@hasna/skills 0.1.71 → 0.2.0

package/dist/index.js

@@ -47,13 +47,12 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // src/lib/registry.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync6 } from "fs";
+import { join as join8 } from "path";
 
 // src/lib/config.ts
-import { existsSync, readFileSync, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join, dirname } from "path";
-import { homedir } from "os";
+import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
+import { join as join2, dirname } from "path";
 
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
@@ -101,6 +100,124 @@ function assertNoRetiredConfigKeys(config, source) {
   }
 }
 
+// src/lib/app-home.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
+  config: "HASNA_CONFIG_HOME",
+  data: "HASNA_DATA_HOME",
+  state: "HASNA_STATE_HOME",
+  cache: "HASNA_CACHE_HOME"
+};
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
+  if (typeof app !== "string" || app.length === 0) {
+    throw new TypeError("paths: app must be a non-empty string");
+  }
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
+    throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
+  }
+}
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
+}
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
+    return override;
+  const home = options.home ?? pathsResolverHomedir();
+  const platform = options.platform ?? process.platform;
+  if (platform === "darwin") {
+    switch (kind) {
+      case "config":
+      case "data":
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
+      case "cache":
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
+      case "state":
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
+    }
+  }
+  switch (kind) {
+    case "config":
+      return pathsResolverJoin(home, ".config", "hasna");
+    case "data":
+      return pathsResolverJoin(home, ".local", "share", "hasna");
+    case "state":
+      return pathsResolverJoin(home, ".local", "state", "hasna");
+    case "cache":
+      return pathsResolverJoin(home, ".cache", "hasna");
+  }
+}
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
+}
+function dataDir(options) {
+  return pathsResolverResolve("data", options);
+}
+var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
+var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
+var SKILLS_HOME_ENV = "SKILLS_HOME";
+var DEFAULT_SQLITE_FILENAME = "server.db";
+var GLOBAL_CONFIG_FILENAME = "config.json";
+function effectiveHome() {
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir() || "/tmp";
+}
+function legacyDataRoot() {
+  return join(effectiveHome(), ".hasna", "skills");
+}
+function resolverDataRoot(home = effectiveHome(), env) {
+  return dataDir({ app: "skills", home, env });
+}
+function adoptResolverDataRoot(resolved, env = process.env) {
+  const dataOverride = env.HASNA_DATA_HOME;
+  if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
+    return true;
+  return existsSync(join(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join(resolved, GLOBAL_CONFIG_FILENAME));
+}
+function exactDataRoot() {
+  for (const key of [DATA_DIR_ENV, HASNA_SKILLS_HOME_ENV, SKILLS_HOME_ENV]) {
+    const dir = process.env[key]?.trim();
+    if (dir)
+      return resolve(dir);
+  }
+  return;
+}
+function hasExactOverride(env = process.env) {
+  return Boolean(env[DATA_DIR_ENV]?.trim()) || Boolean(env[HASNA_SKILLS_HOME_ENV]?.trim()) || Boolean(env[SKILLS_HOME_ENV]?.trim());
+}
+function hasOperatorOverride(env = process.env) {
+  return hasExactOverride(env) || Boolean(env.HASNA_DATA_HOME?.trim());
+}
+function getDataRoot() {
+  const exact = exactDataRoot();
+  if (exact)
+    return exact;
+  const resolved = resolverDataRoot();
+  return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
+}
+function skillsDataRootForHome(home) {
+  const isOwnHome = resolve(home) === resolve(effectiveHome()) || resolve(home) === resolve(homedir());
+  if (isOwnHome) {
+    const exact = exactDataRoot();
+    if (exact)
+      return exact;
+    const resolved2 = resolverDataRoot(home);
+    return adoptResolverDataRoot(resolved2) ? resolve(resolved2) : resolve(join(home, ".hasna", "skills"));
+  }
+  const resolved = resolverDataRoot(home, {});
+  return adoptResolverDataRoot(resolved, {}) ? resolve(resolved) : resolve(join(home, ".hasna", "skills"));
+}
+
 // src/lib/config.ts
 var ENUM_KEYS = {
   defaultAgent: ["claude", "codex", "gemini", "pi", "opencode", "all"],
@@ -115,19 +232,19 @@ function allowedValues(key) {
   return ENUM_KEYS[key];
 }
 function mergeDirectoryContents(sourceDir, targetDir) {
-  if (!existsSync(sourceDir))
+  if (!existsSync2(sourceDir))
     return;
   mkdirSync(targetDir, { recursive: true });
   for (const entry of readdirSync(sourceDir)) {
-    const sourcePath = join(sourceDir, entry);
-    const targetPath = join(targetDir, entry);
+    const sourcePath = join2(sourceDir, entry);
+    const targetPath = join2(targetDir, entry);
     try {
       const sourceStat = statSync(sourcePath);
       if (sourceStat.isDirectory()) {
         mergeDirectoryContents(sourcePath, targetPath);
         continue;
       }
-      if (!existsSync(targetPath))
+      if (!existsSync2(targetPath))
         copyFileSync(sourcePath, targetPath);
     } catch {}
   }
@@ -152,44 +269,40 @@ function normalizeConfigValue(key, value) {
     return value.trim() ? value : undefined;
   return;
 }
-var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var INSTALLED_SKILLS_DIRNAME = "installed";
 var SKILLS_CACHE_DIRNAME = "skills";
 var LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
 function isOwnerLayoutMigrated(appDir) {
-  return existsSync(join(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+  return existsSync2(join2(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
 }
 function getDataDir() {
-  const override = process.env[DATA_DIR_ENV];
-  if (override) {
-    try {
-      mkdirSync(override, { recursive: true });
-    } catch {}
-    return override;
-  }
-  const home = process.env["HOME"] || process.env["USERPROFILE"] || homedir();
-  const newDir = join(home, ".hasna", "skills");
-  const oldDir = join(home, ".skills");
-  const oldConfigFile = join(home, ".skillsrc");
-  mkdirSync(newDir, { recursive: true });
+  const root = getDataRoot();
   try {
-    mergeDirectoryContents(oldDir, newDir);
+    mkdirSync(root, { recursive: true });
   } catch {}
-  if (existsSync(oldConfigFile) && !existsSync(join(newDir, "config.json"))) {
+  if (hasOperatorOverride())
+    return root;
+  const home = effectiveHome();
+  const oldDir = join2(home, ".skills");
+  const oldConfigFile = join2(home, ".skillsrc");
+  try {
+    mergeDirectoryContents(oldDir, root);
+  } catch {}
+  if (existsSync2(oldConfigFile) && !existsSync2(join2(root, "config.json"))) {
     try {
-      copyFileSync(oldConfigFile, join(newDir, "config.json"));
+      copyFileSync(oldConfigFile, join2(root, "config.json"));
     } catch {}
   }
-  return newDir;
+  return root;
 }
 function getConfigPath(scope) {
   if (scope === "global") {
-    return join(getDataDir(), "config.json");
+    return join2(getDataDir(), "config.json");
   }
-  return join(process.cwd(), "skills.config.json");
+  return join2(process.cwd(), "skills.config.json");
 }
 function readConfigFile(path) {
-  if (!existsSync(path))
+  if (!existsSync2(path))
     return {};
   let parsed;
   try {
@@ -225,7 +338,7 @@ function saveConfig(key, value, scope = "project") {
   }
   const filePath = getConfigPath(scope);
   let existing = {};
-  if (existsSync(filePath)) {
+  if (existsSync2(filePath)) {
     try {
       existing = JSON.parse(readFileSync(filePath, "utf-8"));
       if (typeof existing !== "object" || existing === null || Array.isArray(existing)) {
@@ -236,7 +349,7 @@ function saveConfig(key, value, scope = "project") {
     }
   } else {
     const dir = dirname(filePath);
-    if (!existsSync(dir)) {
+    if (!existsSync2(dir)) {
       mkdirSync(dir, { recursive: true });
     }
   }
@@ -250,7 +363,7 @@ function unsetConfig(key, scope = "project") {
     throw new Error(`Unknown config key: ${key}. Valid keys: ${validKeys().join(", ")}`);
   }
   const filePath = getConfigPath(scope);
-  if (!existsSync(filePath))
+  if (!existsSync2(filePath))
     return false;
   let existing;
   try {
@@ -272,7 +385,7 @@ function unsetConfig(key, scope = "project") {
 // src/lib/portable-skills.ts
 import {
   cpSync as cpSync2,
-  existsSync as existsSync6,
+  existsSync as existsSync7,
   mkdirSync as mkdirSync3,
   mkdtempSync,
   readdirSync as readdirSync5,
@@ -281,7 +394,7 @@ import {
   statSync as statSync6,
   writeFileSync as writeFileSync3
 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join6, normalize as normalize2 } from "path";
+import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join7, normalize as normalize2 } from "path";
 
 // src/lib/registry-data/development-tools.ts
 var DEVELOPMENT_TOOLS_SKILLS = [
@@ -495,14 +608,6 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     category: "Development Tools",
     tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
     kind: "instruction"
-  },
-  {
-    name: "session-inject-monitor",
-    displayName: "Session Inject Monitor",
-    description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
-    category: "Development Tools",
-    tags: ["monitor", "session", "injection", "automation", "wake"],
-    kind: "instruction"
   }
 ];
 
@@ -1001,8 +1106,8 @@ var SKILLS = [
 ];
 
 // src/lib/hosted-skill-set.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
+import { join as join3 } from "path";
 var HOSTED_RUNTIMES = new Set(["hosted"]);
 var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
 function normalizeMarker(value) {
@@ -1015,8 +1120,8 @@ function isHostedMetadataPackage(pkg) {
   return HOSTED_RUNTIMES.has(normalizeMarker(skills.runtime)) || HOSTED_SOURCES.has(normalizeMarker(skills.source));
 }
 function isHostedMetadataSkillDir(skillDir) {
-  const pkgPath = join2(skillDir, "package.json");
-  if (!existsSync2(pkgPath))
+  const pkgPath = join3(skillDir, "package.json");
+  if (!existsSync3(pkgPath))
     return false;
   try {
     return isHostedMetadataPackage(JSON.parse(readFileSync2(pkgPath, "utf8")));
@@ -1040,8 +1145,8 @@ var BRACE_SOURCE_EXCLUSION = new RegExp(`^!skills/\\{(${SLUG}(?:,${SLUG})+)\\}/s
 var SINGLE_SOURCE_EXCLUSION = new RegExp(`^!skills/(${SLUG})/src$`);
 
 // src/lib/skill-validation.ts
-import { existsSync as existsSync3, lstatSync, readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join3, normalize } from "path";
+import { existsSync as existsSync4, lstatSync, readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
+import { isAbsolute, join as join4, normalize } from "path";
 var VALID_SKILL_KINDS = ["executable", "instruction"];
 var DOC_FILES = ["SKILL.md", "README.md", "CLAUDE.md"];
 var RESERVED_SKILL_ENTRIES = new Set([
@@ -1179,7 +1284,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     binCommands: [],
     docFiles: []
   };
-  if (!existsSync3(skillPath)) {
+  if (!existsSync4(skillPath)) {
     add(issues, "skill.dir_missing", `Skill directory not found: ${skillPath}`);
     return {
       name: bareName,
@@ -1194,7 +1299,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     add(issues, "skill.name_invalid", `Skill name '${bareName}' must use lowercase letters, numbers, dots, underscores, or hyphens`);
   }
   for (const entry of readdirSync3(skillPath).sort()) {
-    const entryPath = join3(skillPath, entry);
+    const entryPath = join4(skillPath, entry);
     if (RESERVED_SKILL_ENTRIES.has(entry)) {
       add(issues, "skill.reserved_file", `Reserved file '${entry}' is not allowed in skill packages`);
     }
@@ -1206,14 +1311,14 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     }
   }
   for (const docFile of DOC_FILES) {
-    if (existsSync3(join3(skillPath, docFile)))
+    if (existsSync4(join4(skillPath, docFile)))
       metadata.docFiles.push(docFile);
   }
   if (metadata.docFiles.length === 0) {
     add(issues, "skill.docs_missing", "Missing documentation file: expected SKILL.md, README.md, or CLAUDE.md");
   }
-  const skillMdPath = join3(skillPath, "SKILL.md");
-  if (existsSync3(skillMdPath)) {
+  const skillMdPath = join4(skillPath, "SKILL.md");
+  if (existsSync4(skillMdPath)) {
     const frontmatter = parseSkillFrontmatter(readFileSync3(skillMdPath, "utf-8"));
     if (!frontmatter) {
       add(warnings, "skill.frontmatter_missing", "SKILL.md has no YAML frontmatter");
@@ -1256,8 +1361,8 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   }
   metadata.kind = resolvedKind;
   const isInstruction = resolvedKind === "instruction";
-  const pkgPath = join3(skillPath, "package.json");
-  if (!existsSync3(pkgPath)) {
+  const pkgPath = join4(skillPath, "package.json");
+  if (!existsSync4(pkgPath)) {
     if (!isInstruction)
       add(issues, "package.missing", "Missing package.json");
   } else {
@@ -1315,8 +1420,8 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
               add(issues, "package.bin_target_unsafe", `package.json bin '${command}' target '${target}' must stay inside the skill directory`);
               continue;
             }
-            const targetPath = join3(skillPath, target);
-            if (!existsSync3(targetPath)) {
+            const targetPath = join4(skillPath, target);
+            if (!existsSync4(targetPath)) {
               add(warnings, "package.bin_target_missing", `package.json bin '${command}' target '${target}' is not present before build`);
             } else if (statSync3(targetPath).isDirectory()) {
               add(issues, "package.bin_target_directory", `package.json bin '${command}' target '${target}' must point to a file, not a directory`);
@@ -1333,17 +1438,17 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     metadata.runtime = "none";
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
-    const srcDir = join3(skillPath, "src");
+    const srcDir = join4(skillPath, "src");
     if (hostedMetadata) {
-      if (existsSync3(srcDir)) {
+      if (existsSync4(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
-    } else if (!existsSync3(srcDir)) {
+    } else if (!existsSync4(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
-    } else if (!existsSync3(join3(srcDir, "index.ts")) && !existsSync3(join3(srcDir, "index.js"))) {
+    } else if (!existsSync4(join4(srcDir, "index.ts")) && !existsSync4(join4(srcDir, "index.js"))) {
       add(issues, "skill.src_index_missing", "Missing src/index.ts or src/index.js");
     } else {
-      const indexPath = existsSync3(join3(srcDir, "index.ts")) ? join3(srcDir, "index.ts") : join3(srcDir, "index.js");
+      const indexPath = existsSync4(join4(srcDir, "index.ts")) ? join4(srcDir, "index.ts") : join4(srcDir, "index.js");
       const size = statSync3(indexPath).size;
       if (size < 50)
         add(warnings, "skill.src_index_minimal", `Source entry point is very small (${size}B)`);
@@ -1367,8 +1472,8 @@ function validateRegistryConsistency(registry, skillsDir) {
     seen.add(name);
     return false;
   })));
-  const skillDirs = existsSync3(skillsDir) ? readdirSync3(skillsDir).filter((entry) => {
-    const fullPath = join3(skillsDir, entry);
+  const skillDirs = existsSync4(skillsDir) ? readdirSync3(skillsDir).filter((entry) => {
+    const fullPath = join4(skillsDir, entry);
     return !entry.startsWith(".") && entry !== "_common" && statSync3(fullPath).isDirectory();
   }) : [];
   const directoryNames = new Set(skillDirs);
@@ -1385,8 +1490,8 @@ function validateRegistryConsistency(registry, skillsDir) {
 
 // src/lib/skill-hash.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync4, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
-import { join as join4, sep } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { join as join5, sep } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
 var HASH_COVERAGE = [
@@ -1445,8 +1550,8 @@ function collectBundleFiles(skillPath) {
     if (seen.has(entry))
       continue;
     seen.add(entry);
-    const absolute = join4(skillPath, entry);
-    if (!existsSync4(absolute))
+    const absolute = join5(skillPath, entry);
+    if (!existsSync5(absolute))
       continue;
     if (statSync4(absolute).isDirectory())
       collectDirectory(files, absolute, entry);
@@ -1459,7 +1564,7 @@ function collectDirectory(files, dir, rel) {
   for (const entry of readdirSync4(dir).sort()) {
     if (entry.startsWith("."))
       continue;
-    const absolute = join4(dir, entry);
+    const absolute = join5(dir, entry);
     const childRel = `${rel}/${entry}`;
     let stats;
     try {
@@ -1679,14 +1784,14 @@ function validateRuntimeContract(manifest, issues, strict) {
 // src/lib/portable-skills-files.ts
 import {
   cpSync,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync5,
   realpathSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { basename, dirname as dirname2, join as join5, relative } from "path";
+import { basename, dirname as dirname2, join as join6, relative } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -1729,12 +1834,12 @@ function normalizePortableSkillName(name) {
   return normalized;
 }
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
-  const skillJsonPath = join5(skillPath, "skill.json");
-  const skillMdPath = join5(skillPath, "SKILL.md");
-  const pkgPath = join5(skillPath, "package.json");
-  const jsonManifest = existsSync5(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
-  const frontmatter = existsSync5(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
-  const pkg = existsSync5(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  const skillJsonPath = join6(skillPath, "skill.json");
+  const skillMdPath = join6(skillPath, "SKILL.md");
+  const pkgPath = join6(skillPath, "package.json");
+  const jsonManifest = existsSync6(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync6(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizePortableSkillName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version = stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version) ?? PORTABLE_SKILL_DEFAULT_VERSION;
@@ -1780,7 +1885,7 @@ function createInstructionManifest(name, options) {
 }
 function writeInstructionSkillTemplate(skillPath, manifest) {
   mkdirSync2(skillPath, { recursive: true });
-  writeFileSync2(join5(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
+  writeFileSync2(join6(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function renderInstructionSkillMd(manifest) {
@@ -1829,12 +1934,12 @@ function createPortableManifest(name, options) {
   };
 }
 function writePortableSkillTemplate(skillPath, manifest) {
-  mkdirSync2(join5(skillPath, "src"), { recursive: true });
-  writeFileSync2(join5(skillPath, "SKILL.md"), renderSkillMd(manifest));
-  writeFileSync2(join5(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
-  writeFileSync2(join5(skillPath, "package.json"), renderPackageJson(manifest));
-  writeFileSync2(join5(skillPath, "tsconfig.json"), renderTsconfig());
-  writeFileSync2(join5(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
+  mkdirSync2(join6(skillPath, "src"), { recursive: true });
+  writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(manifest));
+  writeFileSync2(join6(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
+  writeFileSync2(join6(skillPath, "package.json"), renderPackageJson(manifest));
+  writeFileSync2(join6(skillPath, "tsconfig.json"), renderTsconfig());
+  writeFileSync2(join6(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function fillContractDefaults(manifest, entrypoint) {
@@ -1859,7 +1964,7 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: undefined
     }
   };
-  writeFileSync2(join5(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
+  writeFileSync2(join6(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
 `);
   const hash = computeContentHash(skillPath);
   const withHash = {
@@ -1869,13 +1974,13 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: hash
     }
   };
-  writeFileSync2(join5(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
+  writeFileSync2(join6(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
 `);
   return withHash;
 }
 function readExistingSkillJson(skillPath) {
-  const path = join5(skillPath, "skill.json");
-  if (!existsSync5(path))
+  const path = join6(skillPath, "skill.json");
+  if (!existsSync6(path))
     return {};
   try {
     const parsed = JSON.parse(readFileSync5(path, "utf-8"));
@@ -1908,28 +2013,28 @@ function ensurePortableSkillFiles(skillPath, manifest) {
     tags: next.tags?.length ? next.tags : ["custom", next.name]
   };
   const entry = next.commands[0]?.entry ?? "src/index.ts";
-  if (entry && !existsSync5(join5(skillPath, entry))) {
-    mkdirSync2(dirname2(join5(skillPath, entry)), { recursive: true });
-    writeFileSync2(join5(skillPath, entry), renderEntrypoint(next));
+  if (entry && !existsSync6(join6(skillPath, entry))) {
+    mkdirSync2(dirname2(join6(skillPath, entry)), { recursive: true });
+    writeFileSync2(join6(skillPath, entry), renderEntrypoint(next));
   }
-  if (!existsSync5(join5(skillPath, "SKILL.md")))
-    writeFileSync2(join5(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync6(join6(skillPath, "SKILL.md")))
+    writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(next));
   else
-    writeFileSync2(join5(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync5(join5(skillPath, "SKILL.md"), "utf-8"), next));
-  if (!existsSync5(join5(skillPath, "AGENTS.md")))
-    writeFileSync2(join5(skillPath, "AGENTS.md"), renderAgentsMd(next));
+    writeFileSync2(join6(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync5(join6(skillPath, "SKILL.md"), "utf-8"), next));
+  if (!existsSync6(join6(skillPath, "AGENTS.md")))
+    writeFileSync2(join6(skillPath, "AGENTS.md"), renderAgentsMd(next));
   ensurePackageJson(skillPath, next);
-  if (!existsSync5(join5(skillPath, "tsconfig.json")))
-    writeFileSync2(join5(skillPath, "tsconfig.json"), renderTsconfig());
+  if (!existsSync6(join6(skillPath, "tsconfig.json")))
+    writeFileSync2(join6(skillPath, "tsconfig.json"), renderTsconfig());
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
 function ensurePackageJson(skillPath, manifest) {
-  const pkgPath = join5(skillPath, "package.json");
+  const pkgPath = join6(skillPath, "package.json");
   const first = manifest.commands[0] ?? { name: manifest.name, entry: "src/index.ts" };
   const commandName = normalizePortableSkillName(first.name || manifest.name);
   const entry = (first.entry ?? "src/index.ts").replace(/^\.\//, "");
-  if (!existsSync5(pkgPath)) {
+  if (!existsSync6(pkgPath)) {
     writeFileSync2(pkgPath, renderPackageJson(manifest));
     return;
   }
@@ -1972,8 +2077,8 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
     inputs: [],
     commands: []
   };
-  if (!existsSync5(join5(skillPath, "SKILL.md"))) {
-    writeFileSync2(join5(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync6(join6(skillPath, "SKILL.md"))) {
+    writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(next));
   }
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
@@ -2265,18 +2370,18 @@ var LEGACY_CUSTOM_DIRNAME = "custom";
 function getPortableSkillsRoot(options = {}) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join6(options.homeDir, ".hasna", "skills") : getDataDir();
-  const cache = join6(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join7(options.homeDir, ".hasna", "skills") : getDataDir();
+  const cache = join7(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache))
     return cache;
-  const installed = join6(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join7(appDir, INSTALLED_SKILLS_DIRNAME);
   migrateLegacySkillLayout(appDir, installed);
   return installed;
 }
 function looksLikeSkillDirectory(path) {
   if (!safeIsDirectory(path))
     return false;
-  return existsSync6(join6(path, "SKILL.md")) || existsSync6(join6(path, "skill.json")) || existsSync6(join6(path, "package.json"));
+  return existsSync7(join7(path, "SKILL.md")) || existsSync7(join7(path, "skill.json")) || existsSync7(join7(path, "package.json"));
 }
 function migrateLegacySkillLayout(appDir, installed) {
   if (!safeIsDirectory(appDir))
@@ -2286,7 +2391,7 @@ function migrateLegacySkillLayout(appDir, installed) {
     for (const entry of readdirSync5(appDir)) {
       if (entry.startsWith(".") || entry === INSTALLED_SKILLS_DIRNAME)
         continue;
-      const path = join6(appDir, entry);
+      const path = join7(appDir, entry);
       if (entry === LEGACY_CUSTOM_DIRNAME) {
         if (!safeIsDirectory(path))
           continue;
@@ -2294,7 +2399,7 @@ function migrateLegacySkillLayout(appDir, installed) {
           for (const nested of readdirSync5(path)) {
             if (nested.startsWith("."))
               continue;
-            const nestedPath = join6(path, nested);
+            const nestedPath = join7(path, nested);
             if (looksLikeSkillDirectory(nestedPath))
               candidates.push({ from: nestedPath, name: nested });
           }
@@ -2308,10 +2413,10 @@ function migrateLegacySkillLayout(appDir, installed) {
     return;
   }
   for (const { from, name } of candidates) {
-    const target = join6(installed, name);
-    if (existsSync6(target))
+    const target = join7(installed, name);
+    if (existsSync7(target))
       continue;
-    const staging = join6(installed, `.migrating-${name}-${process.pid}`);
+    const staging = join7(installed, `.migrating-${name}-${process.pid}`);
     try {
       rmSync(staging, { recursive: true, force: true });
       cpSync2(from, staging, { recursive: true, errorOnExist: false });
@@ -2324,7 +2429,7 @@ function migrateLegacySkillLayout(appDir, installed) {
   }
 }
 function getPortableSkillPath(name, options = {}) {
-  return join6(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join7(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -2334,7 +2439,7 @@ function findPortableSkill(name, options = {}) {
     return null;
   }
   const path = getPortableSkillPath(normalized, options);
-  if (!existsSync6(path) || !statSync6(path).isDirectory())
+  if (!existsSync7(path) || !statSync6(path).isDirectory())
     return null;
   try {
     return summarizePortableSkill(path, normalized);
@@ -2350,7 +2455,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync5(root).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join6(root, entry);
+    const path = join7(root, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -2384,8 +2489,8 @@ function isOfficialSkillName(name) {
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizePortableSkillName(name);
   const root = getPortableSkillsRoot(options);
-  const skillPath = join6(root, skillName);
-  if (existsSync6(skillPath)) {
+  const skillPath = join7(root, skillName);
+  if (existsSync7(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
     rmSync(skillPath, { recursive: true, force: true });
@@ -2403,7 +2508,7 @@ function scaffoldPortableSkill(name, options = {}) {
 }
 function portPortableSkillDirectory(sourceDir, options = {}) {
   const absoluteSource = normalize2(sourceDir);
-  if (!existsSync6(absoluteSource) || !statSync6(absoluteSource).isDirectory()) {
+  if (!existsSync7(absoluteSource) || !statSync6(absoluteSource).isDirectory()) {
     throw new Error(`Import directory not found: ${sourceDir}`);
   }
   const continueOnError = options.continueOnError ?? true;
@@ -2416,7 +2521,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   const skipped = [];
   const entries = readdirSync5(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
-    const childPath = join6(absoluteSource, entryName);
+    const childPath = join7(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
       continue;
     if (!isSkillCandidate(childPath)) {
@@ -2445,11 +2550,11 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
 }
 function isSkillCandidate(dir) {
-  return existsSync6(join6(dir, "SKILL.md")) || existsSync6(join6(dir, "skill.json")) || existsSync6(join6(dir, "package.json"));
+  return existsSync7(join7(dir, "SKILL.md")) || existsSync7(join7(dir, "skill.json")) || existsSync7(join7(dir, "package.json"));
 }
 function portPortableSkill(sourcePath, options = {}) {
   const absoluteSource = normalize2(sourcePath);
-  if (!existsSync6(absoluteSource) || !statSync6(absoluteSource).isDirectory()) {
+  if (!existsSync7(absoluteSource) || !statSync6(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
   const inferred = readPortableSkillManifest(absoluteSource, basename2(absoluteSource));
@@ -2461,8 +2566,8 @@ function portPortableSkill(sourcePath, options = {}) {
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
   const root = getPortableSkillsRoot(options);
-  const destination = join6(root, skillName);
-  if (existsSync6(destination)) {
+  const destination = join7(root, skillName);
+  if (existsSync7(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync(destination, { recursive: true, force: true });
@@ -2504,10 +2609,10 @@ function buildCorpusManifest(input, name) {
 function writeCorpusSkill(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const root = getPortableSkillsRoot(options);
-  const skillPath = join6(root, name);
-  const created = !existsSync6(skillPath);
+  const skillPath = join7(root, name);
+  const created = !existsSync7(skillPath);
   mkdirSync3(skillPath, { recursive: true });
-  writeFileSync3(join6(skillPath, "SKILL.md"), input.skillMd);
+  writeFileSync3(join7(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
   return { name, path: skillPath, manifest, created };
@@ -2515,19 +2620,19 @@ function writeCorpusSkill(input, options = {}) {
 function installCorpusSkillAtomically(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const root = getPortableSkillsRoot(options);
-  const target = join6(root, name);
-  const created = !existsSync6(target);
+  const target = join7(root, name);
+  const created = !existsSync7(target);
   mkdirSync3(root, { recursive: true });
-  const staging = mkdtempSync(join6(root, `.pull-${name}-`));
+  const staging = mkdtempSync(join7(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
-    writeFileSync3(join6(staging, "SKILL.md"), input.skillMd);
+    writeFileSync3(join7(staging, "SKILL.md"), input.skillMd);
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
-    if (existsSync6(target)) {
-      backup = mkdtempSync(join6(root, `.pull-backup-${name}-`));
-      renameSync(target, join6(backup, name));
+    if (existsSync7(target)) {
+      backup = mkdtempSync(join7(root, `.pull-backup-${name}-`));
+      renameSync(target, join7(backup, name));
       moved = true;
     }
     renameSync(staging, target);
@@ -2536,9 +2641,9 @@ function installCorpusSkillAtomically(input, options = {}) {
     return { name, path: target, manifest, created };
   } catch (error) {
     rmSync(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync6(join6(backup, name))) {
+    if (moved && backup && existsSync7(join7(backup, name))) {
       try {
-        renameSync(join6(backup, name), target);
+        renameSync(join7(backup, name), target);
       } catch {}
     }
     throw error;
@@ -2550,10 +2655,10 @@ function validatePortableSkillDirectory(name, skillPath) {
   const issues = [...base.issues];
   const warnings = [...base.warnings];
   let manifest;
-  if (existsSync6(skillPath)) {
-    const skillJsonPath = join6(skillPath, "skill.json");
-    const skillMdPath = join6(skillPath, "SKILL.md");
-    if (!existsSync6(skillJsonPath) && !existsSync6(skillMdPath)) {
+  if (existsSync7(skillPath)) {
+    const skillJsonPath = join7(skillPath, "skill.json");
+    const skillMdPath = join7(skillPath, "SKILL.md");
+    if (!existsSync7(skillJsonPath) && !existsSync7(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
     try {
@@ -2572,7 +2677,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync6(join6(skillPath, "skill.json")),
+        strict: existsSync7(join7(skillPath, "skill.json")),
         skillPath
       });
       for (const issue of contractIssues)
@@ -2608,8 +2713,8 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command.name}' entry '${command.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join6(skillPath, command.entry);
-            if (!existsSync6(entryPath))
+            const entryPath = join7(skillPath, command.entry);
+            if (!existsSync7(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command.name}' entry '${command.entry}' is missing`);
             else if (statSync6(entryPath).isDirectory())
               add3(issues, "portable.command_entry_directory", `Command '${command.name}' entry '${command.entry}' must be a file`);
@@ -2619,7 +2724,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error) {
       add3(issues, "portable.manifest_invalid", error.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync6(join6(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync7(join7(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -2655,13 +2760,13 @@ async function runPortableSkill(name, args, options = {}) {
   if (!isSafeRelativePath2(command.entry)) {
     return { exitCode: 1, error: `Portable skill '${name}' command entry is unsafe` };
   }
-  const entryPath = join6(skill.path, command.entry);
-  if (!existsSync6(entryPath)) {
+  const entryPath = join7(skill.path, command.entry);
+  if (!existsSync7(entryPath)) {
     return { exitCode: 1, error: `Entry point '${command.entry}' not found in portable skill '${name}'` };
   }
-  const pkgPath = join6(skill.path, "package.json");
-  const nodeModules = join6(skill.path, "node_modules");
-  if (existsSync6(pkgPath) && !existsSync6(nodeModules) && hasPackageDependencies(pkgPath)) {
+  const pkgPath = join7(skill.path, "package.json");
+  const nodeModules = join7(skill.path, "node_modules");
+  if (existsSync7(pkgPath) && !existsSync7(nodeModules) && hasPackageDependencies(pkgPath)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skill.path,
       stdout: "pipe",
@@ -2930,7 +3035,7 @@ function parseSkillMdFrontmatter(content) {
   return Object.keys(result).length > 0 ? result : null;
 }
 function discoverSkillsInDir(dir, source = "custom") {
-  if (!existsSync7(dir))
+  if (!existsSync8(dir))
     return [];
   const result = [];
   try {
@@ -2938,8 +3043,8 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join7(dir, entry.name, "SKILL.md");
-      if (!existsSync7(skillMdPath))
+      const skillMdPath = join8(dir, entry.name, "SKILL.md");
+      if (!existsSync8(skillMdPath))
         continue;
       let content;
       try {
@@ -2958,7 +3063,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join7(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join8(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -2967,16 +3072,16 @@ function discoverSkillsInDir(dir, source = "custom") {
 }
 function findExtensionSkillPath(name) {
   const config = loadConfig();
-  if (!config.extensionsDir || !existsSync7(config.extensionsDir))
+  if (!config.extensionsDir || !existsSync8(config.extensionsDir))
     return null;
   try {
     const entries = readdirSync6(config.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join7(config.extensionsDir, entry.name);
-      const skillMdPath = join7(skillDir, "SKILL.md");
-      if (!existsSync7(skillMdPath))
+      const skillDir = join8(config.extensionsDir, entry.name);
+      const skillMdPath = join8(skillDir, "SKILL.md");
+      if (!existsSync8(skillMdPath))
         continue;
       let content;
       try {
@@ -3008,12 +3113,12 @@ function loadRegistry(cwd) {
   if (registryCache && registryCacheKey === rootKey && now - registryCacheTime < REGISTRY_CACHE_TTL) {
     return registryCache;
   }
-  const dataDir = getDataDir();
+  const dataDir2 = getDataDir();
   const config = loadConfig();
   const official = SKILLS.map((s) => ({ ...s, source: "official" }));
   const extensions = config.extensionsDir ? discoverSkillsInDir(config.extensionsDir, "extension") : [];
   const portableCustom = listPortableSkillMetas();
-  const legacyCustom = discoverSkillsInDir(join7(dataDir, "custom"));
+  const legacyCustom = discoverSkillsInDir(join8(dataDir2, "custom"));
   const globalCustom = mergeCustomSkills([...legacyCustom, ...portableCustom]);
   registryCache = mergeSkillRegistryLists(official, extensions, globalCustom);
   registryCacheTime = now;
@@ -3060,15 +3165,15 @@ function getAllTags() {
   return Array.from(tagSet).sort();
 }
 // src/lib/installer.ts
-import { existsSync as existsSync10, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
-import { dirname as dirname5, join as join10 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
+import { dirname as dirname5, join as join11 } from "path";
 import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/agent-sync.ts
 import {
   cpSync as cpSync3,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync4,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync7,
@@ -3079,7 +3184,7 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, dirname as dirname4, join as join8 } from "path";
+import { basename as basename3, dirname as dirname4, join as join9 } from "path";
 // src/lib/home-migration.ts
 function resolveCorpusRoot(options = {}) {
   return getPortableSkillsRoot(options);
@@ -3104,9 +3209,9 @@ function resolveSyncAgents(arg) {
 function agentGlobalSkillsDir(agent, homeDir = homedir2()) {
   switch (agent) {
     case "opencode":
-      return join8(homeDir, ".config", "opencode", "skills");
+      return join9(homeDir, ".config", "opencode", "skills");
     default:
-      return join8(homeDir, `.${agent}`, "skills");
+      return join9(homeDir, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -3165,8 +3270,8 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate = join8(source, sub);
-    if (existsSync8(candidate) && isDirectory(candidate))
+    const candidate = join9(source, sub);
+    if (existsSync9(candidate) && isDirectory(candidate))
       roots.push(candidate);
   }
   if (roots.length > 0)
@@ -3181,10 +3286,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate = join8(path, entry);
+    const candidate = join9(path, entry);
     if (!isDirectory(candidate))
       return false;
-    return existsSync8(join8(candidate, "SKILL.md")) || existsSync8(join8(candidate, "skill.json")) || existsSync8(join8(candidate, "package.json"));
+    return existsSync9(join9(candidate, "SKILL.md")) || existsSync9(join9(candidate, "skill.json")) || existsSync9(join9(candidate, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -3223,7 +3328,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join8(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
+          path: join9(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -3253,7 +3358,7 @@ function syncSkillsToAgents(options = {}) {
 }
 function writeManagedAgentSkill(params) {
   const homeDir = params.homeDir ?? homedir2();
-  const dir = join8(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
+  const dir = join9(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -3270,11 +3375,11 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join8(dir, "SKILL.md");
-  const markerPath = join8(dir, SYNC_MARKER_FILE);
-  const dirExists = existsSync8(dir);
-  const managed = existsSync8(markerPath);
-  const hasSkillMd = existsSync8(skillMdPath);
+  const skillMdPath = join9(dir, "SKILL.md");
+  const markerPath = join9(dir, SYNC_MARKER_FILE);
+  const dirExists = existsSync9(dir);
+  const managed = existsSync9(markerPath);
+  const hasSkillMd = existsSync9(skillMdPath);
   if (dirExists && !managed && !hasSkillMd) {
     return {
       action: "skip",
@@ -3309,11 +3414,11 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return { action, path: skillMdPath };
   const parentDir = dirname4(dir);
   mkdirSync4(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join8(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
-  const candidateDir = join8(transactionDir, "candidate");
-  const backupDir = join8(transactionDir, "backup");
-  const candidateSkillMdPath = join8(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join8(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join9(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
+  const candidateDir = join9(transactionDir, "candidate");
+  const backupDir = join9(transactionDir, "backup");
+  const candidateSkillMdPath = join9(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join9(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -3340,9 +3445,9 @@ function writeManagedSkillDir(dir, skillMd, options) {
     }
     renameDirectory(candidateDir, dir);
   } catch (error) {
-    if (originalMoved && existsSync8(backupDir)) {
+    if (originalMoved && existsSync9(backupDir)) {
       try {
-        if (existsSync8(dir))
+        if (existsSync9(dir))
           rmSync2(dir, { recursive: true, force: true });
         renameDirectory(backupDir, dir);
         originalMoved = false;
@@ -3362,16 +3467,16 @@ function writeManagedSkillDir(dir, skillMd, options) {
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir = homedir2()) {
-  const dir = join8(agentGlobalSkillsDir(agent, homeDir), skill);
-  if (!existsSync8(join8(dir, SYNC_MARKER_FILE)))
+  const dir = join9(agentGlobalSkillsDir(agent, homeDir), skill);
+  if (!existsSync9(join9(dir, SYNC_MARKER_FILE)))
     return false;
   rmSync2(dir, { recursive: true, force: true });
   return true;
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join8(skillPath, "SKILL.md");
-    if (existsSync8(skillMdPath))
+    const skillMdPath = join9(skillPath, "SKILL.md");
+    if (existsSync9(skillMdPath))
       return readFileSync7(skillMdPath, "utf-8");
   }
   return pointerSkillMd(name, description);
@@ -3402,8 +3507,8 @@ function normalizeSkillName(name) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { join as join10 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -3418,14 +3523,14 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join9(targetDir, SKILLS_PROJECT_DIR);
+  return join10(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join9(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join10(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
-  if (!existsSync9(path))
+  if (!existsSync10(path))
     return null;
   try {
     return normalizeProjectConfig(JSON.parse(readFileSync8(path, "utf-8")));
@@ -3546,12 +3651,12 @@ var __dirname2 = dirname5(fileURLToPath(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join10(dir, "skills");
-    if (existsSync10(candidate) && !dir.includes(".skills"))
+    const candidate = join11(dir, "skills");
+    if (existsSync11(candidate) && !dir.includes(".skills"))
       return candidate;
     dir = dirname5(dir);
   }
-  return join10(__dirname2, "..", "skills");
+  return join11(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -3559,25 +3664,25 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join10(getDataDir(), "custom", skillName);
-  if (existsSync10(legacyCustomPath))
+  const legacyCustomPath = join11(getDataDir(), "custom", skillName);
+  if (existsSync11(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join10(SKILLS_DIR, skillName);
+  return join11(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
 }
 function skillExists(name) {
-  return existsSync10(getSkillPath(name));
+  return existsSync11(getSkillPath(name));
 }
 function installSkill(name, options = {}) {
   const { targetDir = process.cwd(), overwrite = false } = options;
   const canonicalName = getCanonicalSkillName(name);
   const skillName = normalizeSkillName(canonicalName);
-  if (!existsSync10(getSkillPath(name))) {
+  if (!existsSync11(getSkillPath(name))) {
     const knownOfficial = Boolean(getSkill(name));
     return {
       skill: canonicalName,
@@ -3604,7 +3709,7 @@ function installSkill(name, options = {}) {
 }
 function installSkillSource(name, _options = {}) {
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync10(getSkillPath(name))) {
+  if (!existsSync11(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found`, mode: "source" };
   }
   return {
@@ -3625,11 +3730,11 @@ function installSkillManifest(manifest, _options = {}) {
 }
 function createLocalSkillManifest(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync10(sourcePath))
+  if (!existsSync11(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join10(sourcePath, "SKILL.md");
-  if (existsSync10(skillMdPath)) {
+  const skillMdPath = join11(sourcePath, "SKILL.md");
+  if (existsSync11(skillMdPath)) {
     skillMd = readFileSync9(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
     skillMd = generateSkillMd(name) ?? "";
@@ -3702,20 +3807,20 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join10(base, ".pi", "skills") : join10(homedir3(), ".pi", "agent", "skills");
+      return scope === "project" ? join11(base, ".pi", "skills") : join11(homedir3(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join10(base, ".opencode", "skills") : join10(homedir3(), ".config", "opencode", "skills");
+      return scope === "project" ? join11(base, ".opencode", "skills") : join11(homedir3(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join10(base, `.${agent}`, "skills") : join10(homedir3(), `.${agent}`, "skills");
+      return scope === "project" ? join11(base, `.${agent}`, "skills") : join11(homedir3(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join10(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join11(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync10(getSkillPath(name))) {
+  if (!existsSync11(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found` };
   }
   const scope = options.scope ?? "global";
@@ -3739,15 +3844,15 @@ function removeSkillForAgent(name, options) {
   const canonicalName = getCanonicalSkillName(name);
   const scope = options.scope ?? "global";
   const dir = getAgentSkillPath(canonicalName, options.agent, scope, options.projectDir);
-  if (!existsSync10(join10(dir, SYNC_MARKER_FILE)))
+  if (!existsSync11(join11(dir, SYNC_MARKER_FILE)))
     return false;
   rmSync3(dir, { recursive: true, force: true });
   return true;
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join10(sourcePath, "SKILL.md");
-  if (existsSync10(skillMdPath))
+  const skillMdPath = join11(sourcePath, "SKILL.md");
+  if (existsSync11(skillMdPath))
     return readFileSync9(skillMdPath, "utf-8");
   if (generateSkillMd)
     return generateSkillMd(name);
@@ -3766,7 +3871,7 @@ function warnMissingDependencies(name, targetDir) {
 }
 function generateMinimalSkillMd(name) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync10(sourcePath))
+  if (!existsSync11(sourcePath))
     return null;
   const canonicalName = getCanonicalSkillName(name);
   const meta = getSkill(canonicalName);
@@ -3781,7 +3886,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join10(sourcePath, "README.md")) || readFileIfExists(join10(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join11(sourcePath, "README.md")) || readFileIfExists(join11(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -3800,8 +3905,8 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join10(getSkillPath(name), "package.json");
-  if (!existsSync10(pkgPath))
+  const pkgPath = join11(getSkillPath(name), "package.json");
+  if (!existsSync11(pkgPath))
     return "unknown";
   try {
     const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
@@ -3811,27 +3916,27 @@ function readBundledSkillVersion(name) {
   }
 }
 function readFileIfExists(path) {
-  return existsSync10(path) ? readFileSync9(path, "utf-8") : null;
+  return existsSync11(path) ? readFileSync9(path, "utf-8") : null;
 }
 function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
 }
 // src/lib/run-state.ts
 import { createHash as createHash2, randomBytes } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync10, readdirSync as readdirSync8, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
-import { extname, join as join11, relative as relative2 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync10, readdirSync as readdirSync8, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
+import { extname, join as join12, relative as relative2 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join11(root, "runs", day, id);
-  const logsDir = join11(runDir, "logs");
-  const exportDir = join11(root, "exports", skillName, id);
+  const runDir = join12(root, "runs", day, id);
+  const logsDir = join12(runDir, "logs");
+  const exportDir = join12(root, "exports", skillName, id);
   mkdirSync6(logsDir, { recursive: true });
   mkdirSync6(exportDir, { recursive: true });
-  mkdirSync6(join11(root, "tmp"), { recursive: true });
+  mkdirSync6(join12(root, "tmp"), { recursive: true });
   const record = {
     id,
     skill: skillName,
@@ -3882,27 +3987,27 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync6(join11(context.logsDir, "stdout.log"), stdout);
-  writeFileSync6(join11(context.logsDir, "stderr.log"), stderr);
+  writeFileSync6(join12(context.logsDir, "stdout.log"), stdout);
+  writeFileSync6(join12(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join11(context.runDir, "events.ndjson");
-  const previous = existsSync11(path) ? readFileSync10(path, "utf-8") : "";
+  const path = join12(context.runDir, "events.ndjson");
+  const previous = existsSync12(path) ? readFileSync10(path, "utf-8") : "";
   writeFileSync6(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
-  const runsRoot = join11(getProjectStateDir(targetDir), "runs");
-  if (!existsSync11(runsRoot))
+  const runsRoot = join12(getProjectStateDir(targetDir), "runs");
+  if (!existsSync12(runsRoot))
     return [];
   const records = [];
   for (const day of readdirSync8(runsRoot).sort().reverse()) {
-    const dayDir = join11(runsRoot, day);
+    const dayDir = join12(runsRoot, day);
     if (!statSync8(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync8(dayDir).sort().reverse()) {
-      const record = readRunRecord(join11(dayDir, runId));
+      const record = readRunRecord(join12(dayDir, runId));
       if (record)
         records.push(record);
       if (records.length >= limit)
@@ -3912,29 +4017,29 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   return records;
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join11(getProjectStateDir(targetDir), "runs");
-  if (!existsSync11(runsRoot))
+  const runsRoot = join12(getProjectStateDir(targetDir), "runs");
+  if (!existsSync12(runsRoot))
     return null;
   for (const day of readdirSync8(runsRoot)) {
-    const record = readRunRecord(join11(runsRoot, day, runId));
+    const record = readRunRecord(join12(runsRoot, day, runId));
     if (record)
       return record;
   }
   return null;
 }
 function getRunExportDir(runId, skill, targetDir = process.cwd()) {
-  return join11(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
+  return join12(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
 }
 function writeRunRecord(context) {
-  writeFileSync6(join11(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync6(join12(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync6(join11(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync6(join12(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
-  if (!existsSync11(context.exportDir))
+  if (!existsSync12(context.exportDir))
     return [];
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
@@ -3950,8 +4055,8 @@ function collectRunArtifacts(context) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join11(runDir, "run.json");
-  if (!existsSync11(path))
+  const path = join12(runDir, "run.json");
+  if (!existsSync12(path))
     return null;
   try {
     return JSON.parse(readFileSync10(path, "utf-8"));
@@ -3962,7 +4067,7 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync8(dir)) {
-    const full = join11(dir, entry);
+    const full = join12(dir, entry);
     if (statSync8(full).isDirectory())
       files.push(...walkFiles(full));
     else
@@ -4008,13 +4113,13 @@ function mimeForPath(path) {
   }
 }
 // src/lib/skillinfo.ts
-import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
+import { join as join13 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join12(skillPath, "SKILL.md");
-  if (!existsSync12(skillMdPath))
+  const skillMdPath = join13(skillPath, "SKILL.md");
+  if (!existsSync13(skillMdPath))
     return false;
   try {
     return parseSkillFrontmatter(readFileSync11(skillMdPath, "utf-8"))?.kind === "instruction";
@@ -4040,12 +4145,12 @@ var HOSTED_PROVIDER_ENV_PREFIXES = [
 ];
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync13(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join12(skillPath, "SKILL.md")),
-    readme: readIfExists(join12(skillPath, "README.md")),
-    claudeMd: readIfExists(join12(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join13(skillPath, "SKILL.md")),
+    readme: readIfExists(join13(skillPath, "README.md")),
+    claudeMd: readIfExists(join13(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -4056,11 +4161,11 @@ function getSkillBestDoc(name) {
 }
 function getSkillRequirements(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync13(skillPath))
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join12(skillPath, file));
+    const content = readIfExists(join13(skillPath, file));
     if (content)
       texts.push(content);
   }
@@ -4099,8 +4204,8 @@ function getSkillRequirements(name) {
   const skillName = normalizeSkillName(name);
   let cliCommand = `skills run ${skillName}`;
   let dependencies = {};
-  const pkgPath = join12(skillPath, "package.json");
-  if (existsSync12(pkgPath)) {
+  const pkgPath = join13(skillPath, "package.json");
+  if (existsSync13(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
       dependencies = pkg.dependencies || {};
@@ -4120,7 +4225,7 @@ async function runSkill(name, args, options = {}) {
   const meta = getSkill(name);
   const canonicalName = meta?.name ?? name;
   const skillPath = getSkillPath(canonicalName);
-  if (!existsSync12(skillPath)) {
+  if (!existsSync13(skillPath)) {
     return { exitCode: 1, error: `Skill '${name}' not found` };
   }
   if (isInstructionSkillDir(skillPath, meta)) {
@@ -4129,8 +4234,8 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join12(skillPath, "package.json");
-  if (!existsSync12(pkgPath)) {
+  const pkgPath = join13(skillPath, "package.json");
+  if (!existsSync13(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint;
@@ -4149,12 +4254,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join12(skillPath, entryPoint);
-  if (!existsSync12(entryPath)) {
+  const entryPath = join13(skillPath, entryPoint);
+  if (!existsSync13(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
-  const nodeModules = join12(skillPath, "node_modules");
-  if (!existsSync12(nodeModules)) {
+  const nodeModules = join13(skillPath, "node_modules");
+  if (!existsSync13(nodeModules)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skillPath,
       stdout: "pipe",
@@ -4226,7 +4331,7 @@ function generateSkillMd(name) {
   if (!meta)
     return null;
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync13(skillPath))
     return null;
   const frontmatter = [
     "---",
@@ -4235,11 +4340,11 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join12(skillPath, "README.md"));
-  const claudeMd = readIfExists(join12(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join13(skillPath, "README.md"));
+  const claudeMd = readIfExists(join13(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join12(skillPath, "package.json");
-  if (existsSync12(pkgPath)) {
+  const pkgPath = join13(skillPath, "package.json");
+  if (existsSync13(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
       if (pkg.bin) {
@@ -4316,7 +4421,7 @@ function extractEnvVars(text) {
 }
 function readIfExists(path) {
   try {
-    if (existsSync12(path)) {
+    if (existsSync13(path)) {
       return readFileSync11(path, "utf-8");
     }
   } catch {}
@@ -8320,21 +8425,21 @@ function requireApiUrl(action = "This command", config, env) {
 }
 
 // src/lib/auth-store.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync } from "fs";
-import { dirname as dirname6, join as join13 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync } from "fs";
+import { dirname as dirname6, join as join14 } from "path";
 import { homedir as homedir4 } from "os";
 function getAuthFilePath() {
-  return join13(getDataDir(), "auth.json");
+  return join14(getDataDir(), "auth.json");
 }
 function legacyAuthFilePath() {
-  return join13(process.env["HOME"] || process.env["USERPROFILE"] || homedir4(), ".skills", "auth.json");
+  return join14(process.env["HOME"] || process.env["USERPROFILE"] || homedir4(), ".skills", "auth.json");
 }
 var cachedConfig;
 function getAuthConfig() {
   if (cachedConfig !== undefined)
     return cachedConfig;
   try {
-    const file = existsSync13(getAuthFilePath()) ? getAuthFilePath() : legacyAuthFilePath();
+    const file = existsSync14(getAuthFilePath()) ? getAuthFilePath() : legacyAuthFilePath();
     const raw = readFileSync12(file, "utf-8");
     const config = JSON.parse(raw);
     if (!config.apiKey) {
@@ -9292,12 +9397,30 @@ class RemoteSkillsClient {
   async downloadSkillBundle(slug) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug)}/bundle`, { method: "GET" });
   }
-  async getBundle(slug) {
-    const response = await this.request(`/api/v1/skills/${encodeURIComponent(slug)}/bundle`, { method: "GET" });
+  async getBundle(slug, version) {
+    const path = version ? `/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/bundle` : `/api/v1/skills/${encodeURIComponent(slug)}/bundle`;
+    const response = await this.request(path, { method: "GET" });
     if (response.status === 404)
       return null;
     return response;
   }
+  async listSkillVersions(slug) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND"] });
+    if (response.status === 404)
+      return [];
+    if (!response.ok)
+      throw new Error(`versions request failed: ${response.status}`);
+    const body = await response.json();
+    return Array.isArray(body.versions) ? body.versions : [];
+  }
+  async getSkillVersion(slug, version) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
+    if (response.status === 404)
+      return null;
+    if (!response.ok)
+      throw new Error(`version request failed: ${response.status}`);
+    return await response.json();
+  }
   async listPins() {
     const response = await this.requestNewRoute("/api/v1/pins");
     return normalizePinList(await response.json());
@@ -9435,14 +9558,14 @@ function createRemoteSkillsClient() {
   return new RemoteSkillsClient(apiKey);
 }
 // src/lib/scheduler.ts
-import { existsSync as existsSync14, readFileSync as readFileSync13, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync13, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
+import { join as join15 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join14(targetDir, ".skills", "schedules.json");
+  return join15(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync14(path)) {
+  if (existsSync15(path)) {
     try {
       return JSON.parse(readFileSync13(path, "utf-8"));
     } catch {}
@@ -9451,8 +9574,8 @@ function loadSchedules(targetDir = process.cwd()) {
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join14(targetDir, ".skills");
-  if (!existsSync14(dir))
+  const dir = join15(targetDir, ".skills");
+  if (!existsSync15(dir))
     mkdirSync8(dir, { recursive: true });
   writeFileSync8(path, JSON.stringify(data, null, 2));
 }
@@ -9639,8 +9762,8 @@ function recordScheduleRun(id, status, targetDir) {
   saveSchedules(data, targetDir);
 }
 // src/lib/pull.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync14, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname7, join as join15 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname7, join as join17 } from "path";
 
 // src/lib/revision.ts
 import { createHash as createHash3 } from "crypto";
@@ -9667,6 +9790,8 @@ function revisionIdOfRecord(record) {
 
 // src/lib/skill-bundle.ts
 import { createHash as createHash4 } from "crypto";
+import { readFileSync as readFileSync14, readdirSync as readdirSync9, statSync as statSync9 } from "fs";
+import { join as join16, relative as relative3 } from "path";
 var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
@@ -9693,6 +9818,7 @@ var CREDENTIAL_FILENAMES = new Set([
   "id_ecdsa",
   "id_ed25519"
 ]);
+var CREDENTIAL_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".keystore", ".jks"];
 var ENV_TEMPLATE_NAMES = new Set([".env.example", ".env.sample", ".env.template", ".env.dist"]);
 var NON_DOTENV_EXTENSIONS = new Set([
   "ts",
@@ -9789,6 +9915,27 @@ var NON_DOTENV_EXTENSIONS = new Set([
   "tar",
   "wasm"
 ]);
+function isDotenvFile(lower) {
+  if (lower === ".env" || lower.startsWith(".env."))
+    return true;
+  if (lower === "env")
+    return true;
+  if (lower.startsWith("env.")) {
+    const extension = lower.slice(lower.lastIndexOf(".") + 1);
+    return !NON_DOTENV_EXTENSIONS.has(extension);
+  }
+  return false;
+}
+function isCredentialFile(name) {
+  const lower = name.toLowerCase();
+  if (ENV_TEMPLATE_NAMES.has(lower))
+    return false;
+  if (isDotenvFile(lower))
+    return true;
+  if (CREDENTIAL_FILENAMES.has(lower))
+    return true;
+  return CREDENTIAL_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
 function ownBytes(view) {
   const source = view instanceof ArrayBuffer ? new Uint8Array(view) : view;
   const out = new Uint8Array(new ArrayBuffer(source.byteLength));
@@ -9798,9 +9945,117 @@ function ownBytes(view) {
 function sha256Hex(bytes) {
   return createHash4("sha256").update(bytes).digest("hex");
 }
+function collectSkillBundleEntries(dir) {
+  const entries = [];
+  walk(dir, dir, entries);
+  return entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+function walk(root, current, out) {
+  for (const entry of readdirSync9(current, { withFileTypes: true })) {
+    const absolute = join16(current, entry.name);
+    const rel = relative3(root, absolute).split("\\").join("/");
+    const isRootLevel = !rel.includes("/");
+    if (ANY_SEGMENT_EXCLUDES.has(entry.name.toLowerCase()))
+      continue;
+    if (isRootLevel && ROOT_EXCLUDES.has(entry.name.toLowerCase()))
+      continue;
+    if (isRootLevel && TOOL_SIDECAR_FILENAMES.has(entry.name.toLowerCase()))
+      continue;
+    if (entry.name.startsWith("._"))
+      continue;
+    if (entry.isSymbolicLink())
+      continue;
+    if (entry.isDirectory()) {
+      walk(root, absolute, out);
+      continue;
+    }
+    if (!entry.isFile())
+      continue;
+    if (isCredentialFile(entry.name))
+      continue;
+    const stats = statSync9(absolute);
+    out.push({
+      path: rel,
+      bytes: ownBytes(readFileSync14(absolute)),
+      mode: stats.mode & 64 ? 493 : 420
+    });
+  }
+}
+function packSkillBundle(dir, options = {}) {
+  const entries = collectSkillBundleEntries(dir);
+  if (entries.length === 0) {
+    throw new Error(`Nothing to pack: ${dir} contains no files after exclusions (.git, node_modules, dist, .env)`);
+  }
+  const unpackedByteSize = entries.reduce((sum, entry) => sum + entry.bytes.byteLength, 0);
+  const max = options.maxUnpackedBytes ?? 0;
+  if (max > 0 && unpackedByteSize > max) {
+    throw new Error(`Skill sources are ${unpackedByteSize} bytes, over the ${max} byte limit. Remove build output or large fixtures.`);
+  }
+  const tar = writeTar(entries);
+  const bytes = canonicalGzip(tar);
+  return {
+    bytes,
+    sha256: sha256Hex(bytes),
+    fileCount: entries.length,
+    unpackedByteSize,
+    paths: entries.map((entry) => entry.path)
+  };
+}
+function canonicalGzip(tar) {
+  const bytes = ownBytes(Bun.gzipSync(tar, { level: 6 }));
+  if (bytes.byteLength >= 10) {
+    bytes[4] = 0;
+    bytes[5] = 0;
+    bytes[6] = 0;
+    bytes[7] = 0;
+    bytes[9] = 255;
+  }
+  return bytes;
+}
 function unpackSkillBundle(bundle) {
   return readTar(ownBytes(Bun.gunzipSync(ownBytes(bundle))));
 }
+function writeTar(entries) {
+  const blocks = [];
+  for (const entry of entries) {
+    blocks.push(ustarHeader(entry));
+    blocks.push(entry.bytes);
+    const remainder = entry.bytes.byteLength % BLOCK;
+    if (remainder !== 0)
+      blocks.push(new Uint8Array(new ArrayBuffer(BLOCK - remainder)));
+  }
+  blocks.push(new Uint8Array(new ArrayBuffer(BLOCK * 2)));
+  return concat(blocks);
+}
+function ustarHeader(entry) {
+  const header = new Uint8Array(new ArrayBuffer(BLOCK));
+  const encoder = new TextEncoder;
+  const put = (offset, length, value) => {
+    const encoded = encoder.encode(value);
+    if (encoded.byteLength > length) {
+      throw new Error(`Cannot pack '${entry.path}': field does not fit in a ustar header (${encoded.byteLength} > ${length})`);
+    }
+    header.set(encoded, offset);
+  };
+  if (encoder.encode(entry.path).byteLength > 100) {
+    throw new Error(`Cannot pack '${entry.path}': path is longer than the 100 bytes a ustar header holds`);
+  }
+  put(0, 100, entry.path);
+  put(100, 8, `${entry.mode.toString(8).padStart(7, "0")}\x00`);
+  put(108, 8, "0000000\x00");
+  put(116, 8, "0000000\x00");
+  put(124, 12, `${entry.bytes.byteLength.toString(8).padStart(11, "0")}\x00`);
+  put(136, 12, `${0 .toString(8).padStart(11, "0")}\x00`);
+  put(148, 8, "        ");
+  put(156, 1, "0");
+  put(257, 6, "ustar\x00");
+  put(263, 2, "00");
+  let checksum = 0;
+  for (const byte of header)
+    checksum += byte;
+  put(148, 8, `${checksum.toString(8).padStart(6, "0")}\x00 `);
+  return header;
+}
 function readTar(tar) {
   const decoder = new TextDecoder;
   const entries = [];
@@ -9849,6 +10104,23 @@ function trimNul(value) {
   const end = value.indexOf("\x00");
   return end === -1 ? value : value.slice(0, end);
 }
+function concat(chunks) {
+  const total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
+  const merged = new Uint8Array(new ArrayBuffer(total));
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+
+// src/lib/skill-version.ts
+var SKILL_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+function isValidSkillVersion(value) {
+  return typeof value === "string" && SKILL_VERSION_PATTERN.test(value) && !/^\.+$/.test(value) && !value.includes("..");
+}
+var SKILL_VERSION_RULE = "1-128 characters: letters, digits, '.', '_', '+', '-'; must start with a letter or digit; no '..'";
 
 // src/lib/skill-bundles.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -9913,25 +10185,36 @@ async function resolveTargetSlugs(client, options) {
   return explicit;
 }
 async function pullOne(client, rawName, corpusOptions, verify) {
+  const { name: bareName, version: requestedVersion } = splitNameVersion(rawName);
   let slug;
   try {
-    slug = normalizePortableSkillName(rawName);
+    slug = normalizePortableSkillName(bareName);
   } catch (error) {
     return { name: rawName, success: false, error: error.message };
   }
+  if (requestedVersion !== undefined && !isValidSkillVersion(requestedVersion)) {
+    return { name: rawName, success: false, error: `'${requestedVersion}' is not a valid skill version (${SKILL_VERSION_RULE}).` };
+  }
   const meta = await safeMeta(client, slug);
   let bundleResponse;
   try {
-    bundleResponse = await client.getBundle(slug);
+    bundleResponse = await client.getBundle(slug, requestedVersion);
   } catch (error) {
     return { name: slug, success: false, error: `Failed to fetch '${slug}': ${error.message}` };
   }
+  if (requestedVersion && (!bundleResponse || bundleResponse.status === 404)) {
+    return {
+      name: rawName,
+      success: false,
+      error: `Version '${requestedVersion}' of '${slug}' is not published on the configured instance (run 'skills versions ${slug}' to list what exists).`
+    };
+  }
   if (bundleResponse && !bundleResponse.ok) {
     if (bundleResponse.status === 410) {
       return reconcileTombstone(slug, corpusOptions);
     }
     if (bundleResponse.status === 404) {
-      const marker = readPullMarker(join15(getPortableSkillsRoot(corpusOptions), slug));
+      const marker = readPullMarker(join17(getPortableSkillsRoot(corpusOptions), slug));
       if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
         return { name: slug, success: true, purged: true, removed: false };
       }
@@ -9944,7 +10227,15 @@ async function pullOne(client, rawName, corpusOptions, verify) {
   }
   if (bundleResponse) {
     try {
-      return await installVerifiedBundle(slug, bundleResponse, meta, corpusOptions, verify);
+      let expectedSha256;
+      if (requestedVersion && client.getSkillVersion) {
+        const recorded = await client.getSkillVersion(slug, requestedVersion);
+        if (!recorded) {
+          return { name: rawName, success: false, error: `Version '${requestedVersion}' of '${slug}' is not published on the configured instance (run 'skills versions ${slug}' to list what exists).` };
+        }
+        expectedSha256 = typeof recorded.bundleSha256 === "string" ? recorded.bundleSha256 : undefined;
+      }
+      return await installVerifiedBundle(slug, bundleResponse, meta, corpusOptions, verify, requestedVersion ? { version: requestedVersion, expectedSha256 } : undefined);
     } catch (error) {
       if (error instanceof PullSkillError) {
         return { name: slug, success: false, error: error.message };
@@ -9962,7 +10253,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
     return { name: slug, success: false, error: `Skill '${slug}' was not found on the configured Skills instance.` };
   }
   if (!meta?.revisionId) {
-    const marker = readPullMarker(join15(getPortableSkillsRoot(corpusOptions), slug));
+    const marker = readPullMarker(join17(getPortableSkillsRoot(corpusOptions), slug));
     if (marker && typeof marker.revisionId === "string" && marker.revisionId) {
       return { name: slug, success: true, purged: true, removed: false };
     }
@@ -10019,8 +10310,8 @@ function provenRevision(meta, slug, bundle) {
   return declared;
 }
 function reconcileTombstone(slug, corpusOptions) {
-  const target = join15(getPortableSkillsRoot(corpusOptions), slug);
-  if (!existsSync15(join15(target, PULL_MARKER_FILE))) {
+  const target = join17(getPortableSkillsRoot(corpusOptions), slug);
+  if (!existsSync16(join17(target, PULL_MARKER_FILE))) {
     return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
   rmSync4(target, { recursive: true, force: true });
@@ -10028,23 +10319,30 @@ function reconcileTombstone(slug, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync14(join15(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync15(join17(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
 }
-function installVerifiedBundle(slug, response, meta, corpusOptions, verify) {
+function installVerifiedBundle(slug, response, meta, corpusOptions, verify, exact) {
   return response.arrayBuffer().then((buffer) => {
     const verified = verifyBundleResponseBytes(buffer, response, verify);
+    if (exact?.expectedSha256 && exact.expectedSha256 !== verified.contentHash) {
+      throw new PullSkillError(`Digest proof failed for '${slug}@${exact.version}': the registry records bundle ${exact.expectedSha256.slice(0, 12)}\u2026 but the received bytes hash to ${verified.contentHash.slice(0, 12)}\u2026. Nothing was installed.`);
+    }
+    const served = str(response.headers.get("X-Skill-Version"));
+    if (exact && served && served !== exact.version) {
+      throw new PullSkillError(`Version proof failed for '${slug}': asked for '${exact.version}', the instance served '${served}'. Nothing was installed.`);
+    }
     let entries;
     try {
       entries = unpackSkillBundle(verified.bytes);
     } catch (error) {
       throw new PullSkillError(`Bundle for '${slug}' could not be unpacked: ${error.message}`);
     }
-    const version = str(meta?.version) ?? versionFromEntries(entries) ?? "unknown";
+    const version = exact?.version ?? served ?? str(meta?.version) ?? versionFromEntries(entries) ?? "unknown";
     const sourceCommit = sourceCommitFromEntries(entries);
-    const declaredRevision = verified.revisionId ?? meta?.revisionId;
+    const declaredRevision = exact ? undefined : verified.revisionId ?? meta?.revisionId;
     if (declaredRevision && meta?.revisionId && verified.revisionId && declaredRevision !== meta.revisionId) {
       throw new PullSkillError(`Revision proof failed for '${slug}': the bundle header declares '${verified.revisionId.slice(0, 12)}\u2026' but the metadata declares '${meta.revisionId.slice(0, 12)}\u2026'. The instance is inconsistent. Nothing was installed.`);
     }
@@ -10149,14 +10447,14 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root = getPortableSkillsRoot(options);
   mkdirSync9(root, { recursive: true });
-  const target = join15(root, name);
-  const created = !existsSync15(target);
-  const staging = mkdtempSync3(join15(root, `.pull-${name}-`));
+  const target = join17(root, name);
+  const created = !existsSync16(target);
+  const staging = mkdtempSync3(join17(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
-      const destination = join15(staging, entry.path);
+      const destination = join17(staging, entry.path);
       mkdirSync9(dirname7(destination), { recursive: true });
       writeFileSync9(destination, entry.bytes, { mode: entry.mode });
     }
@@ -10168,9 +10466,9 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.signature ? { signature: marker.signature } : {},
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
-    if (existsSync15(target)) {
-      backup = mkdtempSync3(join15(root, `.pull-backup-${name}-`));
-      renameSync3(target, join15(backup, name));
+    if (existsSync16(target)) {
+      backup = mkdtempSync3(join17(root, `.pull-backup-${name}-`));
+      renameSync3(target, join17(backup, name));
       moved = true;
     }
     renameSync3(staging, target);
@@ -10178,9 +10476,9 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       rmSync4(backup, { recursive: true, force: true });
   } catch (error) {
     rmSync4(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync15(join15(backup, name))) {
+    if (moved && backup && existsSync16(join17(backup, name))) {
       try {
-        renameSync3(join15(backup, name), target);
+        renameSync3(join17(backup, name), target);
       } catch {}
     }
     throw error;
@@ -10199,7 +10497,7 @@ function writePullMarker(dir, record) {
     ...record.revisionId ? { revisionId: record.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync9(join15(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync9(join17(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client, slug) {
@@ -10241,6 +10539,15 @@ function dedupe(values) {
 function str(value) {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+function splitNameVersion(raw) {
+  const trimmed = raw.trim();
+  const at = trimmed.indexOf("@");
+  if (at <= 0)
+    return { name: trimmed };
+  const name = trimmed.slice(0, at);
+  const version = trimmed.slice(at + 1);
+  return version ? { name, version } : { name };
+}
 // src/lib/cli-mcp-parity.ts
 var SKILLS_CLI_MCP_PARITY = [
   {
@@ -10346,11 +10653,11 @@ function findSkillsParityForMcpTool(tool) {
 }
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname8, relative as relative3 } from "path";
+import { dirname as dirname8, relative as relative4 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.1.71",
+  version: "0.2.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -10430,7 +10737,7 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   devDependencies: {
-    "@types/bun": "latest",
+    "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
     "bun-types": "1.3.14",
@@ -10481,7 +10788,7 @@ function createRegistrySyncArtifact(options = {}) {
   const registry = [...loadRegistryProfile(profile)].sort((a, b) => a.name.localeCompare(b.name));
   const skills = registry.map((skill) => {
     const skillPath = getSkillPath(skill.name);
-    const directory = relative3(process.cwd(), skillPath) || skillPath;
+    const directory = relative4(process.cwd(), skillPath) || skillPath;
     const validation = includeValidation ? validateSkillDirectory(skill.name, skillPath, skill) : undefined;
     const docs = includeDocs ? buildDocs(skill.name) : undefined;
     return {
@@ -11366,16 +11673,16 @@ function clone2(value) {
   return JSON.parse(JSON.stringify(value));
 }
 // src/lib/feedback.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync11 } from "fs";
-import { dirname as dirname9, join as join16 } from "path";
+import { appendFileSync, existsSync as existsSync17, mkdirSync as mkdirSync11 } from "fs";
+import { dirname as dirname9, join as join18 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join16(getDataDir(), "skills.db");
+  return join18(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname9(dbPath);
-  if (!existsSync16(dir))
+  if (!existsSync17(dir))
     mkdirSync11(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
@@ -11401,6 +11708,15 @@ function saveFeedback(input) {
   if (!message)
     throw new Error("Feedback message is required");
   const category = input.category ?? "general";
+  if (isApiMode()) {
+    const path = join18(getDataDir(), "feedback.jsonl");
+    const dir = dirname9(path);
+    if (!existsSync17(dir))
+      mkdirSync11(dir, { recursive: true });
+    appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
+`);
+    return { saved: true, category, path };
+  }
   const db = getFeedbackDb();
   try {
     db.run("INSERT INTO feedback (message, email, category, agent, version) VALUES (?, ?, ?, ?, ?)", [message, input.email || null, category, input.agent || null, input.version || null]);
@@ -11409,17 +11725,26 @@ function saveFeedback(input) {
   }
   return { saved: true, category, path: getFeedbackDbPath() };
 }
+function isApiMode(env = process.env) {
+  if (env.HASNA_SKILLS_API_URL?.trim())
+    return true;
+  try {
+    return Boolean(resolveApiUrl(undefined, env));
+  } catch {
+    return Boolean(env.SKILLS_API_URL?.trim());
+  }
+}
 // src/lib/native-storage.ts
 import { createHash as createHash5, createHmac as createHmac2 } from "crypto";
 import {
-  existsSync as existsSync17,
+  existsSync as existsSync18,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync15,
-  readdirSync as readdirSync9,
-  statSync as statSync9,
+  readFileSync as readFileSync16,
+  readdirSync as readdirSync10,
+  statSync as statSync10,
   writeFileSync as writeFileSync11
 } from "fs";
-import { dirname as dirname10, join as join17, normalize as normalize3, relative as relative4, sep as sep2 } from "path";
+import { dirname as dirname10, join as join19, normalize as normalize3, relative as relative5, sep as sep2 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -11556,7 +11881,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join17(getDataDir(), "skills.db")
+      feedbackDbPath: join19(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config.databaseUrl),
@@ -11579,10 +11904,10 @@ function getStorageStatus(options = {}) {
 function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const projectStateDir = getProjectStateDir(targetDir);
   const files = [];
-  if (existsSync17(projectStateDir)) {
+  if (existsSync18(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync15(filePath);
-      const relativePath = toPosix(relative4(targetDir, filePath));
+      const bytes = readFileSync16(filePath);
+      const relativePath = toPosix(relative5(targetDir, filePath));
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
@@ -11606,7 +11931,7 @@ function importSkillsLocalSnapshot(snapshot, targetDir = process.cwd(), options
       continue;
     }
     const absolutePath = resolveSnapshotPath(targetDir, file.path);
-    if (existsSync17(absolutePath) && !options.overwrite) {
+    if (existsSync18(absolutePath) && !options.overwrite) {
       skipped += 1;
       continue;
     }
@@ -11912,9 +12237,9 @@ function parsePositiveInteger(value) {
 }
 function walkFiles2(dir) {
   const files = [];
-  for (const entry of readdirSync9(dir)) {
-    const full = join17(dir, entry);
-    const stats = statSync9(full);
+  for (const entry of readdirSync10(dir)) {
+    const full = join19(dir, entry);
+    const stats = statSync10(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
     else
@@ -11930,7 +12255,7 @@ function resolveSnapshotPath(targetDir, snapshotPath) {
   if (!toPosix(normalizedPath).startsWith(".skills/")) {
     throw new Error(`Snapshot path must stay inside .skills: ${snapshotPath}`);
   }
-  return join17(targetDir, normalizedPath);
+  return join19(targetDir, normalizedPath);
 }
 function normalizeS3Prefix(prefix) {
   return (prefix ?? "").trim().replace(/^\/+|\/+$/g, "");
@@ -11995,16 +12320,16 @@ import { createHash as createHash6 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync16,
-  statSync as statSync11,
+  readFileSync as readFileSync17,
+  statSync as statSync12,
   writeFileSync as writeFileSync12
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative5, resolve, sep as sep4 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative6, resolve as resolve2, sep as sep4 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
-import { readdirSync as readdirSync10, statSync as statSync10 } from "fs";
+import { readdirSync as readdirSync11, statSync as statSync11 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join18, sep as sep3 } from "path";
+import { join as join20, sep as sep3 } from "path";
 var SYNC_HOMES = [
   { name: "skills", subClass: "skills", agent: null },
   { name: "custom", subClass: "custom", agent: null },
@@ -12097,27 +12422,27 @@ function isPortableWithinSkill(relativeParts) {
 function homePathFor(definition, homesRoot) {
   const home = homesRoot ?? homedir5();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
-    return join18(home, ".hasna", "skills", definition.name);
+    return join20(skillsDataRootForHome(home), definition.name);
   }
   if (definition.agent === "opencode") {
-    return join18(home, ".config", "opencode", "skills");
+    return join20(home, ".config", "opencode", "skills");
   }
-  return join18(home, `.${definition.agent}`, "skills");
+  return join20(home, `.${definition.agent}`, "skills");
 }
 function destinationFor(definition, stationId, relativePath) {
-  const category = definition.subClass === "agent-homes" ? join18("agent-homes", definition.agent ?? "") : definition.name;
-  return join18("resources", stationId, "skills", category, ...relativePath.split(sep3));
+  const category = definition.subClass === "agent-homes" ? join20("agent-homes", definition.agent ?? "") : definition.name;
+  return join20("resources", stationId, "skills", category, ...relativePath.split(sep3));
 }
 function walkEntries(absoluteRoot) {
   let entries;
   try {
-    entries = readdirSync10(absoluteRoot, { withFileTypes: true });
+    entries = readdirSync11(absoluteRoot, { withFileTypes: true });
   } catch {
     return [];
   }
   const output = [];
   for (const entry of entries) {
-    const childFull = join18(absoluteRoot, entry.name);
+    const childFull = join20(absoluteRoot, entry.name);
     if (entry.isSymbolicLink()) {
       output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
       continue;
@@ -12128,7 +12453,7 @@ function walkEntries(absoluteRoot) {
       }
       const nested = walkEntries(childFull);
       for (const item of nested) {
-        output.push({ ...item, relativePath: join18(entry.name, item.relativePath) });
+        output.push({ ...item, relativePath: join20(entry.name, item.relativePath) });
       }
       continue;
     }
@@ -12140,7 +12465,7 @@ function walkEntries(absoluteRoot) {
 }
 function isRegularFile(filePath) {
   try {
-    return statSync10(filePath).isFile();
+    return statSync11(filePath).isFile();
   } catch {
     return false;
   }
@@ -12166,7 +12491,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash6("sha256").update(readFileSync16(filePath)).digest("hex");
+  return createHash6("sha256").update(readFileSync17(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -12196,7 +12521,7 @@ function scanHome(definition, homesRoot) {
       skipped.push({ relativePath: entry.relativePath, reason: "not-regular-file" });
       continue;
     }
-    const info = statSync11(entry.fullPath);
+    const info = statSync12(entry.fullPath);
     portable.push({
       relativePath: entry.relativePath,
       fullPath: entry.fullPath,
@@ -12237,7 +12562,7 @@ function humanHomes(scanned) {
   }));
 }
 function writeStationSnapshot(options) {
-  const repoRoot = resolve(options.repoRoot ?? process.cwd());
+  const repoRoot = resolve2(options.repoRoot ?? process.cwd());
   const { scanned, plans, totalBytes } = planStationSnapshot(options);
   const manifestFiles = plans.map((plan) => ({
     relativePath: plan.source.relativePath,
@@ -12263,8 +12588,8 @@ function writeStationSnapshot(options) {
   const conflicts = [];
   const untouched = [];
   for (const plan of plans) {
-    const destination = resolve(repoRoot, plan.destination);
-    const destinationRelative = relative5(repoRoot, destination);
+    const destination = resolve2(repoRoot, plan.destination);
+    const destinationRelative = relative6(repoRoot, destination);
     if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute3(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
@@ -12286,7 +12611,7 @@ function writeStationSnapshot(options) {
   }
   let written = 0;
   for (const plan of untouched) {
-    const destination = resolve(repoRoot, plan.destination);
+    const destination = resolve2(repoRoot, plan.destination);
     mkdirSync13(dirname11(destination), { recursive: true });
     copyFileSync2(plan.source.fullPath, destination);
     written += 1;
@@ -12305,7 +12630,7 @@ function writeStationSnapshot(options) {
     },
     files: manifestFiles
   };
-  const manifestPath = resolve(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  const manifestPath = resolve2(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
   mkdirSync13(dirname11(manifestPath), { recursive: true });
   writeFileSync12(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
@@ -12321,12 +12646,12 @@ import { createHash as createHash7 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync14,
-  readdirSync as readdirSync11,
-  readFileSync as readFileSync17,
-  statSync as statSync12,
+  readdirSync as readdirSync12,
+  readFileSync as readFileSync18,
+  statSync as statSync13,
   writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname12, join as join19, resolve as resolve2, sep as sep5 } from "path";
+import { dirname as dirname12, join as join21, resolve as resolve3, sep as sep5 } from "path";
 var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1";
 var STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
 var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
@@ -12334,14 +12659,14 @@ function fail(code, message, detail = []) {
   throw new StationSnapshotError(code, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join19(repoRoot, "resources", stationId, "skills");
+  return join21(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join19(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join21(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync17(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync18(manifestPath, "utf8"));
   } catch (error) {
     fail("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error.message}`);
   }
@@ -12362,12 +12687,13 @@ function planStationHydration(stationId, repoRoot) {
   }
   const candidates = [];
   const symlinks = [];
+  const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join19(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join21(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
-      identEntries = readdirSync11(agentRoot, { withFileTypes: true });
+      identEntries = readdirSync12(agentRoot, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -12375,7 +12701,7 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join19(agentRoot, identEntry.name);
+      const identRoot = join21(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
         const relativeParts = [identEntry.name, ...entry.relativePath.split(sep5)];
@@ -12422,7 +12748,19 @@ function planStationHydration(stationId, repoRoot) {
           });
           continue;
         }
-        const info = statSync12(entry.fullPath);
+        const info = statSync13(entry.fullPath);
+        const manifestHash = manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null;
+        let verified = false;
+        if (manifestHash !== null) {
+          verified = sha256File(entry.fullPath) === manifestHash;
+          if (!verified) {
+            hashMismatches.push({
+              ident: identEntry.name,
+              agent,
+              relativePath: entry.relativePath
+            });
+          }
+        }
         candidates.push({
           ident: identEntry.name,
           agent,
@@ -12430,7 +12768,8 @@ function planStationHydration(stationId, repoRoot) {
           fullPath: entry.fullPath,
           size: info.size,
           mtimeMs: info.mtimeMs,
-          manifestHash: manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null
+          manifestHash,
+          verified
         });
       }
     }
@@ -12438,6 +12777,9 @@ function planStationHydration(stationId, repoRoot) {
   if (symlinks.length > 0) {
     fail("SYMLINKS_REFUSED", `${symlinks.length} symlink(s) inside the snapshot; symlinks are refused (fail closed)`);
   }
+  if (hashMismatches.length > 0) {
+    fail("MANIFEST_HASH_MISMATCH", `${hashMismatches.length} snapshot file(s) no longer match their sync-manifest sha256; ` + "stale or tampered content is refused (fail closed), nothing written \u2014 re-run sync to refresh the manifest", hashMismatches.map((mismatch) => `agent-homes/${mismatch.agent}/${mismatch.ident}/${mismatch.relativePath}`));
+  }
   const byIdent = new Map;
   for (const candidate of candidates) {
     const group = byIdent.get(candidate.ident) ?? [];
@@ -12460,7 +12802,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync17(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync18(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }
@@ -12472,8 +12814,8 @@ function planStationHydration(stationId, repoRoot) {
         }
       }
       eligible.sort((left, right) => {
-        const leftHash = left.manifestHash !== null;
-        const rightHash = right.manifestHash !== null;
+        const leftHash = left.verified;
+        const rightHash = right.verified;
         if (leftHash !== rightHash) {
           return leftHash ? -1 : 1;
         }
@@ -12510,8 +12852,8 @@ function skillSha256(skill) {
 `)).digest("hex");
 }
 function writeStationHydration(options) {
-  const repoRoot = resolve2(options.repoRoot ?? process.cwd());
-  const cacheRoot = resolve2(options.cacheRoot ?? resolveCorpusRoot());
+  const repoRoot = resolve3(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve3(options.cacheRoot ?? resolveCorpusRoot());
   const plan = planStationHydration(options.stationId, repoRoot);
   const resultSkills = plan.winners.map((skill) => ({
     ident: skill.ident,
@@ -12544,7 +12886,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file of skill.files) {
-      const destination = join19(cacheRoot, skill.ident, file.withinIdent);
+      const destination = join21(cacheRoot, skill.ident, file.withinIdent);
       const digest = sha256File(file.winner.fullPath);
       let existingDigest = null;
       try {
@@ -12586,7 +12928,7 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join19(dirname12(cacheRoot), `hydration-${options.stationId}.json`);
+  const hydrationManifestPath = join21(dirname12(cacheRoot), `hydration-${options.stationId}.json`);
   mkdirSync14(dirname12(hydrationManifestPath), { recursive: true });
   writeFileSync13(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);