@hasna/skills 0.10.28 → 0.10.30

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.28",
+    version: "0.10.30",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -38184,6 +38184,8 @@ var init_native_discovery_roots = __esm(() => {
     ["codex", ".codex/skills"],
     ["codex", ".agents/skills"],
     ["gemini", ".gemini/skills"],
+    ["sumi", ".sumi/skills"],
+    ["sumi", ".sumi/skill"],
     ["codewith", ".codewith/skills"],
     ["opencode", ".config/opencode/skills"],
     ["opencode", ".opencode/skills"],
@@ -38201,7 +38203,7 @@ var init_native_discovery_roots = __esm(() => {
 // src/lib/agent-adapters.ts
 var INTEGRATION_AGENTS;
 var init_agent_adapters = __esm(() => {
-  INTEGRATION_AGENTS = ["claude", "codex", "gemini", "opencode", "cursor", "hermes"];
+  INTEGRATION_AGENTS = ["claude", "codex", "gemini", "opencode", "cursor", "hermes", "sumi"];
 });
 
 // src/lib/agent-policy-limits.ts
@@ -48092,6 +48094,38 @@ var init_agent_bridge = __esm(() => {
 // src/lib/agent-codex.ts
 var init_agent_codex = () => {};
 
+// src/lib/agent-sumi.ts
+import { existsSync as existsSync8, lstatSync as lstatSync13, realpathSync as realpathSync4 } from "fs";
+import { join as join18, resolve as resolve10 } from "path";
+function sumiConfigDirectory(home, env = process.env) {
+  for (const key of ["SUMI_CONFIG", "SUMI_CONFIG_CONTENT"])
+    if (env[key] !== undefined)
+      throw new Error(`Sumi ${key} requires a dedicated discovery adapter; unset it before Skills integration`);
+  const selected = (key) => env[key]?.trim() ? env[key] : undefined;
+  const expand = (value) => resolve10(value === "~" ? home : value.startsWith("~/") ? join18(home, value.slice(2)) : value);
+  const explicit = selected("SUMI_CONFIG_DIR");
+  const xdg = selected("XDG_CONFIG_HOME");
+  const custom2 = selected("SUMI_HOME");
+  const canonical5 = explicit ? expand(explicit) : xdg ? join18(expand(xdg), "sumi") : join18(custom2 ? expand(custom2) : join18(home, ".hasna-internal/sumi"), "config");
+  if (explicit || xdg || custom2)
+    return canonical5;
+  const legacy = join18(home, ".config/sumi");
+  const a = lstatSync13(canonical5, { throwIfNoEntry: false }), b = lstatSync13(legacy, { throwIfNoEntry: false });
+  if (a && b && realpathSync4(canonical5) !== realpathSync4(legacy))
+    throw new Error("Sumi config roots conflict; complete native home adoption before Skills integration");
+  const path = a ? canonical5 : b ? legacy : canonical5;
+  if (!existsSync8(path))
+    return path;
+  const physical = realpathSync4(path);
+  if ((a?.isSymbolicLink() || b?.isSymbolicLink()) && ![canonical5, legacy].includes(physical))
+    throw new Error("Sumi config alias must resolve to its canonical or legacy root");
+  return physical;
+}
+function sumiConfigPath(home) {
+  return join18(sumiConfigDirectory(home), "sumi.json");
+}
+var init_agent_sumi = () => {};
+
 // src/lib/agent-integration.ts
 var init_agent_integration = __esm(() => {
   init_codex_plugin_skill_controls();
@@ -48105,6 +48139,7 @@ var init_agent_integration = __esm(() => {
   init_agent_discovery();
   init_agent_adapters();
   init_agent_codex();
+  init_agent_sumi();
   init_agent_hermes();
   init_claude_settings_witness();
 });
@@ -48142,17 +48177,17 @@ var init_skill_aliases = __esm(() => {
 });
 
 // src/lib/project-state.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
+import { join as join19 } from "path";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join18(targetDir, SKILLS_PROJECT_DIR);
+  return join19(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join18(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join19(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
-  if (!existsSync8(path))
+  if (!existsSync9(path))
     return null;
   try {
     return normalizeProjectConfig(JSON.parse(readFileSync12(path, "utf-8")));
@@ -48263,8 +48298,8 @@ var init_project_state = __esm(() => {
 });
 
 // src/lib/installer.ts
-import { existsSync as existsSync9, readFileSync as readFileSync13, rmSync } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync13, rmSync } from "fs";
+import { join as join20 } from "path";
 import { homedir as homedir2 } from "os";
 function getSkillPath(name) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
@@ -48274,7 +48309,7 @@ function getSkillPath(name) {
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join19(getPortableSkillsRoot(), skillName);
+  return join20(getPortableSkillsRoot(), skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -48283,7 +48318,7 @@ function installSkill(name, options = {}) {
   const { targetDir = process.cwd(), overwrite = false } = options;
   const canonicalName = getCanonicalSkillName(name);
   const skillName = normalizeSkillName(canonicalName);
-  if (!existsSync9(getSkillPath(name))) {
+  if (!existsSync10(getSkillPath(name))) {
     const knownOfficial = Boolean(getSkill(name));
     return {
       skill: canonicalName,
@@ -48328,11 +48363,11 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join19(base, ".pi", "skills") : join19(homedir2(), ".pi", "agent", "skills");
+      return scope === "project" ? join20(base, ".pi", "skills") : join20(homedir2(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join19(base, ".opencode", "skills") : join19(homedir2(), ".config", "opencode", "skills");
+      return scope === "project" ? join20(base, ".opencode", "skills") : join20(homedir2(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join19(base, `.${agent}`, "skills") : join19(homedir2(), `.${agent}`, "skills");
+      return scope === "project" ? join20(base, `.${agent}`, "skills") : join20(homedir2(), `.${agent}`, "skills");
   }
 }
 function warnMissingDependencies(name, targetDir) {
@@ -48347,8 +48382,8 @@ function warnMissingDependencies(name, targetDir) {
   }
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join19(getSkillPath(name), "package.json");
-  if (!existsSync9(pkgPath))
+  const pkgPath = join20(getSkillPath(name), "package.json");
+  if (!existsSync10(pkgPath))
     return "unknown";
   try {
     const pkg = JSON.parse(readFileSync13(pkgPath, "utf-8"));
@@ -48415,13 +48450,13 @@ var init_skill_doc_file = __esm(() => {
 });
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync14 } from "fs";
+import { join as join21 } from "path";
 function isInstructionSkillDir(skillPath, meta3) {
   if (meta3?.kind === "instruction")
     return true;
-  const skillMdPath = join20(skillPath, "SKILL.md");
-  if (!existsSync10(skillMdPath))
+  const skillMdPath = join21(skillPath, "SKILL.md");
+  if (!existsSync11(skillMdPath))
     return false;
   try {
     return parseSkillFrontmatter(readFileSync14(skillMdPath, "utf-8"))?.kind === "instruction";
@@ -48431,12 +48466,12 @@ function isInstructionSkillDir(skillPath, meta3) {
 }
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync10(skillPath))
+  if (!existsSync11(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join20(skillPath, "SKILL.md")),
-    readme: readIfExists(join20(skillPath, "README.md")),
-    claudeMd: readIfExists(join20(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join21(skillPath, "SKILL.md")),
+    readme: readIfExists(join21(skillPath, "README.md")),
+    claudeMd: readIfExists(join21(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name, file2) {
@@ -48448,18 +48483,18 @@ function getSkillBestDoc(name, file2) {
 }
 function getSkillRequirements(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync10(skillPath))
+  if (!existsSync11(skillPath))
     return null;
   const texts = [];
   for (const file2 of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join20(skillPath, file2));
+    const content = readIfExists(join21(skillPath, file2));
     if (content)
       texts.push(content);
   }
   const meta3 = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync14(join20(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync14(join21(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta3);
 }
@@ -48512,7 +48547,7 @@ async function runSkill(name, args, options = {}) {
   const meta3 = getSkill(name);
   const canonicalName = meta3?.name ?? name;
   const skillPath = getSkillPath(canonicalName);
-  if (!existsSync10(skillPath)) {
+  if (!existsSync11(skillPath)) {
     return { exitCode: 1, error: `Skill '${name}' not found` };
   }
   if (isInstructionSkillDir(skillPath, meta3)) {
@@ -48521,8 +48556,8 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join20(skillPath, "package.json");
-  if (!existsSync10(pkgPath)) {
+  const pkgPath = join21(skillPath, "package.json");
+  if (!existsSync11(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint2;
@@ -48541,12 +48576,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join20(skillPath, entryPoint2);
-  if (!existsSync10(entryPath)) {
+  const entryPath = join21(skillPath, entryPoint2);
+  if (!existsSync11(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint2}' not found in skill '${name}'` };
   }
   const env = { ...process.env, ...options.env };
-  if (!existsSync10(join20(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync11(join21(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -48572,7 +48607,7 @@ async function runSkill(name, args, options = {}) {
 function detectProjectSkills(cwd = process.cwd()) {
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync14(join20(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync14(join21(cwd, "package.json"), "utf8"));
   } catch {
     return { detected: [], recommended: [] };
   }
@@ -48610,7 +48645,7 @@ function extractEnvVars(text2) {
 }
 function readIfExists(path) {
   try {
-    if (existsSync10(path)) {
+    if (existsSync11(path)) {
       return readFileSync14(path, "utf-8");
     }
   } catch {}
@@ -48667,6 +48702,8 @@ var init_selected_document = __esm(() => {
 async function resolveSelectionContext(profileId, options = {}) {
   const sessionState = options.sessionId ? readSkillSessionSnapshotIfExists(options.sessionId, options) : null;
   const session = sessionState?.receipt ?? null;
+  if (options.nativeParentSessionId !== undefined && session && (session.parent?.sessionId ?? null) !== options.nativeParentSessionId)
+    throw new SkillSelectionError("SESSION_PARENT_MISMATCH", "The native session id is already bound to different parent custody.");
   const parentState = !session && options.parentSessionId ? readSkillSessionSnapshotIfExists(options.parentSessionId, options) : null;
   if (!session && options.parentSessionId && !parentState) {
     throw new SkillSelectionError("SESSION_PARENT_NOT_FOUND", "A child Skills session requires an existing parent receipt so its inherited pin can be bound exactly.");
@@ -48860,11 +48897,11 @@ var init_plugin_projection = __esm(() => {
 });
 
 // src/lib/plugin-projection-store.ts
-import { constants as constants7, closeSync as closeSync10, fchmodSync, fstatSync as fstatSync10, fsyncSync as fsyncSync2, linkSync, lstatSync as lstatSync13, mkdirSync as mkdirSync6, openSync as openSync10, opendirSync as opendirSync2, readSync as readSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, rmSync as rmSync2, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute9, join as join21, parse as parse9, resolve as resolve10 } from "path";
+import { constants as constants7, closeSync as closeSync10, fchmodSync, fstatSync as fstatSync10, fsyncSync as fsyncSync2, linkSync, lstatSync as lstatSync14, mkdirSync as mkdirSync6, openSync as openSync10, opendirSync as opendirSync2, readSync as readSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, rmSync as rmSync2, unlinkSync as unlinkSync3, writeSync as writeSync2 } from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute9, join as join22, parse as parse9, resolve as resolve11 } from "path";
 function stat(path) {
   try {
-    return lstatSync13(path, { bigint: true });
+    return lstatSync14(path, { bigint: true });
   } catch (error61) {
     if (missing(error61))
       return null;
@@ -48872,7 +48909,7 @@ function stat(path) {
   }
 }
 function canonical5(path) {
-  pluginNeed(typeof path === "string" && path.length <= 8192 && isAbsolute9(path) && resolve10(path) === path && !/[\x00-\x1f\x7f]/.test(path), "Plugin storage paths must be canonical absolute paths");
+  pluginNeed(typeof path === "string" && path.length <= 8192 && isAbsolute9(path) && resolve11(path) === path && !/[\x00-\x1f\x7f]/.test(path), "Plugin storage paths must be canonical absolute paths");
 }
 function owner(stats, system = false) {
   const current = uid();
@@ -48887,7 +48924,7 @@ function ancestors(path, create = false) {
   let current = filesystemRoot;
   for (const segment of ["", ...parent.slice(filesystemRoot.length).split("/").filter(Boolean)]) {
     if (segment)
-      current = join21(current, segment);
+      current = join22(current, segment);
     let currentStat = stat(current);
     if (!currentStat && create) {
       try {
@@ -48995,7 +49032,7 @@ function snapshotPluginTree(root, options = {}) {
       pluginNeed(++visited <= PLUGIN_PROJECTION_LIMITS.files * 50, "Plugin tree membership exceeds its limit");
       const path = relative5 ? `${relative5}/${name}` : name;
       pluginNeed(new TextEncoder().encode(path).byteLength <= 100 && !/[\\:\x00-\x1f\x7f]/u.test(path), "Plugin entry path exceeds its limit or is unsafe");
-      const absolute = join21(directory, name), entryStat = stat(absolute);
+      const absolute = join22(directory, name), entryStat = stat(absolute);
       pluginNeed(entryStat, "Plugin tree member disappeared");
       if (relative5 === "" && name === ".orphaned_at" && (options.nativeRuntime === "claude-2.1.274" || options.nativeRuntime === "claude-2.1.276")) {
         const bytes2 = readBytes(absolute, 32, "native-pin");
@@ -49012,7 +49049,7 @@ function snapshotPluginTree(root, options = {}) {
         directories.push({ path: absolute, stat: entryStat, names: pins });
         for (const pin of pins) {
           pluginNeed(/^[1-9][0-9]{0,9}$/.test(pin) && Number(pin) <= 2147483647, "Unrecognized native plugin pin name");
-          const pinPath = join21(absolute, pin), pinStat = stat(pinPath);
+          const pinPath = join22(absolute, pin), pinStat = stat(pinPath);
           pluginNeed(pinStat, "Native plugin pin disappeared");
           const bytes2 = readBytes(pinPath, 4096, "native-pin");
           let value;
@@ -49109,7 +49146,7 @@ var init_selected_manifest = __esm(() => {
 });
 
 // src/lib/plugin-admission.ts
-import { isAbsolute as isAbsolute10, join as join22, resolve as resolve11 } from "path";
+import { isAbsolute as isAbsolute10, join as join23, resolve as resolve12 } from "path";
 function validatePluginTarget(value) {
   pluginKeys(value, ["schemaVersion", "pluginId", "registrations", "native", "resolver"]);
   pluginNeed(value.schemaVersion === 1, "Invalid plugin admission target");
@@ -49119,7 +49156,7 @@ function validatePluginTarget(value) {
   for (const registration of value.registrations) {
     pluginKeys(registration, ["scope", "projectPath"]);
     pluginNeed(registration.scope === "user" || registration.scope === "project", "Unsupported plugin registration scope");
-    pluginNeed(registration.scope === "user" ? registration.projectPath === null : typeof registration.projectPath === "string" && isAbsolute10(registration.projectPath) && resolve11(registration.projectPath) === registration.projectPath, "Plugin scope requires its exact project path");
+    pluginNeed(registration.scope === "user" ? registration.projectPath === null : typeof registration.projectPath === "string" && isAbsolute10(registration.projectPath) && resolve12(registration.projectPath) === registration.projectPath, "Plugin scope requires its exact project path");
     const key = JSON.stringify([registration.scope, registration.projectPath]);
     pluginNeed(!scopes.has(key), "Duplicate plugin registration scope");
     scopes.add(key);
@@ -49127,7 +49164,7 @@ function validatePluginTarget(value) {
   for (const key of ["native", "resolver"]) {
     pluginKeys(value[key], key === "native" ? ["version", "executable", "digest"] : ["executable", "digest"]);
     pluginText(value[key].executable);
-    pluginNeed(isAbsolute10(value[key].executable) && resolve11(value[key].executable) === value[key].executable, "Plugin executable must have a canonical absolute path");
+    pluginNeed(isAbsolute10(value[key].executable) && resolve12(value[key].executable) === value[key].executable, "Plugin executable must have a canonical absolute path");
     pluginDigest(value[key].digest);
   }
   pluginNeed(["2.1.274", "2.1.276"].includes(value.native.version), "Plugin admission requires a certified Claude command-source runtime (2.1.274 or 2.1.276)");
@@ -49270,12 +49307,12 @@ function pluginResolverCommand(binding) {
 }
 function pluginBindingPath(storeRoot, id) {
   pluginNeed(/^[a-f0-9]{64}$/.test(id), "Invalid plugin binding identifier");
-  return join22(storeRoot, "bindings", `${id}.json`);
+  return join23(storeRoot, "bindings", `${id}.json`);
 }
 function pluginReceiptPath(storeRoot, id, digest) {
   pluginNeed(/^[a-f0-9]{64}$/.test(id), "Invalid plugin binding identifier");
   pluginDigest(digest);
-  return join22(storeRoot, "receipts", id, `${digest.slice(7)}.json`);
+  return join23(storeRoot, "receipts", id, `${digest.slice(7)}.json`);
 }
 function readPluginBinding(storeRoot, id) {
   const value = readPluginJson(pluginBindingPath(storeRoot, id));
@@ -49295,7 +49332,7 @@ function readPluginAdmissionReceipt(storeRoot, id, digest) {
   pluginNeed(receipt.plan.bindingId === id && receipt.plan.planDigest === digest, "Plugin receipt identity differs from its filename");
   const binding = readPluginBinding(storeRoot, id);
   pluginNeed(canonicalJson(binding) === canonicalJson(receipt.plan.binding) && receipt.plan.sourceCommand === pluginResolverCommand(binding), "Plugin receipt binding changed");
-  pluginNeed(receipt.materializedPath === join22(storeRoot, "objects", id, digest.slice(7)), "Plugin receipt points outside its immutable materialization");
+  pluginNeed(receipt.materializedPath === join23(storeRoot, "objects", id, digest.slice(7)), "Plugin receipt points outside its immutable materialization");
   pluginText(receipt.admittedAt, 64);
   pluginNeed(Number.isFinite(Date.parse(receipt.admittedAt)), "Invalid plugin admission time");
   return receipt;
@@ -49312,8 +49349,8 @@ var init_plugin_admission = __esm(() => {
 });
 
 // src/lib/plugin-discovery.ts
-import { closeSync as closeSync11, constants as constants8, fstatSync as fstatSync11, lstatSync as lstatSync14, openSync as openSync11, opendirSync as opendirSync3, readSync as readSync7 } from "fs";
-import { basename as basename6, dirname as dirname12, isAbsolute as isAbsolute11, join as join23, resolve as resolve12 } from "path";
+import { closeSync as closeSync11, constants as constants8, fstatSync as fstatSync11, lstatSync as lstatSync15, openSync as openSync11, opendirSync as opendirSync3, readSync as readSync7 } from "fs";
+import { basename as basename6, dirname as dirname12, isAbsolute as isAbsolute11, join as join24, resolve as resolve13 } from "path";
 function validateManagedPluginWitnesses(value) {
   pluginNeed(Array.isArray(value) && value.length > 0 && value.length <= PLUGIN_PROJECTION_LIMITS.registrations, "Invalid managed plugin witness collection");
   const seen = new Set;
@@ -49322,21 +49359,21 @@ function validateManagedPluginWitnesses(value) {
     pluginNeed(typeof item.bindingId === "string" && /^[a-f0-9]{64}$/.test(item.bindingId) && !seen.has(item.bindingId), "Invalid or duplicate managed plugin witness");
     seen.add(item.bindingId);
     pluginText(item.storeRoot);
-    pluginNeed(isAbsolute11(item.storeRoot) && resolve12(item.storeRoot) === item.storeRoot, "Invalid plugin receipt store path");
+    pluginNeed(isAbsolute11(item.storeRoot) && resolve13(item.storeRoot) === item.storeRoot, "Invalid plugin receipt store path");
   }
 }
 function safe3(path) {
   pluginText(path);
-  pluginNeed(isAbsolute11(path) && resolve12(path) === path, "Invalid plugin registry path");
+  pluginNeed(isAbsolute11(path) && resolve13(path) === path, "Invalid plugin registry path");
   for (let at = path;; at = dirname12(at)) {
-    pluginNeed(!lstatSync14(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
+    pluginNeed(!lstatSync15(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
     if (at === dirname12(at))
       break;
   }
 }
 function readRegistry(path) {
   safe3(path);
-  const initial = lstatSync14(path);
+  const initial = lstatSync15(path);
   pluginNeed(initial.isFile() && initial.size <= 1024 * 1024, "Plugin registry is not a bounded regular file");
   const fd = openSync11(path, constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK);
   try {
@@ -49350,7 +49387,7 @@ function readRegistry(path) {
         break;
       length += count;
     }
-    const after = fstatSync11(fd), current = lstatSync14(path);
+    const after = fstatSync11(fd), current = lstatSync15(path);
     safe3(path);
     pluginNeed(length <= 1024 * 1024 && length === opened.size && after.size === opened.size && after.mtimeMs === opened.mtimeMs && after.ctimeMs === opened.ctimeMs && current.dev === opened.dev && current.ino === opened.ino && current.mtimeMs === opened.mtimeMs && current.ctimeMs === opened.ctimeMs, "Plugin registry changed during read");
     let value;
@@ -49380,7 +49417,7 @@ function hashManagedPluginRegistry(path, managed) {
     seen.add(target.pluginId);
     const rows = plugins[target.pluginId];
     pluginNeed(Array.isArray(rows) && rows.length === target.registrations.length, "Managed plugin registration membership changed");
-    const [name, market] = target.pluginId.split("@"), cacheRoot = join23(dirname12(path), "cache", market, name);
+    const [name, market] = target.pluginId.split("@"), cacheRoot = join24(dirname12(path), "cache", market, name);
     const scopes = new Set, approvals = new Map, currentFiles = new Map;
     plugins[target.pluginId] = rows.map((row) => {
       pluginNeed(pluginObject(row), "Invalid managed plugin registration");
@@ -49393,7 +49430,7 @@ function hashManagedPluginRegistry(path, managed) {
       pluginText(row.sourceProducerPath);
       pluginText(row.lastUpdated, 64);
       pluginNeed(Number.isFinite(Date.parse(row.lastUpdated)), "Invalid managed plugin update timestamp");
-      pluginNeed(/^(?:[A-Za-z0-9][A-Za-z0-9._+-]*-)?[a-f0-9]{12}$/.test(row.version) && row.installPath === join23(cacheRoot, row.version), "Managed plugin cache path or version is outside its registration");
+      pluginNeed(/^(?:[A-Za-z0-9][A-Za-z0-9._+-]*-)?[a-f0-9]{12}$/.test(row.version) && row.installPath === join24(cacheRoot, row.version), "Managed plugin cache path or version is outside its registration");
       const approval = (producer) => {
         pluginText(producer);
         const digest = `sha256:${basename6(producer)}`;
@@ -49423,7 +49460,7 @@ function hashManagedPluginRegistry(path, managed) {
       return Object.fromEntries(Object.entries(row).filter(([key]) => !["version", "installPath", "sourceProducerPath", "previousProducerPaths", "lastUpdated"].includes(key)));
     });
     safe3(cacheRoot);
-    const before = lstatSync14(cacheRoot);
+    const before = lstatSync15(cacheRoot);
     pluginNeed(before.isDirectory(), "Invalid managed plugin cache root");
     const directory = opendirSync3(cacheRoot), names = [];
     try {
@@ -49436,17 +49473,17 @@ function hashManagedPluginRegistry(path, managed) {
       directory.closeSync();
     }
     for (const version2 of names.sort()) {
-      const files = pluginFileWitnesses(snapshotPluginTree(join23(cacheRoot, version2), { nativeRuntime: `claude-${target.native.version}` }));
+      const files = pluginFileWitnesses(snapshotPluginTree(join24(cacheRoot, version2), { nativeRuntime: `claude-${target.native.version}` }));
       verifiedBytes += files.reduce((total, file2) => total + file2.size, 0);
       pluginNeed(verifiedBytes <= 256 * 1024 * 1024, "Managed plugin verification exceeds its aggregate byte budget");
       const serialized = JSON.stringify(files);
-      const expected = currentFiles.get(join23(cacheRoot, version2));
+      const expected = currentFiles.get(join24(cacheRoot, version2));
       pluginNeed(expected === undefined || serialized === expected, "Current native cache differs from its exact registered producer receipt");
       pluginNeed([...approvals.values()].some((receipt) => nativeVersionMatches(version2, receipt) && JSON.stringify(receipt.plan.files) === serialized), "A retained native plugin cache version differs from every approved projection");
     }
     for (const row of rows)
       pluginNeed(names.includes(row.version), "Managed native plugin installation is missing");
-    const after = lstatSync14(cacheRoot);
+    const after = lstatSync15(cacheRoot);
     safe3(cacheRoot);
     pluginNeed(before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs, "Managed cache version membership changed during verification");
   }
@@ -49461,19 +49498,19 @@ var init_plugin_discovery = __esm(() => {
 
 // src/lib/claude-marketplace-registry.ts
 import { createHash as createHash13 } from "crypto";
-import { closeSync as closeSync12, constants as constants9, fstatSync as fstatSync12, lstatSync as lstatSync15, openSync as openSync12, readSync as readSync8 } from "fs";
-import { basename as basename7, dirname as dirname13, isAbsolute as isAbsolute12, resolve as resolve13 } from "path";
+import { closeSync as closeSync12, constants as constants9, fstatSync as fstatSync12, lstatSync as lstatSync16, openSync as openSync12, readSync as readSync8 } from "fs";
+import { basename as basename7, dirname as dirname13, isAbsolute as isAbsolute12, resolve as resolve14 } from "path";
 function need5(value, reason) {
   if (!value)
     throw new Error(`Claude marketplace registry ${reason}`);
 }
 function absolutePath2(value) {
-  need5(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute12(value) && resolve13(value) === value, "requires a normalized absolute path");
+  need5(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute12(value) && resolve14(value) === value, "requires a normalized absolute path");
 }
 function parents2(path) {
   const result = [];
   for (let at = dirname13(path);; at = dirname13(at)) {
-    const stat2 = lstatSync15(at, { bigint: true });
+    const stat2 = lstatSync16(at, { bigint: true });
     need5(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
     result.push([at, stat2]);
     if (at === dirname13(at))
@@ -49484,7 +49521,7 @@ function readRegistry2(path, budget) {
   absolutePath2(path);
   need5(basename7(path) === "known_marketplaces.json", "requires known_marketplaces.json");
   need5(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
-  const ancestors2 = parents2(path), initial = lstatSync15(path, { bigint: true });
+  const ancestors2 = parents2(path), initial = lstatSync16(path, { bigint: true });
   need5(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
   need5(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
   const fd = openSync12(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
@@ -49499,10 +49536,10 @@ function readRegistry2(path, budget) {
         break;
       length += count;
     }
-    const after = fstatSync12(fd, { bigint: true }), current = lstatSync15(path, { bigint: true });
+    const after = fstatSync12(fd, { bigint: true }), current = lstatSync16(path, { bigint: true });
     need5(current.isFile() && sameFile2(opened, after) && sameFile2(after, current) && BigInt(length) === opened.size, "changed during read");
     for (const [ancestor, before] of ancestors2) {
-      const now = lstatSync15(ancestor, { bigint: true });
+      const now = lstatSync16(ancestor, { bigint: true });
       need5(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
     }
     budget.remaining -= length;
@@ -49642,7 +49679,7 @@ var init_claude_marketplace_registry = __esm(() => {
 });
 
 // src/lib/codex-hook-trust-files.ts
-import { closeSync as closeSync13, constants as constants10, fstatSync as fstatSync13, fsyncSync as fsyncSync3, lstatSync as lstatSync16, openSync as openSync13, readSync as readSync9, writeFileSync as writeFileSync5 } from "fs";
+import { closeSync as closeSync13, constants as constants10, fstatSync as fstatSync13, fsyncSync as fsyncSync3, lstatSync as lstatSync17, openSync as openSync13, readSync as readSync9, writeFileSync as writeFileSync5 } from "fs";
 import { createHash as createHash14 } from "crypto";
 import { dirname as dirname14 } from "path";
 function need6(value, code) {
@@ -49651,7 +49688,7 @@ function need6(value, code) {
 }
 function safeParents(file2) {
   for (let p = dirname14(file2);; p = dirname14(p)) {
-    const s = lstatSync16(p);
+    const s = lstatSync17(p);
     need6(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
     need6((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
     if (dirname14(p) === p)
@@ -49661,7 +49698,7 @@ function safeParents(file2) {
 function snapshot(file2, privateFile = false, options = {}) {
   const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
   safeParents(file2);
-  const initial = lstatSync16(file2, { bigint: true });
+  const initial = lstatSync17(file2, { bigint: true });
   need6(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
   need6(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
   const fd = openSync13(file2, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
@@ -49676,7 +49713,7 @@ function snapshot(file2, privateFile = false, options = {}) {
         break;
       length += n2;
     }
-    need6(length === Number(before.size) && sameStat(before, fstatSync13(fd, { bigint: true })) && sameStat(before, lstatSync16(file2, { bigint: true })), "INPUT_CHANGED");
+    need6(length === Number(before.size) && sameStat(before, fstatSync13(fd, { bigint: true })) && sameStat(before, lstatSync17(file2, { bigint: true })), "INPUT_CHANGED");
     const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
     return { file: file2, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash14("sha256").update(content).digest("hex") };
   } finally {
@@ -49731,8 +49768,8 @@ var init_codex_hook_discovery_recovery = __esm(() => {
 
 // src/lib/agent-discovery.ts
 import { createHash as createHash16 } from "crypto";
-import { lstatSync as lstatSync17, readFileSync as readFileSync15, readdirSync as readdirSync7, realpathSync as realpathSync4 } from "fs";
-import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute13, join as join24, resolve as resolve14, sep as sep5 } from "path";
+import { lstatSync as lstatSync18, readFileSync as readFileSync15, readdirSync as readdirSync7, realpathSync as realpathSync5 } from "fs";
+import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute13, join as join25, resolve as resolve15, sep as sep5 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 function parseConfig(text2, path, toml = false) {
   try {
@@ -49748,7 +49785,7 @@ function safe4(path) {
   if (!isAbsolute13(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
   for (let cursor = path;; cursor = dirname15(cursor)) {
-    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync18(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
     if (dirname15(cursor) === cursor)
       break;
@@ -49758,7 +49795,7 @@ function read(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync17(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync18(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
@@ -49869,12 +49906,12 @@ function codexInstallationRoots(binding) {
   if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
     throw new Error("Invalid native installation input proof");
   const cache = dirname15(dirname15(proof.plugins[0].pluginParent));
-  const config2 = join24(dirname15(dirname15(cache)), "config.toml"), home = dirname15(dirname15(dirname15(cache)));
+  const config2 = join25(dirname15(dirname15(cache)), "config.toml"), home = dirname15(dirname15(dirname15(cache)));
   const configSource = binding.sources.find((source) => source.path === config2 && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
-  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join24(home, path));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join25(home, path));
   if (!configSource || proof.plugins.some((input2) => nativeRoots.some((root) => root === input2.sourceRoot || root.startsWith(input2.sourceRoot + sep5) || input2.sourceRoot.startsWith(root + sep5)) || binding.sources.some((source) => basename8(source.path) === "config.toml" && (source.path === input2.sourceRoot || source.path.startsWith(input2.sourceRoot + sep5)))))
     throw new Error("Native installation input overlaps configuration or loading roots");
-  if (proof.plugins.some((input2) => dirname15(dirname15(input2.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join24(input2.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+  if (proof.plugins.some((input2) => dirname15(dirname15(input2.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join25(input2.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
     throw new Error("Missing native installation input source witness");
   return reviewedCodexPluginSourceRoots(cache, proof.plugins, (path) => {
     const text2 = read(path);
@@ -49892,10 +49929,12 @@ function assertMarketplaceBinding(binding, source) {
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
 }
 function agentDiscoveryConfigPath(home, agent) {
-  return join24(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  if (agent === "sumi")
+    return sumiConfigPath(home);
+  return join25(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
 }
 function resolveAgentDiscovery(options) {
-  const canonical6 = options.canonical ?? resolve14, home = resolve14(options.home), agent = options.agent;
+  const canonical6 = options.canonical ?? resolve15, home = resolve15(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields2) => {
     const source = { path: canonical6(path), sha256: null, ...format ? { format, fields: fields2 } : {} };
@@ -49906,13 +49945,49 @@ function resolveAgentDiscovery(options) {
   if (agent === "hermes")
     assertHermesEnvironment(home);
   const configPath = agentDiscoveryConfigPath(home, agent);
-  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
+  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : agent === "sumi" ? ["skills", "plugin", "plugins", "permissions"] : ["version"]);
   const config2 = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
   };
+  if (agent === "sumi") {
+    const directory = sumiConfigDirectory(home);
+    if (witness(join25(directory, "sumi.jsonc")) !== null)
+      unresolved("JSONC configuration requires a supported format adapter");
+    for (const root of [directory, join25(home, ".claude"), join25(home, ".agents")])
+      for (const name of ["skill", "skills"])
+        roots.add(join25(root, name));
+    if (config2.skills !== undefined && (!Array.isArray(config2.skills) || config2.skills.some((path) => typeof path !== "string")))
+      unresolved("skills must be a string array");
+    for (const value of config2.skills ?? []) {
+      if (typeof value !== "string" || /[\0$]/.test(value) || !value || !(isAbsolute13(value) || value.startsWith("~/")))
+        unresolved("remote or relative skill sources need a dedicated discovery adapter");
+      roots.add(value.startsWith("~/") ? join25(home, value.slice(2)) : value);
+    }
+    for (const key of ["plugin", "plugins"])
+      if (config2[key] !== undefined && !Array.isArray(config2[key]))
+        unresolved(`${key} must be an array`);
+    const plugins = [join25(directory, "plugin"), join25(directory, "plugins")];
+    for (const path of plugins) {
+      safe4(path);
+      if (lstatSync18(path, { throwIfNoEntry: false })?.isDirectory())
+        for (const name of readdirSync7(path).sort()) {
+          if (name === "skills-cli.js" && path === plugins[1])
+            continue;
+          const target = join25(path, name);
+          if (!lstatSync18(target).isFile())
+            unresolved("local plugin packages need a dedicated discovery adapter");
+          witness(target);
+        }
+    }
+    for (const root of roots) {
+      safe4(root);
+      if (lstatSync18(root, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(root).some((name) => name.endsWith(".md")))
+        unresolved("flat markdown skills require a dedicated native migration adapter");
+    }
+  }
   if (agent === "hermes") {
-    const profile = witness(join24(home, ".hermes/active_profile"));
+    const profile = witness(join25(home, ".hermes/active_profile"));
     if (profile?.trim() && profile.trim() !== "default")
       unresolved("a non-default profile is active");
     const declared = config2.skills?.external_dirs ?? [], paths = typeof declared === "string" ? [declared] : declared;
@@ -49926,7 +50001,7 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join24(home, normalized.slice(2)) : resolve14(home, ".hermes", normalized);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join25(home, normalized.slice(2)) : resolve15(home, ".hermes", normalized);
       safe4(path);
       roots.add(path);
     }
@@ -49935,8 +50010,8 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname15(realpathSync4(executable)), depth = 0;depth < 8; directory = dirname15(directory), depth++) {
-        const path = join24(directory, "package.json"), raw = read(path);
+      for (let directory = dirname15(realpathSync5(executable)), depth = 0;depth < 8; directory = dirname15(directory), depth++) {
+        const path = join25(directory, "package.json"), raw = read(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
@@ -49947,12 +50022,12 @@ function resolveAgentDiscovery(options) {
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
-      const builtinRoot = join24(packageRoot, "bundle/builtin");
+      const builtinRoot = join25(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync17(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync18(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync7(builtinRoot).sort()) {
-        const text2 = witness(join24(builtinRoot, name, "SKILL.md"));
+        const text2 = witness(join25(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
           unresolved("installed Gemini builtin name is missing or ambiguous");
@@ -49994,39 +50069,39 @@ function resolveAgentDiscovery(options) {
   function plugin(root) {
     root = canonical6(root);
     safe4(root);
-    const manifestPath = join24(root, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
+    const manifestPath = join25(root, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
     if (raw === null)
       unresolved("plugin manifest missing");
     const manifest = parseConfig(raw, manifestPath);
-    const hooks = witness(join24(root, "hooks/hooks.json"));
+    const hooks = witness(join25(root, "hooks/hooks.json"));
     if (manifest.hooks !== undefined || hooks !== null)
       unresolved("plugin hooks require a separate no-skill-injection review");
-    const commands = join24(root, "commands");
+    const commands = join25(root, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync18(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
-    const rootSkill = witness(join24(root, "SKILL.md"));
+    const rootSkill = witness(join25(root, "SKILL.md"));
     if (rootSkill !== null)
       roots.add(root);
     const declared = manifest.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
     if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
       unresolved("unsupported plugin skill paths");
     if (agent === "claude")
-      roots.add(join24(root, "skills"));
+      roots.add(join25(root, "skills"));
     for (const value of declared) {
-      const path = resolve14(root, value);
+      const path = resolve15(root, value);
       if (path !== root && !path.startsWith(root + sep5))
         unresolved("plugin skill path escapes its root");
       roots.add(path.endsWith(`${sep5}SKILL.md`) ? dirname15(path) : path);
     }
   }
   if (agent === "claude") {
-    const registrations = witness(join24(home, ".claude/plugins/installed_plugins.json"));
-    const installed = registrations === null ? {} : parseConfig(registrations, join24(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical6(join24(home, ".claude/commands"));
+    const registrations = witness(join25(home, ".claude/plugins/installed_plugins.json"));
+    const installed = registrations === null ? {} : parseConfig(registrations, join25(home, ".claude/plugins/installed_plugins.json")).plugins;
+    const commands = canonical6(join25(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length)
+    if (lstatSync18(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config2.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -50048,16 +50123,16 @@ function resolveAgentDiscovery(options) {
       const market = config2.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
       if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute13(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
-      const catalogText = witness(join24(market.source, ".agents/plugins/marketplace.json"));
+      const catalogText = witness(join25(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
         unresolved("marketplace catalog missing");
-      const catalog = parseConfig(catalogText, join24(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
+      const catalog = parseConfig(catalogText, join25(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve14(market.source, matches[0].source.path));
+      plugin(resolve15(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
-    if (witness(join24(home, ".config/opencode/opencode.jsonc")) !== null || witness(join24(home, ".config/opencode/config.json")) !== null)
+    if (witness(join25(home, ".config/opencode/opencode.jsonc")) !== null || witness(join25(home, ".config/opencode/config.json")) !== null)
       unresolved("additional config layers require review");
     if ((config2.plugin?.length ?? 0) > 0 || config2.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
@@ -50066,14 +50141,17 @@ function resolveAgentDiscovery(options) {
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
-    const localPlugins = join24(home, ".config/opencode/plugins");
+    const localPlugins = join25(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync17(localPlugins, { throwIfNoEntry: false }) && readdirSync7(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync18(localPlugins, { throwIfNoEntry: false }) && readdirSync7(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
+  } else if (agent === "sumi") {
+    if ((config2.plugin?.length ?? 0) > 0 || (config2.plugins?.length ?? 0) > 0 || sources.some((source) => source.path !== canonical6(configPath) && source.path !== canonical6(join25(sumiConfigDirectory(home), "sumi.jsonc")) && source.sha256 !== null))
+      unresolved("external or foreign local plugins require review");
   } else if (agent === "hermes") {
-    for (const directory of [join24(home, ".hermes/plugins"), join24(home, ".hermes/hermes-agent")]) {
+    for (const directory of [join25(home, ".hermes/plugins"), join25(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync17(directory, { throwIfNoEntry: false }))
+      if (lstatSync18(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config2.plugins ?? {}).length)
@@ -50081,24 +50159,24 @@ function resolveAgentDiscovery(options) {
   } else if (agent === "gemini") {
     if (Object.keys(config2.extensions ?? {}).length || config2.skills?.paths?.length)
       unresolved("custom extension or skill paths");
-    const directory = join24(home, ".gemini/extensions");
+    const directory = join25(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync17(directory, { throwIfNoEntry: false }))
+    if (lstatSync18(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync7(directory)) {
-        const root = join24(directory, name);
+        const root = join25(directory, name);
         safe4(root);
-        if (!lstatSync17(root)?.isDirectory())
+        if (!lstatSync18(root)?.isDirectory())
           continue;
-        const raw = witness(join24(root, "gemini-extension.json"));
+        const raw = witness(join25(root, "gemini-extension.json"));
         if (raw === null)
           unresolved("extension registration missing");
-        const manifest = parseConfig(raw, join24(root, "gemini-extension.json"));
-        if (manifest.hooks !== undefined || witness(join24(root, "hooks/hooks.json")) !== null || witness(join24(root, ".gemini-extension-install.json")) !== null)
+        const manifest = parseConfig(raw, join25(root, "gemini-extension.json"));
+        if (manifest.hooks !== undefined || witness(join25(root, "hooks/hooks.json")) !== null || witness(join25(root, ".gemini-extension-install.json")) !== null)
           unresolved("extension hooks or linked registration require review");
-        roots.add(join24(root, "skills"));
+        roots.add(join25(root, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join24(home, ".hermes/plugins"), join24(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join25(home, ".hermes/plugins"), join25(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
 }
 var digest = (text2) => createHash16("sha256").update(text2).digest("hex");
 var init_agent_discovery = __esm(() => {
@@ -50114,16 +50192,17 @@ var init_agent_discovery = __esm(() => {
   init_codex_hook_discovery_recovery();
   init_codex_settings_witness();
   init_codex_plugin_skill_controls();
+  init_agent_sumi();
   init_native_discovery_roots();
   init_agent_discovery_directories();
 });
 
 // src/lib/authoring-path.ts
-import { lstatSync as lstatSync18, realpathSync as realpathSync5 } from "fs";
+import { lstatSync as lstatSync19, realpathSync as realpathSync6 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename9, dirname as dirname16, join as join25, resolve as resolve15, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname16, join as join26, resolve as resolve16, sep as sep6 } from "path";
 function pathParts(path) {
-  return resolve15(path).split(sep6).filter(Boolean);
+  return resolve16(path).split(sep6).filter(Boolean);
 }
 function nativeRootMatch(path) {
   const parts = pathParts(path);
@@ -50137,24 +50216,24 @@ function nativeRootMatch(path) {
   return;
 }
 function physicalPath(path) {
-  let cursor = resolve15(path);
+  let cursor = resolve16(path);
   const suffix = [];
-  while (!lstatSync18(cursor, { throwIfNoEntry: false })) {
+  while (!lstatSync19(cursor, { throwIfNoEntry: false })) {
     suffix.unshift(basename9(cursor));
     const parent = dirname16(cursor);
     if (parent === cursor)
-      return resolve15(path);
+      return resolve16(path);
     cursor = parent;
   }
-  return resolve15(realpathSync5(cursor), ...suffix);
+  return resolve16(realpathSync6(cursor), ...suffix);
 }
 function contains(root, path) {
   return path === root || path.startsWith(root + sep6);
 }
 function configuredRoots(home, explicitHome) {
-  const homeData = join25(home, ".hasna", "skills");
+  const homeData = join26(home, ".hasna", "skills");
   const homePolicy = readManagedSkillPolicySnapshot(homeData);
-  const configuredPolicy = !explicitHome && resolve15(getDataDirReadOnly()) !== resolve15(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
+  const configuredPolicy = !explicitHome && resolve16(getDataDirReadOnly()) !== resolve16(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
   const policy = homePolicy ?? configuredPolicy;
   const bridge = policy?.value.bridge;
   if (bridge && (typeof bridge.home !== "string" || physicalPath(bridge.home) !== physicalPath(home))) {
@@ -50183,8 +50262,8 @@ function configuredRoots(home, explicitHome) {
       admitBinding(binding);
       continue;
     }
-    const nativeHome = join25(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
-    if (!lstatSync18(nativeHome, { throwIfNoEntry: false }))
+    const nativeHome = join26(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
+    if (!lstatSync19(nativeHome, { throwIfNoEntry: false }))
       continue;
     roots.push(...resolveAgentDiscovery({ home, agent, canonical: physicalPath }).roots);
   }
@@ -50193,22 +50272,22 @@ function configuredRoots(home, explicitHome) {
 function assertPortableAuthoringPath(path, options = {}) {
   if (typeof path !== "string" || !path || path.includes("\x00"))
     throw new Error("Invalid portable authoring path");
-  const lexical = resolve15(path);
+  const lexical = resolve16(path);
   const physical = physicalPath(lexical);
   const candidates = [lexical, physical];
   let native = candidates.map(nativeRootMatch).find(Boolean);
-  const home = resolve15(options.homeDir ?? homedir3());
-  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join25(home, ...parts));
-  defaults.push(join25(home, ".codex/plugins/cache"), join25(home, ".claude/plugins/cache"), join25(home, ".claude/plugins/synced"), join25(home, ".gemini/extensions"));
+  const home = resolve16(options.homeDir ?? homedir3());
+  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join26(home, ...parts));
+  defaults.push(join26(home, ".codex/plugins/cache"), join26(home, ".claude/plugins/cache"), join26(home, ".claude/plugins/synced"), join26(home, ".gemini/extensions"));
   for (const root of defaults) {
-    if (candidates.some((candidate) => contains(resolve15(root), candidate) || contains(physicalPath(root), candidate)))
+    if (candidates.some((candidate) => contains(resolve16(root), candidate) || contains(physicalPath(root), candidate)))
       native ??= root;
   }
   if (native) {
     throw new Error(`Refusing portable Skills authoring below native discovery root '${native}': ${lexical}. Set HASNA_SKILLS_DIR to a private authoring corpus outside native roots.`);
   }
   for (const root of configuredRoots(home, options.homeDir !== undefined)) {
-    if (candidates.some((candidate) => contains(resolve15(root), candidate) || contains(physicalPath(root), candidate))) {
+    if (candidates.some((candidate) => contains(resolve16(root), candidate) || contains(physicalPath(root), candidate))) {
       throw new Error(`Refusing portable Skills authoring below configured native discovery root: ${lexical}`);
     }
   }
@@ -50225,32 +50304,32 @@ var init_authoring_path = __esm(() => {
 
 // src/lib/portable-skills.ts
 import {
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync7,
   mkdtempSync,
   readdirSync as readdirSync8,
-  realpathSync as realpathSync6,
+  realpathSync as realpathSync7,
   renameSync as renameSync3,
   rmSync as rmSync3,
   statSync as statSync7,
   writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename10, dirname as dirname17, isAbsolute as isAbsolute14, join as join26, normalize as normalize3, relative as relative5, resolve as resolve16, sep as sep7 } from "path";
+import { basename as basename10, dirname as dirname17, isAbsolute as isAbsolute14, join as join27, normalize as normalize3, relative as relative5, resolve as resolve17, sep as sep7 } from "path";
 function getPortableSkillsRoot(options = {}) {
   return resolvePortableSkillsRoot(options, true);
 }
 function resolvePortableSkillsRoot(options, migrate) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join26(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
-  const cache = join26(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join27(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
+  const cache = join27(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache))
     return cache;
-  const installed = join26(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join27(appDir, INSTALLED_SKILLS_DIRNAME);
   return installed;
 }
 function getPortableSkillPath(name, options = {}) {
-  return join26(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join27(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -50260,7 +50339,7 @@ function findPortableSkill(name, options = {}) {
     return null;
   }
   const path = getPortableSkillPath(normalized, options);
-  if (!existsSync11(path) || !statSync7(path).isDirectory())
+  if (!existsSync12(path) || !statSync7(path).isDirectory())
     return null;
   try {
     return summarizePortableSkill(path, normalized);
@@ -50276,7 +50355,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync8(root).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join26(root, entry);
+    const path = join27(root, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -50309,11 +50388,11 @@ function isOfficialSkillName(name) {
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizeNewPortableSkillName(name);
   const readOnlyRoot = resolvePortableSkillsRoot(options, false);
-  assertPortableAuthoringPath(join26(readOnlyRoot, skillName), options);
+  assertPortableAuthoringPath(join27(readOnlyRoot, skillName), options);
   const root = getPortableSkillsRoot(options);
-  const skillPath = join26(root, skillName);
+  const skillPath = join27(root, skillName);
   assertPortableAuthoringPath(skillPath, options);
-  if (existsSync11(skillPath)) {
+  if (existsSync12(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
     rmSync3(skillPath, { recursive: true, force: true });
@@ -50330,16 +50409,16 @@ function scaffoldPortableSkill(name, options = {}) {
   return { name: skillName, path: skillPath, manifest, created: true };
 }
 function physicalImportPath(path) {
-  let ancestor = resolve16(path);
+  let ancestor = resolve17(path);
   const suffix = [];
-  while (!existsSync11(ancestor)) {
+  while (!existsSync12(ancestor)) {
     suffix.unshift(basename10(ancestor));
     ancestor = dirname17(ancestor);
   }
-  return join26(realpathSync6(ancestor), ...suffix);
+  return join27(realpathSync7(ancestor), ...suffix);
 }
 function assertDisjointImportPaths(source, destination) {
-  const sourcePath = realpathSync6(source);
+  const sourcePath = realpathSync7(source);
   const destinationPath = physicalImportPath(destination);
   const contains2 = (parent, child) => {
     const path = relative5(parent, child);
@@ -50351,7 +50430,7 @@ function assertDisjointImportPaths(source, destination) {
 }
 function portPortableSkill(sourcePath, options = {}) {
   const absoluteSource = normalize3(sourcePath);
-  if (!existsSync11(absoluteSource) || !statSync7(absoluteSource).isDirectory()) {
+  if (!existsSync12(absoluteSource) || !statSync7(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
   const inferred = readPortableSkillManifestForImport(absoluteSource);
@@ -50362,14 +50441,14 @@ function portPortableSkill(sourcePath, options = {}) {
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename10(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
-  const readOnlyDestination = join26(resolvePortableSkillsRoot(options, false), skillName);
+  const readOnlyDestination = join27(resolvePortableSkillsRoot(options, false), skillName);
   assertPortableAuthoringPath(readOnlyDestination, options);
   assertDisjointImportPaths(absoluteSource, readOnlyDestination);
   const root = getPortableSkillsRoot(options);
-  const destination = join26(root, skillName);
+  const destination = join27(root, skillName);
   assertPortableAuthoringPath(destination, options);
   assertDisjointImportPaths(absoluteSource, destination);
-  if (existsSync11(destination)) {
+  if (existsSync12(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync3(destination, { recursive: true, force: true });
@@ -50397,10 +50476,10 @@ function validatePortableSkillDirectory(name, skillPath) {
   const issues = [...base.issues];
   const warnings = [...base.warnings];
   let manifest;
-  if (existsSync11(skillPath)) {
-    const skillJsonPath = join26(skillPath, "skill.json");
-    const skillMdPath = join26(skillPath, "SKILL.md");
-    if (!existsSync11(skillJsonPath) && !existsSync11(skillMdPath)) {
+  if (existsSync12(skillPath)) {
+    const skillJsonPath = join27(skillPath, "skill.json");
+    const skillMdPath = join27(skillPath, "SKILL.md");
+    if (!existsSync12(skillJsonPath) && !existsSync12(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
     try {
@@ -50419,7 +50498,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync11(join26(skillPath, "skill.json")),
+        strict: existsSync12(join27(skillPath, "skill.json")),
         skillPath
       });
       for (const issue2 of contractIssues)
@@ -50459,8 +50538,8 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command.name}' entry '${command.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join26(skillPath, command.entry);
-            if (!existsSync11(entryPath))
+            const entryPath = join27(skillPath, command.entry);
+            if (!existsSync12(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command.name}' entry '${command.entry}' is missing`);
             else if (statSync7(entryPath).isDirectory())
               add3(issues, "portable.command_entry_directory", `Command '${command.name}' entry '${command.entry}' must be a file`);
@@ -50470,7 +50549,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error61) {
       add3(issues, "portable.manifest_invalid", error61.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync11(join26(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync12(join27(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -50697,8 +50776,8 @@ var init_search = __esm(() => {
 });
 
 // src/lib/registry.ts
-import { existsSync as existsSync12, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
+import { join as join28 } from "path";
 function parseSkillMdFrontmatter(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---/);
   if (!match)
@@ -50731,7 +50810,7 @@ function parseSkillMdFrontmatter(content) {
   return Object.keys(result).length > 0 ? result : null;
 }
 function discoverSkillsInDir(dir, source = "custom") {
-  if (!existsSync12(dir))
+  if (!existsSync13(dir))
     return [];
   const result = [];
   try {
@@ -50739,8 +50818,8 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join27(dir, entry.name, "SKILL.md");
-      if (!existsSync12(skillMdPath))
+      const skillMdPath = join28(dir, entry.name, "SKILL.md");
+      if (!existsSync13(skillMdPath))
         continue;
       let content;
       try {
@@ -50759,7 +50838,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join27(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join28(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -50768,16 +50847,16 @@ function discoverSkillsInDir(dir, source = "custom") {
 }
 function findExtensionSkillPath(name) {
   const config2 = loadConfig();
-  if (!config2.extensionsDir || !existsSync12(config2.extensionsDir))
+  if (!config2.extensionsDir || !existsSync13(config2.extensionsDir))
     return null;
   try {
     const entries = readdirSync9(config2.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join27(config2.extensionsDir, entry.name);
-      const skillMdPath = join27(skillDir, "SKILL.md");
-      if (!existsSync12(skillMdPath))
+      const skillDir = join28(config2.extensionsDir, entry.name);
+      const skillMdPath = join28(skillDir, "SKILL.md");
+      if (!existsSync13(skillMdPath))
         continue;
       let content;
       try {
@@ -50820,8 +50899,8 @@ function clearRegistryCache() {
   registryCacheTime = 0;
   registryCacheKey = null;
 }
-function getSkillsByCategory(category) {
-  return loadRegistry().filter((s) => s.category === category);
+function getSkillsByCategory(category, catalog) {
+  return (catalog ?? loadRegistry()).filter((s) => s.category === category);
 }
 function getSkill(name) {
   const registry2 = loadRegistry();
@@ -51973,14 +52052,14 @@ var init_remote_workspace_leave = __esm(() => {
 });
 
 // src/lib/auth-store.ts
-import { chmodSync, existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync17, renameSync as renameSync4, statSync as statSync8, unlinkSync as unlinkSync4, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename11, dirname as dirname18, join as join28 } from "path";
+import { chmodSync, existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync17, renameSync as renameSync4, statSync as statSync8, unlinkSync as unlinkSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename11, dirname as dirname18, join as join29 } from "path";
 function getAuthFilePath(env = process.env) {
   return skillsCredentialFilePath(env);
 }
 function getIdentityFilePath(env = process.env) {
   const file2 = skillsCredentialFilePath(env);
-  return join28(dirname18(file2), basename11(file2).replace(/^credentials/, "identity") + ".json");
+  return join29(dirname18(file2), basename11(file2).replace(/^credentials/, "identity") + ".json");
 }
 function getApiUrl(action, env = process.env, options = {}) {
   return requireSkillsApiOrigin(action, env, options);
@@ -52208,10 +52287,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve17) => {
+  const deadline = new Promise((resolve18) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve17(expired);
+      resolve18(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -53694,12 +53773,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve17) => {
+      await new Promise((resolve18) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve17();
+          resolve18();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -53987,10 +54066,10 @@ var init_remote_auth = __esm(() => {
 });
 
 // src/lib/workspace-profile.ts
-import { constants as constants11, closeSync as closeSync14, fstatSync as fstatSync14, lstatSync as lstatSync19, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, openSync as openSync14, readFileSync as readFileSync18, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { constants as constants11, closeSync as closeSync14, fstatSync as fstatSync14, lstatSync as lstatSync20, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, openSync as openSync14, readFileSync as readFileSync18, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
 function stat2(path) {
   try {
-    return lstatSync19(path);
+    return lstatSync20(path);
   } catch (error61) {
     if (error61.code === "ENOENT")
       return null;
@@ -54219,8 +54298,8 @@ var init_recurring_customer = __esm(() => {
 });
 
 // src/lib/recurring-recovery.ts
-import { constants as constants12, closeSync as closeSync15, fsyncSync as fsyncSync4, fstatSync as fstatSync15, lstatSync as lstatSync20, mkdirSync as mkdirSync10, openSync as openSync15, readSync as readSync10, realpathSync as realpathSync7, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname19, isAbsolute as isAbsolute15, join as join29, resolve as resolve17 } from "path";
+import { constants as constants12, closeSync as closeSync15, fsyncSync as fsyncSync4, fstatSync as fstatSync15, lstatSync as lstatSync21, mkdirSync as mkdirSync10, openSync as openSync15, readSync as readSync10, realpathSync as realpathSync8, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname19, isAbsolute as isAbsolute15, join as join30, resolve as resolve18 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 
 class RecoveryOwner {
@@ -54228,10 +54307,10 @@ class RecoveryOwner {
   parents = [];
   constructor(directory) {
     this.directory = directory;
-    if (!isAbsolute15(directory) || resolve17(directory) !== directory || realpathSync7(directory) !== directory)
+    if (!isAbsolute15(directory) || resolve18(directory) !== directory || realpathSync8(directory) !== directory)
       invalid5();
     for (let path = directory;; path = dirname19(path)) {
-      const stat3 = lstatSync20(path);
+      const stat3 = lstatSync21(path);
       if (!stat3.isDirectory() || stat3.isSymbolicLink())
         invalid5();
       this.parents.push({ path, dev: stat3.dev, ino: stat3.ino });
@@ -54241,20 +54320,20 @@ class RecoveryOwner {
     this.assert();
   }
   assert() {
-    if (realpathSync7(this.directory) !== this.directory)
+    if (realpathSync8(this.directory) !== this.directory)
       invalid5();
     for (const prior of this.parents) {
-      const now = lstatSync20(prior.path);
+      const now = lstatSync21(prior.path);
       if (!now.isDirectory() || now.isSymbolicLink() || now.dev !== prior.dev || now.ino !== prior.ino)
         invalid5();
     }
-    const own2 = lstatSync20(this.directory);
+    const own2 = lstatSync21(this.directory);
     if ((own2.mode & 511) !== 448 || (own2.mode & 3584) !== 0 || process.getuid && own2.uid !== process.getuid())
       invalid5();
   }
   read(name) {
     this.assert();
-    const fd = openSync15(join29(this.directory, name), constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
+    const fd = openSync15(join30(this.directory, name), constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
     try {
       const before = fstatSync15(fd);
       if (!before.isFile() || before.nlink !== 1 || (before.mode & 4095) !== 384 || before.size < 1 || before.size > 8192 || process.getuid && before.uid !== process.getuid())
@@ -54267,7 +54346,7 @@ class RecoveryOwner {
           break;
         size += n2;
       }
-      const after = fstatSync15(fd), path = lstatSync20(join29(this.directory, name));
+      const after = fstatSync15(fd), path = lstatSync21(join30(this.directory, name));
       if (size !== before.size || after.size !== before.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || path.dev !== before.dev || path.ino !== before.ino || !path.isFile() || path.isSymbolicLink())
         invalid5();
       this.assert();
@@ -54280,7 +54359,7 @@ class RecoveryOwner {
     this.assert();
     const bytes = canonicalJson2(value, 8192) + `
 `;
-    const fd = openSync15(join29(this.directory, name), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
+    const fd = openSync15(join30(this.directory, name), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
     try {
       writeFileSync9(fd, bytes);
       fsyncSync4(fd);
@@ -54307,14 +54386,14 @@ class RecoveryOwner {
     if (this.read("state.json") !== expected)
       invalid5();
     this.assert();
-    renameSync6(join29(this.directory, name), join29(this.directory, "state.json"));
+    renameSync6(join30(this.directory, name), join30(this.directory, "state.json"));
     this.sync();
   }
   async locked(action) {
     this.assert();
     let fd;
     try {
-      fd = openSync15(join29(this.directory, "operation.lock"), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
+      fd = openSync15(join30(this.directory, "operation.lock"), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
     } catch {
       throw new RecurringCustomerError("RECURRING_RECOVERY_BUSY", "Recovery is locked. Confirm the original process has stopped before explicitly reconciling the retained lock; no request was retried.");
     }
@@ -54327,10 +54406,10 @@ class RecoveryOwner {
     } finally {
       closeSync15(fd);
       this.assert();
-      const now = lstatSync20(join29(this.directory, "operation.lock"));
+      const now = lstatSync21(join30(this.directory, "operation.lock"));
       if (owner2.dev !== now.dev || owner2.ino !== now.ino || !now.isFile() || now.isSymbolicLink())
         invalid5();
-      unlinkSync5(join29(this.directory, "operation.lock"));
+      unlinkSync5(join30(this.directory, "operation.lock"));
       this.sync();
     }
   }
@@ -54363,7 +54442,7 @@ function base(customer, organizationId) {
   };
 }
 function create(directory, intent) {
-  if (!isAbsolute15(directory) || resolve17(directory) !== directory || realpathSync7(dirname19(directory)) !== dirname19(directory))
+  if (!isAbsolute15(directory) || resolve18(directory) !== directory || realpathSync8(dirname19(directory)) !== dirname19(directory))
     invalid5();
   mkdirSync10(directory, { mode: 448 });
   const owner2 = new RecoveryOwner(directory), checked = intentSchema.parse(intent), intentSha256 = canonicalJsonSha256(checked);
@@ -56461,20 +56540,20 @@ var init_credential_state = __esm(() => {
 
 // src/lib/run-state.ts
 import { createHash as createHash19, randomBytes } from "crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync19, readdirSync as readdirSync10, statSync as statSync9, writeFileSync as writeFileSync10 } from "fs";
-import { extname, join as join30, relative as relative6 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync19, readdirSync as readdirSync10, statSync as statSync9, writeFileSync as writeFileSync10 } from "fs";
+import { extname, join as join31, relative as relative6 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join30(root, "runs", day, id);
-  const logsDir = join30(runDir, "logs");
-  const exportDir = join30(root, "exports", skillName, id);
+  const runDir = join31(root, "runs", day, id);
+  const logsDir = join31(runDir, "logs");
+  const exportDir = join31(root, "exports", skillName, id);
   mkdirSync11(logsDir, { recursive: true });
   mkdirSync11(exportDir, { recursive: true });
-  mkdirSync11(join30(root, "tmp"), { recursive: true });
+  mkdirSync11(join31(root, "tmp"), { recursive: true });
   const record11 = {
     id,
     skill: skillName,
@@ -56526,22 +56605,22 @@ function updateSkillRun(context2, patch) {
   return context2.record;
 }
 function writeRunLogs(context2, stdout = "", stderr = "") {
-  writeFileSync10(join30(context2.logsDir, "stdout.log"), stdout);
-  writeFileSync10(join30(context2.logsDir, "stderr.log"), stderr);
+  writeFileSync10(join31(context2.logsDir, "stdout.log"), stdout);
+  writeFileSync10(join31(context2.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context2, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join30(context2.runDir, "events.ndjson");
-  const previous = existsSync14(path) ? readFileSync19(path, "utf-8") : "";
+  const path = join31(context2.runDir, "events.ndjson");
+  const previous = existsSync15(path) ? readFileSync19(path, "utf-8") : "";
   writeFileSync10(path, previous + line);
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join30(getProjectStateDir(targetDir), "runs");
-  if (!existsSync14(runsRoot))
+  const runsRoot = join31(getProjectStateDir(targetDir), "runs");
+  if (!existsSync15(runsRoot))
     return null;
   for (const day of readdirSync10(runsRoot)) {
-    const record11 = readRunRecord(join30(runsRoot, day, runId));
+    const record11 = readRunRecord(join31(runsRoot, day, runId));
     if (record11)
       return record11;
   }
@@ -56558,15 +56637,15 @@ function skillRunEnv(context2) {
   };
 }
 function writeRunRecord(context2) {
-  writeFileSync10(join30(context2.runDir, "run.json"), JSON.stringify(context2.record, null, 2) + `
+  writeFileSync10(join31(context2.runDir, "run.json"), JSON.stringify(context2.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context2, artifacts) {
-  writeFileSync10(join30(context2.runDir, "artifacts.json"), JSON.stringify({ runId: context2.record.id, artifacts }, null, 2) + `
+  writeFileSync10(join31(context2.runDir, "artifacts.json"), JSON.stringify({ runId: context2.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context2) {
-  if (!existsSync14(context2.exportDir))
+  if (!existsSync15(context2.exportDir))
     return [];
   const artifacts = [];
   for (const path of walkFiles(context2.exportDir)) {
@@ -56582,8 +56661,8 @@ function collectRunArtifacts(context2) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join30(runDir, "run.json");
-  if (!existsSync14(path))
+  const path = join31(runDir, "run.json");
+  if (!existsSync15(path))
     return null;
   try {
     return JSON.parse(readFileSync19(path, "utf-8"));
@@ -56594,7 +56673,7 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync10(dir)) {
-    const full = join30(dir, entry);
+    const full = join31(dir, entry);
     if (statSync9(full).isDirectory())
       files.push(...walkFiles(full));
     else
@@ -56851,7 +56930,7 @@ import { closeSync as closeSync16, fstatSync as fstatSync16, openSync as openSyn
 import { O_NOFOLLOW as O_NOFOLLOW3, O_NONBLOCK as O_NONBLOCK3, O_RDONLY as O_RDONLY3 } from "constants";
 import { createRequire as createRequire2 } from "module";
 import { hostname as osHostname2 } from "os";
-import { isAbsolute as isAbsolute17, join as join31 } from "path";
+import { isAbsolute as isAbsolute17, join as join32 } from "path";
 import { createRequire as createRequire22 } from "module";
 function envToken2(name) {
   return name.toUpperCase().replace(/-/g, "_");
@@ -56882,14 +56961,14 @@ function hasnaHomeDir2(env) {
   if (override)
     return override;
   const home = homeDir2(env);
-  return home ? join31(home, HASNA_HOME_DIR2) : null;
+  return home ? join32(home, HASNA_HOME_DIR2) : null;
 }
 function appConfigDir2(name, env) {
   const configRoot = absoluteOverride2(env, HASNA_CONFIG_HOME_ENV_KEY2);
   if (configRoot)
-    return join31(configRoot, name);
+    return join32(configRoot, name);
   const root = hasnaHomeDir2(env);
-  return root ? join31(root, name, CONFIG_SUBDIR2) : null;
+  return root ? join32(root, name, CONFIG_SUBDIR2) : null;
 }
 function credentialDiskSourceList2(name, env, profile = null) {
   if (!SAFE_APP_SLUG2.test(name))
@@ -56898,7 +56977,7 @@ function credentialDiskSourceList2(name, env, profile = null) {
   if (!directory2)
     return [];
   const file2 = profile ? `${CREDENTIALS_FILE2}-${profile}` : CREDENTIALS_FILE2;
-  return [{ path: join31(directory2, file2), tier: "disk" }];
+  return [{ path: join32(directory2, file2), tier: "disk" }];
 }
 function credentialDiskSources2(name, env) {
   return credentialDiskSourceList2(name, env, null).map((s) => s.path);
@@ -58012,7 +58091,7 @@ function createSecretsClientFromEnv(env = process.env, overrides = {}) {
   });
   return new SecretsClient({ ...clientOverrides, baseUrl, apiKey });
 }
-var __esm2 = (fn, res) => () => (fn && (res = fn(fn = 0)), res), CREDENTIAL_PROFILE_ENV_KEY2 = "HASNA_PROFILE", CredentialResolutionError2, CredentialFileUnsafeError2, HASNA_HOME_ENV_KEY2 = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY2 = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY2 = "HASNA_STATION", HASNA_HOME_DIR2 = ".hasna", CONFIG_SUBDIR2 = "config", CREDENTIALS_FILE2 = "credentials", KEYCHAIN_SECURITY_BIN2 = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX2 = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS2 = 44, KEYCHAIN_SPAWN_TIMEOUT_MS2 = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG2, SAFE_PROFILE2, ILLEGAL_IN_HEADER_VALUE2, VAULT_POINTER_SHAPE2, CREDENTIAL_SHAPED_KEY2, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider", AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN2 = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN2, DNS_LABEL_PATTERN2, ClientTransportConfigurationError2, HasnaHttpError, DEFAULT_RETRY_STATUSES, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2, defaultSleep = (ms) => new Promise((resolve18) => setTimeout(resolve18, ms)), init_transport2, MAX_CREDENTIAL_FILE_BYTES22, INSPECT_CUSTOM22, CREDENTIAL_SEAL22, AMBIENT_ENVIRONMENT22, SECRETS_PACKAGE_SPECIFIER2, requireSecretsSdk22, IDEMPOTENT_METHODS22, AUTHORITY_OVERRIDE_HEADERS22, init_storage, PATHS_RESOLVER_APP_SLUG_RE2, SQLITE_SIDECAR_FILES, LEGACY_SERVICE_FILES, init_data_dir, SecretsTestIsolationError, TEST_ENTRYPOINT_RE, init_test_isolation, init_client, ApiError;
+var __esm2 = (fn, res) => () => (fn && (res = fn(fn = 0)), res), CREDENTIAL_PROFILE_ENV_KEY2 = "HASNA_PROFILE", CredentialResolutionError2, CredentialFileUnsafeError2, HASNA_HOME_ENV_KEY2 = "HASNA_HOME", HASNA_CONFIG_HOME_ENV_KEY2 = "HASNA_CONFIG_HOME", KEYCHAIN_STATION_ENV_KEY2 = "HASNA_STATION", HASNA_HOME_DIR2 = ".hasna", CONFIG_SUBDIR2 = "config", CREDENTIALS_FILE2 = "credentials", KEYCHAIN_SECURITY_BIN2 = "/usr/bin/security", KEYCHAIN_SERVICE_PREFIX2 = "hasna.credentials", KEYCHAIN_ITEM_NOT_FOUND_STATUS2 = 44, KEYCHAIN_SPAWN_TIMEOUT_MS2 = 1e4, MAX_CREDENTIAL_FILE_BYTES2, SAFE_APP_SLUG2, SAFE_PROFILE2, ILLEGAL_IN_HEADER_VALUE2, VAULT_POINTER_SHAPE2, CREDENTIAL_SHAPED_KEY2, INSPECT_CUSTOM2, CREDENTIAL_SEAL2, CALLER_SUPPLIED_CREDENTIAL_PROVIDER_SOURCE = "caller-supplied CredentialProvider", AMBIENT_ENVIRONMENT2, SECRETS_PACKAGE_SPECIFIER, requireSecretsSdk2, DEFAULT_FLEET_GATEWAY_ORIGIN2 = "https://api.hasna.com", DEFAULT_AUTHORITY_SOURCE = "default", ASCII_CONTROL_PATTERN2, DNS_LABEL_PATTERN2, ClientTransportConfigurationError2, HasnaHttpError, DEFAULT_RETRY_STATUSES, IDEMPOTENT_METHODS2, AUTHORITY_OVERRIDE_HEADERS2, defaultSleep = (ms) => new Promise((resolve19) => setTimeout(resolve19, ms)), init_transport2, MAX_CREDENTIAL_FILE_BYTES22, INSPECT_CUSTOM22, CREDENTIAL_SEAL22, AMBIENT_ENVIRONMENT22, SECRETS_PACKAGE_SPECIFIER2, requireSecretsSdk22, IDEMPOTENT_METHODS22, AUTHORITY_OVERRIDE_HEADERS22, init_storage, PATHS_RESOLVER_APP_SLUG_RE2, SQLITE_SIDECAR_FILES, LEGACY_SERVICE_FILES, init_data_dir, SecretsTestIsolationError, TEST_ENTRYPOINT_RE, init_test_isolation, init_client, ApiError;
 var init_sdk = __esm(() => {
   init_transport2 = __esm2(() => {
     CredentialResolutionError2 = class CredentialResolutionError3 extends Error {
@@ -58147,7 +58226,7 @@ var init_sdk = __esm(() => {
 });
 
 // src/lib/execution-secrets.ts
-import { constants as constants13, closeSync as closeSync17, fstatSync as fstatSync17, openSync as openSync17, readSync as readSync11, realpathSync as realpathSync8 } from "fs";
+import { constants as constants13, closeSync as closeSync17, fstatSync as fstatSync17, openSync as openSync17, readSync as readSync11, realpathSync as realpathSync9 } from "fs";
 import { hostname as stationHostname } from "os";
 function selectedSecretBindingsTemplate(scope, names, createClient = createSecretsClientFromEnv) {
   let secretsAuthority;
@@ -58160,7 +58239,7 @@ function selectedSecretBindingsTemplate(scope, names, createClient = createSecre
   return {
     schema: "hasna.skills-secret-bindings.v1",
     selection: { authority, workspaceId, profileId: scope.profileId, profileRevision, slug: slug2, version: version2, bundleDigest },
-    consumer: { stationId: process.env.HASNA_STATION || stationHostname(), workspaceDirectory: realpathSync8(scope.cwd) },
+    consumer: { stationId: process.env.HASNA_STATION || stationHostname(), workspaceDirectory: realpathSync9(scope.cwd) },
     secretsAuthority,
     bindings: Object.fromEntries(names.map((name) => [name, ""]))
   };
@@ -58198,7 +58277,7 @@ function validateSelectedSecretBindings(value, scope, names) {
   }
   let workspaceDirectory;
   try {
-    workspaceDirectory = realpathSync8(scope.cwd);
+    workspaceDirectory = realpathSync9(scope.cwd);
   } catch {
     return refuse2("SECRET_BINDING_CONSUMER_MISMATCH", "The execution workspace cannot be resolved.");
   }
@@ -58391,8 +58470,8 @@ __export(exports_selected_run, {
 });
 import { createHash as createHash20 } from "crypto";
 import { spawn } from "child_process";
-import { mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync11, realpathSync as realpathSync9 } from "fs";
-import { dirname as dirname20, join as join32, resolve as resolve18 } from "path";
+import { mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync11, realpathSync as realpathSync10 } from "fs";
+import { dirname as dirname20, join as join33, resolve as resolve19 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 async function resolveSelectedRun(spec, profileId, options = {}) {
   const context2 = await resolveSelectionContext(profileId, options);
@@ -58472,7 +58551,7 @@ async function executeSelectedLocal(selected, options = {}) {
         throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Explicit environment values must be bounded strings without NUL bytes.");
       secretEnv[name] = value;
     }
-  const runDirectory = mkdtempSync3(join32(tmpdir(), "skills-execution-"));
+  const runDirectory = mkdtempSync3(join33(tmpdir(), "skills-execution-"));
   const paths = new SkillEntryPaths;
   for (const entry of entries) {
     paths.add(entry.path, 100, () => {
@@ -58480,12 +58559,12 @@ async function executeSelectedLocal(selected, options = {}) {
     }, () => {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
-    const destination = join32(runDirectory, entry.path);
+    const destination = join33(runDirectory, entry.path);
     mkdirSync12(dirname20(destination), { recursive: true, mode: 448 });
     writeFileSync11(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env.SKILLS_INPUT_JSON = input2;
-  env.SKILLS_WORKSPACE_DIR = resolve18(options.cwd ?? process.cwd());
+  env.SKILLS_WORKSPACE_DIR = resolve19(options.cwd ?? process.cwd());
   env.SKILLS_RUN_DIR = runDirectory;
   if (runtime.version) {
     const version2 = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], "--version"], runDirectory, env, "", Math.min(timeoutMs, 5000));
@@ -58498,7 +58577,7 @@ async function executeSelectedLocal(selected, options = {}) {
     const { authority: authority2, workspaceId, profileRevision, slug: slug2, version: version2, bundleDigest } = selection2;
     const request2 = {
       selection: { authority: authority2, workspaceId, profileId, profileRevision, slug: slug2, version: version2, bundleDigest },
-      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync9(options.cwd ?? process.cwd()) }
+      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync10(options.cwd ?? process.cwd()) }
     };
     const grant = await (options.resolveExecutionGrant ?? resolveExecutionGrant)(request2);
     if (!grant || !grantIdentifier(grant.policyRevision) || !grantIdentifier(grant.grantId))
@@ -58508,7 +58587,7 @@ async function executeSelectedLocal(selected, options = {}) {
   }
   if (bindings)
     secretEnv = await resolveSelectedSecrets(bindings, options.createSecretsClient);
-  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join32(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input2, timeoutMs);
+  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join33(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input2, timeoutMs);
   result.stdout = redactExecutionSecrets(result.stdout, secretEnv);
   result.stderr = redactExecutionSecrets(result.stderr, secretEnv);
   const receipt = {
@@ -58521,7 +58600,7 @@ async function executeSelectedLocal(selected, options = {}) {
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
     ...result
   };
-  writeFileSync11(join32(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
+  writeFileSync11(join33(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
   return receipt;
 }
 async function subprocess(command, cwd, env, input2, timeoutMs) {
@@ -58710,8 +58789,8 @@ var init_blog_article = __esm(() => {
 });
 
 // src/mcp/operation-tools.ts
-import { existsSync as existsSync15, readdirSync as readdirSync11, statSync as statSync10 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync11, statSync as statSync10 } from "fs";
+import { join as join34 } from "path";
 function registerOperationTools(server) {
   server.registerTool("cloud_skill_eligibility", {
     title: "Cloud Skill Eligibility",
@@ -59183,12 +59262,12 @@ function registerOperationTools(server) {
     const agents = [];
     for (const agent of AGENT_TARGETS) {
       const agentSkillsPath = getAgentSkillsDir(agent, "global");
-      const exists = existsSync15(agentSkillsPath);
+      const exists = existsSync16(agentSkillsPath);
       let skillCount = 0;
       if (exists) {
         try {
           skillCount = readdirSync11(agentSkillsPath).filter((f) => {
-            const full = join33(agentSkillsPath, f);
+            const full = join34(agentSkillsPath, f);
             return !f.startsWith(".") && statSync10(full).isDirectory();
           }).length;
         } catch {}
@@ -59255,16 +59334,16 @@ var init_operation_tools = __esm(() => {
 });
 
 // src/lib/feedback.ts
-import { appendFileSync, existsSync as existsSync16, mkdirSync as mkdirSync13 } from "fs";
-import { dirname as dirname21, join as join34 } from "path";
+import { appendFileSync, existsSync as existsSync17, mkdirSync as mkdirSync13 } from "fs";
+import { dirname as dirname21, join as join35 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join34(getDataDir(), "skills.db");
+  return join35(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname21(dbPath);
-  if (!existsSync16(dir))
+  if (!existsSync17(dir))
     mkdirSync13(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
@@ -59291,9 +59370,9 @@ function saveFeedback(input2) {
     throw new Error("Feedback message is required");
   const category = input2.category ?? "general";
   if (isApiMode()) {
-    const path = join34(getDataDir(), "feedback.jsonl");
+    const path = join35(getDataDir(), "feedback.jsonl");
     const dir = dirname21(path);
-    if (!existsSync16(dir))
+    if (!existsSync17(dir))
       mkdirSync13(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input2.email ?? null, agent: input2.agent ?? null, version: input2.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
@@ -59455,14 +59534,14 @@ var init_resource_meta_tools = __esm(() => {
 });
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync17, readFileSync as readFileSync21, writeFileSync as writeFileSync12, mkdirSync as mkdirSync14 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync21, writeFileSync as writeFileSync12, mkdirSync as mkdirSync14 } from "fs";
+import { join as join36 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join35(targetDir, ".skills", "schedules.json");
+  return join36(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync17(path)) {
+  if (existsSync18(path)) {
     try {
       return JSON.parse(readFileSync21(path, "utf-8"));
     } catch {}
@@ -59471,8 +59550,8 @@ function loadSchedules(targetDir = process.cwd()) {
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join35(targetDir, ".skills");
-  if (!existsSync17(dir))
+  const dir = join36(targetDir, ".skills");
+  if (!existsSync18(dir))
     mkdirSync14(dir, { recursive: true });
   writeFileSync12(path, JSON.stringify(data, null, 2));
 }
@@ -59745,14 +59824,14 @@ var init_schedule_tools = __esm(() => {
 // src/lib/native-storage.ts
 import { createHash as createHash21, createHmac } from "crypto";
 import {
-  existsSync as existsSync18,
+  existsSync as existsSync19,
   mkdirSync as mkdirSync15,
   readFileSync as readFileSync22,
   readdirSync as readdirSync12,
   statSync as statSync11,
   writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname22, join as join36, normalize as normalize4, relative as relative7, sep as sep8 } from "path";
+import { dirname as dirname22, join as join37, normalize as normalize4, relative as relative7, sep as sep8 } from "path";
 function resolveSkillsNativeStorageConfig(env = process.env) {
   assertNoRetiredModeEnvVars(env, {
     app: SKILLS_ENV_NAMESPACE,
@@ -59793,7 +59872,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join36(getDataDir(), "skills.db")
+      feedbackDbPath: join37(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config2.databaseUrl),
@@ -59813,7 +59892,7 @@ function getStorageStatus(options = {}) {
 function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const projectStateDir = getProjectStateDir(targetDir);
   const files = [];
-  if (existsSync18(projectStateDir)) {
+  if (existsSync19(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
       const bytes = readFileSync22(filePath);
       const relativePath = toPosix(relative7(targetDir, filePath));
@@ -59874,7 +59953,7 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync12(dir)) {
-    const full = join36(dir, entry);
+    const full = join37(dir, entry);
     const stats = statSync11(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
@@ -60112,20 +60191,20 @@ var init_private_publication_customer = __esm(() => {
 });
 
 // src/lib/private-publication-recovery.ts
-import { constants as constants14, closeSync as closeSync18, fsyncSync as fsyncSync5, fstatSync as fstatSync18, lstatSync as lstatSync21, mkdirSync as mkdirSync16, openSync as openSync18, readSync as readSync12, realpathSync as realpathSync10, renameSync as renameSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname23, isAbsolute as isAbsolute18, join as join37, resolve as resolve19 } from "path";
+import { constants as constants14, closeSync as closeSync18, fsyncSync as fsyncSync5, fstatSync as fstatSync18, lstatSync as lstatSync22, mkdirSync as mkdirSync16, openSync as openSync18, readSync as readSync12, realpathSync as realpathSync11, renameSync as renameSync7, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname23, isAbsolute as isAbsolute18, join as join38, resolve as resolve20 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function safeDirectory(directory2) {
-  if (!isAbsolute18(directory2) || directory2 !== resolve19(directory2) || realpathSync10(directory2) !== directory2)
+  if (!isAbsolute18(directory2) || directory2 !== resolve20(directory2) || realpathSync11(directory2) !== directory2)
     return fail2();
   for (let path = directory2;; path = dirname23(path)) {
-    const stat3 = lstatSync21(path);
+    const stat3 = lstatSync22(path);
     if (!stat3.isDirectory() || stat3.isSymbolicLink())
       return fail2();
     if (path === dirname23(path))
       break;
   }
-  const own2 = lstatSync21(directory2);
+  const own2 = lstatSync22(directory2);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail2();
   return { dev: own2.dev, ino: own2.ino };
@@ -60136,7 +60215,7 @@ function unchangedDirectory(directory2, identity3) {
     return fail2();
 }
 function readOwned(directory2, name, max) {
-  const identity3 = safeDirectory(directory2), file2 = join37(directory2, name);
+  const identity3 = safeDirectory(directory2), file2 = join38(directory2, name);
   const fd = openSync18(file2, constants14.O_RDONLY | constants14.O_NOFOLLOW);
   try {
     const stat3 = fstatSync18(fd);
@@ -60160,7 +60239,7 @@ function readOwned(directory2, name, max) {
   }
 }
 function writeOwned(directory2, name, bytes) {
-  const fd = openSync18(join37(directory2, name), constants14.O_WRONLY | constants14.O_CREAT | constants14.O_EXCL | constants14.O_NOFOLLOW, 384);
+  const fd = openSync18(join38(directory2, name), constants14.O_WRONLY | constants14.O_CREAT | constants14.O_EXCL | constants14.O_NOFOLLOW, 384);
   try {
     writeFileSync14(fd, bytes);
     fsyncSync5(fd);
@@ -60173,7 +60252,7 @@ function save(directory2, value) {
   writeOwned(directory2, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory2, identity3);
-  renameSync7(join37(directory2, temporary), join37(directory2, "receipt.json"));
+  renameSync7(join38(directory2, temporary), join38(directory2, "receipt.json"));
   const fd = openSync18(directory2, constants14.O_RDONLY | constants14.O_NOFOLLOW);
   try {
     fsyncSync5(fd);
@@ -60186,7 +60265,7 @@ function bind(client, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory2, action) {
-  const identity3 = safeDirectory(directory2), file2 = join37(directory2, "operation.lock");
+  const identity3 = safeDirectory(directory2), file2 = join38(directory2, "operation.lock");
   let fd;
   try {
     fd = openSync18(file2, constants14.O_WRONLY | constants14.O_CREAT | constants14.O_EXCL | constants14.O_NOFOLLOW, 384);
@@ -60202,7 +60281,7 @@ async function locked(directory2, action) {
   } finally {
     closeSync18(fd);
     unchangedDirectory(directory2, identity3);
-    const now = lstatSync21(file2);
+    const now = lstatSync22(file2);
     if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
       fail2();
     unlinkSync6(file2);
@@ -60254,7 +60333,7 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute18(recoveryDirectory) || resolve19(recoveryDirectory) !== recoveryDirectory || realpathSync10(dirname23(recoveryDirectory)) !== dirname23(recoveryDirectory))
+  if (!isAbsolute18(recoveryDirectory) || resolve20(recoveryDirectory) !== recoveryDirectory || realpathSync11(dirname23(recoveryDirectory)) !== dirname23(recoveryDirectory))
     return fail2();
   mkdirSync16(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
@@ -61070,7 +61149,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
     request2[bodyBufferKey] = buffered;
     return Promise.resolve(buffered);
   }
-  const promise3 = new Promise((resolve20, reject) => {
+  const promise3 = new Promise((resolve21, reject) => {
     const chunks = [];
     let settled = false;
     const finish = (callback) => {
@@ -61092,7 +61171,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
           reject(error61 ?? normalizeAbortError(request2, incoming));
         else {
           request2[bodyBufferKey] = recovered;
-          resolve20(recovered);
+          resolve21(recovered);
         }
       });
       return true;
@@ -61104,7 +61183,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
       finish(() => {
         const buffer = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks);
         request2[bodyBufferKey] = buffer;
-        resolve20(buffer);
+        resolve21(buffer);
       });
     };
     const onError = (error61) => {
@@ -61378,7 +61457,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve20) => setTimeout(resolve20));
+            await new Promise((resolve21) => setTimeout(resolve21));
             maxReadCount = 3;
             continue;
           }
@@ -62608,9 +62687,9 @@ data:
       const initRequest = messages.find((m) => isInitializeRequest(m));
       const clientProtocolVersion = initRequest ? initRequest.params.protocolVersion : req.headers.get("mcp-protocol-version") ?? DEFAULT_NEGOTIATED_PROTOCOL_VERSION;
       if (this._enableJsonResponse) {
-        return new Promise((resolve20) => {
+        return new Promise((resolve21) => {
           this._streamMapping.set(streamId, {
-            resolveJson: resolve20,
+            resolveJson: resolve21,
             cleanup: () => {
               this._streamMapping.delete(streamId);
             }
@@ -62979,19 +63058,19 @@ async function connectMcpForNode() {
   return { server: server2, transport };
 }
 function readBody(req) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     const chunks = [];
     req.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
     req.on("end", () => {
       const raw = Buffer.concat(chunks).toString("utf-8");
       if (!raw.trim()) {
-        resolve20(undefined);
+        resolve21(undefined);
         return;
       }
       try {
-        resolve20(JSON.parse(raw));
+        resolve21(JSON.parse(raw));
       } catch {
-        resolve20(undefined);
+        resolve21(undefined);
       }
     });
     req.on("error", reject);
@@ -63033,9 +63112,9 @@ async function startSkillsMcpHttpServer(options = {}) {
       }
     }
   });
-  await new Promise((resolve20, reject) => {
+  await new Promise((resolve21, reject) => {
     httpServer.once("error", reject);
-    httpServer.listen(port, hostname4, () => resolve20());
+    httpServer.listen(port, hostname4, () => resolve21());
   });
   const address = httpServer.address();
   const listenPort = typeof address === "object" && address ? address.port : port;