@hasna/skills 0.10.1 → 0.10.3

package/dist/index.js

@@ -6988,7 +6988,7 @@ var require_public_api = __commonJS((exports) => {
 });
 
 // src/lib/registry.ts
-import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync11 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync18, readdirSync as readdirSync11 } from "fs";
 import { join as join29 } from "path";
 
 // src/lib/config.ts
@@ -9091,7 +9091,7 @@ function assertAgentPolicyCollections(policy) {
 
 // src/lib/agent-discovery.ts
 import { createHash as createHash16 } from "crypto";
-import { lstatSync as lstatSync20, readFileSync as readFileSync16, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
+import { lstatSync as lstatSync20, readFileSync as readFileSync17, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
 import { basename as basename8, dirname as dirname16, isAbsolute as isAbsolute14, join as join26, resolve as resolve14, sep as sep5 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 
@@ -9611,7 +9611,7 @@ import { isAbsolute as isAbsolute11, join as join23, resolve as resolve11 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.1",
+  version: "0.10.3",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -11823,7 +11823,9 @@ function tarOctal(field) {
 
 // src/lib/selection-cache.ts
 import { createHash as createHash7, randomUUID } from "crypto";
-import { closeSync as closeSync6, constants as constants3, fstatSync as fstatSync6, fsyncSync, lstatSync as lstatSync9, mkdirSync as mkdirSync3, openSync as openSync6, readSync as readSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { closeSync as closeSync6, constants as constants3, fstatSync as fstatSync6, fsyncSync, lstatSync as lstatSync9, mkdirSync as mkdirSync3, openSync as openSync6, readFileSync as readFileSync9, readlinkSync as readlinkSync2, readSync as readSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { hostname } from "os";
 import { dirname as dirname8, join as join12, parse as parse2, resolve as resolve7 } from "path";
 import { isDeepStrictEqual } from "util";
 
@@ -12124,6 +12126,166 @@ function readSkillSessionSnapshot(sessionId, options = {}) {
 function skillSessionSnapshotBinding(snapshot) {
   return { sessionId: snapshot.sessionId, generation: snapshot.generation, receiptSha256: snapshot.receiptSha256 };
 }
+var SESSION_LOCK_MAX_BYTES = 4096;
+var SESSION_LOCK_MIN_AGE_MS = 30000;
+function localBootId() {
+  try {
+    if (process.platform === "linux") {
+      const value = readFileSync9("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return /^[a-f0-9-]{36}$/i.test(value) ? value : null;
+    }
+    if (process.platform === "darwin") {
+      const result = spawnSync2("/usr/sbin/sysctl", ["-n", "kern.boottime"], { encoding: "utf8", timeout: 3000, env: { LC_ALL: "C" } });
+      if (result.status !== 0 || result.error)
+        return null;
+      const seconds = /\bsec\s*=\s*(\d+)\b/.exec(result.stdout)?.[1];
+      return seconds ? `darwin:${seconds}` : null;
+    }
+  } catch {}
+  return null;
+}
+function processStart(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    return { state: "unknown" };
+  if (process.platform === "linux") {
+    try {
+      const stat = readFileSync9(`/proc/${pid}/stat`, "utf8");
+      const close = stat.lastIndexOf(")");
+      const start = close < 0 ? undefined : stat.slice(close + 2).trim().split(/\s+/)[19];
+      return start && /^\d+$/.test(start) ? { state: "alive", start: `linux:${start}` } : { state: "unknown" };
+    } catch (error) {
+      return { state: error.code === "ENOENT" ? "absent" : "unknown" };
+    }
+  }
+  if (process.platform === "darwin") {
+    const result = spawnSync2("/bin/ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", timeout: 3000, env: { LC_ALL: "C" } });
+    if (result.error || result.signal)
+      return { state: "unknown" };
+    const start = result.stdout.trim();
+    if (result.status === 1 && !start && !result.stderr.trim())
+      return { state: "absent" };
+    return result.status === 0 && start ? { state: "alive", start: `darwin:${start}` } : { state: "unknown" };
+  }
+  return { state: "unknown" };
+}
+function localLockIdentity() {
+  const bootId = localBootId(), owner = processStart(process.pid);
+  if (!bootId || owner.state !== "alive")
+    return null;
+  let pidNamespace;
+  if (process.platform === "linux") {
+    try {
+      pidNamespace = readlinkSync2("/proc/self/ns/pid");
+    } catch {
+      return null;
+    }
+    if (!/^pid:\[\d+\]$/.test(pidNamespace))
+      return null;
+  }
+  return { host: hostname(), bootId, pidNamespace, processStart: owner.start };
+}
+function readSessionLock(sessionId, options) {
+  const path = `${sessionReceiptPath(sessionId, options)}.write-lock`;
+  const before = lstatSync9(path, { throwIfNoEntry: false });
+  if (!before)
+    return null;
+  if (!before.isFile() || before.nlink !== 1 || process.getuid && before.uid !== process.getuid()) {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is not a private regular file; recovery requires review.");
+  }
+  const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
+  const after = lstatSync9(path, { throwIfNoEntry: false });
+  if (!bytes || !after?.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.mtimeMs !== after.mtimeMs) {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock changed during inspection; recovery requires review.");
+  }
+  let marker;
+  try {
+    marker = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is unreadable; recovery requires review.");
+  }
+  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has invalid ownership metadata; recovery requires review.");
+  }
+  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs };
+}
+function writerIsGone(lock, explicitLocalHost) {
+  if (Date.now() - lock.mtimeMs < SESSION_LOCK_MIN_AGE_MS)
+    return false;
+  const owner = processStart(lock.marker.pid);
+  if (owner.state === "unknown")
+    return false;
+  if (lock.marker.schemaVersion === 1)
+    return explicitLocalHost && owner.state === "absent";
+  const local = localLockIdentity();
+  if (!local || lock.marker.host !== local.host || lock.marker.bootId !== local.bootId || lock.marker.pidNamespace !== local.pidNamespace)
+    return false;
+  return owner.state === "absent" || owner.state === "alive" && owner.start !== lock.marker.processStart;
+}
+function archiveSessionLock(lock, receipt, explicitLocalHost) {
+  const guardPath = `${lock.path}.recovery-guard`;
+  let guardFd;
+  try {
+    guardFd = openSync6(guardPath, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  } catch (error) {
+    if (error.code === "EEXIST")
+      return null;
+    throw error;
+  }
+  const guardStat = fstatSync6(guardFd);
+  try {
+    writeFileSync3(guardFd, `${JSON.stringify({ schemaVersion: 1, pid: process.pid, operationId: randomUUID() })}
+`);
+    fsyncSync(guardFd);
+    const cacheOptions = { cacheDir: dirname8(dirname8(lock.path)) };
+    const current = readSessionLock(lock.marker.sessionId, cacheOptions);
+    if (!current || current.dev !== lock.dev || current.ino !== lock.ino || current.sha256 !== lock.sha256 || current.mtimeMs !== lock.mtimeMs || !writerIsGone(current, explicitLocalHost))
+      return null;
+    const currentReceipt = readSkillSessionSnapshotIfExists(lock.marker.sessionId, cacheOptions);
+    if (currentReceipt?.sha256 !== receipt?.sha256 || currentReceipt?.generation !== receipt?.generation)
+      return null;
+    const directory = join12(dirname8(dirname8(lock.path)), "session-lock-recoveries", randomUUID());
+    const archivePath = join12(directory, "original.write-lock");
+    const recordPath = join12(directory, "recovery.json");
+    assertRegularPath(archivePath, true);
+    archiveBytes(recordPath, Buffer.from(`${JSON.stringify({
+      schemaVersion: 1,
+      sessionId: lock.marker.sessionId,
+      originalPath: lock.path,
+      lockSha256: lock.sha256,
+      lockMtime: new Date(lock.mtimeMs).toISOString(),
+      lockPid: lock.marker.pid,
+      receiptSha256: receipt?.sha256 ?? null,
+      receiptGeneration: receipt?.generation ?? null,
+      status: "prepared"
+    })}
+`));
+    syncDirectory(directory);
+    syncDirectory(dirname8(directory));
+    const finalLock = readSessionLock(lock.marker.sessionId, cacheOptions);
+    if (!finalLock || finalLock.dev !== lock.dev || finalLock.ino !== lock.ino || finalLock.sha256 !== lock.sha256 || readSkillSessionSnapshotIfExists(lock.marker.sessionId, cacheOptions)?.sha256 !== receipt?.sha256)
+      return null;
+    let moved = false;
+    try {
+      renameSync(lock.path, archivePath);
+      moved = true;
+      syncDirectory(directory);
+      syncDirectory(dirname8(lock.path));
+      if (sha256Hex(readRegularFile(archivePath, SESSION_LOCK_MAX_BYTES)) !== lock.sha256) {
+        throw new Error("Archived lock bytes changed");
+      }
+    } catch (error) {
+      if (moved)
+        throw new SkillSelectionError("SESSION_LOCK_RECOVERY_INCOMPLETE", "The lock moved, but durable recovery could not be confirmed; inspect the preserved recovery directory and session receipt.");
+      throw error;
+    }
+    return archivePath;
+  } finally {
+    closeSync6(guardFd);
+    const current = lstatSync9(guardPath, { throwIfNoEntry: false });
+    if (current?.isFile() && current.dev === guardStat.dev && current.ino === guardStat.ino)
+      unlinkSync(guardPath);
+  }
+}
 function withSessionWriteLocks(sessionIds, options, action) {
   const operationId = randomUUID();
   const locks = [...new Set(sessionIds)].map((sessionId) => ({ sessionId, path: `${sessionReceiptPath(sessionId, options)}.write-lock` })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
@@ -12143,13 +12305,30 @@ function withSessionWriteLocks(sessionIds, options, action) {
       try {
         fd = openSync6(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
       } catch (error) {
-        if (error.code === "EEXIST")
-          throw new SkillSelectionError("SESSION_WRITE_LOCKED", "Another Skills process owns a required session write lock; retry after it completes. A surviving lock requires explicit recovery review.");
-        throw error;
+        if (error.code !== "EEXIST")
+          throw error;
+        try {
+          const stale = readSessionLock(lock.sessionId, options);
+          const receipt = stale && readSkillSessionSnapshotIfExists(lock.sessionId, options);
+          if (stale?.marker.schemaVersion === 2 && writerIsGone(stale, false)) {
+            archiveSessionLock(stale, receipt, false);
+          }
+        } catch (recoveryError) {
+          if (recoveryError instanceof SkillSelectionError && recoveryError.code === "SESSION_LOCK_RECOVERY_INCOMPLETE")
+            throw recoveryError;
+        }
+        try {
+          fd = openSync6(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+        } catch (retryError) {
+          if (retryError.code === "EEXIST")
+            throw new SkillSelectionError("SESSION_WRITE_LOCKED", "Another Skills process owns a required session write lock; retry after it completes. A surviving legacy lock requires explicit recovery review.");
+          throw retryError;
+        }
       }
       const stat = fstatSync6(fd);
       owned.push({ path: lock.path, fd, dev: stat.dev, ino: stat.ino });
-      writeFileSync3(fd, `${JSON.stringify({ schemaVersion: 1, operationId, sessionId: lock.sessionId, pid: process.pid })}
+      const identity3 = localLockIdentity();
+      writeFileSync3(fd, `${JSON.stringify({ schemaVersion: identity3 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity3 })}
 `);
     }
     return action(assertOwned);
@@ -12268,7 +12447,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 }
 
 // src/lib/dependency-preparation.ts
-import { constants as constants4, closeSync as closeSync7, fstatSync as fstatSync7, lstatSync as lstatSync10, mkdirSync as mkdirSync4, openSync as openSync7, readFileSync as readFileSync9, readdirSync as readdirSync5, rmdirSync, unlinkSync as unlinkSync2, ftruncateSync, writeSync } from "fs";
+import { constants as constants4, closeSync as closeSync7, fstatSync as fstatSync7, lstatSync as lstatSync10, mkdirSync as mkdirSync4, openSync as openSync7, readFileSync as readFileSync10, readdirSync as readdirSync5, rmdirSync, unlinkSync as unlinkSync2, ftruncateSync, writeSync } from "fs";
 import { join as join13 } from "path";
 
 // src/lib/preparation-process.ts
@@ -12342,7 +12521,7 @@ function claimPreparation(skillPath) {
         return;
       if (!lstatSync10(state).isFile() || lstatSync10(state).isSymbolicLink() || lstatSync10(state).size > 1024)
         return;
-      const previous = JSON.parse(readFileSync9(state, "utf8"));
+      const previous = JSON.parse(readFileSync10(state, "utf8"));
       if (previous.version !== 1 || previous.status !== "failed" || Object.keys(previous).length !== 2)
         return;
     }
@@ -12475,11 +12654,11 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync12, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync16 } from "fs";
 import { join as join20 } from "path";
 
 // src/lib/installer.ts
-import { existsSync as existsSync11, readFileSync as readFileSync14, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync15, rmSync as rmSync2 } from "fs";
 import { join as join19 } from "path";
 import { homedir as homedir4 } from "os";
 
@@ -12490,7 +12669,7 @@ import {
   lstatSync as lstatSync15,
   mkdirSync as mkdirSync6,
   mkdtempSync,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   readdirSync as readdirSync8,
   renameSync as renameSync3,
   rmSync,
@@ -12502,7 +12681,7 @@ import { basename as basename5, dirname as dirname11, join as join17 } from "pat
 
 // src/lib/agent-integration.ts
 import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync8, lstatSync as lstatSync14, statSync as statSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync11, readdirSync as readdirSync7, opendirSync as opendirSync3, readlinkSync as readlinkSync2, realpathSync as realpathSync3, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync10, closeSync as closeSync10, fsyncSync as fsyncSync2, fstatSync as fstatSync10, readSync as readSync6, constants as constants7, linkSync } from "fs";
+import { existsSync as existsSync8, lstatSync as lstatSync14, statSync as statSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync7, opendirSync as opendirSync3, readlinkSync as readlinkSync3, realpathSync as realpathSync3, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync10, closeSync as closeSync10, fsyncSync as fsyncSync2, fstatSync as fstatSync10, readSync as readSync6, constants as constants7, linkSync } from "fs";
 import { dirname as dirname10, join as join16, resolve as resolve9, relative as relative4, isAbsolute as isAbsolute9, sep as sep4 } from "path";
 import { homedir as homedir2 } from "os";
 
@@ -12588,7 +12767,7 @@ function requiresCliSkillLoading(dataDir2 = getDataDirReadOnly()) {
 
 // src/lib/agent-bridge.ts
 import { createHash as createHash8 } from "crypto";
-import { lstatSync as lstatSync12, readFileSync as readFileSync10, readdirSync as readdirSync6 } from "fs";
+import { lstatSync as lstatSync12, readFileSync as readFileSync11, readdirSync as readdirSync6 } from "fs";
 import { join as join15 } from "path";
 var CLI_BRIDGE_NAME = "skills-cli";
 var CLI_BRIDGE_VERSION = 1;
@@ -12622,7 +12801,7 @@ function isOwnedCliBridge(path, expectedPaths) {
       return false;
     return Object.entries(CLI_BRIDGE_FILES).every(([name, content]) => {
       const file = join15(path, name), stat = lstatSync12(file);
-      return stat.isFile() && !stat.isSymbolicLink() && stat.size === Buffer.byteLength(content) && readFileSync10(file, "utf8") === content;
+      return stat.isFile() && !stat.isSymbolicLink() && stat.size === Buffer.byteLength(content) && readFileSync11(file, "utf8") === content;
     });
   } catch {
     return false;
@@ -13022,7 +13201,7 @@ function readRootAlias(home, agent) {
   const stat = lstatSync14(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync2(alias), targetPath = resolve9(dirname10(alias), link);
+  const link = readlinkSync3(alias), targetPath = resolve9(dirname10(alias), link);
   assertSafePath(targetPath);
   const targetStat = lstatSync14(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
@@ -13130,8 +13309,8 @@ function selectNativeMigrationTargets(inventory, manifest) {
     if (matches.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
     const entry = matches[0];
-    if (entry.bridge || entry.system || entry.vendor)
-      throw new Error(`Native migration target is protected or vendor-owned: ${entry.path}`);
+    if (entry.bridge || entry.system || entry.vendor !== (target.vendor === true))
+      throw new Error(`Native migration target is protected or vendor classification changed: ${entry.path}`);
     if (entry.hash !== target.treeSha256 || treeHash(entry.path) !== target.treeSha256)
       throw new Error(`Native migration target changed after review: ${entry.path}`);
     selected.push(entry);
@@ -13154,6 +13333,8 @@ function projectAncestorDirectories(projects) {
   return [...directories];
 }
 function inventoryNativeSkills(home = homedir2(), options = {}) {
+  if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute9(options.reviewedCacheAlias) || resolve9(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
+    throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
   const aliases = rootAliases(home, options.allowRootAliases);
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
@@ -13174,14 +13355,22 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     if (discoveryPathBytes > 4 * 1024 * 1024)
       throw new Error("Native skill discovery metadata limit exceeded");
   }
-  function emptySiblingCacheAlias(path, parent) {
-    const link = readlinkSync2(path), target = resolve9(parent, link);
+  let reviewedCacheAliasFound = false;
+  function verifiedSiblingCacheAlias(path, parent) {
+    const link = readlinkSync3(path), target = resolve9(parent, link);
     if (dirname10(target) !== parent || (isAbsolute9(link) ? link !== target : dirname10(link) !== "."))
       return false;
     if (!lstatSync14(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
-    return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
+    if (!scan?.complete || scan.entries > maxAliasProofEntries)
+      return false;
+    if (scan.hasSkills) {
+      if (path !== options.reviewedCacheAlias)
+        return false;
+      reviewedCacheAliasFound = true;
+    }
+    return true;
   }
   function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
     if (!admitted)
@@ -13204,7 +13393,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       const marker = join16(path, ".hasna-skills.json");
       if (existsSync8(marker)) {
         try {
-          managed = JSON.parse(readFileSync11(marker, "utf8")).managedBy === "@hasna/skills";
+          managed = JSON.parse(readFileSync12(marker, "utf8")).managedBy === "@hasna/skills";
         } catch {}
       }
       const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
@@ -13238,7 +13427,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       const child = join16(path, name);
       if (isVendor && lstatSync14(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync7(child, { throwIfNoEntry: false });
-        if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
+        if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(child, path)) {
           scan.entries++;
           continue;
         }
@@ -13272,12 +13461,14 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   for (const root of [...options.agentRoots ?? [], ...configured])
     if (includesAgent(root.agent))
       scanRoot(root.agent, canonicalAgentPath(root.path, aliases), true);
+  if (options.reviewedCacheAlias !== undefined && !reviewedCacheAliasFound)
+    throw new Error("Reviewed cache alias was not an inventoried skill-containing sibling alias");
   recheckRootAliases(aliases);
   return entries;
 }
 function readOptional(path) {
   assertSafePath(path);
-  return existsSync8(path) ? readFileSync11(path, "utf8") : null;
+  return existsSync8(path) ? readFileSync12(path, "utf8") : null;
 }
 function jsonObject(text2, path) {
   if (text2 === null)
@@ -13989,7 +14180,7 @@ function hasSkillsOwnershipMarker(dir) {
   try {
     if (!lstatSync15(path).isFile())
       return false;
-    const marker = JSON.parse(readFileSync12(path, "utf8"));
+    const marker = JSON.parse(readFileSync13(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
   } catch {
     return false;
@@ -14198,7 +14389,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   if (dirExists && managed && hasSkillMd && !options.force && isPointerSkillMd(skillMd)) {
     let existingIsStub = false;
     try {
-      existingIsStub = isPointerSkillMd(readFileSync12(skillMdPath, "utf-8"));
+      existingIsStub = isPointerSkillMd(readFileSync13(skillMdPath, "utf-8"));
     } catch {
       existingIsStub = false;
     }
@@ -14278,7 +14469,7 @@ function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = f
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
     const skillMdPath = join17(skillPath, "SKILL.md");
     if (existsSync9(skillMdPath))
-      return readFileSync12(skillMdPath, "utf-8");
+      return readFileSync13(skillMdPath, "utf-8");
   }
   return pointerSkillMd(name, description);
 }
@@ -14318,7 +14509,7 @@ function resolveSkillAlias(name) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
 import { join as join18 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
@@ -14344,7 +14535,7 @@ function loadProjectConfig(targetDir = process.cwd()) {
   if (!existsSync10(path))
     return null;
   try {
-    return normalizeProjectConfig(JSON.parse(readFileSync13(path, "utf-8")));
+    return normalizeProjectConfig(JSON.parse(readFileSync14(path, "utf-8")));
   } catch {
     return null;
   }
@@ -14531,7 +14722,7 @@ function createLocalSkillManifest(name, generateSkillMd) {
   let skillMd = "";
   const skillMdPath = join19(sourcePath, "SKILL.md");
   if (existsSync11(skillMdPath)) {
-    skillMd = readFileSync14(skillMdPath, "utf-8");
+    skillMd = readFileSync15(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
     skillMd = generateSkillMd(name) ?? "";
   } else {
@@ -14650,7 +14841,7 @@ function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
   const skillMdPath = join19(sourcePath, "SKILL.md");
   if (existsSync11(skillMdPath))
-    return readFileSync14(skillMdPath, "utf-8");
+    return readFileSync15(skillMdPath, "utf-8");
   if (generateSkillMd)
     return generateSkillMd(name);
   return generateMinimalSkillMd(name);
@@ -14706,14 +14897,14 @@ function readBundledSkillVersion(name) {
   if (!existsSync11(pkgPath))
     return "unknown";
   try {
-    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
     return pkg.version || "unknown";
   } catch {
     return "unknown";
   }
 }
 function readFileIfExists(path) {
-  return existsSync11(path) ? readFileSync14(path, "utf-8") : null;
+  return existsSync11(path) ? readFileSync15(path, "utf-8") : null;
 }
 function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
@@ -14761,7 +14952,7 @@ function isInstructionSkillDir(skillPath, meta) {
   if (!existsSync12(skillMdPath))
     return false;
   try {
-    return parseSkillFrontmatter(readFileSync15(skillMdPath, "utf-8"))?.kind === "instruction";
+    return parseSkillFrontmatter(readFileSync16(skillMdPath, "utf-8"))?.kind === "instruction";
   } catch {
     return false;
   }
@@ -14812,7 +15003,7 @@ function getSkillRequirements(name) {
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync15(join20(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync16(join20(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -14880,7 +15071,7 @@ async function runSkill(name, args, options = {}) {
   }
   let entryPoint2;
   try {
-    const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync16(pkgPath, "utf-8"));
     if (pkg.bin) {
       const binValues = Object.values(pkg.bin);
       entryPoint2 = binValues[0];
@@ -14983,7 +15174,7 @@ function generateSkillMd(name) {
   const pkgPath = join20(skillPath, "package.json");
   if (existsSync12(pkgPath)) {
     try {
-      const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
+      const pkg = JSON.parse(readFileSync16(pkgPath, "utf-8"));
       if (pkg.bin) {
         const binKeys = Object.keys(pkg.bin);
         if (binKeys.length > 0)
@@ -15059,7 +15250,7 @@ function extractEnvVars(text2) {
 function readIfExists(path) {
   try {
     if (existsSync12(path)) {
-      return readFileSync15(path, "utf-8");
+      return readFileSync16(path, "utf-8");
     }
   } catch {}
   return null;
@@ -16569,7 +16760,7 @@ function read2(path, changes) {
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
     throw new Error(`Unsupported or oversized native discovery input: ${path}`);
-  return readFileSync16(path, "utf8");
+  return readFileSync17(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
@@ -17660,7 +17851,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         continue;
       let content;
       try {
-        content = readFileSync17(skillMdPath, "utf-8");
+        content = readFileSync18(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -17697,7 +17888,7 @@ function findExtensionSkillPath(name) {
         continue;
       let content;
       try {
-        content = readFileSync17(skillMdPath, "utf-8");
+        content = readFileSync18(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -17762,7 +17953,7 @@ function getAllTags() {
 }
 // src/lib/run-state.ts
 import { createHash as createHash17, randomBytes } from "crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync18, readdirSync as readdirSync12, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync19, readdirSync as readdirSync12, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
 import { extname, join as join30, relative as relative6 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
@@ -17834,7 +18025,7 @@ function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
   const path = join30(context.runDir, "events.ndjson");
-  const previous = existsSync15(path) ? readFileSync18(path, "utf-8") : "";
+  const previous = existsSync15(path) ? readFileSync19(path, "utf-8") : "";
   writeFileSync9(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
@@ -17884,7 +18075,7 @@ function collectRunArtifacts(context) {
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
     const stat2 = statSync10(path);
-    const bytes = readFileSync18(path);
+    const bytes = readFileSync19(path);
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
@@ -17899,7 +18090,7 @@ function readRunRecord(runDir) {
   if (!existsSync15(path))
     return null;
   try {
-    return JSON.parse(readFileSync18(path, "utf-8"));
+    return JSON.parse(readFileSync19(path, "utf-8"));
   } catch {
     return null;
   }
@@ -18069,7 +18260,7 @@ __export(exports_external, {
   input: () => input,
   includes: () => _includes,
   httpUrl: () => httpUrl,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   hex: () => hex2,
   hash: () => hash2,
   guid: () => guid2,
@@ -19855,7 +20046,7 @@ __export(exports_regexes, {
   idnEmail: () => idnEmail,
   httpProtocol: () => httpProtocol,
   html5Email: () => html5Email,
-  hostname: () => hostname,
+  hostname: () => hostname2,
   hex: () => hex,
   guid: () => guid,
   extendedDuration: () => extendedDuration,
@@ -19917,7 +20108,7 @@ var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]
 var cidrv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))\/(12[0-8]|1[01][0-9]|[1-9]?[0-9])$/;
 var base64 = /^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/;
 var base64url = /^[A-Za-z0-9_-]*$/;
-var hostname = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
+var hostname2 = /^(?=.{1,253}\.?$)[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-0-9a-zA-Z]{0,61}[0-9a-zA-Z])?)*\.?$/;
 var domain = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/;
 var httpProtocol = /^https?$/;
 var e164 = /^\+[1-9]\d{6,14}$/;
@@ -20754,9 +20945,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url, hostname2) {
-  hostname2.lastIndex = 0;
-  return hostname2.test(url.hostname);
+function urlHostnameOk(url, hostname3) {
+  hostname3.lastIndex = 0;
+  return hostname3.test(url.hostname);
 }
 function urlProtocolOk(url, protocol) {
   protocol.lastIndex = 0;
@@ -34144,7 +34335,7 @@ __export(exports_schemas2, {
   int: () => int,
   instanceof: () => _instanceof,
   httpUrl: () => httpUrl,
-  hostname: () => hostname2,
+  hostname: () => hostname3,
   hex: () => hex2,
   hash: () => hash2,
   guid: () => guid2,
@@ -34854,7 +35045,7 @@ var ZodCustomStringFormat = /* @__PURE__ */ $constructor("ZodCustomStringFormat"
 function stringFormat(format, fnOrRegex, _params = {}) {
   return _stringFormat(ZodCustomStringFormat, format, fnOrRegex, _params);
 }
-function hostname2(_params) {
+function hostname3(_params) {
   return _stringFormat(ZodCustomStringFormat, "hostname", exports_regexes.hostname, _params);
 }
 function hex2(_params) {
@@ -39414,7 +39605,7 @@ async function createRemoteSkillsClient(env = process.env) {
   return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
 }
 // src/lib/scheduler.ts
-import { existsSync as existsSync16, readFileSync as readFileSync19, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync20, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "fs";
 import { join as join31 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join31(targetDir, ".skills", "schedules.json");
@@ -39423,7 +39614,7 @@ function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   if (existsSync16(path)) {
     try {
-      return JSON.parse(readFileSync19(path, "utf-8"));
+      return JSON.parse(readFileSync20(path, "utf-8"));
     } catch {}
   }
   return { version: 1, schedules: [] };
@@ -39646,7 +39837,7 @@ function revisionIdOfRecord(record7) {
   return revisionIdOf(record7);
 }
 // src/lib/pull.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync20, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname19, join as join32 } from "path";
 
 // src/lib/skill-bundles.ts
@@ -39846,7 +40037,7 @@ function reconcileTombstone(slug2, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync20(join32(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync21(join32(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
@@ -42098,7 +42289,7 @@ import { createHash as createHash21, createHmac as createHmac2 } from "crypto";
 import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync15,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync13,
   statSync as statSync11,
   writeFileSync as writeFileSync13
@@ -42265,7 +42456,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const files = [];
   if (existsSync19(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync21(filePath);
+      const bytes = readFileSync23(filePath);
       const relativePath = toPosix(relative8(targetDir, filePath));
       files.push({
         path: relativePath,
@@ -42683,7 +42874,7 @@ import { createHash as createHash22 } from "crypto";
 import {
   copyFileSync,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync23,
+  readFileSync as readFileSync25,
   statSync as statSync13,
   writeFileSync as writeFileSync14
 } from "fs";
@@ -42854,7 +43045,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash22("sha256").update(readFileSync23(filePath)).digest("hex");
+  return createHash22("sha256").update(readFileSync25(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -43010,7 +43201,7 @@ import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync17,
   readdirSync as readdirSync15,
-  readFileSync as readFileSync25,
+  readFileSync as readFileSync26,
   statSync as statSync14,
   writeFileSync as writeFileSync15
 } from "fs";
@@ -43029,7 +43220,7 @@ function readSnapshotManifest(repoRoot, stationId) {
   const manifestPath = join36(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync25(manifestPath, "utf8"));
+    manifest = JSON.parse(readFileSync26(manifestPath, "utf8"));
   } catch (error61) {
     fail("MANIFEST_UNREADABLE", `cannot read snapshot manifest: ${manifestPath}: ${error61.message}`);
   }
@@ -43165,7 +43356,7 @@ function planStationHydration(stationId, repoRoot) {
         for (const copy of copies) {
           let isStub = false;
           try {
-            isStub = isPointerSkillMd(readFileSync25(copy.fullPath, "utf8"));
+            isStub = isPointerSkillMd(readFileSync26(copy.fullPath, "utf8"));
           } catch {
             isStub = false;
           }