     throw new SessionApplyError(`Pre-rollback legacy v1 snapshot has an invalid creation time: ${snapshotPath}`);
   }
-  for (const entry of readdirSync(dirname2(snapshotPath))) {
-    const candidatePath = resolve4(dirname2(snapshotPath), entry);
-    if (candidatePath === resolve4(snapshotPath) || !entry.endsWith(".json"))
+  for (const entry of readdirSync(dirname3(snapshotPath))) {
+    const candidatePath = resolve5(dirname3(snapshotPath), entry);
+    if (candidatePath === resolve5(snapshotPath) || !entry.endsWith(".json"))
       continue;
-    const candidateStat = lstatSync(candidatePath);
+    const candidateStat = lstatSync2(candidatePath);
     if (candidateStat.isSymbolicLink() || !candidateStat.isFile() || candidateStat.size > 32 * 1024 * 1024)
       continue;
     try {
       const candidate = JSON.parse(readFileSync(candidatePath, "utf8"));
       const candidateCreatedAtMs = typeof candidate.createdAt === "string" ? Date.parse(candidate.createdAt) : Number.NaN;
-      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve4(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
+      if ((candidate.schema === "hasna.configs.session-render-snapshot/v1" || candidate.schema === "hasna.configs.session-render-snapshot/v2") && typeof candidate.targetHome === "string" && resolve5(candidate.targetHome) === targetHome && Number.isFinite(candidateCreatedAtMs) && candidateCreatedAtMs >= createdAtMs) {
         throw new SessionApplyError(`Cannot restore pre-rollback legacy v1 snapshot after a newer session snapshot exists: ${candidatePath}`);
       }
     } catch (error) {
@@ -5262,7 +5484,7 @@ function inferLegacySnapshotAction(file, previousFiles, previousManifestFiles, p
 }
 function resolveSnapshotFilePath(relativePath, recordedPath, targetHome) {
   const path = resolveManifestRelativePath(relativePath, targetHome);
-  if (resolve4(recordedPath) !== path) {
+  if (resolve5(recordedPath) !== path) {
     throw new SessionApplyError(`Session snapshot file path mismatch for ${relativePath}`);
   }
   return path;
@@ -5378,17 +5600,55 @@ function isPlanManagedFile(plan, relativePath, role) {
     return true;
   return plan.tool === "claude" && role === "rule" && relativePath.startsWith("rules/");
 }
-function planStaleFileResults(plan, targetHome, previousManifest, currentRelativePaths, options) {
+function planStaleFileResults(plan, targetHome, previousManifest, currentRelativePaths, options, retiredHashes) {
   if (!previousManifest)
     return [];
-  return previousManifest.files.filter((file) => !currentRelativePaths.has(file.relativePath)).filter((file) => isPlanManagedFile(plan, file.relativePath, file.role)).map((file) => planStaleFileResult(file, targetHome, options)).filter((result) => result !== null);
+  return previousManifest.files.filter((file) => !currentRelativePaths.has(file.relativePath)).filter((file) => isPlanManagedFile(plan, file.relativePath, file.role) || file.role === "asset" || retiredHashes.has(file.relativePath)).map((file) => planStaleFileResult(file, targetHome, options, retiredHashes.get(file.relativePath))).filter((result) => result !== null);
 }
-function planStaleFileResult(file, targetHome, options) {
+function planStaleFileResult(file, targetHome, options, retiredHash) {
   const target = resolveManifestRelativePath(file.relativePath, targetHome);
-  if (!existsSync5(target))
-    return null;
+  if (!existsSync5(target)) {
+    if (file.role !== "asset")
+      return null;
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "conflict",
+      changed: true,
+      previousSha256: null,
+      newSha256: "",
+      reason: "obsolete managed asset is missing; preserve manifest ownership until its reviewed preimage is restored and retired exactly"
+    };
+  }
   const previousContent = readFileSync(target, "utf-8");
   const previousSha256 = sha2563(previousContent);
+  if (retiredHash !== undefined) {
+    if (previousSha256 !== retiredHash)
+      throw new SessionApplyError(`File retirement preimage changed after validation: ${file.relativePath}`);
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "delete",
+      changed: true,
+      previousSha256,
+      newSha256: "",
+      reason: "exact reviewed obsolete managed file retired"
+    };
+  }
+  if (file.role === "asset") {
+    return {
+      path: target,
+      relativePath: file.relativePath,
+      role: file.role,
+      action: "conflict",
+      changed: true,
+      previousSha256,
+      newSha256: "",
+      reason: "obsolete managed asset requires exact retirement; preserve ownership until --retire-file and --expected-manifest-sha256 are supplied"
+    };
+  }
   if (!options.force && previousSha256 !== file.sha256) {
     return {
       path: target,
@@ -5432,21 +5692,21 @@ function isPreviouslyManaged(file, previousSha256, previousHashes, previousManif
   return previousHashes.get(file.relativePath) === previousSha256;
 }
 function resolvePlannedFilePath(plan, file, targetHome) {
-  const target = resolve4(targetHome, ...file.relativePath.split("/"));
+  const target = resolve5(targetHome, ...file.relativePath.split("/"));
   const rel = relative(targetHome, target);
-  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute(rel)) {
+  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute2(rel)) {
     throw new SessionApplyError(`Session file escapes target home: ${file.relativePath}`);
   }
-  if (resolve4(file.path) !== target) {
+  if (resolve5(file.path) !== target) {
     throw new SessionApplyError(`Session file path mismatch for ${file.relativePath}: ${file.path}`);
   }
   assertNoSymlinkSegments(targetHome, target);
   return target;
 }
 function resolveManifestRelativePath(relativePath, targetHome) {
-  const target = resolve4(targetHome, ...relativePath.split(/[\\/]+/));
+  const target = resolve5(targetHome, ...relativePath.split(/[\\/]+/));
   const rel = relative(targetHome, target);
-  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute(rel)) {
+  if (rel === "" || rel === ".." || rel.startsWith("../") || isAbsolute2(rel)) {
     throw new SessionApplyError(`Session manifest file escapes target home: ${relativePath}`);
   }
   assertNoSymlinkSegments(targetHome, target);
@@ -5497,7 +5757,7 @@ function currentSessionFileHash(path, targetHome) {
   assertNoSymlinkSegments(targetHome, path);
   if (!existsSync5(path))
     return null;
-  const stat = lstatSync(path);
+  const stat = lstatSync2(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new SessionApplyError(`Session apply path is not a regular file: ${path}`);
   }
@@ -5509,7 +5769,7 @@ function requiredPreviousHash(result) {
   }
   return result.previousSha256;
 }
-function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps, adoptions, reconciliations) {
+function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousManifest, coordination, allowPortableFallback, forcePortableFileOps, adoptions, reconciliations, retirements) {
   const existingFiles = results.filter((result) => result.action === "update" || result.action === "delete").map((result) => {
     assertExpectedSessionFileHash(result.path, targetHome, result.previousSha256);
     const content = readFileSync(result.path, "utf-8");
@@ -5533,7 +5793,7 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
     };
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-  const snapshotPath = join5(getSessionRenderSnapshotDir(targetHome), `${timestamp}-${randomUUID3()}.json`);
+  const snapshotPath = join6(getSessionRenderSnapshotDir(targetHome), `${timestamp}-${randomUUID3()}.json`);
   const afterFiles = results.map((result) => {
     if (result.action === "conflict") {
       throw new SessionApplyError(`Cannot snapshot unresolved conflict: ${result.relativePath}`);
@@ -5558,11 +5818,12 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
     files: existingFiles,
     afterFiles,
     ...adoptions.length > 0 ? { adoptions } : {},
-    ...reconciliations.length > 0 ? { reconciliations } : {}
+    ...reconciliations.length > 0 ? { reconciliations } : {},
+    ...retirements.length > 0 ? { retirements } : {}
   };
   const snapshotContent = `${JSON.stringify(snapshot, null, 2)}
 `;
-  if ((adoptions.length > 0 || reconciliations.length > 0) && Buffer.byteLength(snapshotContent, "utf8") > 32 * 1024 * 1024) {
+  if ((adoptions.length > 0 || reconciliations.length > 0 || retirements.length > 0) && Buffer.byteLength(snapshotContent, "utf8") > 32 * 1024 * 1024) {
     throw new SessionApplyError("Exact file preimage snapshot exceeds the 32 MiB restore limit.");
   }
   coordination?.assert_held();
@@ -5585,14 +5846,14 @@ function writeSessionSnapshot(plan, targetHome, manifestPath, results, previousM
   };
 }
 function assertSafeTargetHome(targetHome) {
-  if (!isAbsolute(targetHome))
+  if (!isAbsolute2(targetHome))
     throw new SessionApplyError(`Session target home must be absolute: ${targetHome}`);
-  const normalized = resolve4(targetHome);
+  const normalized = resolve5(targetHome);
   if (normalized === parse(normalized).root) {
     throw new SessionApplyError(`Session target home cannot be the filesystem root: ${targetHome}`);
   }
   assertNoSymlinkAncestors(normalized);
-  if (existsSync5(normalized) && lstatSync(normalized).isSymbolicLink()) {
+  if (existsSync5(normalized) && lstatSync2(normalized).isSymbolicLink()) {
     throw new SessionApplyError(`Session target home cannot be a symlink: ${normalized}`);
   }
   return normalized;
@@ -5602,22 +5863,22 @@ function assertNoSymlinkSegments(root, target) {
   const rel = relative(root, target);
   let current = root;
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join5(current, segment);
-    if (existsSync5(current) && lstatSync(current).isSymbolicLink()) {
+    current = join6(current, segment);
+    if (existsSync5(current) && lstatSync2(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink: ${current}`);
     }
   }
 }
 function assertNoSymlinkAncestors(path) {
-  const normalized = resolve4(path);
+  const normalized = resolve5(path);
   const parsed = parse(normalized);
   let current = parsed.root;
   const rel = relative(parsed.root, normalized);
   for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join5(current, segment);
+    current = join6(current, segment);
     if (!existsSync5(current))
       return;
-    if (lstatSync(current).isSymbolicLink()) {
+    if (lstatSync2(current).isSymbolicLink()) {
       throw new SessionApplyError(`Session apply path uses a symlink ancestor: ${current}`);
     }
   }
@@ -5628,8 +5889,8 @@ function sha2563(content) {
 
 // src/lib/session-refresh.ts
 import { createHash as createHash4 } from "crypto";
-import { closeSync, constants, fstatSync, lstatSync as lstatSync3, openSync, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname4, join as join7, parse as parse2, resolve as resolve5 } from "path";
+import { closeSync, constants as constants2, fstatSync, lstatSync as lstatSync4, openSync, readFileSync as readFileSync3 } from "fs";
+import { basename, dirname as dirname5, isAbsolute as isAbsolute3, join as join8, parse as parse2, resolve as resolve6 } from "path";
 
 // src/lib/global-source-coverage.ts
 var GLOBAL_SOURCE_SLUG_PREFIX = "global-";
@@ -5667,9 +5928,9 @@ function formatGlobalSourceCoverageWarnings(result) {
 
 // src/lib/station-profile.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { arch as osArch, homedir as homedir2, hostname as osHostname, platform as osPlatform, userInfo as osUserInfo } from "os";
-import { dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync6, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { arch as osArch, homedir as homedir3, hostname as osHostname, platform as osPlatform, userInfo as osUserInfo } from "os";
+import { dirname as dirname4, join as join7 } from "path";
 var STATION_PROFILE_CACHE_FILENAME = "station-profile.md";
 var STATION_PROFILE_SOURCE_ID = "station-profile";
 var STATION_PROFILE_LAYER = "machine";
@@ -5680,16 +5941,16 @@ var STATION_PROFILE_PRIMARY_SCOPE = "@hasna";
 var MACHINES_MANIFEST_PATH_ENV = "HASNA_MACHINES_MANIFEST_PATH";
 var BUN_INSTALL_ENV = "BUN_INSTALL";
 function homeDir(env = process.env) {
-  return env["HOME"] || env["USERPROFILE"] || homedir2();
+  return env["HOME"] || env["USERPROFILE"] || homedir3();
 }
 function getStationProfileCachePath(env = process.env) {
-  return join6(getRawStoreRoot(env), STATION_PROFILE_CACHE_FILENAME);
+  return join7(getRawStoreRoot(env), STATION_PROFILE_CACHE_FILENAME);
 }
 function getMachinesManifestPath(env = process.env) {
-  return env[MACHINES_MANIFEST_PATH_ENV] || join6(homeDir(env), ".hasna", "machines", "machines.json");
+  return env[MACHINES_MANIFEST_PATH_ENV] || join7(homeDir(env), ".hasna", "machines", "machines.json");
 }
 function getBunGlobalModulesDir(env = process.env) {
-  return join6(env[BUN_INSTALL_ENV] || join6(homeDir(env), ".bun"), "install", "global", "node_modules");
+  return join7(env[BUN_INSTALL_ENV] || join7(homeDir(env), ".bun"), "install", "global", "node_modules");
 }
 function readMachinesManifest(path) {
   try {
@@ -5751,7 +6012,7 @@ function resolveStationProfileMachine(env = process.env, options = {}) {
   const record = findLocalManifestMachine(readMachinesManifest(getMachinesManifestPath(env)), hostname);
   const home = homeDir(env);
   const platform = stringField(record, "platform") ?? osPlatform();
-  const workspacePath = stringField(record, "workspacePath") ?? join6(home, platform === "darwin" ? "Workspace" : "workspace");
+  const workspacePath = stringField(record, "workspacePath");
   const machine = {
     id: stringField(record, "id") ?? hostname,
     hostname: stringField(record, "hostname") ?? hostname,
@@ -5768,7 +6029,7 @@ function resolveStationProfileMachine(env = process.env, options = {}) {
   return machine;
 }
 function scopedPackageNames(modulesDir, scope) {
-  const scopeDir = join6(modulesDir, scope);
+  const scopeDir = join7(modulesDir, scope);
   try {
     if (!existsSync6(scopeDir))
       return null;
@@ -5780,7 +6041,7 @@ function scopedPackageNames(modulesDir, scope) {
 function readdirNames(dir) {
   return readdirSync2(dir).filter((name) => {
     try {
-      return lstatSync2(join6(dir, name)).isDirectory();
+      return lstatSync3(join7(dir, name)).isDirectory();
     } catch {
       return false;
     }
@@ -5867,7 +6128,7 @@ function refreshStationProfile(options = {}) {
   if (!options.dryRun) {
     const existing = existsSync6(path) ? readFileSync2(path, "utf8") : null;
     if (existing !== content) {
-      mkdirSync3(dirname3(path), { recursive: true });
+      mkdirSync3(dirname4(path), { recursive: true });
       writeFileSync2(path, content, "utf8");
     }
   }
@@ -5907,7 +6168,6 @@ function stationProfileSource(env = process.env) {
 }
 
 // src/lib/session-refresh.ts
-import { basename } from "path";
 var nonempty = exports_external.string().min(1).max(4096);
 var selectorSchema = exports_external.object({
   schema: exports_external.literal("hasna.instructions.hosted-profile-selector/v1"),
@@ -5958,18 +6218,18 @@ function assertHostedProfileBindings(profileId, configs, bindings) {
   }
 }
 function readManagedManifest(targetHome) {
-  const path = join7(targetHome, SESSION_RENDER_MANIFEST_RELATIVE_PATH);
-  let ancestor = dirname4(path);
+  const path = join8(targetHome, SESSION_RENDER_MANIFEST_RELATIVE_PATH);
+  let ancestor = dirname5(path);
   while (true) {
-    const stat = lstatSync3(ancestor);
+    const stat = lstatSync4(ancestor);
     if (stat.isSymbolicLink() || !stat.isDirectory())
       throw new Error("SESSION_REFRESH_PATH_INVALID: managed target uses a symlink or non-directory ancestor.");
-    const parent = dirname4(ancestor);
+    const parent = dirname5(ancestor);
     if (parent === ancestor)
       break;
     ancestor = parent;
   }
-  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  const fd = openSync(path, constants2.O_RDONLY | constants2.O_NOFOLLOW);
   let raw;
   try {
     const stat = fstatSync(fd);
@@ -5985,6 +6245,19 @@ function readManagedManifest(targetHome) {
   if (manifest.schema !== SESSION_RENDER_SCHEMA || !SESSION_RENDER_TOOLS.includes(manifest.tool) || manifest.targetHome !== targetHome || !manifest.profile?.trim() || !["session-home", "project-root"].includes(manifest.targetKind) || !Array.isArray(manifest.files) || !manifest.refreshSelector || manifest.targetOwner?.writer?.id !== SESSION_RENDERER_OWNER_ID || manifest.targetOwner?.targetHome !== targetHome) {
     throw new Error("SESSION_REFRESH_MANIFEST_INVALID: target is not an owned hosted profile render; apply a hosted --compile-profile first.");
   }
+  const recordedProjectRoot = manifest.targetOwner.projectRoot;
+  if (recordedProjectRoot !== null && recordedProjectRoot !== undefined) {
+    if (typeof recordedProjectRoot !== "string" || !isAbsolute3(recordedProjectRoot)) {
+      throw new Error("SESSION_REFRESH_MANIFEST_INVALID: recorded project root must be an absolute path.");
+    }
+    const normalizedProjectRoot = resolve6(recordedProjectRoot);
+    if (normalizedProjectRoot === parse2(normalizedProjectRoot).root || manifest.targetKind === "project-root" && normalizedProjectRoot !== targetHome || manifest.targetKind === "session-home" && manifest.tool !== "opencode") {
+      throw new Error("SESSION_REFRESH_MANIFEST_INVALID: recorded project root does not match the managed target.");
+    }
+    manifest.targetOwner.projectRoot = normalizedProjectRoot;
+  } else if (manifest.targetKind === "project-root") {
+    throw new Error("SESSION_REFRESH_MANIFEST_INVALID: project-scoped render is missing its recorded project root.");
+  }
   manifest.refreshSelector = normalizeSessionHostedProfileSelector(manifest.refreshSelector);
   return { manifest, sha256: createHash4("sha256").update(raw).digest("hex") };
 }
@@ -5992,7 +6265,7 @@ async function refreshSessionRender(input) {
   const { store } = input;
   if (store.mode !== "api" || !store.v1BaseUrl)
     throw new Error("SESSION_REFRESH_HOSTED_REQUIRED: refresh requires the configured hosted Instructions API.");
-  const targetHome = resolve5(input.targetHome);
+  const targetHome = resolve6(input.targetHome);
   if (targetHome === parse2(targetHome).root)
     throw new Error("SESSION_REFRESH_PATH_INVALID: filesystem root is not a managed target.");
   const previous = readManagedManifest(targetHome);
@@ -6027,7 +6300,7 @@ async function refreshSessionRender(input) {
     profile_id: profile.id,
     provider_version: selector.providerVersion,
     targetHome,
-    ...previous.manifest.targetKind === "project-root" ? { projectRoot: targetHome } : {},
+    ...previous.manifest.targetKind === "project-root" ? { projectRoot: targetHome } : previous.manifest.targetOwner.projectRoot ? { projectRoot: previous.manifest.targetOwner.projectRoot } : {},
     sessionId: previous.manifest.sessionId ?? undefined,
     refreshSelector: selector,
     codewithNativeImports: selector.codewithNativeImports,
@@ -6036,7 +6309,7 @@ async function refreshSessionRender(input) {
     bindings,
     asset_configs: assetConfigs,
     asset_bindings: assetBindings,
-    asset_plan_mode: input.dryRun ? "dry-run" : "apply",
+    asset_plan_mode: "apply",
     asset_scope: selector.assetScope,
     asset_surface: selector.assetSurface,
     extra_sources: station ? [station] : undefined,
@@ -6392,19 +6665,9 @@ async function ensureDangerousOperationGuardStandardConfig(store = resolveConfig
 }
 
 // src/lib/managed-skill-runtimes.ts
-import { createHash as createHash5 } from "crypto";
-import { spawnSync as spawnSync2 } from "child_process";
-import {
-  existsSync as existsSync7,
-  lstatSync as lstatSync4,
-  mkdirSync as mkdirSync4,
-  readFileSync as readFileSync4,
-  renameSync,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync3
-} from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join8, parse as parse3, relative as relative2, resolve as resolve6 } from "path";
+import { lstatSync as lstatSync5 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join9, resolve as resolve7 } from "path";
 var INBOX_CONVERSATIONS_MINIMUM_VERSION = "0.5.28";
 var INBOX_SKILL_MARKERS = [
   [".claude", "skills", "inbox", "SKILL.md"],
@@ -6413,378 +6676,76 @@ var INBOX_SKILL_MARKERS = [
   [".config", "opencode", "skills", "inbox", "SKILL.md"],
   [".cursor", "skills", "inbox", "SKILL.md"]
 ];
-var REQUIRED_WATCH_FLAGS = ["--from <agent>", "--all", "--full-content"];
-function sha2564(content) {
-  return createHash5("sha256").update(content).digest("hex");
-}
-function lstatOrNull(path) {
-  try {
-    return lstatSync4(path);
-  } catch {
-    return null;
-  }
-}
-function findSymlinkedAncestor(path) {
-  const normalized = resolve6(path);
-  const parsed = parse3(normalized);
-  let current = parsed.root;
-  const rel = relative2(parsed.root, normalized);
-  for (const segment of rel.split(/[\\/]+/).filter(Boolean)) {
-    current = join8(current, segment);
-    if (!existsSync7(current))
-      return null;
-    if (lstatSync4(current).isSymbolicLink())
-      return current;
-  }
-  return null;
-}
-function assertNoSymlinkAncestors2(path) {
-  const found = findSymlinkedAncestor(path);
-  if (found !== null) {
-    throw new Error(`managed skill path uses a symlink ancestor: ${found}`);
-  }
-}
-function packagedInboxSkillPath(explicitPath) {
-  if (explicitPath)
-    return explicitPath;
-  throw new Error("Bundled skill contracts are retired; use the Skills CLI to manage private skills");
-}
-function readCanonicalSkill(explicitPath) {
-  const assetPath = packagedInboxSkillPath(explicitPath);
-  const stat = lstatOrNull(assetPath);
-  if (!stat?.isFile()) {
-    throw new Error("packaged inbox skill contract is not a regular file");
-  }
-  const content = readFileSync4(assetPath, "utf8");
-  if (!content.includes("conversations watch --from <agent> --all")) {
-    throw new Error("packaged inbox skill contract does not declare the canonical conversations watcher");
-  }
-  if (!content.includes("There is no separate")) {
-    throw new Error("packaged inbox skill contract does not retire the legacy executable");
-  }
-  return { content, sha256: sha2564(content) };
-}
-function runProbe(command, args) {
-  const result = spawnSync2(command, args, {
-    encoding: "utf8",
-    timeout: 5000,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  if (result.error || result.status !== 0) {
-    return { ok: false, output: "" };
-  }
-  return {
-    ok: true,
-    output: `${result.stdout ?? ""}
-${result.stderr ?? ""}`.trim()
-  };
-}
-function parseVersion(output) {
-  return output.match(/\b(\d+\.\d+\.\d+)\b/)?.[1] ?? null;
-}
-function compareVersions(left, right) {
-  const a = left.split(".").map(Number);
-  const b = right.split(".").map(Number);
-  for (let i = 0;i < Math.max(a.length, b.length); i++) {
-    const delta = (a[i] ?? 0) - (b[i] ?? 0);
-    if (delta !== 0)
-      return delta;
-  }
-  return 0;
-}
-function inspectSkillMarkers(homeDir2) {
-  return INBOX_SKILL_MARKERS.map((parts) => join8(homeDir2, ...parts)).map((path) => {
-    const stat = lstatOrNull(path);
-    if (!stat)
-      return null;
-    if (!stat.isFile()) {
-      return { path, content: null, mode: null, regular: false };
+function needsMigrationReview(homeDir2, parts) {
+  let current = resolve7(homeDir2);
+  const absolute = join9(current, ...parts);
+  for (const segment of parts) {
+    current = join9(current, segment);
+    let stat;
+    try {
+      stat = lstatSync5(current);
+    } catch (error) {
+      if (error.code === "ENOENT")
+        return false;
+      throw error;
     }
-    return {
-      path,
-      content: readFileSync4(path, "utf8"),
-      mode: stat.mode & 511,
-      regular: true
-    };
-  }).filter((snapshot) => snapshot !== null);
-}
-function inspectInbox(options) {
-  const homeDir2 = options.homeDir ?? homedir3();
-  const runtimeCommand = options.conversationsCommand ?? "conversations";
-  const snapshots = inspectSkillMarkers(homeDir2);
-  const skillPresent = snapshots.length > 0;
-  let canonicalContent = null;
-  let canonicalSha256 = null;
-  let assetError = null;
-  try {
-    const canonical = readCanonicalSkill(options.assetPath);
-    canonicalContent = canonical.content;
-    canonicalSha256 = canonical.sha256;
-  } catch (error) {
-    assetError = error instanceof Error ? error.message : String(error);
-  }
-  const versionProbe = skillPresent ? runProbe(runtimeCommand, ["--version"]) : { ok: false, output: "" };
-  const helpProbe = versionProbe.ok ? runProbe(runtimeCommand, ["watch", "--help"]) : { ok: false, output: "" };
-  const runtimeVersion = versionProbe.ok ? parseVersion(versionProbe.output) : null;
-  const supportsFrom = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[0]);
-  const supportsAll = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[1]);
-  const supportsFullContent = helpProbe.ok && helpProbe.output.includes(REQUIRED_WATCH_FLAGS[2]);
-  const packageReady = versionProbe.ok && runtimeVersion !== null && compareVersions(runtimeVersion, INBOX_CONVERSATIONS_MINIMUM_VERSION) >= 0 && helpProbe.ok && supportsFrom && supportsAll && supportsFullContent;
-  const heartbeatProbe = skillPresent && packageReady && options.agent ? runProbe(runtimeCommand, ["agents", "heartbeat", "--from", options.agent, "--json"]) : null;
-  const hostedHeartbeat = heartbeatProbe === null ? "unverified" : heartbeatProbe.ok ? "passed" : "failed";
-  const deliveryVerified = hostedHeartbeat === "passed" && options.deliveryVerified === true;
-  const staleMarkers = canonicalContent === null ? snapshots.map((snapshot) => snapshot.path) : snapshots.filter((snapshot) => !snapshot.regular || snapshot.content !== canonicalContent).map((snapshot) => snapshot.path);
-  let reason = "skill not installed";
-  if (skillPresent) {
-    const nonRegular = snapshots.some((snapshot) => !snapshot.regular);
-    const symlinkAncestor = snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname5(path))).find((found) => found !== null);
-    if (nonRegular)
-      reason = "managed skill target is not a regular file";
-    else if (symlinkAncestor)
-      reason = `managed skill path uses a symlink ancestor: ${symlinkAncestor}`;
-    else if (assetError)
-      reason = assetError;
-    else if (!versionProbe.ok)
-      reason = "conversations command unavailable";
-    else if (!runtimeVersion)
-      reason = "conversations version is unreadable";
-    else if (compareVersions(runtimeVersion, INBOX_CONVERSATIONS_MINIMUM_VERSION) < 0) {
-      reason = `conversations ${runtimeVersion} is older than ${INBOX_CONVERSATIONS_MINIMUM_VERSION}`;
-    } else if (!helpProbe.ok)
-      reason = "conversations watch help is unavailable";
-    else if (!supportsFrom || !supportsAll || !supportsFullContent) {
-      const missing = [
-        !supportsFrom ? "--from" : null,
-        !supportsAll ? "--all" : null,
-        !supportsFullContent ? "--full-content" : null
-      ].filter((flag) => flag !== null);
-      reason = `conversations watch is missing required flags: ${missing.join(", ")}`;
-    } else if (staleMarkers.length > 0)
-      reason = "skill contract stale";
-    else if (hostedHeartbeat === "failed")
-      reason = "hosted heartbeat failed; manual fallback required";
-    else if (hostedHeartbeat === "unverified")
-      reason = "hosted heartbeat unverified; manual fallback required";
-    else if (!deliveryVerified)
-      reason = "hosted heartbeat passed; channel and DM delivery verification required";
-    else
-      reason = "ready";
+    if (stat.isSymbolicLink() || current !== absolute && !stat.isDirectory())
+      return true;
   }
+  return true;
+}
+function inspectLegacyInbox(options) {
+  const homeDir2 = options.homeDir ?? homedir4();
+  const markers = INBOX_SKILL_MARKERS.filter((parts) => needsMigrationReview(homeDir2, parts)).map((parts) => join9(homeDir2, ...parts));
+  const present = markers.length > 0;
   return {
-    status: {
-      skill: "inbox",
-      runtime: "conversations watch",
-      minimum_version: INBOX_CONVERSATIONS_MINIMUM_VERSION,
-      skill_present: skillPresent,
-      skill_markers: snapshots.map((snapshot) => snapshot.path),
-      skill_contracts_current: snapshots.length - staleMarkers.length,
-      stale_skill_markers: staleMarkers,
-      expected_skill_sha256: canonicalSha256,
-      runtime_command: runtimeCommand,
-      runtime_present: versionProbe.ok,
-      runtime_version: runtimeVersion,
-      watch_supports_from: supportsFrom,
-      watch_supports_all: supportsAll,
-      watch_supports_full_content: supportsFullContent,
-      hosted_heartbeat: hostedHeartbeat,
-      delivery_verified: deliveryVerified,
-      manual_fallback_ready: skillPresent && staleMarkers.length === 0 && packageReady,
-      healthy: !skillPresent || reason === "ready",
-      reason
-    },
-    canonicalContent,
-    snapshots
+    skill: "inbox",
+    runtime: "conversations watch",
+    minimum_version: INBOX_CONVERSATIONS_MINIMUM_VERSION,
+    skill_present: present,
+    skill_markers: markers,
+    skill_contracts_current: 0,
+    stale_skill_markers: markers,
+    expected_skill_sha256: null,
+    runtime_command: options.conversationsCommand ?? "conversations",
+    runtime_present: false,
+    runtime_version: null,
+    watch_supports_from: false,
+    watch_supports_all: false,
+    watch_supports_full_content: false,
+    hosted_heartbeat: "unverified",
+    delivery_verified: false,
+    manual_fallback_ready: false,
+    healthy: !present,
+    reason: present ? "Native Inbox skill management is retired; use the Skills CLI to review skills migrate native, then sync and load the selected skills" : "No legacy native Inbox skill found; skill availability is managed by the Skills CLI"
   };
 }
 function inspectManagedSkillRuntimes(options = {}) {
-  const runtime = inspectInbox(options).status;
-  const installed = runtime.skill_present ? [runtime] : [];
+  const runtime = inspectLegacyInbox(options);
   return {
     runtimes: [runtime],
-    skills_present: installed.length,
-    healthy: installed.filter((item) => item.healthy).length,
-    missing: installed.filter((item) => !item.healthy).length
+    skills_present: runtime.skill_present ? 1 : 0,
+    healthy: 0,
+    missing: runtime.skill_present ? 1 : 0
   };
 }
-function runtimeReadyForWrite(status) {
-  return status.runtime_present && status.runtime_version !== null && compareVersions(status.runtime_version, INBOX_CONVERSATIONS_MINIMUM_VERSION) >= 0 && status.watch_supports_from && status.watch_supports_all && status.watch_supports_full_content;
-}
-function projectUpdatedStatus(status, contractCount) {
-  const healthy = status.hosted_heartbeat === "passed" && status.delivery_verified;
-  return {
-    ...status,
-    skill_contracts_current: contractCount,
-    stale_skill_markers: [],
-    manual_fallback_ready: true,
-    healthy,
-    reason: healthy ? "ready" : status.hosted_heartbeat === "failed" ? "hosted heartbeat failed; manual fallback required" : status.hosted_heartbeat === "unverified" ? "hosted heartbeat unverified; manual fallback required" : "hosted heartbeat passed; channel and DM delivery verification required"
-  };
-}
-function cleanup(path) {
-  rmSync2(path, { force: true });
-}
-function writeAtomic(path, content, mode) {
-  assertNoSymlinkAncestors2(dirname5(path));
-  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  try {
-    mkdirSync4(dirname5(path), { recursive: true, mode: 493 });
-    writeFileSync3(tempPath, content, { mode, flag: "wx" });
-    renameSync(tempPath, path);
-  } finally {
-    cleanup(tempPath);
-  }
-}
-var DEFAULT_SKILL_WRITE_FILE_OPERATIONS = {
-  lstat: lstatOrNull,
-  read: (path) => readFileSync4(path, "utf8"),
-  write: writeAtomic
-};
-function writeSkillContractsTransactional(snapshots, canonicalContent, fileOperations = DEFAULT_SKILL_WRITE_FILE_OPERATIONS) {
-  const written = [];
-  try {
-    for (const snapshot of snapshots) {
-      const currentStat = fileOperations.lstat(snapshot.path);
-      if (!currentStat?.isFile() || fileOperations.read(snapshot.path) !== snapshot.content) {
-        throw new Error("managed skill changed after inspection; refusing a stale write");
-      }
-      fileOperations.write(snapshot.path, canonicalContent, snapshot.mode);
-      written.push(snapshot);
-    }
-    return { ok: true, error: null, rollback_conflicts: [] };
-  } catch (error) {
-    const rollbackConflicts = [];
-    for (const snapshot of written.reverse()) {
-      const currentStat = fileOperations.lstat(snapshot.path);
-      if (!currentStat?.isFile()) {
-        rollbackConflicts.push(`${snapshot.path}: no longer a regular file`);
-        continue;
-      }
-      let currentContent;
-      try {
-        currentContent = fileOperations.read(snapshot.path);
-      } catch {
-        rollbackConflicts.push(`${snapshot.path}: could not read the current file`);
-        continue;
-      }
-      if (currentContent !== canonicalContent) {
-        rollbackConflicts.push(`${snapshot.path}: changed after this reconciliation wrote it`);
-        continue;
-      }
-      try {
-        fileOperations.write(snapshot.path, snapshot.content, snapshot.mode);
-      } catch {
-        rollbackConflicts.push(`${snapshot.path}: still owned but could not be restored`);
-      }
-    }
-    return {
-      ok: false,
-      error: error instanceof Error ? error.message : String(error),
-      rollback_conflicts: rollbackConflicts
-    };
-  }
-}
 async function reconcileManagedSkillRuntimes(options = {}) {
+  const runtime = inspectLegacyInbox(options);
   const dryRun = options.dryRun ?? false;
-  const before = inspectInbox(options);
-  const status = before.status;
-  if (!status.skill_present) {
-    return {
-      runtimes: [{ ...status, action: "skipped", dry_run: dryRun, skill_contracts_changed: 0 }],
-      changed: 0,
-      failed: 0,
-      dry_run: dryRun
-    };
-  }
-  if (before.snapshots.some((snapshot) => !snapshot.regular)) {
-    return {
-      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
-      changed: 0,
-      failed: 1,
-      dry_run: dryRun
-    };
-  }
-  const symlinkedAncestor = before.snapshots.map((snapshot) => snapshot.path).map((path) => findSymlinkedAncestor(dirname5(path))).find((found) => found !== null);
-  if (symlinkedAncestor) {
-    return {
-      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
-      changed: 0,
-      failed: 1,
-      dry_run: dryRun
-    };
-  }
-  if (!before.canonicalContent || !runtimeReadyForWrite(status)) {
-    return {
-      runtimes: [{ ...status, action: "failed", dry_run: dryRun, skill_contracts_changed: 0 }],
-      changed: 0,
-      failed: 1,
-      dry_run: dryRun
-    };
-  }
-  const staleSnapshots = before.snapshots.filter((snapshot) => snapshot.content !== before.canonicalContent);
-  if (staleSnapshots.length === 0) {
-    return {
-      runtimes: [{ ...status, action: "unchanged", dry_run: dryRun, skill_contracts_changed: 0 }],
-      changed: 0,
-      failed: 0,
-      dry_run: dryRun
-    };
-  }
-  if (dryRun) {
-    const projected = projectUpdatedStatus(status, before.snapshots.length);
-    return {
-      runtimes: [{
-        ...projected,
-        action: "update",
-        dry_run: true,
-        skill_contracts_changed: staleSnapshots.length
-      }],
-      changed: 1,
-      failed: 0,
-      dry_run: true
-    };
-  }
-  const transaction = writeSkillContractsTransactional(staleSnapshots.map((snapshot) => ({
-    path: snapshot.path,
-    content: snapshot.content,
-    mode: snapshot.mode ?? 420
-  })), before.canonicalContent);
-  if (!transaction.ok) {
-    const rollbackConflictReason = transaction.rollback_conflicts.length > 0 ? `; rollback conflicts: ${transaction.rollback_conflicts.join("; ")}` : "";
-    const reason = `${transaction.error ?? "managed skill reconciliation failed"}${rollbackConflictReason}`;
-    return {
-      runtimes: [{
-        ...status,
-        action: "failed",
-        dry_run: false,
-        skill_contracts_changed: 0,
-        reason
-      }],
-      changed: 0,
-      failed: 1,
-      dry_run: false
-    };
-  }
-  const after = inspectInbox(options).status;
-  const accepted = after.healthy || after.manual_fallback_ready;
   return {
-    runtimes: [{
-      ...after,
-      action: accepted ? "update" : "failed",
-      dry_run: false,
-      skill_contracts_changed: accepted ? staleSnapshots.length : 0
-    }],
-    changed: accepted ? 1 : 0,
-    failed: accepted ? 0 : 1,
-    dry_run: false
+    runtimes: [{ ...runtime, action: runtime.skill_present ? "failed" : "skipped", dry_run: dryRun, skill_contracts_changed: 0 }],
+    changed: 0,
+    failed: runtime.skill_present ? 1 : 0,
+    dry_run: dryRun
   };
 }
 
 // src/status.ts
-import { existsSync as existsSync9, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
 
 // src/lib/package-version.ts
-import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname6, join as join9 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname6, join as join10 } from "path";
 import { fileURLToPath } from "url";
 var cached = null;
 function getPackageVersion() {
@@ -6793,9 +6754,9 @@ function getPackageVersion() {
   try {
     let dir = dirname6(fileURLToPath(import.meta.url));
     for (let i = 0;i < 8; i++) {
-      const pkgPath = join9(dir, "package.json");
-      if (existsSync8(pkgPath)) {
-        const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+      const pkgPath = join10(dir, "package.json");
+      if (existsSync7(pkgPath)) {
+        const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
         if (pkg.name === "@hasna/instructions" && pkg.version) {
           cached = pkg.version;
           return cached;
@@ -6870,11 +6831,11 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
       continue;
     knownTargets += 1;
     const targetPath = expandPath(config.target_path);
-    if (!existsSync9(targetPath)) {
+    if (!existsSync8(targetPath)) {
       missingTargets += 1;
       continue;
     }
-    const disk = readFileSync6(targetPath, "utf-8");
+    const disk = readFileSync5(targetPath, "utf-8");
     const { content: redactedDisk } = redactContent(disk, redactFormatForTarget(config.target_path, config.format));
     if (redactedDisk !== config.content) {
       driftedTargets += 1;
@@ -6966,9 +6927,9 @@ async function getConfigsStatus(store = resolveConfigStore(), options = {}) {
 }
 
 // src/lib/provider-context.ts
-import { createHash as createHash6 } from "crypto";
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { createHash as createHash5 } from "crypto";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
+import { join as join11 } from "path";
 var PROVIDER_CONTEXT_DIR = ".hasna/provider-context";
 var PROVIDER_CONTEXT_MANIFEST = "manifest.json";
 var PROVIDER_CONTEXT_SCHEMA = "hasna.instructions.provider-context/v1";
@@ -7103,8 +7064,8 @@ function renderPerEndpointFragment(entry) {
 function renderProviderFragment(entry) {
   return entry ? renderPerEndpointFragment(entry) : INVARIANT_FRAGMENT;
 }
-function sha2565(content) {
-  return createHash6("sha256").update(content).digest("hex");
+function sha2564(content) {
+  return createHash5("sha256").update(content).digest("hex");
 }
 function resolveAndRenderProviderContext(opts) {
   const entry = matchProviderEndpoint(opts.origin);
@@ -7113,18 +7074,18 @@ function resolveAndRenderProviderContext(opts) {
   const recordedEndpoint = originAccepted ? `${opts.origin.host}${opts.origin.pathPrefix || ""}` : null;
   const reason = entry === null && opts.rawEndpoint ? originAccepted ? `endpoint "${recordedEndpoint}" is not in the provider-context registry; using the invariant fragment` : "endpoint rejected (embedded credentials or unparseable); using the invariant fragment" : null;
   const content = renderProviderFragment(entry);
-  const dir = join10(opts.homeDir, PROVIDER_CONTEXT_DIR);
-  if (!existsSync10(dir))
-    mkdirSync5(dir, { recursive: true });
+  const dir = join11(opts.homeDir, PROVIDER_CONTEXT_DIR);
+  if (!existsSync9(dir))
+    mkdirSync4(dir, { recursive: true });
   const filename = `${entry ? entry.key : "invariant"}.md`;
-  const fragmentPath = join10(dir, filename);
-  const fragmentSha256 = sha2565(content);
-  writeFileSync4(fragmentPath, content, "utf8");
-  const manifestPath = join10(dir, PROVIDER_CONTEXT_MANIFEST);
+  const fragmentPath = join11(dir, filename);
+  const fragmentSha256 = sha2564(content);
+  writeFileSync3(fragmentPath, content, "utf8");
+  const manifestPath = join11(dir, PROVIDER_CONTEXT_MANIFEST);
   let manifest = { schema: PROVIDER_CONTEXT_SCHEMA, fragments: {} };
   try {
-    if (existsSync10(manifestPath)) {
-      const parsed = JSON.parse(readFileSync7(manifestPath, "utf8"));
+    if (existsSync9(manifestPath)) {
+      const parsed = JSON.parse(readFileSync6(manifestPath, "utf8"));
       if (parsed && typeof parsed === "object")
         manifest = parsed;
     }
@@ -7139,7 +7100,7 @@ function resolveAndRenderProviderContext(opts) {
     rawModel: opts.rawModel || null
   };
   manifest.fragments = fragmentsObj;
-  writeFileSync4(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
+  writeFileSync3(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
   return {
     entry,
     rawEndpoint: opts.rawEndpoint,
@@ -7270,7 +7231,7 @@ function parseSessionSource(value, order) {
   if (!path)
     throw new Error(`Invalid --source "${value}" (expected path or id=path)`);
   const absPath = resolveSessionPath(path);
-  if (!existsSync11(absPath))
+  if (!existsSync10(absPath))
     throw new Error(`Instruction source file not found: ${absPath}`);
   const content = readSessionInstructionSourceFile(absPath);
   const source = sourceFromFilePath(absPath, content, order);
@@ -7314,7 +7275,7 @@ function sessionSourceReplacements(values) {
   return replacements;
 }
 function readSessionInstructionSourceFile(path) {
-  const stat = lstatSync5(path);
+  const stat = lstatSync6(path);
   if (stat.isSymbolicLink()) {
     throw new Error("SESSION_SOURCE_SYMLINK_REJECTED: instruction source file must be a regular non-symlink file");
   }
@@ -7324,7 +7285,7 @@ function readSessionInstructionSourceFile(path) {
   if (stat.size > SESSION_MANAGED_INPUT_MAX_BYTES) {
     throw new Error(`SESSION_SOURCE_INPUT_TOO_LARGE: instruction source file exceeds ${SESSION_MANAGED_INPUT_MAX_BYTES} bytes`);
   }
-  return readFileSync8(path, "utf-8");
+  return readFileSync7(path, "utf-8");
 }
 function parseLayeredReference(value) {
   const trimmed = value.trim();
@@ -7353,9 +7314,9 @@ async function collectSessionSources(opts, tool, store) {
   }
   for (const value of opts.identityExport ?? []) {
     const path = resolveSessionPath(value);
-    if (!existsSync11(path))
+    if (!existsSync10(path))
       throw new Error(`Identity instruction export not found: ${path}`);
-    const parsed = JSON.parse(readFileSync8(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
     sources.push(...sourcesFromIdentityExport(parsed, { path, tool, orderOffset: sources.length }));
   }
   return sources.map((source) => {
@@ -7507,19 +7468,19 @@ function readProjectContextBundleOption(value, allowMissing = false) {
   if (value === "-")
     return { json: readBoundedProjectContextStdin() };
   const path = resolveSessionPath(value);
-  if (!existsSync11(path)) {
+  if (!existsSync10(path)) {
     if (allowMissing)
       return {};
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_MISSING", `bundle file not found: ${path}`);
   }
-  const stat = lstatSync5(path);
+  const stat = lstatSync6(path);
   if (stat.isSymbolicLink() || !stat.isFile()) {
     throw new ProjectContextError("PROJECT_CONTEXT_SYMLINK_REJECTED", "bundle input must be a regular non-symlink file");
   }
   if (stat.size > PROJECT_CONTEXT_MAX_INPUT_BYTES) {
     throw new ProjectContextError("PROJECT_CONTEXT_INPUT_TOO_LARGE", `bundle exceeds ${PROJECT_CONTEXT_MAX_INPUT_BYTES} bytes`);
   }
-  return { json: readFileSync8(path, "utf8"), sourcePath: path };
+  return { json: readFileSync7(path, "utf8"), sourcePath: path };
 }
 function readBoundedProjectContextStdin() {
   const chunks = [];
@@ -7904,12 +7865,12 @@ program.command("add <path>").description("Ingest a file into the config DB").op
   if (expectedVersion !== undefined && !opts.update) {
     throw new Error("--expected-version requires --update");
   }
-  const abs = resolve7(filePath);
-  if (!existsSync11(abs)) {
+  const abs = resolve8(filePath);
+  if (!existsSync10(abs)) {
     console.error(chalk.red(`File not found: ${abs}`));
     process.exit(1);
   }
-  const rawContent = readFileSync8(abs, "utf-8");
+  const rawContent = readFileSync7(abs, "utf-8");
   const storedFmt = detectFormat(abs);
   const fmt = redactFormatForTarget(abs, storedFmt);
   const { content, redacted, isTemplate } = redactContent(rawContent, fmt);
@@ -8092,7 +8053,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
       for (const entry of entries) {
         if (!entry.isDirectory())
           continue;
-        const projDir = join11(absDir, entry.name);
+        const projDir = join12(absDir, entry.name);
         const hasAgentConfig = [
           "CLAUDE.md",
           ".mcp.json",
@@ -8105,7 +8066,7 @@ program.command("sync").description("Sync known AI coding configs from disk into
           ".aicopilot",
           ".cursor",
           ".agents"
-        ].some((marker) => existsSync11(join11(projDir, marker)));
+        ].some((marker) => existsSync10(join12(projDir, marker)));
         if (!hasAgentConfig)
           continue;
         const result2 = await syncProject({ projectDir: projDir, dryRun: opts.dryRun, store });
@@ -8153,7 +8114,7 @@ program.command("import <file>").description("Restore a v2 Instructions domain a
 });
 program.command("whoami").description("Show setup summary").action(async () => {
   const store = resolveConfigStore();
-  const dbPath = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join11(getRawStoreRoot(), "instructions.db");
+  const dbPath = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join12(getRawStoreRoot(), "instructions.db");
   const stats = await store.getConfigStats();
   console.log(chalk.bold("@hasna/instructions") + chalk.dim(" v" + pkg.version));
   console.log(chalk.cyan(store.mode === "api" ? "API:" : "DB:") + " " + dbPath);
@@ -8376,7 +8337,7 @@ profileCmd.command("binding <profile> <config>").description("Set a config's sch
     process.exit(1);
   }
 });
-profileCmd.command("apply [id]").description("Apply all configs in a profile to disk").option("--dry-run", "preview without writing").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--auto", "resolve the matching profile for the current machine").option("--hostname <hostname>", "override detected hostname for auto resolution").option("--os <os>", "override detected OS for auto resolution").option("--arch <arch>", "override detected arch for auto resolution").action(async (id, opts) => {
+profileCmd.command("apply [id]").description("Apply all configs in a profile to disk").option("--dry-run", "preview without writing").option("--from <agent>", "deprecated compatibility option; no heartbeat is sent").option("--delivery-verified", "deprecated compatibility option; Skills delivery is not verified here").option("--auto", "resolve the matching profile for the current machine").option("--hostname <hostname>", "override detected hostname for auto resolution").option("--os <os>", "override detected OS for auto resolution").option("--arch <arch>", "override detected arch for auto resolution").action(async (id, opts) => {
   try {
     const store = resolveConfigStore();
     const { machine, profile } = await getMachineProfileContext(opts, store);
@@ -8413,14 +8374,6 @@ profileCmd.command("apply [id]").description("Apply all configs in a profile to
     }
     if (report.failures.length > 0)
       process.exitCode = 1;
-    const runtimeReport = await reconcileManagedSkillRuntimes({
-      dryRun: opts.dryRun,
-      agent: opts.from,
-      deliveryVerified: opts.deliveryVerified
-    });
-    printManagedSkillRuntimeReport(runtimeReport);
-    if (runtimeReport.failed > 0)
-      process.exitCode = 1;
     console.log(chalk.dim(`
 ${changed}/${results.length} changed (${selected.slug} on ${machine.hostname} ${machine.os_family}/${machine.arch})`));
   } catch (e) {
@@ -8592,7 +8545,7 @@ sessionCmd.command("plan").description("Produce a dry-run render plan for profil
     process.exit(1);
   }
 });
-sessionCmd.command("apply").description("Write a session render plan to its managed target home or explicit project root").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "native instruction home; Sumi: resolved config from `sumi debug paths config`; Grok: GROK_HOME; Devin: user config directory (global AGENTS.md unless --project-root is set)").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--compile-profile <id-or-slug>", "compile persisted config bindings from this Instructions profile").option("--provider-version <semver>", "installed provider version used for capability matching").option("--provider-variant <variant>", "explicit provider capability variant (for example OpenCode v2-agents)").option("--model <model>", "active model used for model activation").option("--path <path>", "active path recorded in the graph context").option("--manual <config-id-or-slug>", "manually activate a binding; repeatable", collectOption, []).option("--asset-surface <surface>", "explicit provider asset surface (for example cline cli or ide)").option("--asset-scope <scope>", "asset scope (global|project|session)").option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render").option("--check-global-coverage", "verify every registered, non-retired global-* source is in this render (expected read fresh from the registry, independent of this plan); on shortfall warn, exit non-zero, and for apply refuse to write (todos 102d6d0a, O15-00694)").option("--no-station-profile", "do not inject the cached station-profile source").option("--dry-run", "preview writes and conflicts without writing").option("--force", "overwrite existing unmanaged files").option("--adopt-file <relativepath=sha256>", "adopt one reviewed unmanaged generated target only at its exact observed SHA256; repeatable", collectOption, []).option("--reconcile-file <relativepath=sha256>", "reconcile one reviewed managed drifted target at its exact observed SHA256; requires --expected-manifest-sha256", collectOption, []).option("--expected-manifest-sha256 <sha256>", "require the previously reviewed manifest preimage to match exactly before applying").option("--json", "output apply JSON").action(async (opts) => {
+sessionCmd.command("apply").description("Write a session render plan to its managed target home or explicit project root").requiredOption("--tool <tool>", `target tool (${SESSION_RENDER_TOOLS.join("|")})`).requiredOption("--profile <profile>", "account/profile name that owns the rendered instruction home").option("--target-home <path>", "native instruction home; Sumi: resolved config from `sumi debug paths config`; Grok: GROK_HOME; Devin: user config directory (global AGENTS.md unless --project-root is set)").option("--project-root <path>", "repository root for project-scoped adapters such as Cursor").option("--session-id <id>", "session id to include in the manifest").option("--source <layer:id=path>", `instruction source file; layers: ${SESSION_SOURCE_LAYER_HELP}`, collectOption, []).option("--config <layer:id-or-slug>", "stored config source by id/slug; repeatable; layer aliases match --source", collectOption, []).option("--identity-export <path>", "OpenIdentities configs instruction export JSON; repeatable", collectOption, []).option("--replace-source <replacer-id>[=<target-source-id>]", "source id that broadly replaces earlier layers, or targets one earlier source", collectOption, []).option("--compile-profile <id-or-slug>", "compile persisted config bindings from this Instructions profile").option("--provider-version <semver>", "installed provider version used for capability matching").option("--provider-variant <variant>", "explicit provider capability variant (for example OpenCode v2-agents)").option("--model <model>", "active model used for model activation").option("--path <path>", "active path recorded in the graph context").option("--manual <config-id-or-slug>", "manually activate a binding; repeatable", collectOption, []).option("--asset-surface <surface>", "explicit provider asset surface (for example cline cli or ide)").option("--asset-scope <scope>", "asset scope (global|project|session)").option("--codewith-native-imports", "select the gated Codewith native @ import adapter").option("--allow-empty-sources", "allow an explicit empty render").option("--check-global-coverage", "verify every registered, non-retired global-* source is in this render (expected read fresh from the registry, independent of this plan); on shortfall warn, exit non-zero, and for apply refuse to write (todos 102d6d0a, O15-00694)").option("--no-station-profile", "do not inject the cached station-profile source").option("--dry-run", "preview writes and conflicts without writing").option("--force", "overwrite existing unmanaged files").option("--adopt-file <relativepath=sha256>", "adopt one reviewed unmanaged generated target only at its exact observed SHA256; repeatable", collectOption, []).option("--reconcile-file <relativepath=sha256>", "reconcile one reviewed managed drifted target at its exact observed SHA256; requires --expected-manifest-sha256", collectOption, []).option("--retire-file <relativepath=sha256>", "retire one reviewed obsolete managed fragment, rule, or asset at its exact SHA256; requires --expected-manifest-sha256", collectOption, []).option("--expected-manifest-sha256 <sha256>", "require the previously reviewed manifest preimage to match exactly before applying").option("--json", "output apply JSON").action(async (opts) => {
   try {
     const tool = opts.tool;
     if (!SESSION_RENDER_TOOLS.includes(tool)) {
@@ -8626,7 +8579,8 @@ sessionCmd.command("apply").description("Write a session render plan to its mana
     });
     const adoptFiles = parsePreimages(opts.adoptFile, "--adopt-file");
     const reconcileFiles = parsePreimages(opts.reconcileFile, "--reconcile-file");
-    const result = applySessionRender(plan, { dryRun: opts.dryRun, force: opts.force, adoptFiles, reconcileFiles, expectedManifestSha256: opts.expectedManifestSha256, ownedClaudeAuthorities });
+    const retireFiles = parsePreimages(opts.retireFile, "--retire-file");
+    const result = applySessionRender(plan, { dryRun: opts.dryRun, force: opts.force, adoptFiles, reconcileFiles, retireFiles, expectedManifestSha256: opts.expectedManifestSha256, ownedClaudeAuthorities });
     if (opts.json) {
       printJson({
         ...result,
@@ -8726,6 +8680,36 @@ sessionCmd.command("restore <snapshot>").description("Restore a session render s
     process.exit(1);
   }
 });
+program.command("harness").description("Inspect native harness installations and portable path inputs").command("discover").description("Read paths without running harnesses, reading prompt bodies, or changing configuration").option("--owner-home <path>", "explicit owner home; otherwise HOME, USERPROFILE, then OS home").option("--project-root <path>", "separate repository scope; never redirects global configuration").option("--executable <tool=path>", "explicit executable path; repeat per harness", (value, previous) => [...previous, value], []).option("--config-dir <tool=path>", "reviewed native config root; repeat per harness", (value, previous) => [...previous, value], []).option("--json", "output the versioned discovery receipt").action((opts) => {
+  try {
+    const overrides = {};
+    for (const [key, inputs] of [["executable", opts.executable], ["configDir", opts.configDir]]) {
+      for (const input of inputs) {
+        const separator = input.indexOf("=");
+        const tool = input.slice(0, separator);
+        if (separator < 1 || !DISCOVERABLE_HARNESSES.includes(tool))
+          throw new Error("Expected claude|codex|opencode|sumi=path.");
+        const entry = overrides[tool] ??= {};
+        if (entry[key] !== undefined)
+          throw new Error(`Duplicate ${key} for ${tool}.`);
+        entry[key] = input.slice(separator + 1);
+      }
+    }
+    const result = discoverHarnesses({ ownerHome: opts.ownerHome, projectRoot: opts.projectRoot, overrides });
+    if (opts.json) {
+      printJson(result);
+      return;
+    }
+    for (const entry of result.tools) {
+      printLine(`${entry.tool}: ${entry.status}; executable=${entry.executable?.path ?? "none"}; config=${entry.config?.path ?? "unresolved"}; version=not-probed`);
+      for (const diagnostic of entry.diagnostics)
+        printLine(`  ${diagnostic}`);
+    }
+  } catch (error) {
+    console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+    process.exitCode = 1;
+  }
+});
 var stationProfileCmd = program.command("station-profile").description("Generate and inject the compact station profile block into every session render");
 stationProfileCmd.command("refresh").description("Regenerate the cached station profile block (idempotent; writes only when changed)").option("--dry-run", "build and print the block without writing the cache").option("--json", "output JSON").action((opts) => {
   try {
@@ -8955,7 +8939,7 @@ program.command("scan [id]").description("Scan configs for secrets. Defaults to
   } else if (opts.all) {
     configs = await store.listConfigs(opts.category ? { kind: "file", category: opts.category } : { kind: "file" });
   } else {
-    const { KNOWN_CONFIGS: KNOWN_CONFIGS2 } = await import("../chunks/sync-azd9t4p8.js");
+    const { KNOWN_CONFIGS: KNOWN_CONFIGS2 } = await import("../chunks/sync-6r1v8hd3.js");
     const slugs = [
       ...KNOWN_CONFIGS2.filter((k) => !k.rulesDir).map((k) => k.name)
     ];
@@ -9242,14 +9226,14 @@ mcpCmd.command("install").alias("add").description("Install configs MCP server i
       } else if (target === "codex") {
         const { appendFileSync, existsSync: ex, mkdirSync: md } = await import("fs");
         const { dirname: dn, join: j } = await import("path");
-        const configPath = j(homedir4(), ".codex", "config.toml");
+        const configPath = j(homedir5(), ".codex", "config.toml");
         const block = `
 [mcp_servers.configs]
 command = "${mcpBinary}"
 args = []
 `;
         if (ex(configPath)) {
-          const content = readFileSync8(configPath, "utf-8");
+          const content = readFileSync7(configPath, "utf-8");
           if (findTomlTableLines(content.split(`
 `), "mcp_servers.configs")) {
             console.log(chalk.dim("= Already installed in Codex"));
@@ -9262,7 +9246,7 @@ args = []
       } else if (target === "antigravity") {
         const { mkdirSync: md, readFileSync: rf, writeFileSync: wf, existsSync: ex } = await import("fs");
         const { dirname: dn, join: j } = await import("path");
-        const configPath = j(homedir4(), ".gemini", "config", "mcp_config.json");
+        const configPath = j(homedir5(), ".gemini", "config", "mcp_config.json");
         let settings = {};
         if (ex(configPath)) {
           try {
@@ -9306,12 +9290,12 @@ mcpCmd.command("uninstall").alias("remove").description("Remove configs MCP serv
       } else if (target === "codex") {
         const { existsSync: ex, writeFileSync: wf } = await import("fs");
         const { join: j } = await import("path");
-        const configPath = j(homedir4(), ".codex", "config.toml");
+        const configPath = j(homedir5(), ".codex", "config.toml");
         if (!ex(configPath)) {
           console.log(chalk.dim("= Not installed in Codex (no config.toml)"));
           continue;
         }
-        const content = readFileSync8(configPath, "utf-8");
+        const content = readFileSync7(configPath, "utf-8");
         const lines = content.split(`
 `);
         const table = findTomlTableLines(lines, "mcp_servers.configs");
@@ -9330,7 +9314,7 @@ mcpCmd.command("uninstall").alias("remove").description("Remove configs MCP serv
         console.log(chalk.green("\u2713") + " Removed from Codex");
       } else if (target === "antigravity") {
         const { existsSync: ex, readFileSync: rf, writeFileSync: wf } = await import("fs");
-        const configPath = join11(homedir4(), ".gemini", "config", "mcp_config.json");
+        const configPath = join12(homedir5(), ".gemini", "config", "mcp_config.json");
         if (!ex(configPath)) {
           console.log(chalk.dim("= Not installed in Antigravity (no mcp_config.json)"));
           continue;
@@ -9365,15 +9349,15 @@ program.command("migrate-legacy").description("Migrate the historical ~/.hasna/c
   if (!opts.confirmLocal) {
     throw new Error("migrate-legacy requires --confirm-local");
   }
-  const destinationPath = resolve7(opts.destination || process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join11(getRawStoreRoot(), "instructions.db"));
+  const destinationPath = resolve8(opts.destination || process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join12(getRawStoreRoot(), "instructions.db"));
   const database = await import("../chunks/database-wstmr56z.js");
   database.getDatabase(destinationPath);
   database.resetDatabase();
   const { migrateLegacyInstructionsStore } = await import("../chunks/legacy-store-migration-z2m5yzyk.js");
   const result = migrateLegacyInstructionsStore({
-    ...opts.source ? { sourcePath: resolve7(opts.source) } : {},
+    ...opts.source ? { sourcePath: resolve8(opts.source) } : {},
     destinationPath,
-    ...opts.backup ? { backupPath: resolve7(opts.backup) } : {},
+    ...opts.backup ? { backupPath: resolve8(opts.backup) } : {},
     dryRun: !opts.apply,
     ...opts.mergePreserveDestination ? { mergePolicy: "preserve-destination" } : {},
     operatorConfirmed: true
@@ -9452,7 +9436,7 @@ DB stats:`));
     if (count > 0)
       console.log(`  ${key.padEnd(18)} ${count}`);
   }
-  const location = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join11(getRawStoreRoot(), "instructions.db");
+  const location = store.mode === "api" ? store.v1BaseUrl : process.env["HASNA_INSTRUCTIONS_DB_PATH"] || join12(getRawStoreRoot(), "instructions.db");
   console.log(chalk.dim(`
 ${store.mode === "api" ? "API" : "DB"}: ${location}`));
 });
@@ -9470,11 +9454,11 @@ program.command("status").description("Health check: total configs, drift from d
   console.log(chalk.cyan("Missing:") + ` ${status.health.missingTargets === 0 ? chalk.green("0") : chalk.yellow(String(status.health.missingTargets))} (file not on disk)`);
   console.log(chalk.cyan("Secrets:") + ` ${status.health.unredactedSecretFindings === 0 ? chalk.green("0 \u2713") : chalk.red(String(status.health.unredactedSecretFindings) + " \u26A0")} unredacted`);
   console.log(chalk.cyan("Retired agents:") + ` ${status.health.retiredAgentRows === 0 ? chalk.green("0") : chalk.yellow(String(status.health.retiredAgentRows))} row(s)`);
-  console.log(chalk.cyan("Skill runtimes:") + ` ${status.health.missingManagedSkillRuntimes === 0 ? chalk.green(`${status.counts.managedSkillRuntimes.healthy} ready`) : chalk.yellow(`${status.health.missingManagedSkillRuntimes} missing`)} (${status.counts.managedSkillRuntimes.skillsPresent} managed skill(s) present)`);
+  console.log(chalk.cyan("Legacy Inbox migration:") + ` ${status.health.missingManagedSkillRuntimes === 0 ? chalk.green("no legacy paths found") : chalk.yellow("native paths need Skills CLI review")} (Skills availability is not verified here)`);
   console.log(chalk.cyan("Templates:") + ` ${status.counts.configs.templates} (with {{VAR}} placeholders)`);
 });
-var managedSkillsCmd = program.command("managed-skills").description("Inspect or reconcile package-owned runtime contracts for installed managed skills");
-managedSkillsCmd.command("status").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--json", "output the full local runtime status as JSON").action((opts) => {
+var managedSkillsCmd = program.command("managed-skills").description("Report retired native Inbox skill paths; manage skills through the Skills CLI");
+managedSkillsCmd.command("status").option("--from <agent>", "deprecated compatibility option; no heartbeat is sent").option("--delivery-verified", "deprecated compatibility option; Skills delivery is not verified here").option("--json", "output the read-only legacy migration status as JSON").action((opts) => {
   const report = inspectManagedSkillRuntimes({
     agent: opts.from,
     deliveryVerified: opts.deliveryVerified
@@ -9486,7 +9470,7 @@ managedSkillsCmd.command("status").option("--from <agent>", "verify the hosted C
     return;
   }
   if (report.skills_present === 0) {
-    console.log(chalk.dim("No managed skills with package-owned runtime contracts are installed."));
+    console.log(chalk.dim("No legacy native Inbox skill found. Use the Skills CLI to inspect selected skills."));
     return;
   }
   for (const runtime of report.runtimes) {
@@ -9498,7 +9482,7 @@ managedSkillsCmd.command("status").option("--from <agent>", "verify the hosted C
   if (report.missing > 0)
     process.exitCode = 1;
 });
-managedSkillsCmd.command("apply").option("--dry-run", "preview without writing").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--json", "output the reconcile report as JSON").action(async (opts) => {
+managedSkillsCmd.command("apply").description("Deprecated: report migration requirements without repairing native skill payloads").option("--dry-run", "preview without writing").option("--from <agent>", "deprecated compatibility option; no heartbeat is sent").option("--delivery-verified", "deprecated compatibility option; Skills delivery is not verified here").option("--json", "output the read-only retirement report as JSON").action(async (opts) => {
   const report = await reconcileManagedSkillRuntimes({
     dryRun: opts.dryRun,
     agent: opts.from,
@@ -9553,8 +9537,8 @@ storageCmd.command("status").description("Show redacted S3 configuration status
 });
 var storageBackupCmd = storageCmd.command("backup").description("Push, pull, and verify immutable Instructions backup objects");
 storageBackupCmd.command("push <file>").description("Upload an immutable backup archive and integrity manifest").requiredOption("--id <backup-id>", "stable immutable backup identifier").option("--content-type <type>", "payload content type", "application/gzip").option("--dry-run", "plan keys and hashes without contacting S3").option("--json", "output JSON").action(async (file, opts) => {
-  const abs = resolve7(file);
-  if (!existsSync11(abs) || !lstatSync5(abs).isFile())
+  const abs = resolve8(file);
+  if (!existsSync10(abs) || !lstatSync6(abs).isFile())
     throw new Error(`Backup file not found: ${abs}`);
   const [{ loadInstructionsS3Config }, backup, objectStore] = await Promise.all([
     import("../chunks/s3-config-hhght91k.js"),
@@ -9644,19 +9628,19 @@ storageBackupCmd.command("pull <backup-id>").description("Download and verify an
     backupId,
     ...versions
   });
-  const output = resolve7(opts.output);
-  if (existsSync11(output)) {
+  const output = resolve8(opts.output);
+  if (existsSync10(output)) {
     if (!opts.force)
       throw new Error(`Refusing to overwrite existing backup file: ${output}`);
-    if (!lstatSync5(output).isFile() || lstatSync5(output).isSymbolicLink()) {
+    if (!lstatSync6(output).isFile() || lstatSync6(output).isSymbolicLink()) {
       throw new Error(`Refusing to replace a non-regular backup destination: ${output}`);
     }
   }
-  mkdirSync6(dirname7(output), { recursive: true, mode: 448 });
-  const temp = join11(dirname7(output), `.${basename2(output)}.tmp-${process.pid}-${Date.now()}`);
+  mkdirSync5(dirname7(output), { recursive: true, mode: 448 });
+  const temp = join12(dirname7(output), `.${basename2(output)}.tmp-${process.pid}-${Date.now()}`);
   try {
-    writeFileSync5(temp, pulled.bytes, { flag: "wx", mode: 384 });
-    renameSync2(temp, output);
+    writeFileSync4(temp, pulled.bytes, { flag: "wx", mode: 384 });
+    renameSync(temp, output);
   } catch (error) {
     try {
       unlinkSync(temp);
@@ -9678,10 +9662,10 @@ storageBackupCmd.command("pull <backup-id>").description("Download and verify an
 });
 program.command("backup").description("Export configs to a timestamped backup file").action(async () => {
   const { mkdirSync: mk } = await import("fs");
-  const backupDir = join11(getRawStoreRoot(), "backups");
+  const backupDir = join12(getRawStoreRoot(), "backups");
   mk(backupDir, { recursive: true });
   const ts = new Date().toISOString().replace(/[:.]/g, "-").replace("T", "-").slice(0, 19);
-  const outPath = join11(backupDir, `configs-${ts}.tar.gz`);
+  const outPath = join12(backupDir, `configs-${ts}.tar.gz`);
   const result = await exportConfigs(outPath, { store: resolveConfigStore() });
   const { statSync: st } = await import("fs");
   const size = st(outPath).size;
@@ -9707,9 +9691,9 @@ program.command("doctor").description("Validate configs: syntax, permissions, mi
   console.log(chalk.cyan("Known files on disk:"));
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
-      existsSync11(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail2(`${k.rulesDir}/ not found`);
+      existsSync10(expandPath(k.rulesDir)) ? pass(`${k.rulesDir}/ exists`) : k.optional ? skip(`${k.rulesDir}/ (optional)`) : fail2(`${k.rulesDir}/ not found`);
     } else {
-      existsSync11(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail2(`${k.path} not found`);
+      existsSync10(expandPath(k.path)) ? pass(k.path) : k.optional ? skip(`${k.path} (optional)`) : fail2(`${k.path} not found`);
     }
   }
   const allConfigs = await store.listConfigs();
@@ -9855,7 +9839,7 @@ program.command("watch").description("Watch known config files for changes and a
   const store = resolveConfigStore();
   const interval = Number(opts.interval);
   const { statSync: st } = await import("fs");
-  const { expandPath: expandPath2 } = await import("../chunks/apply-wj7wh5km.js");
+  const { expandPath: expandPath2 } = await import("../chunks/apply-fyfzqc7s.js");
   console.log(chalk.bold("@hasna/instructions watch") + chalk.dim(` \u2014 polling every ${interval}ms`));
   console.log(chalk.dim(`Watching known config files for changes\u2026
 `));
@@ -9863,16 +9847,16 @@ program.command("watch").description("Watch known config files for changes and a
   for (const k of KNOWN_CONFIGS) {
     if (k.rulesDir) {
       const absDir = expandPath2(k.rulesDir);
-      if (!existsSync11(absDir))
+      if (!existsSync10(absDir))
         continue;
       const { readdirSync: readdirSync3 } = await import("fs");
       for (const f of readdirSync3(absDir).filter((f2) => f2.endsWith(".md"))) {
-        const abs = join11(absDir, f);
+        const abs = join12(absDir, f);
         mtimes.set(abs, st(abs).mtimeMs);
       }
     } else {
       const abs = expandPath2(k.path);
-      if (existsSync11(abs))
+      if (existsSync10(abs))
         mtimes.set(abs, st(abs).mtimeMs);
     }
   }
@@ -9880,7 +9864,7 @@ program.command("watch").description("Watch known config files for changes and a
   const tick = async () => {
     let changed = 0;
     for (const [abs, oldMtime] of mtimes) {
-      if (!existsSync11(abs))
+      if (!existsSync10(abs))
         continue;
       const newMtime = st(abs).mtimeMs;
       if (newMtime !== oldMtime) {
@@ -9892,10 +9876,10 @@ program.command("watch").description("Watch known config files for changes and a
     for (const k of KNOWN_CONFIGS) {
       if (k.rulesDir) {
         const absDir = expandPath2(k.rulesDir);
-        if (!existsSync11(absDir))
+        if (!existsSync10(absDir))
           continue;
         for (const f of rd(absDir).filter((f2) => f2.endsWith(".md"))) {
-          const abs = join11(absDir, f);
+          const abs = join12(absDir, f);
           if (!mtimes.has(abs)) {
             mtimes.set(abs, st(abs).mtimeMs);
             changed++;
@@ -9903,7 +9887,7 @@ program.command("watch").description("Watch known config files for changes and a
         }
       } else {
         const abs = expandPath2(k.path);
-        if (existsSync11(abs) && !mtimes.has(abs)) {
+        if (existsSync10(abs) && !mtimes.has(abs)) {
           mtimes.set(abs, st(abs).mtimeMs);
           changed++;
         }
@@ -9931,11 +9915,11 @@ program.command("report").description("Summary of stored configs, drift, and eco
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync11(abs)) {
+    if (!existsSync10(abs)) {
       missing++;
       continue;
     }
-    const disk = readFileSync8(abs, "utf-8");
+    const disk = readFileSync7(abs, "utf-8");
     const { content: redactedDisk } = redactContent(disk, redactFormatForTarget(c.target_path, c.format));
     if (redactedDisk !== c.content)
       drifted++;
@@ -10002,7 +9986,7 @@ program.command("clean").description("Remove configs from DB whose target files
     if (!c.target_path)
       continue;
     const abs = expandPath(c.target_path);
-    if (!existsSync11(abs)) {
+    if (!existsSync10(abs)) {
       if (printed < maxPrinted) {
         if (opts.dryRun) {
           console.log(chalk.yellow("  would remove:") + ` ${c.slug} ${chalk.dim(`(${truncateMiddle(c.target_path, 88)})`)}`);
@@ -10026,7 +10010,7 @@ ${removed} orphaned config(s) ${opts.dryRun ? "found" : "removed"}${omitted > 0
       console.log(chalk.dim(`Use --limit ${removed} to print every orphan row.`));
   }
 });
-program.command("bootstrap").description("Install the full @hasna ecosystem: CLI tools + MCP servers + configs").option("--dry-run", "show what would be installed without doing it").option("--from <agent>", "verify the hosted Conversations heartbeat for this agent").option("--delivery-verified", "assert channel and direct-message canaries were observed in this acceptance pass").option("--skip-mcp", "skip MCP server registration").action(async (opts) => {
+program.command("bootstrap").description("Install the full @hasna ecosystem: CLI tools + MCP servers + configs").option("--dry-run", "show what would be installed without doing it").option("--from <agent>", "deprecated compatibility option; no heartbeat is sent").option("--delivery-verified", "deprecated compatibility option; Skills delivery is not verified here").option("--skip-mcp", "skip MCP server registration").action(async (opts) => {
   const store = resolveConfigStore();
   const packages = [
     { name: "@hasna/todos", bin: "todos", mcp: "todos-mcp" },
@@ -10034,7 +10018,6 @@ program.command("bootstrap").description("Install the full @hasna ecosystem: CLI
     { name: "@hasna/conversations", bin: "conversations", mcp: "conversations-mcp" },
     { name: "@hasna/skills", bin: "skills", mcp: "skills-mcp" },
     { name: "@hasna/economy", bin: "economy", mcp: "economy-mcp" },
-    { name: "@hasna/attachments", bin: "attachments", mcp: "attachments-mcp" },
     { name: "@hasna/emails", bin: "emails", mcp: "emails-mcp" },
     { name: "@hasna/recordings", bin: "recordings", mcp: "recordings-mcp" },
     { name: "@hasna/assistants", bin: "assistants", mcp: "assistants-mcp" }
@@ -10086,20 +10069,8 @@ Initializing configs:`));
   } else {
     console.log(chalk.dim("  would run: configs init"));
   }
-  console.log(chalk.cyan(`
-Reconciling managed skill runtimes:`));
-  const runtimeReport = await reconcileManagedSkillRuntimes({
-    dryRun: opts.dryRun,
-    agent: opts.from,
-    deliveryVerified: opts.deliveryVerified
-  });
-  printManagedSkillRuntimeReport(runtimeReport);
-  if (runtimeReport.failed > 0) {
-    console.error(chalk.red(`
-Bootstrap incomplete: a managed skill runtime could not be reconciled.`));
-    process.exitCode = 1;
-    return;
-  }
+  console.log(chalk.dim(`
+Manage skill publication, selection and agent hooks through the Skills CLI.`));
   console.log(chalk.bold(`
 \u2713 Bootstrap complete.`) + chalk.dim(" Restart agent sessions to load updated integrations."));
 });
@@ -10145,7 +10116,7 @@ providerContextCmd.command("resolve").description("Resolve the endpoint to a pro
   try {
     const rawEndpoint = opts.endpoint ?? process.env["ANTHROPIC_BASE_URL"] ?? "";
     const rawModel = opts.model ?? process.env["ANTHROPIC_MODEL"] ?? "";
-    const homeDir2 = opts.home ?? homedir4();
+    const homeDir2 = opts.home ?? homedir5();
     const origin = normalizeEndpointOrigin(rawEndpoint);
     const resolution = resolveAndRenderProviderContext({
       origin,