@hasna/skills 0.1.72 → 0.2.0

package/dist/index.js

@@ -48,11 +48,11 @@ var __require = import.meta.require;
 
 // src/lib/registry.ts
 import { existsSync as existsSync8, readFileSync as readFileSync6, readdirSync as readdirSync6 } from "fs";
-import { join as join9 } from "path";
+import { join as join8 } from "path";
 
 // src/lib/config.ts
 import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, copyFileSync, readdirSync, statSync } from "fs";
-import { join as join3, dirname } from "path";
+import { join as join2, dirname } from "path";
 
 // src/lib/retired-settings.ts
 var RETIRED_ENV_SUFFIXES = ["_STORAGE_MODE", "_DEPLOYMENT_MODE", "_CLOUD_MODE"];
@@ -102,94 +102,87 @@ function assertNoRetiredConfigKeys(config, source) {
 
 // src/lib/app-home.ts
 import { existsSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve } from "path";
-
-// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
 import { homedir } from "os";
-import { join } from "path";
-var KIND_ENV = {
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+var PATHS_RESOLVER_KIND_ENV = {
   config: "HASNA_CONFIG_HOME",
   data: "HASNA_DATA_HOME",
   state: "HASNA_STATE_HOME",
   cache: "HASNA_CACHE_HOME"
 };
-var APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function assertApp(app) {
+var PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
       case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
     case "config":
-      return join(home, ".config", "hasna");
+      return pathsResolverJoin(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function dataDir(options) {
-  return resolvePath("data", options);
+  return pathsResolverResolve("data", options);
 }
-
-// src/lib/app-home.ts
 var DATA_DIR_ENV = "HASNA_SKILLS_DIR";
 var HASNA_SKILLS_HOME_ENV = "HASNA_SKILLS_HOME";
 var SKILLS_HOME_ENV = "SKILLS_HOME";
 var DEFAULT_SQLITE_FILENAME = "server.db";
 var GLOBAL_CONFIG_FILENAME = "config.json";
 function effectiveHome() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2() || "/tmp";
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir() || "/tmp";
 }
 function legacyDataRoot() {
-  return join2(effectiveHome(), ".hasna", "skills");
+  return join(effectiveHome(), ".hasna", "skills");
 }
-function resolverDataRoot(home = effectiveHome()) {
-  return dataDir({ app: "skills", home });
+function resolverDataRoot(home = effectiveHome(), env) {
+  return dataDir({ app: "skills", home, env });
 }
 function adoptResolverDataRoot(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync(join2(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join2(resolved, GLOBAL_CONFIG_FILENAME));
+  return existsSync(join(resolved, DEFAULT_SQLITE_FILENAME)) || existsSync(join(resolved, GLOBAL_CONFIG_FILENAME));
 }
 function exactDataRoot() {
   for (const key of [DATA_DIR_ENV, HASNA_SKILLS_HOME_ENV, SKILLS_HOME_ENV]) {
@@ -213,8 +206,16 @@ function getDataRoot() {
   return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
 }
 function skillsDataRootForHome(home) {
-  const resolved = resolverDataRoot(home);
-  return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(join2(home, ".hasna", "skills"));
+  const isOwnHome = resolve(home) === resolve(effectiveHome()) || resolve(home) === resolve(homedir());
+  if (isOwnHome) {
+    const exact = exactDataRoot();
+    if (exact)
+      return exact;
+    const resolved2 = resolverDataRoot(home);
+    return adoptResolverDataRoot(resolved2) ? resolve(resolved2) : resolve(join(home, ".hasna", "skills"));
+  }
+  const resolved = resolverDataRoot(home, {});
+  return adoptResolverDataRoot(resolved, {}) ? resolve(resolved) : resolve(join(home, ".hasna", "skills"));
 }
 
 // src/lib/config.ts
@@ -235,8 +236,8 @@ function mergeDirectoryContents(sourceDir, targetDir) {
     return;
   mkdirSync(targetDir, { recursive: true });
   for (const entry of readdirSync(sourceDir)) {
-    const sourcePath = join3(sourceDir, entry);
-    const targetPath = join3(targetDir, entry);
+    const sourcePath = join2(sourceDir, entry);
+    const targetPath = join2(targetDir, entry);
     try {
       const sourceStat = statSync(sourcePath);
       if (sourceStat.isDirectory()) {
@@ -272,7 +273,7 @@ var INSTALLED_SKILLS_DIRNAME = "installed";
 var SKILLS_CACHE_DIRNAME = "skills";
 var LAYOUT_MIGRATION_RECORD = ".layout-migration.json";
 function isOwnerLayoutMigrated(appDir) {
-  return existsSync2(join3(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
+  return existsSync2(join2(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD));
 }
 function getDataDir() {
   const root = getDataRoot();
@@ -282,23 +283,23 @@ function getDataDir() {
   if (hasOperatorOverride())
     return root;
   const home = effectiveHome();
-  const oldDir = join3(home, ".skills");
-  const oldConfigFile = join3(home, ".skillsrc");
+  const oldDir = join2(home, ".skills");
+  const oldConfigFile = join2(home, ".skillsrc");
   try {
     mergeDirectoryContents(oldDir, root);
   } catch {}
-  if (existsSync2(oldConfigFile) && !existsSync2(join3(root, "config.json"))) {
+  if (existsSync2(oldConfigFile) && !existsSync2(join2(root, "config.json"))) {
     try {
-      copyFileSync(oldConfigFile, join3(root, "config.json"));
+      copyFileSync(oldConfigFile, join2(root, "config.json"));
     } catch {}
   }
   return root;
 }
 function getConfigPath(scope) {
   if (scope === "global") {
-    return join3(getDataDir(), "config.json");
+    return join2(getDataDir(), "config.json");
   }
-  return join3(process.cwd(), "skills.config.json");
+  return join2(process.cwd(), "skills.config.json");
 }
 function readConfigFile(path) {
   if (!existsSync2(path))
@@ -393,7 +394,7 @@ import {
   statSync as statSync6,
   writeFileSync as writeFileSync3
 } from "fs";
-import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join8, normalize as normalize2 } from "path";
+import { basename as basename2, dirname as dirname3, isAbsolute as isAbsolute2, join as join7, normalize as normalize2 } from "path";
 
 // src/lib/registry-data/development-tools.ts
 var DEVELOPMENT_TOOLS_SKILLS = [
@@ -607,14 +608,6 @@ var DEVELOPMENT_TOOLS_SKILLS = [
     category: "Development Tools",
     tags: ["storage", "backend", "postgresql", "sqlite", "two-backend", "oss-app"],
     kind: "instruction"
-  },
-  {
-    name: "session-inject-monitor",
-    displayName: "Session Inject Monitor",
-    description: "Set up a declarative monitor that injects a prompt into a live coding-agent session when a watched source (conversations, email, todos, knowledge, command output) has new content",
-    category: "Development Tools",
-    tags: ["monitor", "session", "injection", "automation", "wake"],
-    kind: "instruction"
   }
 ];
 
@@ -1114,7 +1107,7 @@ var SKILLS = [
 
 // src/lib/hosted-skill-set.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 var HOSTED_RUNTIMES = new Set(["hosted"]);
 var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
 function normalizeMarker(value) {
@@ -1127,7 +1120,7 @@ function isHostedMetadataPackage(pkg) {
   return HOSTED_RUNTIMES.has(normalizeMarker(skills.runtime)) || HOSTED_SOURCES.has(normalizeMarker(skills.source));
 }
 function isHostedMetadataSkillDir(skillDir) {
-  const pkgPath = join4(skillDir, "package.json");
+  const pkgPath = join3(skillDir, "package.json");
   if (!existsSync3(pkgPath))
     return false;
   try {
@@ -1153,7 +1146,7 @@ var SINGLE_SOURCE_EXCLUSION = new RegExp(`^!skills/(${SLUG})/src$`);
 
 // src/lib/skill-validation.ts
 import { existsSync as existsSync4, lstatSync, readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync3 } from "fs";
-import { isAbsolute, join as join5, normalize } from "path";
+import { isAbsolute, join as join4, normalize } from "path";
 var VALID_SKILL_KINDS = ["executable", "instruction"];
 var DOC_FILES = ["SKILL.md", "README.md", "CLAUDE.md"];
 var RESERVED_SKILL_ENTRIES = new Set([
@@ -1306,7 +1299,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     add(issues, "skill.name_invalid", `Skill name '${bareName}' must use lowercase letters, numbers, dots, underscores, or hyphens`);
   }
   for (const entry of readdirSync3(skillPath).sort()) {
-    const entryPath = join5(skillPath, entry);
+    const entryPath = join4(skillPath, entry);
     if (RESERVED_SKILL_ENTRIES.has(entry)) {
       add(issues, "skill.reserved_file", `Reserved file '${entry}' is not allowed in skill packages`);
     }
@@ -1318,13 +1311,13 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     }
   }
   for (const docFile of DOC_FILES) {
-    if (existsSync4(join5(skillPath, docFile)))
+    if (existsSync4(join4(skillPath, docFile)))
       metadata.docFiles.push(docFile);
   }
   if (metadata.docFiles.length === 0) {
     add(issues, "skill.docs_missing", "Missing documentation file: expected SKILL.md, README.md, or CLAUDE.md");
   }
-  const skillMdPath = join5(skillPath, "SKILL.md");
+  const skillMdPath = join4(skillPath, "SKILL.md");
   if (existsSync4(skillMdPath)) {
     const frontmatter = parseSkillFrontmatter(readFileSync3(skillMdPath, "utf-8"));
     if (!frontmatter) {
@@ -1368,7 +1361,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   }
   metadata.kind = resolvedKind;
   const isInstruction = resolvedKind === "instruction";
-  const pkgPath = join5(skillPath, "package.json");
+  const pkgPath = join4(skillPath, "package.json");
   if (!existsSync4(pkgPath)) {
     if (!isInstruction)
       add(issues, "package.missing", "Missing package.json");
@@ -1427,7 +1420,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
               add(issues, "package.bin_target_unsafe", `package.json bin '${command}' target '${target}' must stay inside the skill directory`);
               continue;
             }
-            const targetPath = join5(skillPath, target);
+            const targetPath = join4(skillPath, target);
             if (!existsSync4(targetPath)) {
               add(warnings, "package.bin_target_missing", `package.json bin '${command}' target '${target}' is not present before build`);
             } else if (statSync3(targetPath).isDirectory()) {
@@ -1445,17 +1438,17 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     metadata.runtime = "none";
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
-    const srcDir = join5(skillPath, "src");
+    const srcDir = join4(skillPath, "src");
     if (hostedMetadata) {
       if (existsSync4(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
     } else if (!existsSync4(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
-    } else if (!existsSync4(join5(srcDir, "index.ts")) && !existsSync4(join5(srcDir, "index.js"))) {
+    } else if (!existsSync4(join4(srcDir, "index.ts")) && !existsSync4(join4(srcDir, "index.js"))) {
       add(issues, "skill.src_index_missing", "Missing src/index.ts or src/index.js");
     } else {
-      const indexPath = existsSync4(join5(srcDir, "index.ts")) ? join5(srcDir, "index.ts") : join5(srcDir, "index.js");
+      const indexPath = existsSync4(join4(srcDir, "index.ts")) ? join4(srcDir, "index.ts") : join4(srcDir, "index.js");
       const size = statSync3(indexPath).size;
       if (size < 50)
         add(warnings, "skill.src_index_minimal", `Source entry point is very small (${size}B)`);
@@ -1480,7 +1473,7 @@ function validateRegistryConsistency(registry, skillsDir) {
     return false;
   })));
   const skillDirs = existsSync4(skillsDir) ? readdirSync3(skillsDir).filter((entry) => {
-    const fullPath = join5(skillsDir, entry);
+    const fullPath = join4(skillsDir, entry);
     return !entry.startsWith(".") && entry !== "_common" && statSync3(fullPath).isDirectory();
   }) : [];
   const directoryNames = new Set(skillDirs);
@@ -1498,7 +1491,7 @@ function validateRegistryConsistency(registry, skillsDir) {
 // src/lib/skill-hash.ts
 import { createHash } from "crypto";
 import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
-import { join as join6, sep } from "path";
+import { join as join5, sep } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
 var HASH_COVERAGE = [
@@ -1557,7 +1550,7 @@ function collectBundleFiles(skillPath) {
     if (seen.has(entry))
       continue;
     seen.add(entry);
-    const absolute = join6(skillPath, entry);
+    const absolute = join5(skillPath, entry);
     if (!existsSync5(absolute))
       continue;
     if (statSync4(absolute).isDirectory())
@@ -1571,7 +1564,7 @@ function collectDirectory(files, dir, rel) {
   for (const entry of readdirSync4(dir).sort()) {
     if (entry.startsWith("."))
       continue;
-    const absolute = join6(dir, entry);
+    const absolute = join5(dir, entry);
     const childRel = `${rel}/${entry}`;
     let stats;
     try {
@@ -1798,7 +1791,7 @@ import {
   realpathSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { basename, dirname as dirname2, join as join7, relative } from "path";
+import { basename, dirname as dirname2, join as join6, relative } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -1841,9 +1834,9 @@ function normalizePortableSkillName(name) {
   return normalized;
 }
 function readPortableSkillManifest(skillPath, fallbackName = basename(skillPath)) {
-  const skillJsonPath = join7(skillPath, "skill.json");
-  const skillMdPath = join7(skillPath, "SKILL.md");
-  const pkgPath = join7(skillPath, "package.json");
+  const skillJsonPath = join6(skillPath, "skill.json");
+  const skillMdPath = join6(skillPath, "SKILL.md");
+  const pkgPath = join6(skillPath, "package.json");
   const jsonManifest = existsSync6(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
   const frontmatter = existsSync6(skillMdPath) ? parseSkillFrontmatter(readFileSync5(skillMdPath, "utf-8")) ?? undefined : undefined;
   const pkg = existsSync6(pkgPath) ? readJsonObject(pkgPath) : undefined;
@@ -1892,7 +1885,7 @@ function createInstructionManifest(name, options) {
 }
 function writeInstructionSkillTemplate(skillPath, manifest) {
   mkdirSync2(skillPath, { recursive: true });
-  writeFileSync2(join7(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
+  writeFileSync2(join6(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function renderInstructionSkillMd(manifest) {
@@ -1941,12 +1934,12 @@ function createPortableManifest(name, options) {
   };
 }
 function writePortableSkillTemplate(skillPath, manifest) {
-  mkdirSync2(join7(skillPath, "src"), { recursive: true });
-  writeFileSync2(join7(skillPath, "SKILL.md"), renderSkillMd(manifest));
-  writeFileSync2(join7(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
-  writeFileSync2(join7(skillPath, "package.json"), renderPackageJson(manifest));
-  writeFileSync2(join7(skillPath, "tsconfig.json"), renderTsconfig());
-  writeFileSync2(join7(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
+  mkdirSync2(join6(skillPath, "src"), { recursive: true });
+  writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(manifest));
+  writeFileSync2(join6(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
+  writeFileSync2(join6(skillPath, "package.json"), renderPackageJson(manifest));
+  writeFileSync2(join6(skillPath, "tsconfig.json"), renderTsconfig());
+  writeFileSync2(join6(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function fillContractDefaults(manifest, entrypoint) {
@@ -1971,7 +1964,7 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: undefined
     }
   };
-  writeFileSync2(join7(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
+  writeFileSync2(join6(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
 `);
   const hash = computeContentHash(skillPath);
   const withHash = {
@@ -1981,12 +1974,12 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: hash
     }
   };
-  writeFileSync2(join7(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
+  writeFileSync2(join6(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
 `);
   return withHash;
 }
 function readExistingSkillJson(skillPath) {
-  const path = join7(skillPath, "skill.json");
+  const path = join6(skillPath, "skill.json");
   if (!existsSync6(path))
     return {};
   try {
@@ -2020,24 +2013,24 @@ function ensurePortableSkillFiles(skillPath, manifest) {
     tags: next.tags?.length ? next.tags : ["custom", next.name]
   };
   const entry = next.commands[0]?.entry ?? "src/index.ts";
-  if (entry && !existsSync6(join7(skillPath, entry))) {
-    mkdirSync2(dirname2(join7(skillPath, entry)), { recursive: true });
-    writeFileSync2(join7(skillPath, entry), renderEntrypoint(next));
+  if (entry && !existsSync6(join6(skillPath, entry))) {
+    mkdirSync2(dirname2(join6(skillPath, entry)), { recursive: true });
+    writeFileSync2(join6(skillPath, entry), renderEntrypoint(next));
   }
-  if (!existsSync6(join7(skillPath, "SKILL.md")))
-    writeFileSync2(join7(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync6(join6(skillPath, "SKILL.md")))
+    writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(next));
   else
-    writeFileSync2(join7(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync5(join7(skillPath, "SKILL.md"), "utf-8"), next));
-  if (!existsSync6(join7(skillPath, "AGENTS.md")))
-    writeFileSync2(join7(skillPath, "AGENTS.md"), renderAgentsMd(next));
+    writeFileSync2(join6(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync5(join6(skillPath, "SKILL.md"), "utf-8"), next));
+  if (!existsSync6(join6(skillPath, "AGENTS.md")))
+    writeFileSync2(join6(skillPath, "AGENTS.md"), renderAgentsMd(next));
   ensurePackageJson(skillPath, next);
-  if (!existsSync6(join7(skillPath, "tsconfig.json")))
-    writeFileSync2(join7(skillPath, "tsconfig.json"), renderTsconfig());
+  if (!existsSync6(join6(skillPath, "tsconfig.json")))
+    writeFileSync2(join6(skillPath, "tsconfig.json"), renderTsconfig());
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
 function ensurePackageJson(skillPath, manifest) {
-  const pkgPath = join7(skillPath, "package.json");
+  const pkgPath = join6(skillPath, "package.json");
   const first = manifest.commands[0] ?? { name: manifest.name, entry: "src/index.ts" };
   const commandName = normalizePortableSkillName(first.name || manifest.name);
   const entry = (first.entry ?? "src/index.ts").replace(/^\.\//, "");
@@ -2084,8 +2077,8 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
     inputs: [],
     commands: []
   };
-  if (!existsSync6(join7(skillPath, "SKILL.md"))) {
-    writeFileSync2(join7(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync6(join6(skillPath, "SKILL.md"))) {
+    writeFileSync2(join6(skillPath, "SKILL.md"), renderSkillMd(next));
   }
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
@@ -2377,18 +2370,18 @@ var LEGACY_CUSTOM_DIRNAME = "custom";
 function getPortableSkillsRoot(options = {}) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join8(options.homeDir, ".hasna", "skills") : getDataDir();
-  const cache = join8(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join7(options.homeDir, ".hasna", "skills") : getDataDir();
+  const cache = join7(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache))
     return cache;
-  const installed = join8(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join7(appDir, INSTALLED_SKILLS_DIRNAME);
   migrateLegacySkillLayout(appDir, installed);
   return installed;
 }
 function looksLikeSkillDirectory(path) {
   if (!safeIsDirectory(path))
     return false;
-  return existsSync7(join8(path, "SKILL.md")) || existsSync7(join8(path, "skill.json")) || existsSync7(join8(path, "package.json"));
+  return existsSync7(join7(path, "SKILL.md")) || existsSync7(join7(path, "skill.json")) || existsSync7(join7(path, "package.json"));
 }
 function migrateLegacySkillLayout(appDir, installed) {
   if (!safeIsDirectory(appDir))
@@ -2398,7 +2391,7 @@ function migrateLegacySkillLayout(appDir, installed) {
     for (const entry of readdirSync5(appDir)) {
       if (entry.startsWith(".") || entry === INSTALLED_SKILLS_DIRNAME)
         continue;
-      const path = join8(appDir, entry);
+      const path = join7(appDir, entry);
       if (entry === LEGACY_CUSTOM_DIRNAME) {
         if (!safeIsDirectory(path))
           continue;
@@ -2406,7 +2399,7 @@ function migrateLegacySkillLayout(appDir, installed) {
           for (const nested of readdirSync5(path)) {
             if (nested.startsWith("."))
               continue;
-            const nestedPath = join8(path, nested);
+            const nestedPath = join7(path, nested);
             if (looksLikeSkillDirectory(nestedPath))
               candidates.push({ from: nestedPath, name: nested });
           }
@@ -2420,10 +2413,10 @@ function migrateLegacySkillLayout(appDir, installed) {
     return;
   }
   for (const { from, name } of candidates) {
-    const target = join8(installed, name);
+    const target = join7(installed, name);
     if (existsSync7(target))
       continue;
-    const staging = join8(installed, `.migrating-${name}-${process.pid}`);
+    const staging = join7(installed, `.migrating-${name}-${process.pid}`);
     try {
       rmSync(staging, { recursive: true, force: true });
       cpSync2(from, staging, { recursive: true, errorOnExist: false });
@@ -2436,7 +2429,7 @@ function migrateLegacySkillLayout(appDir, installed) {
   }
 }
 function getPortableSkillPath(name, options = {}) {
-  return join8(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join7(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -2462,7 +2455,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync5(root).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join8(root, entry);
+    const path = join7(root, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -2496,7 +2489,7 @@ function isOfficialSkillName(name) {
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizePortableSkillName(name);
   const root = getPortableSkillsRoot(options);
-  const skillPath = join8(root, skillName);
+  const skillPath = join7(root, skillName);
   if (existsSync7(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
@@ -2528,7 +2521,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   const skipped = [];
   const entries = readdirSync5(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
-    const childPath = join8(absoluteSource, entryName);
+    const childPath = join7(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
       continue;
     if (!isSkillCandidate(childPath)) {
@@ -2557,7 +2550,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
 }
 function isSkillCandidate(dir) {
-  return existsSync7(join8(dir, "SKILL.md")) || existsSync7(join8(dir, "skill.json")) || existsSync7(join8(dir, "package.json"));
+  return existsSync7(join7(dir, "SKILL.md")) || existsSync7(join7(dir, "skill.json")) || existsSync7(join7(dir, "package.json"));
 }
 function portPortableSkill(sourcePath, options = {}) {
   const absoluteSource = normalize2(sourcePath);
@@ -2573,7 +2566,7 @@ function portPortableSkill(sourcePath, options = {}) {
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
   const root = getPortableSkillsRoot(options);
-  const destination = join8(root, skillName);
+  const destination = join7(root, skillName);
   if (existsSync7(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
@@ -2616,10 +2609,10 @@ function buildCorpusManifest(input, name) {
 function writeCorpusSkill(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const root = getPortableSkillsRoot(options);
-  const skillPath = join8(root, name);
+  const skillPath = join7(root, name);
   const created = !existsSync7(skillPath);
   mkdirSync3(skillPath, { recursive: true });
-  writeFileSync3(join8(skillPath, "SKILL.md"), input.skillMd);
+  writeFileSync3(join7(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
   return { name, path: skillPath, manifest, created };
@@ -2627,19 +2620,19 @@ function writeCorpusSkill(input, options = {}) {
 function installCorpusSkillAtomically(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const root = getPortableSkillsRoot(options);
-  const target = join8(root, name);
+  const target = join7(root, name);
   const created = !existsSync7(target);
   mkdirSync3(root, { recursive: true });
-  const staging = mkdtempSync(join8(root, `.pull-${name}-`));
+  const staging = mkdtempSync(join7(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
-    writeFileSync3(join8(staging, "SKILL.md"), input.skillMd);
+    writeFileSync3(join7(staging, "SKILL.md"), input.skillMd);
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
     if (existsSync7(target)) {
-      backup = mkdtempSync(join8(root, `.pull-backup-${name}-`));
-      renameSync(target, join8(backup, name));
+      backup = mkdtempSync(join7(root, `.pull-backup-${name}-`));
+      renameSync(target, join7(backup, name));
       moved = true;
     }
     renameSync(staging, target);
@@ -2648,9 +2641,9 @@ function installCorpusSkillAtomically(input, options = {}) {
     return { name, path: target, manifest, created };
   } catch (error) {
     rmSync(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync7(join8(backup, name))) {
+    if (moved && backup && existsSync7(join7(backup, name))) {
       try {
-        renameSync(join8(backup, name), target);
+        renameSync(join7(backup, name), target);
       } catch {}
     }
     throw error;
@@ -2663,8 +2656,8 @@ function validatePortableSkillDirectory(name, skillPath) {
   const warnings = [...base.warnings];
   let manifest;
   if (existsSync7(skillPath)) {
-    const skillJsonPath = join8(skillPath, "skill.json");
-    const skillMdPath = join8(skillPath, "SKILL.md");
+    const skillJsonPath = join7(skillPath, "skill.json");
+    const skillMdPath = join7(skillPath, "SKILL.md");
     if (!existsSync7(skillJsonPath) && !existsSync7(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
@@ -2684,7 +2677,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync7(join8(skillPath, "skill.json")),
+        strict: existsSync7(join7(skillPath, "skill.json")),
         skillPath
       });
       for (const issue of contractIssues)
@@ -2720,7 +2713,7 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command.name}' entry '${command.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join8(skillPath, command.entry);
+            const entryPath = join7(skillPath, command.entry);
             if (!existsSync7(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command.name}' entry '${command.entry}' is missing`);
             else if (statSync6(entryPath).isDirectory())
@@ -2731,7 +2724,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error) {
       add3(issues, "portable.manifest_invalid", error.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync7(join8(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync7(join7(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -2767,12 +2760,12 @@ async function runPortableSkill(name, args, options = {}) {
   if (!isSafeRelativePath2(command.entry)) {
     return { exitCode: 1, error: `Portable skill '${name}' command entry is unsafe` };
   }
-  const entryPath = join8(skill.path, command.entry);
+  const entryPath = join7(skill.path, command.entry);
   if (!existsSync7(entryPath)) {
     return { exitCode: 1, error: `Entry point '${command.entry}' not found in portable skill '${name}'` };
   }
-  const pkgPath = join8(skill.path, "package.json");
-  const nodeModules = join8(skill.path, "node_modules");
+  const pkgPath = join7(skill.path, "package.json");
+  const nodeModules = join7(skill.path, "node_modules");
   if (existsSync7(pkgPath) && !existsSync7(nodeModules) && hasPackageDependencies(pkgPath)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skill.path,
@@ -3050,7 +3043,7 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join9(dir, entry.name, "SKILL.md");
+      const skillMdPath = join8(dir, entry.name, "SKILL.md");
       if (!existsSync8(skillMdPath))
         continue;
       let content;
@@ -3070,7 +3063,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join9(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join8(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -3086,8 +3079,8 @@ function findExtensionSkillPath(name) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join9(config.extensionsDir, entry.name);
-      const skillMdPath = join9(skillDir, "SKILL.md");
+      const skillDir = join8(config.extensionsDir, entry.name);
+      const skillMdPath = join8(skillDir, "SKILL.md");
       if (!existsSync8(skillMdPath))
         continue;
       let content;
@@ -3125,7 +3118,7 @@ function loadRegistry(cwd) {
   const official = SKILLS.map((s) => ({ ...s, source: "official" }));
   const extensions = config.extensionsDir ? discoverSkillsInDir(config.extensionsDir, "extension") : [];
   const portableCustom = listPortableSkillMetas();
-  const legacyCustom = discoverSkillsInDir(join9(dataDir2, "custom"));
+  const legacyCustom = discoverSkillsInDir(join8(dataDir2, "custom"));
   const globalCustom = mergeCustomSkills([...legacyCustom, ...portableCustom]);
   registryCache = mergeSkillRegistryLists(official, extensions, globalCustom);
   registryCacheTime = now;
@@ -3173,8 +3166,8 @@ function getAllTags() {
 }
 // src/lib/installer.ts
 import { existsSync as existsSync11, readFileSync as readFileSync9, rmSync as rmSync3 } from "fs";
-import { dirname as dirname5, join as join12 } from "path";
-import { homedir as homedir4 } from "os";
+import { dirname as dirname5, join as join11 } from "path";
+import { homedir as homedir3 } from "os";
 import { fileURLToPath } from "url";
 
 // src/lib/agent-sync.ts
@@ -3190,8 +3183,8 @@ import {
   statSync as statSync7,
   writeFileSync as writeFileSync4
 } from "fs";
-import { homedir as homedir3 } from "os";
-import { basename as basename3, dirname as dirname4, join as join10 } from "path";
+import { homedir as homedir2 } from "os";
+import { basename as basename3, dirname as dirname4, join as join9 } from "path";
 // src/lib/home-migration.ts
 function resolveCorpusRoot(options = {}) {
   return getPortableSkillsRoot(options);
@@ -3213,12 +3206,12 @@ function resolveSyncAgents(arg) {
   }
   return [arg];
 }
-function agentGlobalSkillsDir(agent, homeDir = homedir3()) {
+function agentGlobalSkillsDir(agent, homeDir = homedir2()) {
   switch (agent) {
     case "opencode":
-      return join10(homeDir, ".config", "opencode", "skills");
+      return join9(homeDir, ".config", "opencode", "skills");
     default:
-      return join10(homeDir, `.${agent}`, "skills");
+      return join9(homeDir, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -3277,7 +3270,7 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate = join10(source, sub);
+    const candidate = join9(source, sub);
     if (existsSync9(candidate) && isDirectory(candidate))
       roots.push(candidate);
   }
@@ -3293,10 +3286,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate = join10(path, entry);
+    const candidate = join9(path, entry);
     if (!isDirectory(candidate))
       return false;
-    return existsSync9(join10(candidate, "SKILL.md")) || existsSync9(join10(candidate, "skill.json")) || existsSync9(join10(candidate, "package.json"));
+    return existsSync9(join9(candidate, "SKILL.md")) || existsSync9(join9(candidate, "skill.json")) || existsSync9(join9(candidate, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -3309,7 +3302,7 @@ function isDirectory(path) {
 function syncSkillsToAgents(options = {}) {
   const requested = normalizeRequested(options.names);
   const agents = options.agents?.length ? options.agents : [...SYNC_AGENTS];
-  const homeDir = options.homeDir ?? homedir3();
+  const homeDir = options.homeDir ?? homedir2();
   const { roots, source } = resolveSyncCorpus(options);
   const corpus = listPortableSkillsAcrossRoots(roots);
   const byName = new Map(corpus.map((skill) => [skill.name, skill]));
@@ -3335,7 +3328,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join10(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
+          path: join9(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -3364,8 +3357,8 @@ function syncSkillsToAgents(options = {}) {
   return { actions };
 }
 function writeManagedAgentSkill(params) {
-  const homeDir = params.homeDir ?? homedir3();
-  const dir = join10(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
+  const homeDir = params.homeDir ?? homedir2();
+  const dir = join9(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -3382,8 +3375,8 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join10(dir, "SKILL.md");
-  const markerPath = join10(dir, SYNC_MARKER_FILE);
+  const skillMdPath = join9(dir, "SKILL.md");
+  const markerPath = join9(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync9(dir);
   const managed = existsSync9(markerPath);
   const hasSkillMd = existsSync9(skillMdPath);
@@ -3421,11 +3414,11 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return { action, path: skillMdPath };
   const parentDir = dirname4(dir);
   mkdirSync4(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join10(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
-  const candidateDir = join10(transactionDir, "candidate");
-  const backupDir = join10(transactionDir, "backup");
-  const candidateSkillMdPath = join10(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join10(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join9(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
+  const candidateDir = join9(transactionDir, "candidate");
+  const backupDir = join9(transactionDir, "backup");
+  const candidateSkillMdPath = join9(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join9(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -3473,16 +3466,16 @@ function writeManagedSkillDir(dir, skillMd, options) {
   }
   return { action, path: skillMdPath };
 }
-function removeManagedAgentSkill(skill, agent, homeDir = homedir3()) {
-  const dir = join10(agentGlobalSkillsDir(agent, homeDir), skill);
-  if (!existsSync9(join10(dir, SYNC_MARKER_FILE)))
+function removeManagedAgentSkill(skill, agent, homeDir = homedir2()) {
+  const dir = join9(agentGlobalSkillsDir(agent, homeDir), skill);
+  if (!existsSync9(join9(dir, SYNC_MARKER_FILE)))
     return false;
   rmSync2(dir, { recursive: true, force: true });
   return true;
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join10(skillPath, "SKILL.md");
+    const skillMdPath = join9(skillPath, "SKILL.md");
     if (existsSync9(skillMdPath))
       return readFileSync7(skillMdPath, "utf-8");
   }
@@ -3515,7 +3508,7 @@ function normalizeSkillName(name) {
 
 // src/lib/project-state.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { join as join10 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -3530,10 +3523,10 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join11(targetDir, SKILLS_PROJECT_DIR);
+  return join10(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join11(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join10(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
@@ -3658,12 +3651,12 @@ var __dirname2 = dirname5(fileURLToPath(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join12(dir, "skills");
+    const candidate = join11(dir, "skills");
     if (existsSync11(candidate) && !dir.includes(".skills"))
       return candidate;
     dir = dirname5(dir);
   }
-  return join12(__dirname2, "..", "skills");
+  return join11(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -3671,13 +3664,13 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join12(getDataDir(), "custom", skillName);
+  const legacyCustomPath = join11(getDataDir(), "custom", skillName);
   if (existsSync11(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join12(SKILLS_DIR, skillName);
+  return join11(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -3740,7 +3733,7 @@ function createLocalSkillManifest(name, generateSkillMd) {
   if (!existsSync11(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join12(sourcePath, "SKILL.md");
+  const skillMdPath = join11(sourcePath, "SKILL.md");
   if (existsSync11(skillMdPath)) {
     skillMd = readFileSync9(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
@@ -3814,16 +3807,16 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join12(base, ".pi", "skills") : join12(homedir4(), ".pi", "agent", "skills");
+      return scope === "project" ? join11(base, ".pi", "skills") : join11(homedir3(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join12(base, ".opencode", "skills") : join12(homedir4(), ".config", "opencode", "skills");
+      return scope === "project" ? join11(base, ".opencode", "skills") : join11(homedir3(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join12(base, `.${agent}`, "skills") : join12(homedir4(), `.${agent}`, "skills");
+      return scope === "project" ? join11(base, `.${agent}`, "skills") : join11(homedir3(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join12(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join11(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   const canonicalName = getCanonicalSkillName(name);
@@ -3851,14 +3844,14 @@ function removeSkillForAgent(name, options) {
   const canonicalName = getCanonicalSkillName(name);
   const scope = options.scope ?? "global";
   const dir = getAgentSkillPath(canonicalName, options.agent, scope, options.projectDir);
-  if (!existsSync11(join12(dir, SYNC_MARKER_FILE)))
+  if (!existsSync11(join11(dir, SYNC_MARKER_FILE)))
     return false;
   rmSync3(dir, { recursive: true, force: true });
   return true;
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join12(sourcePath, "SKILL.md");
+  const skillMdPath = join11(sourcePath, "SKILL.md");
   if (existsSync11(skillMdPath))
     return readFileSync9(skillMdPath, "utf-8");
   if (generateSkillMd)
@@ -3893,7 +3886,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join12(sourcePath, "README.md")) || readFileIfExists(join12(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join11(sourcePath, "README.md")) || readFileIfExists(join11(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -3912,7 +3905,7 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join12(getSkillPath(name), "package.json");
+  const pkgPath = join11(getSkillPath(name), "package.json");
   if (!existsSync11(pkgPath))
     return "unknown";
   try {
@@ -3931,19 +3924,19 @@ function loadProjectConfigCompat(targetDir) {
 // src/lib/run-state.ts
 import { createHash as createHash2, randomBytes } from "crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync6, readFileSync as readFileSync10, readdirSync as readdirSync8, statSync as statSync8, writeFileSync as writeFileSync6 } from "fs";
-import { extname, join as join13, relative as relative2 } from "path";
+import { extname, join as join12, relative as relative2 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join13(root, "runs", day, id);
-  const logsDir = join13(runDir, "logs");
-  const exportDir = join13(root, "exports", skillName, id);
+  const runDir = join12(root, "runs", day, id);
+  const logsDir = join12(runDir, "logs");
+  const exportDir = join12(root, "exports", skillName, id);
   mkdirSync6(logsDir, { recursive: true });
   mkdirSync6(exportDir, { recursive: true });
-  mkdirSync6(join13(root, "tmp"), { recursive: true });
+  mkdirSync6(join12(root, "tmp"), { recursive: true });
   const record = {
     id,
     skill: skillName,
@@ -3994,27 +3987,27 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync6(join13(context.logsDir, "stdout.log"), stdout);
-  writeFileSync6(join13(context.logsDir, "stderr.log"), stderr);
+  writeFileSync6(join12(context.logsDir, "stdout.log"), stdout);
+  writeFileSync6(join12(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join13(context.runDir, "events.ndjson");
+  const path = join12(context.runDir, "events.ndjson");
   const previous = existsSync12(path) ? readFileSync10(path, "utf-8") : "";
   writeFileSync6(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
-  const runsRoot = join13(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join12(getProjectStateDir(targetDir), "runs");
   if (!existsSync12(runsRoot))
     return [];
   const records = [];
   for (const day of readdirSync8(runsRoot).sort().reverse()) {
-    const dayDir = join13(runsRoot, day);
+    const dayDir = join12(runsRoot, day);
     if (!statSync8(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync8(dayDir).sort().reverse()) {
-      const record = readRunRecord(join13(dayDir, runId));
+      const record = readRunRecord(join12(dayDir, runId));
       if (record)
         records.push(record);
       if (records.length >= limit)
@@ -4024,25 +4017,25 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   return records;
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join13(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join12(getProjectStateDir(targetDir), "runs");
   if (!existsSync12(runsRoot))
     return null;
   for (const day of readdirSync8(runsRoot)) {
-    const record = readRunRecord(join13(runsRoot, day, runId));
+    const record = readRunRecord(join12(runsRoot, day, runId));
     if (record)
       return record;
   }
   return null;
 }
 function getRunExportDir(runId, skill, targetDir = process.cwd()) {
-  return join13(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
+  return join12(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
 }
 function writeRunRecord(context) {
-  writeFileSync6(join13(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync6(join12(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync6(join13(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync6(join12(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
@@ -4062,7 +4055,7 @@ function collectRunArtifacts(context) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join13(runDir, "run.json");
+  const path = join12(runDir, "run.json");
   if (!existsSync12(path))
     return null;
   try {
@@ -4074,7 +4067,7 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync8(dir)) {
-    const full = join13(dir, entry);
+    const full = join12(dir, entry);
     if (statSync8(full).isDirectory())
       files.push(...walkFiles(full));
     else
@@ -4121,11 +4114,11 @@ function mimeForPath(path) {
 }
 // src/lib/skillinfo.ts
 import { existsSync as existsSync13, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join14(skillPath, "SKILL.md");
+  const skillMdPath = join13(skillPath, "SKILL.md");
   if (!existsSync13(skillMdPath))
     return false;
   try {
@@ -4155,9 +4148,9 @@ function getSkillDocs(name) {
   if (!existsSync13(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join14(skillPath, "SKILL.md")),
-    readme: readIfExists(join14(skillPath, "README.md")),
-    claudeMd: readIfExists(join14(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join13(skillPath, "SKILL.md")),
+    readme: readIfExists(join13(skillPath, "README.md")),
+    claudeMd: readIfExists(join13(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -4172,7 +4165,7 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join14(skillPath, file));
+    const content = readIfExists(join13(skillPath, file));
     if (content)
       texts.push(content);
   }
@@ -4211,7 +4204,7 @@ function getSkillRequirements(name) {
   const skillName = normalizeSkillName(name);
   let cliCommand = `skills run ${skillName}`;
   let dependencies = {};
-  const pkgPath = join14(skillPath, "package.json");
+  const pkgPath = join13(skillPath, "package.json");
   if (existsSync13(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
@@ -4241,7 +4234,7 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join14(skillPath, "package.json");
+  const pkgPath = join13(skillPath, "package.json");
   if (!existsSync13(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
@@ -4261,11 +4254,11 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join14(skillPath, entryPoint);
+  const entryPath = join13(skillPath, entryPoint);
   if (!existsSync13(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
-  const nodeModules = join14(skillPath, "node_modules");
+  const nodeModules = join13(skillPath, "node_modules");
   if (!existsSync13(nodeModules)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skillPath,
@@ -4347,10 +4340,10 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join14(skillPath, "README.md"));
-  const claudeMd = readIfExists(join14(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join13(skillPath, "README.md"));
+  const claudeMd = readIfExists(join13(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join14(skillPath, "package.json");
+  const pkgPath = join13(skillPath, "package.json");
   if (existsSync13(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
@@ -8433,13 +8426,13 @@ function requireApiUrl(action = "This command", config, env) {
 
 // src/lib/auth-store.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7, unlinkSync } from "fs";
-import { dirname as dirname6, join as join15 } from "path";
-import { homedir as homedir5 } from "os";
+import { dirname as dirname6, join as join14 } from "path";
+import { homedir as homedir4 } from "os";
 function getAuthFilePath() {
-  return join15(getDataDir(), "auth.json");
+  return join14(getDataDir(), "auth.json");
 }
 function legacyAuthFilePath() {
-  return join15(process.env["HOME"] || process.env["USERPROFILE"] || homedir5(), ".skills", "auth.json");
+  return join14(process.env["HOME"] || process.env["USERPROFILE"] || homedir4(), ".skills", "auth.json");
 }
 var cachedConfig;
 function getAuthConfig() {
@@ -9404,12 +9397,30 @@ class RemoteSkillsClient {
   async downloadSkillBundle(slug) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug)}/bundle`, { method: "GET" });
   }
-  async getBundle(slug) {
-    const response = await this.request(`/api/v1/skills/${encodeURIComponent(slug)}/bundle`, { method: "GET" });
+  async getBundle(slug, version) {
+    const path = version ? `/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}/bundle` : `/api/v1/skills/${encodeURIComponent(slug)}/bundle`;
+    const response = await this.request(path, { method: "GET" });
     if (response.status === 404)
       return null;
     return response;
   }
+  async listSkillVersions(slug) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND"] });
+    if (response.status === 404)
+      return [];
+    if (!response.ok)
+      throw new Error(`versions request failed: ${response.status}`);
+    const body = await response.json();
+    return Array.isArray(body.versions) ? body.versions : [];
+  }
+  async getSkillVersion(slug, version) {
+    const response = await this.requestNewRoute(`/api/v1/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(version)}`, undefined, { domainNotFoundCodes: ["SKILL_NOT_FOUND", "SKILL_VERSION_NOT_FOUND"] });
+    if (response.status === 404)
+      return null;
+    if (!response.ok)
+      throw new Error(`version request failed: ${response.status}`);
+    return await response.json();
+  }
   async listPins() {
     const response = await this.requestNewRoute("/api/v1/pins");
     return normalizePinList(await response.json());
@@ -9548,9 +9559,9 @@ function createRemoteSkillsClient() {
 }
 // src/lib/scheduler.ts
 import { existsSync as existsSync15, readFileSync as readFileSync13, writeFileSync as writeFileSync8, mkdirSync as mkdirSync8 } from "fs";
-import { join as join16 } from "path";
+import { join as join15 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join16(targetDir, ".skills", "schedules.json");
+  return join15(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
@@ -9563,7 +9574,7 @@ function loadSchedules(targetDir = process.cwd()) {
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join16(targetDir, ".skills");
+  const dir = join15(targetDir, ".skills");
   if (!existsSync15(dir))
     mkdirSync8(dir, { recursive: true });
   writeFileSync8(path, JSON.stringify(data, null, 2));
@@ -9751,7 +9762,7 @@ function recordScheduleRun(id, status, targetDir) {
   saveSchedules(data, targetDir);
 }
 // src/lib/pull.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync14, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync3, readFileSync as readFileSync15, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname7, join as join17 } from "path";
 
 // src/lib/revision.ts
@@ -9779,6 +9790,8 @@ function revisionIdOfRecord(record) {
 
 // src/lib/skill-bundle.ts
 import { createHash as createHash4 } from "crypto";
+import { readFileSync as readFileSync14, readdirSync as readdirSync9, statSync as statSync9 } from "fs";
+import { join as join16, relative as relative3 } from "path";
 var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
@@ -9805,6 +9818,7 @@ var CREDENTIAL_FILENAMES = new Set([
   "id_ecdsa",
   "id_ed25519"
 ]);
+var CREDENTIAL_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".keystore", ".jks"];
 var ENV_TEMPLATE_NAMES = new Set([".env.example", ".env.sample", ".env.template", ".env.dist"]);
 var NON_DOTENV_EXTENSIONS = new Set([
   "ts",
@@ -9901,6 +9915,27 @@ var NON_DOTENV_EXTENSIONS = new Set([
   "tar",
   "wasm"
 ]);
+function isDotenvFile(lower) {
+  if (lower === ".env" || lower.startsWith(".env."))
+    return true;
+  if (lower === "env")
+    return true;
+  if (lower.startsWith("env.")) {
+    const extension = lower.slice(lower.lastIndexOf(".") + 1);
+    return !NON_DOTENV_EXTENSIONS.has(extension);
+  }
+  return false;
+}
+function isCredentialFile(name) {
+  const lower = name.toLowerCase();
+  if (ENV_TEMPLATE_NAMES.has(lower))
+    return false;
+  if (isDotenvFile(lower))
+    return true;
+  if (CREDENTIAL_FILENAMES.has(lower))
+    return true;
+  return CREDENTIAL_EXTENSIONS.some((extension) => lower.endsWith(extension));
+}
 function ownBytes(view) {
   const source = view instanceof ArrayBuffer ? new Uint8Array(view) : view;
   const out = new Uint8Array(new ArrayBuffer(source.byteLength));
@@ -9910,9 +9945,117 @@ function ownBytes(view) {
 function sha256Hex(bytes) {
   return createHash4("sha256").update(bytes).digest("hex");
 }
+function collectSkillBundleEntries(dir) {
+  const entries = [];
+  walk(dir, dir, entries);
+  return entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+function walk(root, current, out) {
+  for (const entry of readdirSync9(current, { withFileTypes: true })) {
+    const absolute = join16(current, entry.name);
+    const rel = relative3(root, absolute).split("\\").join("/");
+    const isRootLevel = !rel.includes("/");
+    if (ANY_SEGMENT_EXCLUDES.has(entry.name.toLowerCase()))
+      continue;
+    if (isRootLevel && ROOT_EXCLUDES.has(entry.name.toLowerCase()))
+      continue;
+    if (isRootLevel && TOOL_SIDECAR_FILENAMES.has(entry.name.toLowerCase()))
+      continue;
+    if (entry.name.startsWith("._"))
+      continue;
+    if (entry.isSymbolicLink())
+      continue;
+    if (entry.isDirectory()) {
+      walk(root, absolute, out);
+      continue;
+    }
+    if (!entry.isFile())
+      continue;
+    if (isCredentialFile(entry.name))
+      continue;
+    const stats = statSync9(absolute);
+    out.push({
+      path: rel,
+      bytes: ownBytes(readFileSync14(absolute)),
+      mode: stats.mode & 64 ? 493 : 420
+    });
+  }
+}
+function packSkillBundle(dir, options = {}) {
+  const entries = collectSkillBundleEntries(dir);
+  if (entries.length === 0) {
+    throw new Error(`Nothing to pack: ${dir} contains no files after exclusions (.git, node_modules, dist, .env)`);
+  }
+  const unpackedByteSize = entries.reduce((sum, entry) => sum + entry.bytes.byteLength, 0);
+  const max = options.maxUnpackedBytes ?? 0;
+  if (max > 0 && unpackedByteSize > max) {
+    throw new Error(`Skill sources are ${unpackedByteSize} bytes, over the ${max} byte limit. Remove build output or large fixtures.`);
+  }
+  const tar = writeTar(entries);
+  const bytes = canonicalGzip(tar);
+  return {
+    bytes,
+    sha256: sha256Hex(bytes),
+    fileCount: entries.length,
+    unpackedByteSize,
+    paths: entries.map((entry) => entry.path)
+  };
+}
+function canonicalGzip(tar) {
+  const bytes = ownBytes(Bun.gzipSync(tar, { level: 6 }));
+  if (bytes.byteLength >= 10) {
+    bytes[4] = 0;
+    bytes[5] = 0;
+    bytes[6] = 0;
+    bytes[7] = 0;
+    bytes[9] = 255;
+  }
+  return bytes;
+}
 function unpackSkillBundle(bundle) {
   return readTar(ownBytes(Bun.gunzipSync(ownBytes(bundle))));
 }
+function writeTar(entries) {
+  const blocks = [];
+  for (const entry of entries) {
+    blocks.push(ustarHeader(entry));
+    blocks.push(entry.bytes);
+    const remainder = entry.bytes.byteLength % BLOCK;
+    if (remainder !== 0)
+      blocks.push(new Uint8Array(new ArrayBuffer(BLOCK - remainder)));
+  }
+  blocks.push(new Uint8Array(new ArrayBuffer(BLOCK * 2)));
+  return concat(blocks);
+}
+function ustarHeader(entry) {
+  const header = new Uint8Array(new ArrayBuffer(BLOCK));
+  const encoder = new TextEncoder;
+  const put = (offset, length, value) => {
+    const encoded = encoder.encode(value);
+    if (encoded.byteLength > length) {
+      throw new Error(`Cannot pack '${entry.path}': field does not fit in a ustar header (${encoded.byteLength} > ${length})`);
+    }
+    header.set(encoded, offset);
+  };
+  if (encoder.encode(entry.path).byteLength > 100) {
+    throw new Error(`Cannot pack '${entry.path}': path is longer than the 100 bytes a ustar header holds`);
+  }
+  put(0, 100, entry.path);
+  put(100, 8, `${entry.mode.toString(8).padStart(7, "0")}\x00`);
+  put(108, 8, "0000000\x00");
+  put(116, 8, "0000000\x00");
+  put(124, 12, `${entry.bytes.byteLength.toString(8).padStart(11, "0")}\x00`);
+  put(136, 12, `${0 .toString(8).padStart(11, "0")}\x00`);
+  put(148, 8, "        ");
+  put(156, 1, "0");
+  put(257, 6, "ustar\x00");
+  put(263, 2, "00");
+  let checksum = 0;
+  for (const byte of header)
+    checksum += byte;
+  put(148, 8, `${checksum.toString(8).padStart(6, "0")}\x00 `);
+  return header;
+}
 function readTar(tar) {
   const decoder = new TextDecoder;
   const entries = [];
@@ -9961,6 +10104,23 @@ function trimNul(value) {
   const end = value.indexOf("\x00");
   return end === -1 ? value : value.slice(0, end);
 }
+function concat(chunks) {
+  const total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
+  const merged = new Uint8Array(new ArrayBuffer(total));
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+
+// src/lib/skill-version.ts
+var SKILL_VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/;
+function isValidSkillVersion(value) {
+  return typeof value === "string" && SKILL_VERSION_PATTERN.test(value) && !/^\.+$/.test(value) && !value.includes("..");
+}
+var SKILL_VERSION_RULE = "1-128 characters: letters, digits, '.', '_', '+', '-'; must start with a letter or digit; no '..'";
 
 // src/lib/skill-bundles.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -10025,19 +10185,30 @@ async function resolveTargetSlugs(client, options) {
   return explicit;
 }
 async function pullOne(client, rawName, corpusOptions, verify) {
+  const { name: bareName, version: requestedVersion } = splitNameVersion(rawName);
   let slug;
   try {
-    slug = normalizePortableSkillName(rawName);
+    slug = normalizePortableSkillName(bareName);
   } catch (error) {
     return { name: rawName, success: false, error: error.message };
   }
+  if (requestedVersion !== undefined && !isValidSkillVersion(requestedVersion)) {
+    return { name: rawName, success: false, error: `'${requestedVersion}' is not a valid skill version (${SKILL_VERSION_RULE}).` };
+  }
   const meta = await safeMeta(client, slug);
   let bundleResponse;
   try {
-    bundleResponse = await client.getBundle(slug);
+    bundleResponse = await client.getBundle(slug, requestedVersion);
   } catch (error) {
     return { name: slug, success: false, error: `Failed to fetch '${slug}': ${error.message}` };
   }
+  if (requestedVersion && (!bundleResponse || bundleResponse.status === 404)) {
+    return {
+      name: rawName,
+      success: false,
+      error: `Version '${requestedVersion}' of '${slug}' is not published on the configured instance (run 'skills versions ${slug}' to list what exists).`
+    };
+  }
   if (bundleResponse && !bundleResponse.ok) {
     if (bundleResponse.status === 410) {
       return reconcileTombstone(slug, corpusOptions);
@@ -10056,7 +10227,15 @@ async function pullOne(client, rawName, corpusOptions, verify) {
   }
   if (bundleResponse) {
     try {
-      return await installVerifiedBundle(slug, bundleResponse, meta, corpusOptions, verify);
+      let expectedSha256;
+      if (requestedVersion && client.getSkillVersion) {
+        const recorded = await client.getSkillVersion(slug, requestedVersion);
+        if (!recorded) {
+          return { name: rawName, success: false, error: `Version '${requestedVersion}' of '${slug}' is not published on the configured instance (run 'skills versions ${slug}' to list what exists).` };
+        }
+        expectedSha256 = typeof recorded.bundleSha256 === "string" ? recorded.bundleSha256 : undefined;
+      }
+      return await installVerifiedBundle(slug, bundleResponse, meta, corpusOptions, verify, requestedVersion ? { version: requestedVersion, expectedSha256 } : undefined);
     } catch (error) {
       if (error instanceof PullSkillError) {
         return { name: slug, success: false, error: error.message };
@@ -10140,23 +10319,30 @@ function reconcileTombstone(slug, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync14(join17(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync15(join17(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
 }
-function installVerifiedBundle(slug, response, meta, corpusOptions, verify) {
+function installVerifiedBundle(slug, response, meta, corpusOptions, verify, exact) {
   return response.arrayBuffer().then((buffer) => {
     const verified = verifyBundleResponseBytes(buffer, response, verify);
+    if (exact?.expectedSha256 && exact.expectedSha256 !== verified.contentHash) {
+      throw new PullSkillError(`Digest proof failed for '${slug}@${exact.version}': the registry records bundle ${exact.expectedSha256.slice(0, 12)}\u2026 but the received bytes hash to ${verified.contentHash.slice(0, 12)}\u2026. Nothing was installed.`);
+    }
+    const served = str(response.headers.get("X-Skill-Version"));
+    if (exact && served && served !== exact.version) {
+      throw new PullSkillError(`Version proof failed for '${slug}': asked for '${exact.version}', the instance served '${served}'. Nothing was installed.`);
+    }
     let entries;
     try {
       entries = unpackSkillBundle(verified.bytes);
     } catch (error) {
       throw new PullSkillError(`Bundle for '${slug}' could not be unpacked: ${error.message}`);
     }
-    const version = str(meta?.version) ?? versionFromEntries(entries) ?? "unknown";
+    const version = exact?.version ?? served ?? str(meta?.version) ?? versionFromEntries(entries) ?? "unknown";
     const sourceCommit = sourceCommitFromEntries(entries);
-    const declaredRevision = verified.revisionId ?? meta?.revisionId;
+    const declaredRevision = exact ? undefined : verified.revisionId ?? meta?.revisionId;
     if (declaredRevision && meta?.revisionId && verified.revisionId && declaredRevision !== meta.revisionId) {
       throw new PullSkillError(`Revision proof failed for '${slug}': the bundle header declares '${verified.revisionId.slice(0, 12)}\u2026' but the metadata declares '${meta.revisionId.slice(0, 12)}\u2026'. The instance is inconsistent. Nothing was installed.`);
     }
@@ -10353,6 +10539,15 @@ function dedupe(values) {
 function str(value) {
   return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+function splitNameVersion(raw) {
+  const trimmed = raw.trim();
+  const at = trimmed.indexOf("@");
+  if (at <= 0)
+    return { name: trimmed };
+  const name = trimmed.slice(0, at);
+  const version = trimmed.slice(at + 1);
+  return version ? { name, version } : { name };
+}
 // src/lib/cli-mcp-parity.ts
 var SKILLS_CLI_MCP_PARITY = [
   {
@@ -10458,11 +10653,11 @@ function findSkillsParityForMcpTool(tool) {
 }
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname8, relative as relative3 } from "path";
+import { dirname as dirname8, relative as relative4 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.1.72",
+  version: "0.2.0",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -10542,7 +10737,7 @@ var package_default = {
   author: "Hasna",
   license: "Apache-2.0",
   devDependencies: {
-    "@types/bun": "latest",
+    "@types/bun": "1.3.14",
     "@types/node": "25.2.3",
     "@types/react": "^18.2.0",
     "bun-types": "1.3.14",
@@ -10554,7 +10749,6 @@ var package_default = {
     "@aws-sdk/client-ecs": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
     "@hasna/events": "0.1.16",
-    "@hasna/paths": "0.1.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
     chalk: "^5.3.0",
     commander: "^12.1.0",
@@ -10594,7 +10788,7 @@ function createRegistrySyncArtifact(options = {}) {
   const registry = [...loadRegistryProfile(profile)].sort((a, b) => a.name.localeCompare(b.name));
   const skills = registry.map((skill) => {
     const skillPath = getSkillPath(skill.name);
-    const directory = relative3(process.cwd(), skillPath) || skillPath;
+    const directory = relative4(process.cwd(), skillPath) || skillPath;
     const validation = includeValidation ? validateSkillDirectory(skill.name, skillPath, skill) : undefined;
     const docs = includeDocs ? buildDocs(skill.name) : undefined;
     return {
@@ -11479,7 +11673,7 @@ function clone2(value) {
   return JSON.parse(JSON.stringify(value));
 }
 // src/lib/feedback.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync11 } from "fs";
+import { appendFileSync, existsSync as existsSync17, mkdirSync as mkdirSync11 } from "fs";
 import { dirname as dirname9, join as join18 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
@@ -11514,6 +11708,15 @@ function saveFeedback(input) {
   if (!message)
     throw new Error("Feedback message is required");
   const category = input.category ?? "general";
+  if (isApiMode()) {
+    const path = join18(getDataDir(), "feedback.jsonl");
+    const dir = dirname9(path);
+    if (!existsSync17(dir))
+      mkdirSync11(dir, { recursive: true });
+    appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
+`);
+    return { saved: true, category, path };
+  }
   const db = getFeedbackDb();
   try {
     db.run("INSERT INTO feedback (message, email, category, agent, version) VALUES (?, ?, ?, ?, ?)", [message, input.email || null, category, input.agent || null, input.version || null]);
@@ -11522,17 +11725,26 @@ function saveFeedback(input) {
   }
   return { saved: true, category, path: getFeedbackDbPath() };
 }
+function isApiMode(env = process.env) {
+  if (env.HASNA_SKILLS_API_URL?.trim())
+    return true;
+  try {
+    return Boolean(resolveApiUrl(undefined, env));
+  } catch {
+    return Boolean(env.SKILLS_API_URL?.trim());
+  }
+}
 // src/lib/native-storage.ts
 import { createHash as createHash5, createHmac as createHmac2 } from "crypto";
 import {
   existsSync as existsSync18,
   mkdirSync as mkdirSync12,
-  readFileSync as readFileSync15,
-  readdirSync as readdirSync9,
-  statSync as statSync9,
+  readFileSync as readFileSync16,
+  readdirSync as readdirSync10,
+  statSync as statSync10,
   writeFileSync as writeFileSync11
 } from "fs";
-import { dirname as dirname10, join as join19, normalize as normalize3, relative as relative4, sep as sep2 } from "path";
+import { dirname as dirname10, join as join19, normalize as normalize3, relative as relative5, sep as sep2 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -11694,8 +11906,8 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const files = [];
   if (existsSync18(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync15(filePath);
-      const relativePath = toPosix(relative4(targetDir, filePath));
+      const bytes = readFileSync16(filePath);
+      const relativePath = toPosix(relative5(targetDir, filePath));
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
@@ -12025,9 +12237,9 @@ function parsePositiveInteger(value) {
 }
 function walkFiles2(dir) {
   const files = [];
-  for (const entry of readdirSync9(dir)) {
+  for (const entry of readdirSync10(dir)) {
     const full = join19(dir, entry);
-    const stats = statSync9(full);
+    const stats = statSync10(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
     else
@@ -12108,15 +12320,15 @@ import { createHash as createHash6 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync16,
-  statSync as statSync11,
+  readFileSync as readFileSync17,
+  statSync as statSync12,
   writeFileSync as writeFileSync12
 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative5, resolve as resolve2, sep as sep4 } from "path";
+import { dirname as dirname11, isAbsolute as isAbsolute3, relative as relative6, resolve as resolve2, sep as sep4 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
-import { readdirSync as readdirSync10, statSync as statSync10 } from "fs";
-import { homedir as homedir6 } from "os";
+import { readdirSync as readdirSync11, statSync as statSync11 } from "fs";
+import { homedir as homedir5 } from "os";
 import { join as join20, sep as sep3 } from "path";
 var SYNC_HOMES = [
   { name: "skills", subClass: "skills", agent: null },
@@ -12208,7 +12420,7 @@ function isPortableWithinSkill(relativeParts) {
   return PORTABLE_SUBDIRS.has(second);
 }
 function homePathFor(definition, homesRoot) {
-  const home = homesRoot ?? homedir6();
+  const home = homesRoot ?? homedir5();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
     return join20(skillsDataRootForHome(home), definition.name);
   }
@@ -12224,7 +12436,7 @@ function destinationFor(definition, stationId, relativePath) {
 function walkEntries(absoluteRoot) {
   let entries;
   try {
-    entries = readdirSync10(absoluteRoot, { withFileTypes: true });
+    entries = readdirSync11(absoluteRoot, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -12253,7 +12465,7 @@ function walkEntries(absoluteRoot) {
 }
 function isRegularFile(filePath) {
   try {
-    return statSync10(filePath).isFile();
+    return statSync11(filePath).isFile();
   } catch {
     return false;
   }
@@ -12279,7 +12491,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash6("sha256").update(readFileSync16(filePath)).digest("hex");
+  return createHash6("sha256").update(readFileSync17(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -12309,7 +12521,7 @@ function scanHome(definition, homesRoot) {
       skipped.push({ relativePath: entry.relativePath, reason: "not-regular-file" });
       continue;
     }
-    const info = statSync11(entry.fullPath);
+    const info = statSync12(entry.fullPath);
     portable.push({
       relativePath: entry.relativePath,
       fullPath: entry.fullPath,
@@ -12377,7 +12589,7 @@ function writeStationSnapshot(options) {
   const untouched = [];
   for (const plan of plans) {
     const destination = resolve2(repoRoot, plan.destination);
-    const destinationRelative = relative5(repoRoot, destination);
+    const destinationRelative = relative6(repoRoot, destination);
     if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep4) || isAbsolute3(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
@@ -12434,9 +12646,9 @@ import { createHash as createHash7 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync14,
-  readdirSync as readdirSync11,
-  readFileSync as readFileSync17,
-  statSync as statSync12,
+  readdirSync as readdirSync12,
+  readFileSync as readFileSync18,
+  statSync as statSync13,
   writeFileSync as writeFileSync13
 } from "fs";
 import { dirname as dirname12, join as join21, resolve as resolve3, sep as sep5 } from "path";
@@ -12454,7 +12666,7 @@ function readSnapshotManifest(repoRoot, stationId) {
   const manifestPath = join21(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync17(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync18(manifestPath, "utf8"));
   } catch (error) {
     fail("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error.message}`);
   }
@@ -12481,7 +12693,7 @@ function planStationHydration(stationId, repoRoot) {
     const agentRoot = join21(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
-      identEntries = readdirSync11(agentRoot, { withFileTypes: true });
+      identEntries = readdirSync12(agentRoot, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -12536,7 +12748,7 @@ function planStationHydration(stationId, repoRoot) {
           });
           continue;
         }
-        const info = statSync12(entry.fullPath);
+        const info = statSync13(entry.fullPath);
         const manifestHash = manifestHashes.get(`${agent}${MANIFEST_HASH_KEY_SEP}${homeRelative}`) ?? null;
         let verified = false;
         if (manifestHash !== null) {
@@ -12590,7 +12802,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync17(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync18(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }