@hasna/skills 0.10.28 → 0.10.30

package/dist/index.js

@@ -6988,8 +6988,8 @@ var require_public_api = __commonJS((exports) => {
 });
 
 // src/lib/registry.ts
-import { existsSync as existsSync14, readFileSync as readFileSync18, readdirSync as readdirSync12 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync12 } from "fs";
+import { join as join31 } from "path";
 
 // src/lib/config.ts
 import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync } from "fs";
@@ -7252,17 +7252,17 @@ function unsetConfig(key, scope = "project") {
 
 // src/lib/portable-skills.ts
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync2,
   readdirSync as readdirSync11,
-  realpathSync as realpathSync9,
+  realpathSync as realpathSync10,
   renameSync as renameSync5,
   rmSync as rmSync4,
   statSync as statSync10,
   writeFileSync as writeFileSync8
 } from "fs";
-import { basename as basename11, dirname as dirname19, isAbsolute as isAbsolute17, join as join29, normalize as normalize4, relative as relative6, resolve as resolve17, sep as sep8 } from "path";
+import { basename as basename11, dirname as dirname19, isAbsolute as isAbsolute17, join as join30, normalize as normalize4, relative as relative6, resolve as resolve18, sep as sep8 } from "path";
 
 // src/lib/registry-data/index.ts
 var SKILLS = [];
@@ -8904,6 +8904,8 @@ var NATIVE_SKILL_ROOTS = [
   ["codex", ".codex/skills"],
   ["codex", ".agents/skills"],
   ["gemini", ".gemini/skills"],
+  ["sumi", ".sumi/skills"],
+  ["sumi", ".sumi/skill"],
   ["codewith", ".codewith/skills"],
   ["opencode", ".config/opencode/skills"],
   ["opencode", ".opencode/skills"],
@@ -8918,12 +8920,12 @@ var NATIVE_SKILL_ROOTS = [
 ];
 
 // src/lib/authoring-path.ts
-import { lstatSync as lstatSync22, realpathSync as realpathSync8 } from "fs";
+import { lstatSync as lstatSync23, realpathSync as realpathSync9 } from "fs";
 import { homedir as homedir6 } from "os";
-import { basename as basename10, dirname as dirname18, join as join28, resolve as resolve16, sep as sep7 } from "path";
+import { basename as basename10, dirname as dirname18, join as join29, resolve as resolve17, sep as sep7 } from "path";
 
 // src/lib/agent-adapters.ts
-var INTEGRATION_AGENTS = ["claude", "codex", "gemini", "opencode", "cursor", "hermes"];
+var INTEGRATION_AGENTS = ["claude", "codex", "gemini", "opencode", "cursor", "hermes", "sumi"];
 function renderAgentHookCommand(command, agent, profileId, event) {
   if (typeof profileId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(profileId) || profileId.includes(".."))
     throw new Error("Invalid selection profile id");
@@ -8934,6 +8936,7 @@ var AGENT_ADAPTERS = {
   codex: { root: ".codex/skills", config: ".codex/hooks.json", events: ["UserPromptSubmit", "SessionStart", "SubagentStart"], promptContext: true },
   gemini: { root: ".gemini/skills", config: ".gemini/settings.json", events: ["BeforeAgent", "SessionStart"], promptContext: true },
   opencode: { root: ".config/opencode/skills", config: ".config/opencode/opencode.json", events: ["chat.message"], promptContext: true },
+  sumi: { root: ".hasna-internal/sumi/config/skills", config: ".hasna-internal/sumi/config/sumi.json", events: ["prompt", "context"], promptContext: true },
   hermes: { root: ".hermes/skills", config: ".hermes/config.yaml", events: ["pre_llm_call", "pre_tool_call"], promptContext: true, promptFailureMode: "open", toolFailureMode: "supervised-child-errors-block", requiresNativeTrust: true },
   cursor: { root: ".cursor/skills", config: ".cursor/hooks.json", events: ["beforeSubmitPrompt", "sessionStart"], promptContext: false }
 };
@@ -9139,8 +9142,8 @@ function assertAgentPolicyCollections(policy) {
 
 // src/lib/agent-discovery.ts
 import { createHash as createHash18 } from "crypto";
-import { lstatSync as lstatSync21, readFileSync as readFileSync17, readdirSync as readdirSync10, realpathSync as realpathSync7 } from "fs";
-import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute16, join as join27, resolve as resolve15, sep as sep6 } from "path";
+import { lstatSync as lstatSync22, readFileSync as readFileSync17, readdirSync as readdirSync10, realpathSync as realpathSync8 } from "fs";
+import { basename as basename9, dirname as dirname17, isAbsolute as isAbsolute16, join as join28, resolve as resolve16, sep as sep6 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual5 } from "util";
 
 // node_modules/yaml/dist/index.js
@@ -9652,12 +9655,12 @@ function hashDiscoveryPathFile(path, budget, changes) {
 }
 
 // src/lib/plugin-discovery.ts
-import { closeSync as closeSync10, constants as constants9, fstatSync as fstatSync10, lstatSync as lstatSync18, openSync as openSync10, opendirSync as opendirSync5, readSync as readSync8 } from "fs";
-import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute14, join as join26, resolve as resolve13 } from "path";
+import { closeSync as closeSync10, constants as constants9, fstatSync as fstatSync10, lstatSync as lstatSync19, openSync as openSync10, opendirSync as opendirSync5, readSync as readSync8 } from "fs";
+import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute14, join as join27, resolve as resolve14 } from "path";
 
 // src/lib/plugin-admission.ts
 import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute13, join as join25, resolve as resolve12 } from "path";
+import { isAbsolute as isAbsolute13, join as join26, resolve as resolve13 } from "path";
 
 // src/lib/selection-cache.ts
 import { createHash as createHash6, randomUUID } from "crypto";
@@ -10914,7 +10917,7 @@ function replaceSkillSession(expected, replacement, plan, options = {}, beforeCo
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.28",
+  version: "0.10.30",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -12724,19 +12727,19 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync12, readFileSync as readFileSync16 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync16 } from "fs";
+import { join as join23 } from "path";
 
 // src/lib/installer.ts
-import { existsSync as existsSync11, readFileSync as readFileSync15, rmSync as rmSync2 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync15, rmSync as rmSync2 } from "fs";
+import { join as join21 } from "path";
 import { homedir as homedir4 } from "os";
 
 // src/lib/agent-sync.ts
 import {
   cpSync as cpSync2,
-  existsSync as existsSync9,
-  lstatSync as lstatSync16,
+  existsSync as existsSync10,
+  lstatSync as lstatSync17,
   mkdirSync as mkdirSync6,
   mkdtempSync,
   readFileSync as readFileSync13,
@@ -12747,7 +12750,7 @@ import {
   writeFileSync as writeFileSync5
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename6, dirname as dirname12, join as join18 } from "path";
+import { basename as basename6, dirname as dirname12, join as join19 } from "path";
 
 // src/lib/codex-local-mcp-controls.ts
 function isCodexLocalStdioMcpServer(name, server) {
@@ -14124,8 +14127,8 @@ function upgradeCodexSettingsWitnessV3(previous, reviewedSettingsPath) {
 // src/lib/agent-integration.ts
 import { createHash as createHash12, randomUUID as randomUUID2 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
-import { existsSync as existsSync8, lstatSync as lstatSync15, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync6, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants7, linkSync } from "fs";
-import { dirname as dirname11, join as join17, resolve as resolve10, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
+import { existsSync as existsSync9, lstatSync as lstatSync16, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync8, opendirSync as opendirSync3, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync2, rmdirSync as rmdirSync2, writeFileSync as writeFileSync4, unlinkSync as unlinkSync3, chmodSync, openSync as openSync8, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, readSync as readSync6, constants as constants7, linkSync } from "fs";
+import { dirname as dirname11, join as join18, resolve as resolve11, relative as relative5, isAbsolute as isAbsolute11, sep as sep5 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/lib/managed-policy.ts
@@ -14519,6 +14522,114 @@ function disableCodexBundledSkills(text2) {
   return [...candidates][0];
 }
 
+// src/lib/agent-sumi.ts
+import { existsSync as existsSync8, lstatSync as lstatSync15, realpathSync as realpathSync6 } from "fs";
+import { join as join17, resolve as resolve10 } from "path";
+function sumiConfigDirectory(home, env = process.env) {
+  for (const key of ["SUMI_CONFIG", "SUMI_CONFIG_CONTENT"])
+    if (env[key] !== undefined)
+      throw new Error(`Sumi ${key} requires a dedicated discovery adapter; unset it before Skills integration`);
+  const selected = (key) => env[key]?.trim() ? env[key] : undefined;
+  const expand = (value) => resolve10(value === "~" ? home : value.startsWith("~/") ? join17(home, value.slice(2)) : value);
+  const explicit = selected("SUMI_CONFIG_DIR");
+  const xdg = selected("XDG_CONFIG_HOME");
+  const custom = selected("SUMI_HOME");
+  const canonical5 = explicit ? expand(explicit) : xdg ? join17(expand(xdg), "sumi") : join17(custom ? expand(custom) : join17(home, ".hasna-internal/sumi"), "config");
+  if (explicit || xdg || custom)
+    return canonical5;
+  const legacy = join17(home, ".config/sumi");
+  const a = lstatSync15(canonical5, { throwIfNoEntry: false }), b = lstatSync15(legacy, { throwIfNoEntry: false });
+  if (a && b && realpathSync6(canonical5) !== realpathSync6(legacy))
+    throw new Error("Sumi config roots conflict; complete native home adoption before Skills integration");
+  const path = a ? canonical5 : b ? legacy : canonical5;
+  if (!existsSync8(path))
+    return path;
+  const physical = realpathSync6(path);
+  if ((a?.isSymbolicLink() || b?.isSymbolicLink()) && ![canonical5, legacy].includes(physical))
+    throw new Error("Sumi config alias must resolve to its canonical or legacy root");
+  return physical;
+}
+function sumiBridgeRoot(home) {
+  return join17(sumiConfigDirectory(home), "skills");
+}
+function sumiConfigPath(home) {
+  return join17(sumiConfigDirectory(home), "sumi.json");
+}
+function renderSumiPlugin(command, profile) {
+  return `// Managed by @hasna/skills. Regenerate with skills hook install --agent sumi.
+import { spawn } from "node:child_process";
+const command = ${JSON.stringify(command)};
+const profile = ${JSON.stringify(profile)};
+function context(input) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, ["hook", "user-prompt", "--agent", "sumi", "--selection-profile", profile], { cwd: input.cwd, stdio: ["pipe", "pipe", "pipe"] });
+    const chunks = []; let bytes = 0, failure;
+    const timer = setTimeout(() => { failure = new Error("Skills prompt hook timed out"); child.kill("SIGKILL"); }, 15000);
+    child.stdout.on("data", chunk => { bytes += chunk.length; if (bytes > 1048576) { failure = new Error("Skills prompt hook output exceeded its limit"); child.kill("SIGKILL"); } else chunks.push(chunk); });
+    child.stderr.on("data", () => {});
+    child.stdin.on("error", () => {});
+    child.on("error", error => { clearTimeout(timer); reject(error); });
+    child.on("close", code => {
+      clearTimeout(timer);
+      if (failure || code !== 0) return reject(failure ?? new Error("Skills prompt hook failed"));
+      try {
+        const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!result || typeof result !== "object" || Array.isArray(result)) throw new Error("Invalid Skills hook response");
+        if (result.decision === "block" || result.continue === false) throw new Error("Skills prompt hook refused");
+        if (Object.keys(result).length && (!result.hookSpecificOutput || result.hookSpecificOutput.hookEventName !== input.hook_event_name)) throw new Error("Invalid Skills hook response");
+        const text = result.hookSpecificOutput?.additionalContext ?? "";
+        if (typeof text !== "string") throw new Error("Invalid Skills prompt context");
+        resolve(text);
+      } catch (error) { reject(error); }
+    });
+    child.stdin.end(JSON.stringify(input));
+  });
+}
+export default {
+  id: "local.hasna-skills-cli",
+  async setup(ctx) {
+    if (!ctx?.session?.hook || !ctx?.session?.get || !ctx?.skill?.transform || !ctx?.tool?.hook) throw new Error("Unsupported Sumi native Skills contract");
+    const registrations = [];
+    const sessions = new Set();
+    async function input(sessionID, prompt, first) {
+      // The Promise adapter unwraps single-data endpoint responses.
+      const session = await ctx.session.get({ sessionID });
+      if (!session || session.id !== sessionID || typeof session.location?.directory !== "string" || (session.parentID !== undefined && typeof session.parentID !== "string") || session.parentID === sessionID) throw new Error("Invalid Sumi session custody");
+      return { hook_event_name: first ? session.parentID ? "SubagentStart" : "SessionStart" : "UserPromptSubmit", cwd: session.location.directory, session_id: sessionID, parent_session_id: session.parentID ?? null, prompt, restore: true };
+    }
+    registrations.push(await ctx.skill.transform(editor => {
+      for (const skill of editor.list()) if (skill.id !== "skills-cli" || skill.name !== "skills-cli") editor.remove(skill.id);
+    }));
+    // Native config transforms may add skills after this transform. Guard
+    // both direct tool calls and prompt attachments at the consumption edge.
+    registrations.push(await ctx.tool.hook("execute.before", event => {
+      if (event.tool === "skill" && event.input?.id !== "skills-cli") throw new Error("Native Sumi skill payload refused; use Skills CLI");
+    }));
+    registrations.push(await ctx.session.hook("prompt", async event => {
+      if (typeof event.prompt?.text !== "string") throw new Error("Invalid Sumi prompt");
+      if (event.prompt.skills !== undefined && (!Array.isArray(event.prompt.skills) || event.prompt.skills.some(skill => skill?.id !== "skills-cli"))) throw new Error("Native Sumi skill attachment refused; use Skills CLI");
+      await context(await input(event.sessionID, event.prompt.text, !sessions.has(event.sessionID)));
+      sessions.add(event.sessionID);
+    }));
+    registrations.push(await ctx.session.hook("context", async event => {
+      const last = event.messages.findLast(message => message.role === "user");
+      const prompt = (last?.content ?? []).filter(part => part.type === "text").map(part => part.text).join("\\n");
+      // Recheck on every primary request, including resumed and synthetic
+      // sessions. The CLI owns optional failures versus explicit refusals.
+      const text = await context(await input(event.sessionID, prompt, !sessions.has(event.sessionID)));
+      if (text) event.system.push({ type: "text", text });
+      sessions.add(event.sessionID);
+    }));
+    return async () => { for (const registration of registrations) await registration.dispose(); };
+  },
+};
+`;
+}
+var SUMI_SKILL_PERMISSIONS = [
+  { action: "skill", resource: "*", effect: "deny" },
+  { action: "skill", resource: "skills-cli", effect: "allow" }
+];
+
 // src/lib/agent-integration.ts
 var sha3 = (data) => createHash12("sha256").update(data).digest("hex");
 var ROOTS = NATIVE_SKILL_ROOTS;
@@ -14553,11 +14664,11 @@ function isSystemRootAlias(path) {
   const target = `/private${path}`, link = `private${path}`;
   const identity4 = (stat) => `${stat.dev}:${stat.ino}:${stat.ctimeNs}:${stat.uid}:${stat.mode}`;
   try {
-    const before = lstatSync15(path, { bigint: true });
+    const before = lstatSync16(path, { bigint: true });
     if (!before.isSymbolicLink() || before.uid !== 0n || readlinkSync4(path) !== link)
       return false;
     const directories = ["/", "/private", target].map((directory) => {
-      const stat = lstatSync15(directory, { bigint: true });
+      const stat = lstatSync16(directory, { bigint: true });
       if (!stat.isDirectory() || stat.uid !== 0n)
         throw new Error("Untrusted system alias directory");
       if (directory !== "/private/tmp") {
@@ -14574,23 +14685,23 @@ function isSystemRootAlias(path) {
       }
       return { directory, identity: identity4(stat) };
     });
-    return realpathSync6(path) === target && readlinkSync4(path) === link && identity4(lstatSync15(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync15(item.directory, { bigint: true })) === item.identity);
+    return realpathSync7(path) === target && readlinkSync4(path) === link && identity4(lstatSync16(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync16(item.directory, { bigint: true })) === item.identity);
   } catch {
     return false;
   }
 }
 function canonicalSystemPath(path) {
-  const absolute = resolve10(path), root = `/${absolute.split(sep5)[1]}`;
-  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync15(root, { throwIfNoEntry: false })?.isSymbolicLink())
+  const absolute = resolve11(path), root = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root) || !lstatSync16(root, { throwIfNoEntry: false })?.isSymbolicLink())
     return absolute;
   if (!isSystemRootAlias(root))
     throw new Error(`Refusing symlink path: ${root}`);
   return `/private${absolute}`;
 }
 function assertSafePath(path) {
-  let cursor = resolve10(path);
+  let cursor = resolve11(path);
   while (true) {
-    if (lstatSync15(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
+    if (lstatSync16(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
     const parent = dirname11(cursor);
     if (parent === cursor)
@@ -14600,16 +14711,16 @@ function assertSafePath(path) {
 }
 function readRootAlias(home, agent) {
   assertSafePath(home);
-  const realHome = realpathSync6(home), alias = join17(realHome, `.${agent}`);
-  const stat = lstatSync15(alias, { throwIfNoEntry: false, bigint: true });
+  const realHome = realpathSync7(home), alias = join18(realHome, `.${agent}`);
+  const stat = lstatSync16(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync4(alias), targetPath = resolve10(dirname11(alias), link);
+  const link = readlinkSync4(alias), targetPath = resolve11(dirname11(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync15(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync16(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
-  const target = realpathSync6(targetPath), inside = relative5(realHome, target);
+  const target = realpathSync7(targetPath), inside = relative5(realHome, target);
   if (!inside || inside === ".." || inside.startsWith(`..${sep5}`) || isAbsolute11(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link, aliasIdentity: `${stat.dev}:${stat.ino}:${stat.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
@@ -14619,7 +14730,7 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync15(join17(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync16(join18(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep5) || other.target.startsWith(item.target + sep5))))
     throw new Error("Agent root alias targets must not overlap");
@@ -14627,7 +14738,7 @@ function rootAliases(home, allowed = false) {
 }
 function canonicalAgentPath(path, aliases) {
   const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
-  return binding ? join17(binding.target, relative5(binding.alias, absolute)) : absolute;
+  return binding ? join18(binding.target, relative5(binding.alias, absolute)) : absolute;
 }
 function disabledCodexSkillPaths(config, aliases) {
   const skills = config.skills;
@@ -14646,7 +14757,7 @@ function disabledCodexSkillPaths(config, aliases) {
       continue;
     let document2;
     try {
-      document2 = realpathSync6(canonicalAgentPath(entry.path, aliases));
+      document2 = realpathSync7(canonicalAgentPath(entry.path, aliases));
     } catch {
       continue;
     }
@@ -14658,7 +14769,7 @@ function disabledCodexSkillPaths(config, aliases) {
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
-    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join17(binding.home, `.${binding.agent}`))
+    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join18(binding.home, `.${binding.agent}`))
       throw new Error("Invalid agent root alias binding");
     const current = readRootAlias(binding.home, binding.agent);
     if (JSON.stringify(current) !== JSON.stringify(binding))
@@ -14667,7 +14778,7 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync15(path);
+  const before = lstatSync16(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
   const descriptor = openSync8(path, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
@@ -14683,7 +14794,7 @@ function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
         break;
       length += count;
     }
-    const after = fstatSync8(descriptor), current = lstatSync15(path);
+    const after = fstatSync8(descriptor), current = lstatSync16(path);
     if (current.dev !== opened.dev || current.ino !== opened.ino || current.size !== after.size || current.mtimeMs !== after.mtimeMs || current.ctimeMs !== after.ctimeMs || length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
@@ -14695,14 +14806,14 @@ function treeHash(root) {
   const hash2 = createHash12("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat = lstatSync15(path);
+    const stat = lstatSync16(path);
     if (stat.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative5(root, path);
     if (stat.isDirectory()) {
       hash2.update(`d\x00${rel}\x00`);
       for (const name of readdirSync8(path).sort())
-        visit2(join17(path, name));
+        visit2(join18(path, name));
       return;
     }
     if (!stat.isFile())
@@ -14724,10 +14835,10 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const identities = new Set;
   const selected = [];
   for (const target of manifest.targets) {
-    if (!isAbsolute11(target.projectRoot) || resolve10(target.projectRoot) !== target.projectRoot)
+    if (!isAbsolute11(target.projectRoot) || resolve11(target.projectRoot) !== target.projectRoot)
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
-    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve10(projectRoot, target.path));
-    if (!existsSync8(projectRoot) || !lstatSync15(projectRoot).isDirectory())
+    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative5(projectRoot, resolve11(projectRoot, target.path));
+    if (!existsSync9(projectRoot) || !lstatSync16(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute11(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
@@ -14736,8 +14847,8 @@ function selectNativeMigrationTargets(inventory, manifest) {
     if (identities.has(identity4))
       throw new Error(`Duplicate native migration target: ${target.path}`);
     identities.add(identity4);
-    const expected = canonicalSystemPath(resolve10(target.projectRoot, target.path));
-    const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve10(entry2.path) === expected);
+    const expected = canonicalSystemPath(resolve11(target.projectRoot, target.path));
+    const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve11(entry2.path) === expected);
     if (matches.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
     const entry = matches[0];
@@ -14766,9 +14877,9 @@ function projectAncestorDirectories(projects) {
 }
 function inventoryNativeSkills(home = homedir2(), options = {}) {
   home = canonicalSystemPath(home);
-  if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute11(options.reviewedCacheAlias) || resolve10(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
+  if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute11(options.reviewedCacheAlias) || resolve11(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
-  if (options.disabledVendorPaths?.some((path) => !isAbsolute11(path) || resolve10(path) !== path))
+  if (options.disabledVendorPaths?.some((path) => !isAbsolute11(path) || resolve11(path) !== path))
     throw new Error("Disabled vendor paths must be exact absolute paths");
   const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
   const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
@@ -14776,14 +14887,18 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
   const rootDefinitions = selectedAgents ? ROOTS.filter(([agent, path]) => selectedAgents.has(agent) || selectedAgents.has("hermes") && agent === "codex" && path === ".agents/skills") : ROOTS;
-  const roots = rootDefinitions.map(([agent, path]) => [agent, canonicalAgentPath(join17(home, path), aliases)]);
-  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join17(home, adapter.root, CLI_BRIDGE_NAME), aliases));
+  const roots = rootDefinitions.map(([agent, path]) => [agent, canonicalAgentPath(join18(home, path), aliases)]);
+  const bridgePaths = Object.entries(AGENT_ADAPTERS).filter(([agent]) => agent !== "sumi" || includesAgent("sumi")).map(([agent, adapter]) => canonicalAgentPath(join18(agent === "sumi" ? sumiBridgeRoot(home) : join18(home, adapter.root), CLI_BRIDGE_NAME), aliases));
   for (const project of projectAncestorDirectories([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []])) {
     for (const [agent, path] of rootDefinitions)
-      roots.push([agent, canonicalAgentPath(join17(project, path), aliases)]);
+      roots.push([agent, canonicalAgentPath(join18(project, path), aliases)]);
+    if (selectedAgents?.has("sumi"))
+      for (const directory of [".claude", ".agents"])
+        for (const name of ["skill", "skills"])
+          roots.push(["sumi", canonicalAgentPath(join18(project, directory, name), aliases)]);
   }
   const installationInputs = options.codexInstallationInputRoots ?? [];
-  if (installationInputs.some((input) => resolve10(input) !== input || realpathSync6(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+  if (installationInputs.some((input) => resolve11(input) !== input || realpathSync7(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
     throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
@@ -14797,13 +14912,13 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   }
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
-    const link = readlinkSync4(path), lexicalTarget = resolve10(parent, link);
+    const link = readlinkSync4(path), lexicalTarget = resolve11(parent, link);
     if (isAbsolute11(link) ? link !== lexicalTarget : dirname11(link) !== ".")
       return false;
     const target = canonicalSystemPath(lexicalTarget);
     if (dirname11(target) !== parent)
       return false;
-    if (!lstatSync15(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync16(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     if (!scan?.complete || scan.entries > maxAliasProofEntries)
@@ -14826,37 +14941,40 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     assertSafePath(path);
     if (configuredRoot && agent === "codex" && installationInputs.some((root) => path === root || path.startsWith(`${root}${sep5}`)))
       return scan;
-    if (!existsSync8(path))
+    if (!existsSync9(path))
       return scan;
-    const stat = lstatSync15(path);
-    if (stat.isFile())
+    const stat = lstatSync16(path);
+    if (stat.isFile()) {
+      if (agent === "sumi" && depth === 1 && path.endsWith(".md"))
+        throw new Error("NATIVE_SKILL_DRIFT: flat Sumi skill documents require a dedicated migration adapter");
       return scan;
+    }
     if (!stat.isDirectory())
       throw new Error(`Unsupported native discovery entry: ${path}`);
-    if (existsSync8(join17(path, "SKILL.md"))) {
+    if (existsSync9(join18(path, "SKILL.md"))) {
       scan.hasSkills = true;
       if (seen.has(path))
         return scan;
       seen.add(path);
       let managed = false;
-      const marker = join17(path, ".hasna-skills.json");
-      if (existsSync8(marker)) {
+      const marker = join18(path, ".hasna-skills.json");
+      if (existsSync9(marker)) {
         try {
           managed = JSON.parse(readFileSync12(marker, "utf8")).managedBy === "@hasna/skills";
         } catch {}
       }
-      const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
+      const bridge = (!vendor || agent === "sumi") && isOwnedCliBridge(path, bridgePaths);
       const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep5));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join17(home, ".codex", "skills", ".system"), aliases) + sep5) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve10(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join18(home, ".codex", "skills", ".system"), aliases) + sep5) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve11(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
-    if (depth > (vendor ? 32 : 3))
+    if (depth > (agent === "sumi" ? 32 : vendor ? 32 : 3))
       return { ...scan, complete: false };
     const children = [], directory = opendirSync3(path);
     try {
       let child;
       while ((child = directory.readSync()) !== null) {
-        admit(join17(path, child.name));
+        admit(join18(path, child.name));
         children.push(child);
       }
     } finally {
@@ -14868,13 +14986,13 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     for (const { name } of children) {
       if (name === "node_modules")
         continue;
-      if (name.startsWith(".") && name !== ".system" && agent !== "hermes" && !(options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`)))
+      if (name.startsWith(".") && name !== ".system" && agent !== "hermes" && agent !== "sumi" && !(options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`)))
         continue;
       const isVendor = vendor || name === ".system";
       if (isVendor && !options.includeVendor)
         continue;
-      const child = join17(path, name);
-      if (isVendor && lstatSync15(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      const child = join18(path, name);
+      if (isVendor && lstatSync16(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync8(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
@@ -14900,11 +15018,11 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     scanRoot(agent, path);
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"].filter(includesAgent))
-      scanRoot(agent, canonicalAgentPath(join17(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+      scanRoot(agent, canonicalAgentPath(join18(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
     if (includesAgent("claude"))
-      scanRoot("claude", canonicalAgentPath(join17(home, ".claude", "plugins", "synced"), aliases), true);
+      scanRoot("claude", canonicalAgentPath(join18(home, ".claude", "plugins", "synced"), aliases), true);
     if (includesAgent("gemini"))
-      scanRoot("gemini", join17(home, ".gemini", "extensions"), true);
+      scanRoot("gemini", join18(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
@@ -14917,7 +15035,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
 }
 function readOptional(path) {
   assertSafePath(path);
-  return existsSync8(path) ? readFileSync12(path, "utf8") : null;
+  return existsSync9(path) ? readFileSync12(path, "utf8") : null;
 }
 function jsonObject(text2, path) {
   if (text2 === null)
@@ -15017,19 +15135,19 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
   let result = normalizeCodexInlinePathConfig(bundled);
-  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve10(bridgePath), resolve10(join17(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
+  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve11(bridgePath), resolve11(join18(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
     throw new Error("Codex skill controls require one path or name selector per [[skills.config]] entry; review ambiguous entries before running skills hook install");
   const bridgeNeedsRepair = previousConfig?.some((entry) => entry.enabled === false && bridgeSelector(entry));
   const selections = [...skills.filter((entry) => entry.agent === "codex" && !entry.bridge).map((skill) => ({ path: skill.path, enabled: false })), { path: bridgePath, enabled: true }];
   for (const skill of selections) {
-    const path = join17(skill.path, "SKILL.md");
+    const path = join18(skill.path, "SKILL.md");
     let found = false;
     result = result.replace(CODEX_SKILL_CONFIG_SECTIONS, (section) => {
       const parsed = Bun.TOML.parse(section);
       const declared = parsed.skills?.config?.[0];
-      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve10(path), resolve10(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
+      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve11(path), resolve11(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
         return section;
       found = true;
       return /^\s*enabled\s*=/m.test(section) ? section.replace(/^\s*enabled\s*=.*$/m, `enabled = ${skill.enabled}`) : `${section.trimEnd()}
@@ -15050,14 +15168,14 @@ enabled = false
   return result;
 }
 function assertCodexInstallationInputs(home, projectDirs, inputs) {
-  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve10(directory, path)));
+  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve11(directory, path)));
   if (inputs.some((input) => nativeRoots.some((root) => root === input || root.startsWith(input + sep5) || input.startsWith(root + sep5))))
     throw new Error("Native installation input overlaps an unconditional skill-loading root");
 }
 function planAgentIntegration(options) {
   const home = options.home ?? homedir2(), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const aliases = rootAliases(home, options.allowRootAliases);
-  const policyPath = join17(dataDir2, "agent-policy.json");
+  const policyPath = join18(dataDir2, "agent-policy.json");
   assertSafePath(policyPath);
   const priorSnapshot = readManagedSkillPolicySnapshot(dataDir2), previousPolicy = priorSnapshot?.text ?? null, policy = priorSnapshot?.value ?? {};
   if (policy.bridge !== undefined && (!policy.bridge || typeof policy.bridge !== "object" || Array.isArray(policy.bridge)))
@@ -15089,10 +15207,10 @@ function planAgentIntegration(options) {
     }
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
-  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join17(home, ".codex", "config.toml"), aliases)) ?? "") : {};
+  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join18(home, ".codex", "config.toml"), aliases)) ?? "") : {};
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const observedNativeSources = [];
-  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join17(entry.path, "SKILL.md")), canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), resolve10(options.projectDir ?? home), (path) => {
+  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join18(entry.path, "SKILL.md")), canonicalAgentPath(join18(home, ".codex/plugins/cache"), aliases), resolve11(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha3(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
@@ -15100,7 +15218,7 @@ function planAgentIntegration(options) {
   const codexPluginSkills = codexPluginControls.skills;
   const codexInactivePlugins = codexPluginControls.inactivePlugins;
   const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
-  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root + sep5)) && codexDiscovery.sources.some((source) => source.path === join17(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
+  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root) => root === input.sourceRoot || root.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root + sep5)) && codexDiscovery.sources.some((source) => source.path === join18(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
   assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
@@ -15108,19 +15226,19 @@ function planAgentIntegration(options) {
       throw new Error(`Unsupported agent: ${agent}`);
     const { command, profileId: profileId2 } = bindings.get(agent);
     const adapter = AGENT_ADAPTERS[agent];
-    const bridgePath = canonicalAgentPath(join17(home, adapter.root, CLI_BRIDGE_NAME), aliases);
+    const bridgePath = canonicalAgentPath(join18(agent === "sumi" ? sumiBridgeRoot(home) : join18(home, adapter.root), CLI_BRIDGE_NAME), aliases);
     assertSafePath(bridgePath);
-    if (existsSync8(bridgePath) && !isOwnedCliBridge(bridgePath, [bridgePath]))
+    if (existsSync9(bridgePath) && !isOwnedCliBridge(bridgePath, [bridgePath]))
       throw new Error(`Refusing to overwrite an unrecognized or modified Skills bridge: ${bridgePath}`);
     for (const [name, after2] of Object.entries(CLI_BRIDGE_FILES)) {
-      const path2 = join17(bridgePath, name), before2 = readOptional(path2);
+      const path2 = join18(bridgePath, name), before2 = readOptional(path2);
       if (before2 !== after2)
         changes.push({ path: path2, before: before2, after: after2 });
     }
-    const path = canonicalAgentPath(join17(home, adapter.config), aliases);
+    const path = canonicalAgentPath(agent === "sumi" ? sumiConfigPath(home) : join18(home, adapter.config), aliases);
     const before = readOptional(path);
     if (agent === "hermes") {
-      const supervisorPath = join17(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(command, profileId2);
+      const supervisorPath = join18(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(command, profileId2);
       const priorCommand = policy.bridge?.commands?.hermes, priorProfile = policy.bridge?.profiles?.hermes ?? policy.profileId;
       const previous = policy.bridge?.supervisors?.hermes;
       if (supervisorBefore !== null && supervisorBefore !== supervisorAfter && !(previous?.path === supervisorPath && typeof priorCommand === "string" && typeof priorProfile === "string" && supervisorBefore === renderHermesSupervisor(priorCommand, priorProfile)))
@@ -15131,19 +15249,30 @@ function planAgentIntegration(options) {
       const after2 = configureHermesHooks(before, supervisor, previous);
       if (before !== after2)
         changes.push({ path, before, after: after2 });
-      const optOut = join17(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
+      const optOut = join18(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
       if (optOutBefore === null)
         changes.push({ path: optOut, before: null, after: `Managed by @hasna/skills: bundled native skill reseeding is disabled.
 ` });
       continue;
     }
     const config = jsonObject(before, path);
-    if (agent === "opencode") {
+    if (agent === "sumi") {
+      if (config.permissions !== undefined && (!Array.isArray(config.permissions) || config.permissions.some((rule) => !rule || typeof rule.action !== "string" || typeof rule.resource !== "string" || !["allow", "deny", "ask"].includes(rule.effect))))
+        throw new Error("Expected Sumi native permission rules");
+      config.permissions = [...(config.permissions ?? []).filter((rule) => rule.action !== "skill"), ...SUMI_SKILL_PERMISSIONS];
+      const pluginPath = join18(sumiConfigDirectory(home), "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
+      const pluginAfter = renderSumiPlugin(command, profileId2);
+      const priorCommand = policy.bridge?.commands?.sumi, priorProfile = policy.bridge?.profiles?.sumi ?? policy.profileId;
+      if (pluginBefore !== null && pluginBefore !== pluginAfter && !(typeof priorCommand === "string" && typeof priorProfile === "string" && pluginBefore === renderSumiPlugin(priorCommand, priorProfile)))
+        throw new Error("Refusing to overwrite a modified Sumi Skills plugin; preserve and review it first");
+      if (pluginBefore !== pluginAfter)
+        changes.push({ path: pluginPath, before: pluginBefore, after: pluginAfter });
+    } else if (agent === "opencode") {
       const permission = config.permission ?? {};
       if (!permission || typeof permission !== "object" || Array.isArray(permission))
         throw new Error("Expected OpenCode permission object");
       config.permission = { ...permission, skill: { "*": "deny", [CLI_BRIDGE_NAME]: "allow" } };
-      const pluginPath = join17(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
+      const pluginPath = join18(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
       const pluginAfter = renderOpenCodePlugin(command, profileId2);
       const priorCommand = policy.bridge?.commands?.opencode;
       const ownedPrevious = typeof priorCommand === "string" && typeof policy.profileId === "string" && pluginBefore === renderOpenCodePlugin(priorCommand, policy.bridge?.profiles?.opencode ?? policy.profileId);
@@ -15160,13 +15289,13 @@ function planAgentIntegration(options) {
     if (before !== after)
       changes.push({ path, before, after });
     if (agent === "codex") {
-      const configPath = canonicalAgentPath(join17(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
+      const configPath = canonicalAgentPath(join18(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
       const next = disableReviewedCodexPluginNames(disableCodexSkills(previous ?? "", nativeSkills, aliases, bridgePath), codexPluginSkills);
       if (next !== (previous ?? ""))
         changes.push({ path: configPath, before: previous, after: next });
     }
   }
-  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join17(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join17(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
+  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha3(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join18(home, ".codex/config.toml"), aliases))?.before === null ? null : sha3(readOptional(canonicalAgentPath(join18(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
   const discoveryAfter = discoveries.map((binding) => {
     const rebound = rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after])));
     if (binding.agent !== "codex")
@@ -15181,12 +15310,12 @@ function planAgentIntegration(options) {
     version: CLI_BRIDGE_VERSION,
     digest: CLI_BRIDGE_DIGEST,
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
-    home: resolve10(home),
+    home: resolve11(home),
     includeVendor: true,
-    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join17(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha3(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
+    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join18(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha3(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries([...bindings].map(([agent, binding]) => [agent, binding.command])) },
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
-    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join17(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
+    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join18(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
     ...options.codexNativeCatalog || codexPluginSkills.length || codexInactivePlugins.length || codexPluginSourceInputs.length ? { codexPluginSkills, codexInactivePlugins, codexPluginSkillReview } : {},
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
@@ -15209,7 +15338,7 @@ function claudeSettingsConsumers(home, path, discoveries, aliases) {
     const distance = relative5(canonical5(root), path);
     return distance === "" || distance !== ".." && !distance.startsWith(`..${sep5}`) && !isAbsolute11(distance);
   };
-  return discoveries.filter((binding) => binding.agent === "claude" || binding.agent === "opencode" || canonical5(join17(home, AGENT_ADAPTERS[binding.agent].config)) === path || binding.sources.some((source) => canonical5(source.path) === path) || binding.roots.some(containsSettings) || binding.directories?.some((directory) => containsSettings(directory.path))).map((binding) => binding.agent);
+  return discoveries.filter((binding) => binding.agent === "claude" || binding.agent === "opencode" || canonical5(join18(home, AGENT_ADAPTERS[binding.agent].config)) === path || binding.sources.some((source) => canonical5(source.path) === path) || binding.roots.some(containsSettings) || binding.directories?.some((directory) => containsSettings(directory.path))).map((binding) => binding.agent);
 }
 function verifyCoordinatedDiscovery(binding, home, aliases) {
   try {
@@ -15226,8 +15355,8 @@ function verifyCoordinatedDiscovery(binding, home, aliases) {
   }
 }
 function planClaudeHookEventsUpdate(options) {
-  const home = resolve10(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
-  const policyPath = join17(dataDir2, "agent-policy.json");
+  const home = resolve11(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join18(dataDir2, "agent-policy.json");
   assertSafePath(policyPath);
   const snapshot = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot)
@@ -15238,9 +15367,9 @@ function planClaudeHookEventsUpdate(options) {
   }
   const aliases = bridge.rootAliases ?? [];
   recheckRootAliases(aliases);
-  const path = canonicalAgentPath(join17(home, ".claude", "settings.json"), aliases);
+  const path = canonicalAgentPath(join18(home, ".claude", "settings.json"), aliases);
   assertSafePath(path);
-  const before = lstatSync15(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
+  const before = lstatSync16(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
   if ((before === null ? "absent" : sha3(before)) !== options.expectedSettingsSha256)
     throw new Error("Claude settings preimage changed");
   assertClaudeHookEventsReplacement(before, options.replacement, options.events);
@@ -15300,14 +15429,14 @@ function atomicWrite2(path, content) {
     writeFileSync4(temporary, content, { mode: 384, flag: "wx" });
     renameSync2(temporary, path);
   } finally {
-    if (existsSync8(temporary))
+    if (existsSync9(temporary))
       unlinkSync3(temporary);
   }
 }
 function planAgentSettingsWitnessUpgrade(options) {
   if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
     throw new Error("Invalid Codex witness target version");
-  const home = resolve10(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const home = resolve11(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot || sha3(snapshot.text) !== options.expectedPolicySha256)
     throw new Error("Managed policy preimage changed");
@@ -15316,7 +15445,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   const binding = policy.bridge?.discovery?.[options.agent];
   if (!binding || binding.agent !== options.agent || binding.method !== "reviewed")
     throw new Error("Settings witness upgrade requires an existing reviewed native binding");
-  const configPath = canonicalAgentPath(join17(home, options.agent === "claude" ? ".claude/settings.json" : ".codex/config.toml"), aliases);
+  const configPath = canonicalAgentPath(join18(home, options.agent === "claude" ? ".claude/settings.json" : ".codex/config.toml"), aliases);
   const settings = readOptional(configPath);
   if (settings === null || sha3(settings) !== options.expectedSettingsSha256)
     throw new Error("Native settings preimage changed");
@@ -15355,7 +15484,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   const replacement = { ...binding, sources: rebound };
   verifyAgentDiscovery(replacement);
   const after = serializeManagedSkillPolicy({ ...policy, bridge: { ...policy.bridge, discovery: { ...policy.bridge.discovery, [options.agent]: replacement } } });
-  return { dataDir: dataDir2, profileId: policy.profileId, changes: [{ path: join17(dataDir2, "agent-policy.json"), before: snapshot.text, after }], nativeSkills: [], observedPolicy: { path: join17(dataDir2, "agent-policy.json"), before: snapshot.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
+  return { dataDir: dataDir2, profileId: policy.profileId, changes: [{ path: join18(dataDir2, "agent-policy.json"), before: snapshot.text, after }], nativeSkills: [], observedPolicy: { path: join18(dataDir2, "agent-policy.json"), before: snapshot.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
 }
 function applyAgentIntegration(plan) {
   for (const source of plan.observedNativeSources ?? [])
@@ -15363,12 +15492,12 @@ function applyAgentIntegration(plan) {
       throw new Error("Native identity source changed after planning");
   if (plan.observedSettings && readOptional(plan.observedSettings.path) !== plan.observedSettings.before)
     throw new Error("Native settings changed after witness planning");
-  const policyPath = join17(plan.dataDir, "agent-policy.json");
+  const policyPath = join18(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve10(path) === resolve10(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve11(path) === resolve11(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve10(change.path) === resolve10(policyPath))
+    if (resolve11(change.path) === resolve11(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
@@ -15397,7 +15526,7 @@ function applyAgentIntegration(plan) {
   for (const change of plan.changes)
     if (currentText(change.path) !== change.before)
       throw new Error(`Configuration changed after planning: ${change.path}`);
-  const backupRoot = join17(plan.dataDir, "migration", randomUUID2()), backups = [], written = [], createdDirectories = new Set;
+  const backupRoot = join18(plan.dataDir, "migration", randomUUID2()), backups = [], written = [], createdDirectories = new Set;
   if (!plan.changes.length) {
     recheckRootAliases(aliases);
     return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
@@ -15407,7 +15536,7 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join17(backupRoot, `${index}-${sha3(change.path).slice(0, 12)}.backup`);
+      const backup = join18(backupRoot, `${index}-${sha3(change.path).slice(0, 12)}.backup`);
       writeFileSync4(backup, change.before, { mode: 384, flag: "wx" });
       if (readFileSync12(backup, "utf8") !== change.before)
         throw new Error("Native configuration preservation readback failed");
@@ -15418,7 +15547,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname11(change.path);!existsSync8(directory); directory = dirname11(directory))
+      for (let directory = dirname11(change.path);!existsSync9(directory); directory = dirname11(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -15438,7 +15567,7 @@ function applyAgentIntegration(plan) {
     }
     for (const agent of plan.managedAgentChecks?.agents ?? [])
       assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
-    atomicWrite2(join17(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha3(change.before), afterHash: sha3(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join18(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha3(change.before), afterHash: sha3(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -15492,7 +15621,7 @@ function writeArchiveJournal(path, value) {
   } finally {
     if (descriptor !== undefined)
       closeSync8(descriptor);
-    if (lstatSync15(temporary, { throwIfNoEntry: false }))
+    if (lstatSync16(temporary, { throwIfNoEntry: false }))
       unlinkSync3(temporary);
   }
 }
@@ -15503,7 +15632,7 @@ function archiveNativeSkills(inventory, options) {
   recheckRootAliases(aliases);
   for (const entry of inventory.filter((entry2) => entry2.bridge)) {
     const adapter = AGENT_ADAPTERS[entry.agent];
-    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join17(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
+    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join18(entry.agent === "sumi" ? sumiBridgeRoot(entry.bridgeHome) : join18(entry.bridgeHome, adapter.root), CLI_BRIDGE_NAME), aliases) : undefined;
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
@@ -15514,11 +15643,11 @@ function archiveNativeSkills(inventory, options) {
   const targetManifest = options.targetManifest ? { schema: options.targetManifest.schema, digest: options.targetManifest.digest, targetCount: options.targetManifest.targets.length } : undefined;
   if (!selected.length)
     return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
-  const operationId = randomUUID2(), archiveRoot = join17(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join17(archiveRoot, "receipt.json");
+  const operationId = randomUUID2(), archiveRoot = join18(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join18(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
-    source: entry.vendor ? join17(entry.path, "SKILL.md") : entry.path,
-    archive: join17(archiveRoot, `${index}-${sha3(entry.path).slice(0, 12)}`),
-    hash: entry.vendor ? sha3(readNativeBytes(join17(entry.path, "SKILL.md"))) : entry.hash,
+    source: entry.vendor ? join18(entry.path, "SKILL.md") : entry.path,
+    archive: join18(archiveRoot, `${index}-${sha3(entry.path).slice(0, 12)}`),
+    hash: entry.vendor ? sha3(readNativeBytes(join18(entry.path, "SKILL.md"))) : entry.hash,
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
@@ -15526,7 +15655,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat = lstatSync15(entry.archive);
+    const stat = lstatSync16(entry.archive);
     if (entry.discoveryOnly ? !stat.isFile() : !stat.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha3(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -15534,7 +15663,7 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync8(path); path = dirname11(path))
+  for (let path = archiveRoot;!existsSync9(path); path = dirname11(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
@@ -15574,7 +15703,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync15(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -15591,7 +15720,7 @@ function archiveNativeSkills(inventory, options) {
           syncArchiveDirectory(dirname11(entry.source));
           unlinkSync3(entry.archive);
         } else {
-          if (lstatSync15(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync16(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -15622,8 +15751,8 @@ function assertManagedAgentBridge(agent, options = {}) {
   assertManagedAgentBridgeWithDiscovery(agent, options);
 }
 function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscovery) {
-  const home = resolve10(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
-  assertSafePath(join17(dataDir2, "agent-policy.json"));
+  const home = resolve11(options.home ?? homedir2()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  assertSafePath(join18(dataDir2, "agent-policy.json"));
   const snapshot = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot)
     throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
@@ -15634,14 +15763,14 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   if (!Array.isArray(aliases))
     throw new Error("NATIVE_SKILL_DRIFT: invalid root alias binding");
   recheckRootAliases(aliases);
-  const expected = canonicalAgentPath(join17(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
+  const expected = canonicalAgentPath(join18(agent === "sumi" ? sumiBridgeRoot(home) : join18(home, AGENT_ADAPTERS[agent].root), CLI_BRIDGE_NAME), aliases);
   if (!isOwnedCliBridge(expected, [expected]))
     throw new Error("NATIVE_SKILL_DRIFT: the native Skills bridge is missing or modified; repair it before continuing");
   const roots = projectAncestorDirectories([options.projectDir ?? process.cwd(), ...options.projectDirs ?? [], ...agent === "hermes" && process.env.TERMINAL_CWD ? [process.cwd()] : []]);
-  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep5}.agents${sep5}skills${sep5}`) || agent === "opencode" && entry.agent === "claude";
+  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes", "sumi"].includes(agent) && entry.path.includes(`${sep5}.agents${sep5}skills${sep5}`) || ["opencode", "sumi"].includes(agent) && entry.agent === "claude";
   const discovery = provenDiscovery ?? binding.discovery?.[agent];
   assertProjectDiscovery(agent, [...roots], home, (path) => canonicalAgentPath(path, aliases), discovery);
-  const configPath = canonicalAgentPath(join17(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
+  const configPath = canonicalAgentPath(agent === "sumi" ? sumiConfigPath(home) : join18(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
   const command = binding.commands?.[agent], profile = binding.profiles?.[agent];
   if (typeof command !== "string" || typeof profile !== "string")
     throw new Error("NATIVE_SKILL_DRIFT: the native hook command/profile binding is missing");
@@ -15649,11 +15778,14 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: the hook selection profile differs from its managed binding; restart the native client after reviewing skills hook install");
   if (agent === "hermes") {
     const supervisor = binding.supervisors?.hermes;
-    if (supervisor?.path !== join17(dataDir2, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha3(renderHermesSupervisor(command, profile)))
+    if (supervisor?.path !== join18(dataDir2, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha3(renderHermesSupervisor(command, profile)))
       throw new Error("NATIVE_SKILL_DRIFT: Hermes supervisor binding changed; run skills hook install");
     assertHermesProtection(home, config, command, profile, supervisor);
+  } else if (agent === "sumi") {
+    if (JSON.stringify(config.permissions?.filter((rule) => rule.action === "skill")) !== JSON.stringify(SUMI_SKILL_PERMISSIONS) || readOptional(join18(sumiConfigDirectory(home), "plugins", "skills-cli.js")) !== renderSumiPlugin(command, profile))
+      throw new Error("NATIVE_SKILL_DRIFT: Sumi bridge protection changed; run skills hook install");
   } else if (agent === "opencode") {
-    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join17(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
+    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join18(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
       throw new Error("NATIVE_SKILL_DRIFT: OpenCode bridge protection changed; run skills hook install");
   } else {
     const required = {};
@@ -15670,21 +15802,21 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     if (agent === "gemini" && (config.hooksConfig?.enabled === false || config.skills?.enabled !== true || !["antigravity-support", "skill-creator"].every((name) => config.skills?.disabled?.includes(name)) || config.skills?.disabled?.includes(CLI_BRIDGE_NAME)))
       throw new Error("NATIVE_SKILL_DRIFT: Gemini bridge or bundled-skill protection changed; run skills hook install");
   }
-  const codexPath = canonicalAgentPath(join17(home, ".codex", "config.toml"), aliases);
+  const codexPath = canonicalAgentPath(join18(home, ".codex", "config.toml"), aliases);
   if (options.codexDiscoveryRecovery && (agent !== "codex" || options.codexDiscoveryRecovery.configPath !== codexPath))
     throw new Error("NATIVE_SKILL_DRIFT: Codex trust recovery names a different configuration root");
   const codexConfig = agent === "codex" ? Bun.TOML.parse(readOptional(codexPath) ?? "") : {};
   if (agent === "codex" && codexConfig.skills?.bundled?.enabled !== false)
     throw new Error("NATIVE_SKILL_DRIFT: Codex bundled skill reseeding is not disabled (skills.bundled.enabled); run skills hook install");
-  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join17(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
+  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join18(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
   if (agent === "codex" && [...setting(expected), ...(codexConfig.skills?.config ?? []).filter((entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME)].some((entry) => entry.enabled === false))
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
-  if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
+  if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join18(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
     throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
   const disabledPlugin = (entry) => {
     if (agent !== "codex" || !entry.vendor)
       return false;
-    const document2 = join17(entry.path, "SKILL.md"), cache = canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), read2 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    const document2 = join18(entry.path, "SKILL.md"), cache = canonicalAgentPath(join18(home, ".codex/plugins/cache"), aliases), read2 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
     return isReviewedCodexPluginInactive(document2, cache, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read2) || isReviewedCodexPluginSkillDisabled(document2, cache, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read2);
   };
   const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
@@ -15697,15 +15829,15 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
       return true;
     if (!disabledPaths.has(entry.path))
       return false;
-    if (entry.path.startsWith(canonicalAgentPath(join17(home, ".codex", "plugins", "cache"), aliases) + sep5))
+    if (entry.path.startsWith(canonicalAgentPath(join18(home, ".codex", "plugins", "cache"), aliases) + sep5))
       return true;
-    const runtimeCache = canonicalAgentPath(join17(home, ".cache", "codex-runtimes"), aliases);
+    const runtimeCache = canonicalAgentPath(join18(home, ".cache", "codex-runtimes"), aliases);
     if (entry.path.startsWith(runtimeCache + sep5) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep5)))
       return true;
-    const bundledMarketplaces = canonicalAgentPath(join17(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
+    const bundledMarketplaces = canonicalAgentPath(join18(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
     if (entry.path.startsWith(bundledMarketplaces + sep5) && discovery?.method === "automatic" && discovery.roots.some((root) => entry.path.startsWith(root + sep5)))
       return true;
-    if (!entry.path.startsWith(canonicalAgentPath(join17(home, ".codex", "skills", ".system"), aliases) + sep5))
+    if (!entry.path.startsWith(canonicalAgentPath(join18(home, ".codex", "skills", ".system"), aliases) + sep5))
       return false;
     return Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
   };
@@ -15715,6 +15847,8 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: an installed Gemini builtin is not disabled");
   try {
     verifyAgentDiscovery(discovery, options.codexDiscoveryRecovery);
+    if (agent === "sumi" && discovery.method === "reviewed")
+      resolveAgentDiscovery({ home, agent, retainedReview: discovery, canonical: (path) => canonicalAgentPath(path, aliases) });
     if (discovery.method === "automatic") {
       const current = resolveAgentDiscovery({ home, agent, canonical: (path) => canonicalAgentPath(path, aliases) });
       if (JSON.stringify(current) !== JSON.stringify(discovery))
@@ -15726,7 +15860,7 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   let installationInputRoots = [];
   if (agent === "codex") {
     try {
-      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join17(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join18(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
     } catch {
       throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
     }
@@ -15761,9 +15895,9 @@ function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
-  const path = join18(dir, SYNC_MARKER_FILE);
+  const path = join19(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync16(path).isFile())
+    if (!lstatSync17(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync13(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -15785,9 +15919,9 @@ function resolveSyncAgents(arg) {
 function agentGlobalSkillsDir(agent, homeDir2 = homedir3()) {
   switch (agent) {
     case "opencode":
-      return join18(homeDir2, ".config", "opencode", "skills");
+      return join19(homeDir2, ".config", "opencode", "skills");
     default:
-      return join18(homeDir2, `.${agent}`, "skills");
+      return join19(homeDir2, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -15846,8 +15980,8 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate = join18(source, sub);
-    if (existsSync9(candidate) && isDirectory(candidate))
+    const candidate = join19(source, sub);
+    if (existsSync10(candidate) && isDirectory(candidate))
       roots.push(candidate);
   }
   if (roots.length > 0)
@@ -15862,10 +15996,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate = join18(path, entry);
+    const candidate = join19(path, entry);
     if (!isDirectory(candidate))
       return false;
-    return existsSync9(join18(candidate, "SKILL.md")) || existsSync9(join18(candidate, "skill.json")) || existsSync9(join18(candidate, "package.json"));
+    return existsSync10(join19(candidate, "SKILL.md")) || existsSync10(join19(candidate, "skill.json")) || existsSync10(join19(candidate, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -15905,7 +16039,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join18(agentGlobalSkillsDir(agent, homeDir2), name, "SKILL.md"),
+          path: join19(agentGlobalSkillsDir(agent, homeDir2), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -15935,7 +16069,7 @@ function syncSkillsToAgents(options = {}) {
 }
 function writeManagedAgentSkill(params) {
   const homeDir2 = params.homeDir ?? homedir3();
-  const dir = join18(agentGlobalSkillsDir(params.agent, homeDir2), params.skill);
+  const dir = join19(agentGlobalSkillsDir(params.agent, homeDir2), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -15952,11 +16086,11 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join18(dir, "SKILL.md");
-  const markerPath = join18(dir, SYNC_MARKER_FILE);
-  const dirExists = existsSync9(dir);
+  const skillMdPath = join19(dir, "SKILL.md");
+  const markerPath = join19(dir, SYNC_MARKER_FILE);
+  const dirExists = existsSync10(dir);
   const managed = hasSkillsOwnershipMarker(dir);
-  const hasSkillMd = existsSync9(skillMdPath);
+  const hasSkillMd = existsSync10(skillMdPath);
   if (dirExists && !managed && !hasSkillMd) {
     return {
       action: "skip",
@@ -15968,7 +16102,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return {
       action: "skip",
       path: skillMdPath,
-      reason: existsSync9(markerPath) ? "an unmanaged SKILL.md already exists here (invalid or foreign ownership marker); pass --force to overwrite" : "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
+      reason: existsSync10(markerPath) ? "an unmanaged SKILL.md already exists here (invalid or foreign ownership marker); pass --force to overwrite" : "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
     };
   }
   if (dirExists && managed && hasSkillMd && !options.force && isPointerSkillMd(skillMd)) {
@@ -15991,11 +16125,11 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return { action, path: skillMdPath };
   const parentDir = dirname12(dir);
   mkdirSync6(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync(join18(parentDir, `.hasna-skills-write-${basename6(dir)}-`));
-  const candidateDir = join18(transactionDir, "candidate");
-  const backupDir = join18(transactionDir, "backup");
-  const candidateSkillMdPath = join18(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join18(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync(join19(parentDir, `.hasna-skills-write-${basename6(dir)}-`));
+  const candidateDir = join19(transactionDir, "candidate");
+  const backupDir = join19(transactionDir, "backup");
+  const candidateSkillMdPath = join19(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join19(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -16022,9 +16156,9 @@ function writeManagedSkillDir(dir, skillMd, options) {
     }
     renameDirectory(candidateDir, dir);
   } catch (error) {
-    if (originalMoved && existsSync9(backupDir)) {
+    if (originalMoved && existsSync10(backupDir)) {
       try {
-        if (existsSync9(dir))
+        if (existsSync10(dir))
           rmSync(dir, { recursive: true, force: true });
         renameDirectory(backupDir, dir);
         originalMoved = false;
@@ -16044,7 +16178,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir2 = homedir3()) {
-  const dir = join18(agentGlobalSkillsDir(agent, homeDir2), skill);
+  const dir = join19(agentGlobalSkillsDir(agent, homeDir2), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync(dir, { recursive: true, force: true });
@@ -16052,8 +16186,8 @@ function removeManagedAgentSkill(skill, agent, homeDir2 = homedir3()) {
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join18(skillPath, "SKILL.md");
-    if (existsSync9(skillMdPath))
+    const skillMdPath = join19(skillPath, "SKILL.md");
+    if (existsSync10(skillMdPath))
       return readFileSync13(skillMdPath, "utf-8");
   }
   return pointerSkillMd(name, description);
@@ -16094,8 +16228,8 @@ function resolveSkillAlias(name) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync7, readFileSync as readFileSync14, writeFileSync as writeFileSync6 } from "fs";
+import { join as join20 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -16110,14 +16244,14 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join19(targetDir, SKILLS_PROJECT_DIR);
+  return join20(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join19(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join20(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
-  if (!existsSync10(path))
+  if (!existsSync11(path))
     return null;
   try {
     return normalizeProjectConfig(JSON.parse(readFileSync14(path, "utf-8")));
@@ -16242,19 +16376,19 @@ function getSkillPath(name) {
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join20(getPortableSkillsRoot(), skillName);
+  return join21(getPortableSkillsRoot(), skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
 }
 function skillExists(name) {
-  return existsSync11(getSkillPath(name));
+  return existsSync12(getSkillPath(name));
 }
 function installSkill(name, options = {}) {
   const { targetDir = process.cwd(), overwrite = false } = options;
   const canonicalName = getCanonicalSkillName(name);
   const skillName = normalizeSkillName(canonicalName);
-  if (!existsSync11(getSkillPath(name))) {
+  if (!existsSync12(getSkillPath(name))) {
     const knownOfficial = Boolean(getSkill(name));
     return {
       skill: canonicalName,
@@ -16281,7 +16415,7 @@ function installSkill(name, options = {}) {
 }
 function installSkillSource(name, _options = {}) {
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync11(getSkillPath(name))) {
+  if (!existsSync12(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found`, mode: "source" };
   }
   return {
@@ -16302,11 +16436,11 @@ function installSkillManifest(manifest, _options = {}) {
 }
 function createLocalSkillManifest(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync11(sourcePath))
+  if (!existsSync12(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join20(sourcePath, "SKILL.md");
-  if (existsSync11(skillMdPath)) {
+  const skillMdPath = join21(sourcePath, "SKILL.md");
+  if (existsSync12(skillMdPath)) {
     skillMd = readFileSync15(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
     skillMd = generateSkillMd(name) ?? "";
@@ -16379,21 +16513,21 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join20(base, ".pi", "skills") : join20(homedir4(), ".pi", "agent", "skills");
+      return scope === "project" ? join21(base, ".pi", "skills") : join21(homedir4(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join20(base, ".opencode", "skills") : join20(homedir4(), ".config", "opencode", "skills");
+      return scope === "project" ? join21(base, ".opencode", "skills") : join21(homedir4(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join20(base, `.${agent}`, "skills") : join20(homedir4(), `.${agent}`, "skills");
+      return scope === "project" ? join21(base, `.${agent}`, "skills") : join21(homedir4(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join20(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join21(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   assertNativeExportAllowed();
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync11(getSkillPath(name))) {
+  if (!existsSync12(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found` };
   }
   const scope = options.scope ?? "global";
@@ -16424,8 +16558,8 @@ function removeSkillForAgent(name, options) {
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join20(sourcePath, "SKILL.md");
-  if (existsSync11(skillMdPath))
+  const skillMdPath = join21(sourcePath, "SKILL.md");
+  if (existsSync12(skillMdPath))
     return readFileSync15(skillMdPath, "utf-8");
   if (generateSkillMd)
     return generateSkillMd(name);
@@ -16444,7 +16578,7 @@ function warnMissingDependencies(name, targetDir) {
 }
 function generateMinimalSkillMd(name) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync11(sourcePath))
+  if (!existsSync12(sourcePath))
     return null;
   const canonicalName = getCanonicalSkillName(name);
   const meta = getSkill(canonicalName);
@@ -16459,7 +16593,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join20(sourcePath, "README.md")) || readFileIfExists(join20(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join21(sourcePath, "README.md")) || readFileIfExists(join21(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -16478,8 +16612,8 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join20(getSkillPath(name), "package.json");
-  if (!existsSync11(pkgPath))
+  const pkgPath = join21(getSkillPath(name), "package.json");
+  if (!existsSync12(pkgPath))
     return "unknown";
   try {
     const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
@@ -16489,7 +16623,7 @@ function readBundledSkillVersion(name) {
   }
 }
 function readFileIfExists(path) {
-  return existsSync11(path) ? readFileSync15(path, "utf-8") : null;
+  return existsSync12(path) ? readFileSync15(path, "utf-8") : null;
 }
 function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
@@ -16533,8 +16667,8 @@ function selectSkillDoc(docs, file) {
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join21(skillPath, "SKILL.md");
-  if (!existsSync12(skillMdPath))
+  const skillMdPath = join23(skillPath, "SKILL.md");
+  if (!existsSync13(skillMdPath))
     return false;
   try {
     return parseSkillFrontmatter(readFileSync16(skillMdPath, "utf-8"))?.kind === "instruction";
@@ -16560,12 +16694,12 @@ var HOSTED_PROVIDER_ENV_PREFIXES = [
 ];
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync13(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join21(skillPath, "SKILL.md")),
-    readme: readIfExists(join21(skillPath, "README.md")),
-    claudeMd: readIfExists(join21(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join23(skillPath, "SKILL.md")),
+    readme: readIfExists(join23(skillPath, "README.md")),
+    claudeMd: readIfExists(join23(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name, file) {
@@ -16577,18 +16711,18 @@ function getSkillBestDoc(name, file) {
 }
 function getSkillRequirements(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync13(skillPath))
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join21(skillPath, file));
+    const content = readIfExists(join23(skillPath, file));
     if (content)
       texts.push(content);
   }
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync16(join21(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync16(join23(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -16641,7 +16775,7 @@ async function runSkill(name, args, options = {}) {
   const meta = getSkill(name);
   const canonicalName = meta?.name ?? name;
   const skillPath = getSkillPath(canonicalName);
-  if (!existsSync12(skillPath)) {
+  if (!existsSync13(skillPath)) {
     return { exitCode: 1, error: `Skill '${name}' not found` };
   }
   if (isInstructionSkillDir(skillPath, meta)) {
@@ -16650,8 +16784,8 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join21(skillPath, "package.json");
-  if (!existsSync12(pkgPath)) {
+  const pkgPath = join23(skillPath, "package.json");
+  if (!existsSync13(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint2;
@@ -16670,12 +16804,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join21(skillPath, entryPoint2);
-  if (!existsSync12(entryPath)) {
+  const entryPath = join23(skillPath, entryPoint2);
+  if (!existsSync13(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint2}' not found in skill '${name}'` };
   }
   const env = { ...process.env, ...options.env };
-  if (!existsSync12(join21(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync13(join23(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -16744,7 +16878,7 @@ function generateSkillMd(name) {
   if (!meta)
     return null;
   const skillPath = getSkillPath(name);
-  if (!existsSync12(skillPath))
+  if (!existsSync13(skillPath))
     return null;
   const frontmatter = [
     "---",
@@ -16753,11 +16887,11 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join21(skillPath, "README.md"));
-  const claudeMd = readIfExists(join21(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join23(skillPath, "README.md"));
+  const claudeMd = readIfExists(join23(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join21(skillPath, "package.json");
-  if (existsSync12(pkgPath)) {
+  const pkgPath = join23(skillPath, "package.json");
+  if (existsSync13(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync16(pkgPath, "utf-8"));
       if (pkg.bin) {
@@ -16834,7 +16968,7 @@ function extractEnvVars(text2) {
 }
 function readIfExists(path) {
   try {
-    if (existsSync12(path)) {
+    if (existsSync13(path)) {
       return readFileSync16(path, "utf-8");
     }
   } catch {}
@@ -16901,6 +17035,8 @@ async function syncSelectionProfile(profileId, options = {}) {
 async function resolveSelectionContext(profileId, options = {}) {
   const sessionState = options.sessionId ? readSkillSessionSnapshotIfExists(options.sessionId, options) : null;
   const session = sessionState?.receipt ?? null;
+  if (options.nativeParentSessionId !== undefined && session && (session.parent?.sessionId ?? null) !== options.nativeParentSessionId)
+    throw new SkillSelectionError("SESSION_PARENT_MISMATCH", "The native session id is already bound to different parent custody.");
   const parentState = !session && options.parentSessionId ? readSkillSessionSnapshotIfExists(options.parentSessionId, options) : null;
   if (!session && options.parentSessionId && !parentState) {
     throw new SkillSelectionError("SESSION_PARENT_NOT_FOUND", "A child Skills session requires an existing parent receipt so its inherited pin can be bound exactly.");
@@ -17160,15 +17296,15 @@ function buildPluginProjection(entries) {
 
 // src/lib/plugin-projection-store.ts
 import { createHash as createHash14, randomUUID as randomUUID3 } from "crypto";
-import { constants as constants8, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync17, mkdirSync as mkdirSync8, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute12, join as join23, parse as parse5, resolve as resolve11 } from "path";
+import { constants as constants8, closeSync as closeSync9, fchmodSync, fstatSync as fstatSync9, fsyncSync as fsyncSync3, linkSync as linkSync2, lstatSync as lstatSync18, mkdirSync as mkdirSync8, openSync as openSync9, opendirSync as opendirSync4, readSync as readSync7, renameSync as renameSync4, rmdirSync as rmdirSync3, rmSync as rmSync3, unlinkSync as unlinkSync4, writeSync as writeSync2 } from "fs";
+import { dirname as dirname13, isAbsolute as isAbsolute12, join as join25, parse as parse5, resolve as resolve12 } from "path";
 var READ_FLAGS = constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
 var WRITE_FLAGS = constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW | constants8.O_NONBLOCK;
 var uid = () => typeof process.getuid === "function" ? BigInt(process.getuid()) : undefined;
 var missing = (error) => Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
 function stat(path) {
   try {
-    return lstatSync17(path, { bigint: true });
+    return lstatSync18(path, { bigint: true });
   } catch (error) {
     if (missing(error))
       return null;
@@ -17176,7 +17312,7 @@ function stat(path) {
   }
 }
 function canonical5(path) {
-  pluginNeed(typeof path === "string" && path.length <= 8192 && isAbsolute12(path) && resolve11(path) === path && !/[\x00-\x1f\x7f]/.test(path), "Plugin storage paths must be canonical absolute paths");
+  pluginNeed(typeof path === "string" && path.length <= 8192 && isAbsolute12(path) && resolve12(path) === path && !/[\x00-\x1f\x7f]/.test(path), "Plugin storage paths must be canonical absolute paths");
 }
 function owner(stats, system = false) {
   const current = uid();
@@ -17191,7 +17327,7 @@ function ancestors(path, create = false) {
   let current = filesystemRoot;
   for (const segment of ["", ...parent.slice(filesystemRoot.length).split("/").filter(Boolean)]) {
     if (segment)
-      current = join23(current, segment);
+      current = join25(current, segment);
     let currentStat = stat(current);
     if (!currentStat && create) {
       try {
@@ -17306,7 +17442,7 @@ function snapshotPluginTree(root, options = {}) {
       pluginNeed(++visited <= PLUGIN_PROJECTION_LIMITS.files * 50, "Plugin tree membership exceeds its limit");
       const path = relative6 ? `${relative6}/${name}` : name;
       pluginNeed(new TextEncoder().encode(path).byteLength <= 100 && !/[\\:\x00-\x1f\x7f]/u.test(path), "Plugin entry path exceeds its limit or is unsafe");
-      const absolute = join23(directory, name), entryStat = stat(absolute);
+      const absolute = join25(directory, name), entryStat = stat(absolute);
       pluginNeed(entryStat, "Plugin tree member disappeared");
       if (relative6 === "" && name === ".orphaned_at" && (options.nativeRuntime === "claude-2.1.274" || options.nativeRuntime === "claude-2.1.276")) {
         const bytes2 = readBytes(absolute, 32, "native-pin");
@@ -17323,7 +17459,7 @@ function snapshotPluginTree(root, options = {}) {
         directories.push({ path: absolute, stat: entryStat, names: pins });
         for (const pin of pins) {
           pluginNeed(/^[1-9][0-9]{0,9}$/.test(pin) && Number(pin) <= 2147483647, "Unrecognized native plugin pin name");
-          const pinPath = join23(absolute, pin), pinStat = stat(pinPath);
+          const pinPath = join25(absolute, pin), pinStat = stat(pinPath);
           pluginNeed(pinStat, "Native plugin pin disappeared");
           const bytes2 = readBytes(pinPath, 4096, "native-pin");
           let value;
@@ -17421,7 +17557,7 @@ function materializePluginTree(root, entries) {
     mkdirSync8(staging, { mode: 448 });
     staged = stat(staging);
     for (const entry of entries) {
-      const path = join23(staging, entry.path);
+      const path = join25(staging, entry.path);
       ancestors(path, true);
       writeExclusive(path, entry.bytes, entry.mode);
     }
@@ -17548,7 +17684,7 @@ function describeEntries(entries) {
 
 // src/lib/plugin-admission.ts
 function pluginAdmissionRoot() {
-  return join25(homedir5(), ".hasna", "skills", "plugin-admission");
+  return join26(homedir5(), ".hasna", "skills", "plugin-admission");
 }
 function validatePluginTarget(value) {
   pluginKeys(value, ["schemaVersion", "pluginId", "registrations", "native", "resolver"]);
@@ -17559,7 +17695,7 @@ function validatePluginTarget(value) {
   for (const registration of value.registrations) {
     pluginKeys(registration, ["scope", "projectPath"]);
     pluginNeed(registration.scope === "user" || registration.scope === "project", "Unsupported plugin registration scope");
-    pluginNeed(registration.scope === "user" ? registration.projectPath === null : typeof registration.projectPath === "string" && isAbsolute13(registration.projectPath) && resolve12(registration.projectPath) === registration.projectPath, "Plugin scope requires its exact project path");
+    pluginNeed(registration.scope === "user" ? registration.projectPath === null : typeof registration.projectPath === "string" && isAbsolute13(registration.projectPath) && resolve13(registration.projectPath) === registration.projectPath, "Plugin scope requires its exact project path");
     const key = JSON.stringify([registration.scope, registration.projectPath]);
     pluginNeed(!scopes.has(key), "Duplicate plugin registration scope");
     scopes.add(key);
@@ -17567,7 +17703,7 @@ function validatePluginTarget(value) {
   for (const key of ["native", "resolver"]) {
     pluginKeys(value[key], key === "native" ? ["version", "executable", "digest"] : ["executable", "digest"]);
     pluginText(value[key].executable);
-    pluginNeed(isAbsolute13(value[key].executable) && resolve12(value[key].executable) === value[key].executable, "Plugin executable must have a canonical absolute path");
+    pluginNeed(isAbsolute13(value[key].executable) && resolve13(value[key].executable) === value[key].executable, "Plugin executable must have a canonical absolute path");
     pluginDigest(value[key].digest);
   }
   pluginNeed(["2.1.274", "2.1.276"].includes(value.native.version), "Plugin admission requires a certified Claude command-source runtime (2.1.274 or 2.1.276)");
@@ -17719,17 +17855,17 @@ function pluginResolverCommand(binding) {
 }
 function root(options) {
   const path = options.storeRoot ?? pluginAdmissionRoot();
-  pluginNeed(isAbsolute13(path) && resolve12(path) === path, "Invalid plugin admission store root");
+  pluginNeed(isAbsolute13(path) && resolve13(path) === path, "Invalid plugin admission store root");
   return path;
 }
 function pluginBindingPath(storeRoot, id) {
   pluginNeed(/^[a-f0-9]{64}$/.test(id), "Invalid plugin binding identifier");
-  return join25(storeRoot, "bindings", `${id}.json`);
+  return join26(storeRoot, "bindings", `${id}.json`);
 }
 function pluginReceiptPath(storeRoot, id, digest) {
   pluginNeed(/^[a-f0-9]{64}$/.test(id), "Invalid plugin binding identifier");
   pluginDigest(digest);
-  return join25(storeRoot, "receipts", id, `${digest.slice(7)}.json`);
+  return join26(storeRoot, "receipts", id, `${digest.slice(7)}.json`);
 }
 function readPluginBinding(storeRoot, id) {
   const value = readPluginJson(pluginBindingPath(storeRoot, id));
@@ -17749,7 +17885,7 @@ function readPluginAdmissionReceipt(storeRoot, id, digest) {
   pluginNeed(receipt.plan.bindingId === id && receipt.plan.planDigest === digest, "Plugin receipt identity differs from its filename");
   const binding = readPluginBinding(storeRoot, id);
   pluginNeed(canonicalJson(binding) === canonicalJson(receipt.plan.binding) && receipt.plan.sourceCommand === pluginResolverCommand(binding), "Plugin receipt binding changed");
-  pluginNeed(receipt.materializedPath === join25(storeRoot, "objects", id, digest.slice(7)), "Plugin receipt points outside its immutable materialization");
+  pluginNeed(receipt.materializedPath === join26(storeRoot, "objects", id, digest.slice(7)), "Plugin receipt points outside its immutable materialization");
   pluginText(receipt.admittedAt, 64);
   pluginNeed(Number.isFinite(Date.parse(receipt.admittedAt)), "Invalid plugin admission time");
   return receipt;
@@ -17890,7 +18026,7 @@ async function admitPlugin(spec, profileId, target, approvedDigest, approvedEvid
   const { plan, projection } = await candidate(spec, profileId, target, options);
   pluginNeed(plan.planDigest === approvedDigest, "The plugin plan changed since review; obtain and review a new plan");
   pluginNeed(plan.evidenceDigest === approvedEvidenceDigest, "The plugin routing evidence changed since review; obtain and review a new plan");
-  const store = root(options), materializedPath = join25(store, "objects", plan.bindingId, plan.planDigest.slice(7));
+  const store = root(options), materializedPath = join26(store, "objects", plan.bindingId, plan.planDigest.slice(7));
   materializePluginTree(materializedPath, projection.files);
   writePluginJsonImmutable(pluginBindingPath(store, plan.bindingId), plan.binding);
   const path = pluginReceiptPath(store, plan.bindingId, plan.planDigest), existing = readPluginJson(path);
@@ -17924,21 +18060,21 @@ function validateManagedPluginWitnesses(value) {
     pluginNeed(typeof item.bindingId === "string" && /^[a-f0-9]{64}$/.test(item.bindingId) && !seen.has(item.bindingId), "Invalid or duplicate managed plugin witness");
     seen.add(item.bindingId);
     pluginText(item.storeRoot);
-    pluginNeed(isAbsolute14(item.storeRoot) && resolve13(item.storeRoot) === item.storeRoot, "Invalid plugin receipt store path");
+    pluginNeed(isAbsolute14(item.storeRoot) && resolve14(item.storeRoot) === item.storeRoot, "Invalid plugin receipt store path");
   }
 }
 function safe3(path) {
   pluginText(path);
-  pluginNeed(isAbsolute14(path) && resolve13(path) === path, "Invalid plugin registry path");
+  pluginNeed(isAbsolute14(path) && resolve14(path) === path, "Invalid plugin registry path");
   for (let at = path;; at = dirname14(at)) {
-    pluginNeed(!lstatSync18(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
+    pluginNeed(!lstatSync19(at, { throwIfNoEntry: false })?.isSymbolicLink(), "Plugin registry path traverses a symlink");
     if (at === dirname14(at))
       break;
   }
 }
 function readRegistry(path) {
   safe3(path);
-  const initial = lstatSync18(path);
+  const initial = lstatSync19(path);
   pluginNeed(initial.isFile() && initial.size <= 1024 * 1024, "Plugin registry is not a bounded regular file");
   const fd = openSync10(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
   try {
@@ -17952,7 +18088,7 @@ function readRegistry(path) {
         break;
       length += count;
     }
-    const after = fstatSync10(fd), current = lstatSync18(path);
+    const after = fstatSync10(fd), current = lstatSync19(path);
     safe3(path);
     pluginNeed(length <= 1024 * 1024 && length === opened.size && after.size === opened.size && after.mtimeMs === opened.mtimeMs && after.ctimeMs === opened.ctimeMs && current.dev === opened.dev && current.ino === opened.ino && current.mtimeMs === opened.mtimeMs && current.ctimeMs === opened.ctimeMs, "Plugin registry changed during read");
     let value;
@@ -17982,7 +18118,7 @@ function hashManagedPluginRegistry(path, managed) {
     seen.add(target.pluginId);
     const rows = plugins[target.pluginId];
     pluginNeed(Array.isArray(rows) && rows.length === target.registrations.length, "Managed plugin registration membership changed");
-    const [name, market] = target.pluginId.split("@"), cacheRoot = join26(dirname14(path), "cache", market, name);
+    const [name, market] = target.pluginId.split("@"), cacheRoot = join27(dirname14(path), "cache", market, name);
     const scopes = new Set, approvals = new Map, currentFiles = new Map;
     plugins[target.pluginId] = rows.map((row) => {
       pluginNeed(pluginObject(row), "Invalid managed plugin registration");
@@ -17995,7 +18131,7 @@ function hashManagedPluginRegistry(path, managed) {
       pluginText(row.sourceProducerPath);
       pluginText(row.lastUpdated, 64);
       pluginNeed(Number.isFinite(Date.parse(row.lastUpdated)), "Invalid managed plugin update timestamp");
-      pluginNeed(/^(?:[A-Za-z0-9][A-Za-z0-9._+-]*-)?[a-f0-9]{12}$/.test(row.version) && row.installPath === join26(cacheRoot, row.version), "Managed plugin cache path or version is outside its registration");
+      pluginNeed(/^(?:[A-Za-z0-9][A-Za-z0-9._+-]*-)?[a-f0-9]{12}$/.test(row.version) && row.installPath === join27(cacheRoot, row.version), "Managed plugin cache path or version is outside its registration");
       const approval = (producer) => {
         pluginText(producer);
         const digest = `sha256:${basename7(producer)}`;
@@ -18025,7 +18161,7 @@ function hashManagedPluginRegistry(path, managed) {
       return Object.fromEntries(Object.entries(row).filter(([key]) => !["version", "installPath", "sourceProducerPath", "previousProducerPaths", "lastUpdated"].includes(key)));
     });
     safe3(cacheRoot);
-    const before = lstatSync18(cacheRoot);
+    const before = lstatSync19(cacheRoot);
     pluginNeed(before.isDirectory(), "Invalid managed plugin cache root");
     const directory = opendirSync5(cacheRoot), names = [];
     try {
@@ -18038,17 +18174,17 @@ function hashManagedPluginRegistry(path, managed) {
       directory.closeSync();
     }
     for (const version of names.sort()) {
-      const files = pluginFileWitnesses(snapshotPluginTree(join26(cacheRoot, version), { nativeRuntime: `claude-${target.native.version}` }));
+      const files = pluginFileWitnesses(snapshotPluginTree(join27(cacheRoot, version), { nativeRuntime: `claude-${target.native.version}` }));
       verifiedBytes += files.reduce((total, file) => total + file.size, 0);
       pluginNeed(verifiedBytes <= 256 * 1024 * 1024, "Managed plugin verification exceeds its aggregate byte budget");
       const serialized = JSON.stringify(files);
-      const expected = currentFiles.get(join26(cacheRoot, version));
+      const expected = currentFiles.get(join27(cacheRoot, version));
       pluginNeed(expected === undefined || serialized === expected, "Current native cache differs from its exact registered producer receipt");
       pluginNeed([...approvals.values()].some((receipt) => nativeVersionMatches(version, receipt) && JSON.stringify(receipt.plan.files) === serialized), "A retained native plugin cache version differs from every approved projection");
     }
     for (const row of rows)
       pluginNeed(names.includes(row.version), "Managed native plugin installation is missing");
-    const after = lstatSync18(cacheRoot);
+    const after = lstatSync19(cacheRoot);
     safe3(cacheRoot);
     pluginNeed(before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs, "Managed cache version membership changed during verification");
   }
@@ -18061,21 +18197,21 @@ function captureManagedPluginRegistry(path, managedPlugins) {
 
 // src/lib/claude-marketplace-registry.ts
 import { createHash as createHash15 } from "crypto";
-import { closeSync as closeSync11, constants as constants10, fstatSync as fstatSync11, lstatSync as lstatSync19, openSync as openSync11, readSync as readSync9 } from "fs";
-import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute15, resolve as resolve14 } from "path";
+import { closeSync as closeSync11, constants as constants10, fstatSync as fstatSync11, lstatSync as lstatSync20, openSync as openSync11, readSync as readSync9 } from "fs";
+import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute15, resolve as resolve15 } from "path";
 var CLAUDE_MARKETPLACE_REGISTRY_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
 function need5(value, reason) {
   if (!value)
     throw new Error(`Claude marketplace registry ${reason}`);
 }
 function absolutePath3(value) {
-  need5(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute15(value) && resolve14(value) === value, "requires a normalized absolute path");
+  need5(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_MARKETPLACE_REGISTRY_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute15(value) && resolve15(value) === value, "requires a normalized absolute path");
 }
 var sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;
 function parents2(path) {
   const result = [];
   for (let at = dirname15(path);; at = dirname15(at)) {
-    const stat2 = lstatSync19(at, { bigint: true });
+    const stat2 = lstatSync20(at, { bigint: true });
     need5(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
     result.push([at, stat2]);
     if (at === dirname15(at))
@@ -18086,7 +18222,7 @@ function readRegistry2(path, budget) {
   absolutePath3(path);
   need5(basename8(path) === "known_marketplaces.json", "requires known_marketplaces.json");
   need5(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
-  const ancestors2 = parents2(path), initial = lstatSync19(path, { bigint: true });
+  const ancestors2 = parents2(path), initial = lstatSync20(path, { bigint: true });
   need5(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_MARKETPLACE_REGISTRY_LIMITS.bytes), "is not a bounded regular file");
   need5(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
   const fd = openSync11(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
@@ -18101,10 +18237,10 @@ function readRegistry2(path, budget) {
         break;
       length += count;
     }
-    const after = fstatSync11(fd, { bigint: true }), current = lstatSync19(path, { bigint: true });
+    const after = fstatSync11(fd, { bigint: true }), current = lstatSync20(path, { bigint: true });
     need5(current.isFile() && sameFile2(opened, after) && sameFile2(after, current) && BigInt(length) === opened.size, "changed during read");
     for (const [ancestor, before] of ancestors2) {
-      const now = lstatSync19(ancestor, { bigint: true });
+      const now = lstatSync20(ancestor, { bigint: true });
       need5(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
     }
     budget.remaining -= length;
@@ -18244,7 +18380,7 @@ function captureClaudeMarketplaceRegistryV2(path, budget = { remaining: 256 * 10
 import { createHash as createHash17 } from "crypto";
 
 // src/lib/codex-hook-trust-files.ts
-import { closeSync as closeSync12, constants as constants11, fstatSync as fstatSync12, fsyncSync as fsyncSync4, lstatSync as lstatSync20, openSync as openSync12, readSync as readSync10, writeFileSync as writeFileSync7 } from "fs";
+import { closeSync as closeSync12, constants as constants11, fstatSync as fstatSync12, fsyncSync as fsyncSync4, lstatSync as lstatSync21, openSync as openSync12, readSync as readSync10, writeFileSync as writeFileSync7 } from "fs";
 import { createHash as createHash16 } from "crypto";
 import { dirname as dirname16 } from "path";
 function need6(value, code) {
@@ -18254,7 +18390,7 @@ function need6(value, code) {
 var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
 function safeParents(file) {
   for (let p = dirname16(file);; p = dirname16(p)) {
-    const s = lstatSync20(p);
+    const s = lstatSync21(p);
     need6(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
     need6((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
     if (dirname16(p) === p)
@@ -18264,7 +18400,7 @@ function safeParents(file) {
 function snapshot(file, privateFile = false, options = {}) {
   const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
   safeParents(file);
-  const initial = lstatSync20(file, { bigint: true });
+  const initial = lstatSync21(file, { bigint: true });
   need6(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
   need6(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
   const fd = openSync12(file, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
@@ -18279,7 +18415,7 @@ function snapshot(file, privateFile = false, options = {}) {
         break;
       length += n2;
     }
-    need6(length === Number(before.size) && sameStat(before, fstatSync12(fd, { bigint: true })) && sameStat(before, lstatSync20(file, { bigint: true })), "INPUT_CHANGED");
+    need6(length === Number(before.size) && sameStat(before, fstatSync12(fd, { bigint: true })) && sameStat(before, lstatSync21(file, { bigint: true })), "INPUT_CHANGED");
     const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
     return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash16("sha256").update(content).digest("hex") };
   } finally {
@@ -18331,7 +18467,7 @@ function safe4(path) {
   if (!isAbsolute16(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
   for (let cursor = path;; cursor = dirname17(cursor)) {
-    if (lstatSync21(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync22(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
     if (dirname17(cursor) === cursor)
       break;
@@ -18341,7 +18477,7 @@ function read2(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync21(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync22(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
@@ -18452,12 +18588,12 @@ function codexInstallationRoots(binding) {
   if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
     throw new Error("Invalid native installation input proof");
   const cache = dirname17(dirname17(proof.plugins[0].pluginParent));
-  const config = join27(dirname17(dirname17(cache)), "config.toml"), home = dirname17(dirname17(dirname17(cache)));
+  const config = join28(dirname17(dirname17(cache)), "config.toml"), home = dirname17(dirname17(dirname17(cache)));
   const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
-  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join27(home, path));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join28(home, path));
   if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep6) || input.sourceRoot.startsWith(root2 + sep6)) || binding.sources.some((source) => basename9(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep6)))))
     throw new Error("Native installation input overlaps configuration or loading roots");
-  if (proof.plugins.some((input) => dirname17(dirname17(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join27(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+  if (proof.plugins.some((input) => dirname17(dirname17(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join28(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
     throw new Error("Missing native installation input source witness");
   return reviewedCodexPluginSourceRoots(cache, proof.plugins, (path) => {
     const text2 = read2(path);
@@ -18499,19 +18635,19 @@ function captureDiscoveryPathSources(paths) {
   const budget = discoveryByteBudget();
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
-function assertProjectDiscovery(agent, directories, home, canonical6 = resolve15, reviewed) {
+function assertProjectDiscovery(agent, directories, home, canonical6 = resolve16, reviewed) {
   const homeConfigPath = canonical6(agentDiscoveryConfigPath(home, agent));
   for (const directory of directories) {
-    const isHome = resolve15(directory) === resolve15(home);
+    const isHome = resolve16(directory) === resolve16(home);
     if (agent === "hermes") {
       assertHermesEnvironment(home);
       continue;
     }
-    if (isHome && agent !== "claude")
+    if (isHome && agent !== "claude" && agent !== "sumi")
       continue;
-    const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : [".cursor/hooks.json"];
+    const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : agent === "sumi" ? ["sumi.json", "sumi.jsonc", ".sumi/sumi.json", ".sumi/sumi.jsonc"] : [".cursor/hooks.json"];
     for (const suffix of paths) {
-      const path = canonical6(join27(directory, suffix)), raw = read2(path);
+      const path = canonical6(join28(directory, suffix)), raw = read2(path);
       if (raw === null)
         continue;
       const isRootAliasedHomeConfig = agent === "claude" && suffix === ".claude/settings.json" || agent === "codex" && suffix === ".codex/config.toml";
@@ -18520,7 +18656,7 @@ function assertProjectDiscovery(agent, directories, home, canonical6 = resolve15
       if (suffix.endsWith(".jsonc"))
         throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);
       const config = parseConfig(raw, path, suffix.endsWith(".toml"));
-      const keys = agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces", "skillOverrides"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions"] : agent === "opencode" ? ["plugin", "skills"] : ["hooks"];
+      const keys = agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces", "skillOverrides"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions"] : agent === "opencode" ? ["plugin", "skills"] : agent === "sumi" ? ["plugin", "plugins", "skills", "permissions"] : ["hooks"];
       let admittedPlugins = false;
       if (agent === "claude" && reviewed?.agent === agent && reviewed.method === "reviewed" && config.enabledPlugins && typeof config.enabledPlugins === "object" && !Array.isArray(config.enabledPlugins)) {
         const exact = reviewed.sources.find((source) => source.path === path && source.format === undefined && source.fields === undefined && (source.hashMode === undefined || source.hashMode === "bytes"));
@@ -18533,19 +18669,28 @@ function assertProjectDiscovery(agent, directories, home, canonical6 = resolve15
       if (keys.some((key) => config[key] !== undefined && !(key === "enabledPlugins" && admittedPlugins)) || config.disableAllHooks === true || config.disableBundledSkills === false || config.hooksConfig?.enabled === false || config.permission?.skill !== undefined || config.permissions?.deny?.some((rule) => typeof rule === "string" && /^Skill(?:\(|$)/.test(rule)))
         throw new Error(`NATIVE_SKILL_DRIFT: higher-precedence project skill or hook configuration requires review: ${path}`);
     }
+    if (agent === "sumi")
+      for (const name of ["plugin", "plugins"]) {
+        const path = canonical6(join28(directory, ".sumi", name));
+        safe4(path);
+        if (lstatSync22(path, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(path).length)
+          throw new Error(`NATIVE_SKILL_DRIFT: project Sumi plugins require a dedicated discovery review: ${path}`);
+      }
     if (agent === "claude") {
-      const commands = canonical6(join27(directory, ".claude/commands"));
+      const commands = canonical6(join28(directory, ".claude/commands"));
       safe4(commands);
-      if (lstatSync21(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
+      if (lstatSync22(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
         throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
     }
   }
 }
 function agentDiscoveryConfigPath(home, agent) {
-  return join27(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  if (agent === "sumi")
+    return sumiConfigPath(home);
+  return join28(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
 }
 function resolveAgentDiscovery(options) {
-  const canonical6 = options.canonical ?? resolve15, home = resolve15(options.home), agent = options.agent;
+  const canonical6 = options.canonical ?? resolve16, home = resolve16(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields2) => {
     const source = { path: canonical6(path), sha256: null, ...format ? { format, fields: fields2 } : {} };
@@ -18556,13 +18701,49 @@ function resolveAgentDiscovery(options) {
   if (agent === "hermes")
     assertHermesEnvironment(home);
   const configPath = agentDiscoveryConfigPath(home, agent);
-  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
+  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : agent === "sumi" ? ["skills", "plugin", "plugins", "permissions"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
   };
+  if (agent === "sumi") {
+    const directory = sumiConfigDirectory(home);
+    if (witness(join28(directory, "sumi.jsonc")) !== null)
+      unresolved("JSONC configuration requires a supported format adapter");
+    for (const root2 of [directory, join28(home, ".claude"), join28(home, ".agents")])
+      for (const name of ["skill", "skills"])
+        roots.add(join28(root2, name));
+    if (config.skills !== undefined && (!Array.isArray(config.skills) || config.skills.some((path) => typeof path !== "string")))
+      unresolved("skills must be a string array");
+    for (const value of config.skills ?? []) {
+      if (typeof value !== "string" || /[\0$]/.test(value) || !value || !(isAbsolute16(value) || value.startsWith("~/")))
+        unresolved("remote or relative skill sources need a dedicated discovery adapter");
+      roots.add(value.startsWith("~/") ? join28(home, value.slice(2)) : value);
+    }
+    for (const key of ["plugin", "plugins"])
+      if (config[key] !== undefined && !Array.isArray(config[key]))
+        unresolved(`${key} must be an array`);
+    const plugins = [join28(directory, "plugin"), join28(directory, "plugins")];
+    for (const path of plugins) {
+      safe4(path);
+      if (lstatSync22(path, { throwIfNoEntry: false })?.isDirectory())
+        for (const name of readdirSync10(path).sort()) {
+          if (name === "skills-cli.js" && path === plugins[1])
+            continue;
+          const target = join28(path, name);
+          if (!lstatSync22(target).isFile())
+            unresolved("local plugin packages need a dedicated discovery adapter");
+          witness(target);
+        }
+    }
+    for (const root2 of roots) {
+      safe4(root2);
+      if (lstatSync22(root2, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(root2).some((name) => name.endsWith(".md")))
+        unresolved("flat markdown skills require a dedicated native migration adapter");
+    }
+  }
   if (agent === "hermes") {
-    const profile = witness(join27(home, ".hermes/active_profile"));
+    const profile = witness(join28(home, ".hermes/active_profile"));
     if (profile?.trim() && profile.trim() !== "default")
       unresolved("a non-default profile is active");
     const declared = config.skills?.external_dirs ?? [], paths = typeof declared === "string" ? [declared] : declared;
@@ -18576,7 +18757,7 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join27(home, normalized.slice(2)) : resolve15(home, ".hermes", normalized);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join28(home, normalized.slice(2)) : resolve16(home, ".hermes", normalized);
       safe4(path);
       roots.add(path);
     }
@@ -18585,8 +18766,8 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname17(realpathSync7(executable)), depth = 0;depth < 8; directory = dirname17(directory), depth++) {
-        const path = join27(directory, "package.json"), raw = read2(path);
+      for (let directory = dirname17(realpathSync8(executable)), depth = 0;depth < 8; directory = dirname17(directory), depth++) {
+        const path = join28(directory, "package.json"), raw = read2(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
@@ -18597,12 +18778,12 @@ function resolveAgentDiscovery(options) {
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
-      const builtinRoot = join27(packageRoot, "bundle/builtin");
+      const builtinRoot = join28(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync21(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync22(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync10(builtinRoot).sort()) {
-        const text2 = witness(join27(builtinRoot, name, "SKILL.md"));
+        const text2 = witness(join28(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
           unresolved("installed Gemini builtin name is missing or ambiguous");
@@ -18644,39 +18825,39 @@ function resolveAgentDiscovery(options) {
   function plugin(root2) {
     root2 = canonical6(root2);
     safe4(root2);
-    const manifestPath = join27(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
+    const manifestPath = join28(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
     if (raw === null)
       unresolved("plugin manifest missing");
     const manifest = parseConfig(raw, manifestPath);
-    const hooks = witness(join27(root2, "hooks/hooks.json"));
+    const hooks = witness(join28(root2, "hooks/hooks.json"));
     if (manifest.hooks !== undefined || hooks !== null)
       unresolved("plugin hooks require a separate no-skill-injection review");
-    const commands = join27(root2, "commands");
+    const commands = join28(root2, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync21(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync22(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
-    const rootSkill = witness(join27(root2, "SKILL.md"));
+    const rootSkill = witness(join28(root2, "SKILL.md"));
     if (rootSkill !== null)
       roots.add(root2);
     const declared = manifest.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
     if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
       unresolved("unsupported plugin skill paths");
     if (agent === "claude")
-      roots.add(join27(root2, "skills"));
+      roots.add(join28(root2, "skills"));
     for (const value of declared) {
-      const path = resolve15(root2, value);
+      const path = resolve16(root2, value);
       if (path !== root2 && !path.startsWith(root2 + sep6))
         unresolved("plugin skill path escapes its root");
       roots.add(path.endsWith(`${sep6}SKILL.md`) ? dirname17(path) : path);
     }
   }
   if (agent === "claude") {
-    const registrations = witness(join27(home, ".claude/plugins/installed_plugins.json"));
-    const installed = registrations === null ? {} : parseConfig(registrations, join27(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical6(join27(home, ".claude/commands"));
+    const registrations = witness(join28(home, ".claude/plugins/installed_plugins.json"));
+    const installed = registrations === null ? {} : parseConfig(registrations, join28(home, ".claude/plugins/installed_plugins.json")).plugins;
+    const commands = canonical6(join28(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync21(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
+    if (lstatSync22(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync10(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -18698,16 +18879,16 @@ function resolveAgentDiscovery(options) {
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
       if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute16(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
-      const catalogText = witness(join27(market.source, ".agents/plugins/marketplace.json"));
+      const catalogText = witness(join28(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
         unresolved("marketplace catalog missing");
-      const catalog = parseConfig(catalogText, join27(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
+      const catalog = parseConfig(catalogText, join28(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve15(market.source, matches[0].source.path));
+      plugin(resolve16(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
-    if (witness(join27(home, ".config/opencode/opencode.jsonc")) !== null || witness(join27(home, ".config/opencode/config.json")) !== null)
+    if (witness(join28(home, ".config/opencode/opencode.jsonc")) !== null || witness(join28(home, ".config/opencode/config.json")) !== null)
       unresolved("additional config layers require review");
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
@@ -18716,14 +18897,17 @@ function resolveAgentDiscovery(options) {
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
-    const localPlugins = join27(home, ".config/opencode/plugins");
+    const localPlugins = join28(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync21(localPlugins, { throwIfNoEntry: false }) && readdirSync10(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync22(localPlugins, { throwIfNoEntry: false }) && readdirSync10(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
+  } else if (agent === "sumi") {
+    if ((config.plugin?.length ?? 0) > 0 || (config.plugins?.length ?? 0) > 0 || sources.some((source) => source.path !== canonical6(configPath) && source.path !== canonical6(join28(sumiConfigDirectory(home), "sumi.jsonc")) && source.sha256 !== null))
+      unresolved("external or foreign local plugins require review");
   } else if (agent === "hermes") {
-    for (const directory of [join27(home, ".hermes/plugins"), join27(home, ".hermes/hermes-agent")]) {
+    for (const directory of [join28(home, ".hermes/plugins"), join28(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync21(directory, { throwIfNoEntry: false }))
+      if (lstatSync22(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -18731,30 +18915,30 @@ function resolveAgentDiscovery(options) {
   } else if (agent === "gemini") {
     if (Object.keys(config.extensions ?? {}).length || config.skills?.paths?.length)
       unresolved("custom extension or skill paths");
-    const directory = join27(home, ".gemini/extensions");
+    const directory = join28(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync21(directory, { throwIfNoEntry: false }))
+    if (lstatSync22(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync10(directory)) {
-        const root2 = join27(directory, name);
+        const root2 = join28(directory, name);
         safe4(root2);
-        if (!lstatSync21(root2)?.isDirectory())
+        if (!lstatSync22(root2)?.isDirectory())
           continue;
-        const raw = witness(join27(root2, "gemini-extension.json"));
+        const raw = witness(join28(root2, "gemini-extension.json"));
         if (raw === null)
           unresolved("extension registration missing");
-        const manifest = parseConfig(raw, join27(root2, "gemini-extension.json"));
-        if (manifest.hooks !== undefined || witness(join27(root2, "hooks/hooks.json")) !== null || witness(join27(root2, ".gemini-extension-install.json")) !== null)
+        const manifest = parseConfig(raw, join28(root2, "gemini-extension.json"));
+        if (manifest.hooks !== undefined || witness(join28(root2, "hooks/hooks.json")) !== null || witness(join28(root2, ".gemini-extension-install.json")) !== null)
           unresolved("extension hooks or linked registration require review");
-        roots.add(join27(root2, "skills"));
+        roots.add(join28(root2, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join27(home, ".hermes/plugins"), join27(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join28(home, ".hermes/plugins"), join28(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
 }
 
 // src/lib/authoring-path.ts
 var NATIVE_DISCOVERY_ROOTS = NATIVE_SKILL_ROOTS.map(([, path]) => path.split("/"));
 function pathParts(path) {
-  return resolve16(path).split(sep7).filter(Boolean);
+  return resolve17(path).split(sep7).filter(Boolean);
 }
 function nativeRootMatch(path) {
   const parts = pathParts(path);
@@ -18768,24 +18952,24 @@ function nativeRootMatch(path) {
   return;
 }
 function physicalPath(path) {
-  let cursor = resolve16(path);
+  let cursor = resolve17(path);
   const suffix = [];
-  while (!lstatSync22(cursor, { throwIfNoEntry: false })) {
+  while (!lstatSync23(cursor, { throwIfNoEntry: false })) {
     suffix.unshift(basename10(cursor));
     const parent = dirname18(cursor);
     if (parent === cursor)
-      return resolve16(path);
+      return resolve17(path);
     cursor = parent;
   }
-  return resolve16(realpathSync8(cursor), ...suffix);
+  return resolve17(realpathSync9(cursor), ...suffix);
 }
 function contains(root2, path) {
   return path === root2 || path.startsWith(root2 + sep7);
 }
 function configuredRoots(home, explicitHome) {
-  const homeData = join28(home, ".hasna", "skills");
+  const homeData = join29(home, ".hasna", "skills");
   const homePolicy = readManagedSkillPolicySnapshot(homeData);
-  const configuredPolicy = !explicitHome && resolve16(getDataDirReadOnly()) !== resolve16(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
+  const configuredPolicy = !explicitHome && resolve17(getDataDirReadOnly()) !== resolve17(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
   const policy = homePolicy ?? configuredPolicy;
   const bridge = policy?.value.bridge;
   if (bridge && (typeof bridge.home !== "string" || physicalPath(bridge.home) !== physicalPath(home))) {
@@ -18814,8 +18998,8 @@ function configuredRoots(home, explicitHome) {
       admitBinding(binding);
       continue;
     }
-    const nativeHome = join28(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
-    if (!lstatSync22(nativeHome, { throwIfNoEntry: false }))
+    const nativeHome = join29(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
+    if (!lstatSync23(nativeHome, { throwIfNoEntry: false }))
       continue;
     roots.push(...resolveAgentDiscovery({ home, agent, canonical: physicalPath }).roots);
   }
@@ -18824,22 +19008,22 @@ function configuredRoots(home, explicitHome) {
 function assertPortableAuthoringPath(path, options = {}) {
   if (typeof path !== "string" || !path || path.includes("\x00"))
     throw new Error("Invalid portable authoring path");
-  const lexical = resolve16(path);
+  const lexical = resolve17(path);
   const physical = physicalPath(lexical);
   const candidates = [lexical, physical];
   let native = candidates.map(nativeRootMatch).find(Boolean);
-  const home = resolve16(options.homeDir ?? homedir6());
-  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join28(home, ...parts));
-  defaults.push(join28(home, ".codex/plugins/cache"), join28(home, ".claude/plugins/cache"), join28(home, ".claude/plugins/synced"), join28(home, ".gemini/extensions"));
+  const home = resolve17(options.homeDir ?? homedir6());
+  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join29(home, ...parts));
+  defaults.push(join29(home, ".codex/plugins/cache"), join29(home, ".claude/plugins/cache"), join29(home, ".claude/plugins/synced"), join29(home, ".gemini/extensions"));
   for (const root2 of defaults) {
-    if (candidates.some((candidate2) => contains(resolve16(root2), candidate2) || contains(physicalPath(root2), candidate2)))
+    if (candidates.some((candidate2) => contains(resolve17(root2), candidate2) || contains(physicalPath(root2), candidate2)))
       native ??= root2;
   }
   if (native) {
     throw new Error(`Refusing portable Skills authoring below native discovery root '${native}': ${lexical}. Set HASNA_SKILLS_DIR to a private authoring corpus outside native roots.`);
   }
   for (const root2 of configuredRoots(home, options.homeDir !== undefined)) {
-    if (candidates.some((candidate2) => contains(resolve16(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
+    if (candidates.some((candidate2) => contains(resolve17(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
       throw new Error(`Refusing portable Skills authoring below configured native discovery root: ${lexical}`);
     }
   }
@@ -18851,15 +19035,15 @@ function getPortableSkillsRoot(options = {}) {
 function resolvePortableSkillsRoot(options, migrate) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join29(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
-  const cache = join29(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join30(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
+  const cache = join30(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache))
     return cache;
-  const installed = join29(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join30(appDir, INSTALLED_SKILLS_DIRNAME);
   return installed;
 }
 function getPortableSkillPath(name, options = {}) {
-  return join29(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join30(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -18869,7 +19053,7 @@ function findPortableSkill(name, options = {}) {
     return null;
   }
   const path = getPortableSkillPath(normalized, options);
-  if (!existsSync13(path) || !statSync10(path).isDirectory())
+  if (!existsSync14(path) || !statSync10(path).isDirectory())
     return null;
   try {
     return summarizePortableSkill(path, normalized);
@@ -18885,7 +19069,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync11(root2).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join29(root2, entry);
+    const path = join30(root2, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -18919,11 +19103,11 @@ function isOfficialSkillName(name) {
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizeNewPortableSkillName(name);
   const readOnlyRoot = resolvePortableSkillsRoot(options, false);
-  assertPortableAuthoringPath(join29(readOnlyRoot, skillName), options);
+  assertPortableAuthoringPath(join30(readOnlyRoot, skillName), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join29(root2, skillName);
+  const skillPath = join30(root2, skillName);
   assertPortableAuthoringPath(skillPath, options);
-  if (existsSync13(skillPath)) {
+  if (existsSync14(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
     rmSync4(skillPath, { recursive: true, force: true });
@@ -18941,7 +19125,7 @@ function scaffoldPortableSkill(name, options = {}) {
 }
 function portPortableSkillDirectory(sourceDir, options = {}) {
   const absoluteSource = normalize4(sourceDir);
-  if (!existsSync13(absoluteSource) || !statSync10(absoluteSource).isDirectory()) {
+  if (!existsSync14(absoluteSource) || !statSync10(absoluteSource).isDirectory()) {
     throw new Error(`Import directory not found: ${sourceDir}`);
   }
   const continueOnError = options.continueOnError ?? true;
@@ -18955,7 +19139,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   const skipped = [];
   const entries = readdirSync11(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
-    const childPath = join29(absoluteSource, entryName);
+    const childPath = join30(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
       continue;
     if (!isSkillCandidate(childPath)) {
@@ -18984,19 +19168,19 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
 }
 function isSkillCandidate(dir) {
-  return existsSync13(join29(dir, "SKILL.md")) || existsSync13(join29(dir, "skill.json")) || existsSync13(join29(dir, "package.json"));
+  return existsSync14(join30(dir, "SKILL.md")) || existsSync14(join30(dir, "skill.json")) || existsSync14(join30(dir, "package.json"));
 }
 function physicalImportPath(path) {
-  let ancestor = resolve17(path);
+  let ancestor = resolve18(path);
   const suffix = [];
-  while (!existsSync13(ancestor)) {
+  while (!existsSync14(ancestor)) {
     suffix.unshift(basename11(ancestor));
     ancestor = dirname19(ancestor);
   }
-  return join29(realpathSync9(ancestor), ...suffix);
+  return join30(realpathSync10(ancestor), ...suffix);
 }
 function assertDisjointImportPaths(source, destination) {
-  const sourcePath = realpathSync9(source);
+  const sourcePath = realpathSync10(source);
   const destinationPath = physicalImportPath(destination);
   const contains2 = (parent, child) => {
     const path = relative6(parent, child);
@@ -19008,7 +19192,7 @@ function assertDisjointImportPaths(source, destination) {
 }
 function portPortableSkill(sourcePath, options = {}) {
   const absoluteSource = normalize4(sourcePath);
-  if (!existsSync13(absoluteSource) || !statSync10(absoluteSource).isDirectory()) {
+  if (!existsSync14(absoluteSource) || !statSync10(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
   const inferred = readPortableSkillManifestForImport(absoluteSource);
@@ -19019,14 +19203,14 @@ function portPortableSkill(sourcePath, options = {}) {
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename11(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
-  const readOnlyDestination = join29(resolvePortableSkillsRoot(options, false), skillName);
+  const readOnlyDestination = join30(resolvePortableSkillsRoot(options, false), skillName);
   assertPortableAuthoringPath(readOnlyDestination, options);
   assertDisjointImportPaths(absoluteSource, readOnlyDestination);
   const root2 = getPortableSkillsRoot(options);
-  const destination = join29(root2, skillName);
+  const destination = join30(root2, skillName);
   assertPortableAuthoringPath(destination, options);
   assertDisjointImportPaths(absoluteSource, destination);
-  if (existsSync13(destination)) {
+  if (existsSync14(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync4(destination, { recursive: true, force: true });
@@ -19068,13 +19252,13 @@ function buildCorpusManifest(input, name) {
 function writeCorpusSkill(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const readOnlyRoot = resolvePortableSkillsRoot(options, false);
-  assertPortableAuthoringPath(join29(readOnlyRoot, name), options);
+  assertPortableAuthoringPath(join30(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join29(root2, name);
+  const skillPath = join30(root2, name);
   assertPortableAuthoringPath(skillPath, options);
-  const created = !existsSync13(skillPath);
+  const created = !existsSync14(skillPath);
   mkdirSync9(skillPath, { recursive: true });
-  writeFileSync8(join29(skillPath, "SKILL.md"), input.skillMd);
+  writeFileSync8(join30(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
   return { name, path: skillPath, manifest, created };
@@ -19082,22 +19266,22 @@ function writeCorpusSkill(input, options = {}) {
 function installCorpusSkillAtomically(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const readOnlyRoot = resolvePortableSkillsRoot(options, false);
-  assertPortableAuthoringPath(join29(readOnlyRoot, name), options);
+  assertPortableAuthoringPath(join30(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const target = join29(root2, name);
+  const target = join30(root2, name);
   assertPortableAuthoringPath(target, options);
-  const created = !existsSync13(target);
+  const created = !existsSync14(target);
   mkdirSync9(root2, { recursive: true });
-  const staging = mkdtempSync2(join29(root2, `.pull-${name}-`));
+  const staging = mkdtempSync2(join30(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
-    writeFileSync8(join29(staging, "SKILL.md"), input.skillMd);
+    writeFileSync8(join30(staging, "SKILL.md"), input.skillMd);
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
-    if (existsSync13(target)) {
-      backup = mkdtempSync2(join29(root2, `.pull-backup-${name}-`));
-      renameSync5(target, join29(backup, name));
+    if (existsSync14(target)) {
+      backup = mkdtempSync2(join30(root2, `.pull-backup-${name}-`));
+      renameSync5(target, join30(backup, name));
       moved = true;
     }
     renameSync5(staging, target);
@@ -19106,9 +19290,9 @@ function installCorpusSkillAtomically(input, options = {}) {
     return { name, path: target, manifest, created };
   } catch (error) {
     rmSync4(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync13(join29(backup, name))) {
+    if (moved && backup && existsSync14(join30(backup, name))) {
       try {
-        renameSync5(join29(backup, name), target);
+        renameSync5(join30(backup, name), target);
       } catch {}
     }
     throw error;
@@ -19120,10 +19304,10 @@ function validatePortableSkillDirectory(name, skillPath) {
   const issues = [...base.issues];
   const warnings = [...base.warnings];
   let manifest;
-  if (existsSync13(skillPath)) {
-    const skillJsonPath = join29(skillPath, "skill.json");
-    const skillMdPath = join29(skillPath, "SKILL.md");
-    if (!existsSync13(skillJsonPath) && !existsSync13(skillMdPath)) {
+  if (existsSync14(skillPath)) {
+    const skillJsonPath = join30(skillPath, "skill.json");
+    const skillMdPath = join30(skillPath, "SKILL.md");
+    if (!existsSync14(skillJsonPath) && !existsSync14(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
     try {
@@ -19142,7 +19326,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync13(join29(skillPath, "skill.json")),
+        strict: existsSync14(join30(skillPath, "skill.json")),
         skillPath
       });
       for (const issue of contractIssues)
@@ -19182,8 +19366,8 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command.name}' entry '${command.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join29(skillPath, command.entry);
-            if (!existsSync13(entryPath))
+            const entryPath = join30(skillPath, command.entry);
+            if (!existsSync14(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command.name}' entry '${command.entry}' is missing`);
             else if (statSync10(entryPath).isDirectory())
               add3(issues, "portable.command_entry_directory", `Command '${command.name}' entry '${command.entry}' must be a file`);
@@ -19193,7 +19377,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error) {
       add3(issues, "portable.manifest_invalid", error.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync13(join29(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync14(join30(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -19229,13 +19413,13 @@ async function runPortableSkill(name, args, options = {}) {
   if (!isSafeRelativePath2(command.entry)) {
     return { exitCode: 1, error: `Portable skill '${name}' command entry is unsafe` };
   }
-  const entryPath = join29(skill.path, command.entry);
-  if (!existsSync13(entryPath)) {
+  const entryPath = join30(skill.path, command.entry);
+  if (!existsSync14(entryPath)) {
     return { exitCode: 1, error: `Entry point '${command.entry}' not found in portable skill '${name}'` };
   }
-  const pkgPath = join29(skill.path, "package.json");
-  const nodeModules = join29(skill.path, "node_modules");
-  if (existsSync13(pkgPath) && !existsSync13(nodeModules) && hasPackageDependencies(pkgPath)) {
+  const pkgPath = join30(skill.path, "package.json");
+  const nodeModules = join30(skill.path, "node_modules");
+  if (existsSync14(pkgPath) && !existsSync14(nodeModules) && hasPackageDependencies(pkgPath)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skill.path,
       stdout: "pipe",
@@ -19483,7 +19667,7 @@ function parseSkillMdFrontmatter(content) {
   return Object.keys(result).length > 0 ? result : null;
 }
 function discoverSkillsInDir(dir, source = "custom") {
-  if (!existsSync14(dir))
+  if (!existsSync15(dir))
     return [];
   const result = [];
   try {
@@ -19491,8 +19675,8 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join30(dir, entry.name, "SKILL.md");
-      if (!existsSync14(skillMdPath))
+      const skillMdPath = join31(dir, entry.name, "SKILL.md");
+      if (!existsSync15(skillMdPath))
         continue;
       let content;
       try {
@@ -19511,7 +19695,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join30(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join31(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -19520,16 +19704,16 @@ function discoverSkillsInDir(dir, source = "custom") {
 }
 function findExtensionSkillPath(name) {
   const config = loadConfig();
-  if (!config.extensionsDir || !existsSync14(config.extensionsDir))
+  if (!config.extensionsDir || !existsSync15(config.extensionsDir))
     return null;
   try {
     const entries = readdirSync12(config.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join30(config.extensionsDir, entry.name);
-      const skillMdPath = join30(skillDir, "SKILL.md");
-      if (!existsSync14(skillMdPath))
+      const skillDir = join31(config.extensionsDir, entry.name);
+      const skillMdPath = join31(skillDir, "SKILL.md");
+      if (!existsSync15(skillMdPath))
         continue;
       let content;
       try {
@@ -19576,21 +19760,21 @@ function clearRegistryCache() {
   registryCacheTime = 0;
   registryCacheKey = null;
 }
-function getSkillsByCategory(category) {
-  return loadRegistry().filter((s) => s.category === category);
+function getSkillsByCategory(category, catalog) {
+  return (catalog ?? loadRegistry()).filter((s) => s.category === category);
 }
 function getSkill(name) {
   const registry = loadRegistry();
   const slug = normalizeSkillSlug(name);
   return registry.find((s) => s.name === slug) ?? registry.find((s) => s.name === resolveSkillAlias(slug));
 }
-function getSkillsByTag(tag) {
+function getSkillsByTag(tag, catalog) {
   const needle = tag.toLowerCase();
-  return loadRegistry().filter((s) => s.tags.some((t2) => t2.toLowerCase().includes(needle)));
+  return (catalog ?? loadRegistry()).filter((s) => s.tags.some((t2) => t2.toLowerCase().includes(needle)));
 }
-function getAllTags() {
+function getAllTags(catalog) {
   const tagSet = new Set;
-  for (const skill of loadRegistry()) {
+  for (const skill of catalog ?? loadRegistry()) {
     for (const tag of skill.tags)
       tagSet.add(tag.toLowerCase());
   }
@@ -19598,20 +19782,20 @@ function getAllTags() {
 }
 // src/lib/run-state.ts
 import { createHash as createHash19, randomBytes } from "crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync19, readdirSync as readdirSync13, statSync as statSync11, writeFileSync as writeFileSync9 } from "fs";
-import { extname, join as join31, relative as relative7 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync19, readdirSync as readdirSync13, statSync as statSync11, writeFileSync as writeFileSync9 } from "fs";
+import { extname, join as join32, relative as relative7 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root2 = getProjectStateDir(targetDir);
-  const runDir = join31(root2, "runs", day, id);
-  const logsDir = join31(runDir, "logs");
-  const exportDir = join31(root2, "exports", skillName, id);
+  const runDir = join32(root2, "runs", day, id);
+  const logsDir = join32(runDir, "logs");
+  const exportDir = join32(root2, "exports", skillName, id);
   mkdirSync10(logsDir, { recursive: true });
   mkdirSync10(exportDir, { recursive: true });
-  mkdirSync10(join31(root2, "tmp"), { recursive: true });
+  mkdirSync10(join32(root2, "tmp"), { recursive: true });
   const record3 = {
     id,
     skill: skillName,
@@ -19663,27 +19847,27 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync9(join31(context.logsDir, "stdout.log"), stdout);
-  writeFileSync9(join31(context.logsDir, "stderr.log"), stderr);
+  writeFileSync9(join32(context.logsDir, "stdout.log"), stdout);
+  writeFileSync9(join32(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join31(context.runDir, "events.ndjson");
-  const previous = existsSync15(path) ? readFileSync19(path, "utf-8") : "";
+  const path = join32(context.runDir, "events.ndjson");
+  const previous = existsSync16(path) ? readFileSync19(path, "utf-8") : "";
   writeFileSync9(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
-  const runsRoot = join31(getProjectStateDir(targetDir), "runs");
-  if (!existsSync15(runsRoot))
+  const runsRoot = join32(getProjectStateDir(targetDir), "runs");
+  if (!existsSync16(runsRoot))
     return [];
   const records = [];
   for (const day of readdirSync13(runsRoot).sort().reverse()) {
-    const dayDir = join31(runsRoot, day);
+    const dayDir = join32(runsRoot, day);
     if (!statSync11(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync13(dayDir).sort().reverse()) {
-      const record3 = readRunRecord(join31(dayDir, runId));
+      const record3 = readRunRecord(join32(dayDir, runId));
       if (record3)
         records.push(record3);
       if (records.length >= limit)
@@ -19693,29 +19877,29 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   return records;
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join31(getProjectStateDir(targetDir), "runs");
-  if (!existsSync15(runsRoot))
+  const runsRoot = join32(getProjectStateDir(targetDir), "runs");
+  if (!existsSync16(runsRoot))
     return null;
   for (const day of readdirSync13(runsRoot)) {
-    const record3 = readRunRecord(join31(runsRoot, day, runId));
+    const record3 = readRunRecord(join32(runsRoot, day, runId));
     if (record3)
       return record3;
   }
   return null;
 }
 function getRunExportDir(runId, skill, targetDir = process.cwd()) {
-  return join31(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
+  return join32(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
 }
 function writeRunRecord(context) {
-  writeFileSync9(join31(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync9(join32(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync9(join31(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync9(join32(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
-  if (!existsSync15(context.exportDir))
+  if (!existsSync16(context.exportDir))
     return [];
   const artifacts = [];
   for (const path of walkFiles(context.exportDir)) {
@@ -19731,8 +19915,8 @@ function collectRunArtifacts(context) {
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join31(runDir, "run.json");
-  if (!existsSync15(path))
+  const path = join32(runDir, "run.json");
+  if (!existsSync16(path))
     return null;
   try {
     return JSON.parse(readFileSync19(path, "utf-8"));
@@ -19743,7 +19927,7 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync13(dir)) {
-    const full = join31(dir, entry);
+    const full = join32(dir, entry);
     if (statSync11(full).isDirectory())
       files.push(...walkFiles(full));
     else
@@ -40148,10 +40332,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve18) => {
+  const deadline = new Promise((resolve19) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve18(expired);
+      resolve19(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -41250,14 +41434,14 @@ async function createRemoteSkillsClient(env = process.env) {
   return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
 }
 // src/lib/scheduler.ts
-import { existsSync as existsSync16, readFileSync as readFileSync20, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "fs";
-import { join as join32 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync20, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "fs";
+import { join as join33 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join32(targetDir, ".skills", "schedules.json");
+  return join33(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  if (existsSync16(path)) {
+  if (existsSync17(path)) {
     try {
       return JSON.parse(readFileSync20(path, "utf-8"));
     } catch {}
@@ -41266,8 +41450,8 @@ function loadSchedules(targetDir = process.cwd()) {
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join32(targetDir, ".skills");
-  if (!existsSync16(dir))
+  const dir = join33(targetDir, ".skills");
+  if (!existsSync17(dir))
     mkdirSync11(dir, { recursive: true });
   writeFileSync10(path, JSON.stringify(data, null, 2));
 }
@@ -41482,8 +41666,8 @@ function revisionIdOfRecord(record8) {
   return revisionIdOf(record8);
 }
 // src/lib/pull.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname20, join as join33 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync21, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname20, join as join34 } from "path";
 
 // src/lib/skill-bundles.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -41577,7 +41761,7 @@ async function pullOne(client2, rawName, corpusOptions, verify) {
       return reconcileTombstone(slug2, corpusOptions);
     }
     if (bundleResponse.status === 404) {
-      const marker = readPullMarker(join33(getPortableSkillsRoot(corpusOptions), slug2));
+      const marker = readPullMarker(join34(getPortableSkillsRoot(corpusOptions), slug2));
       if (isPublishedInstallMarker(marker)) {
         return { name: slug2, success: true, purged: true, removed: false };
       }
@@ -41616,7 +41800,7 @@ async function pullOne(client2, rawName, corpusOptions, verify) {
     return { name: slug2, success: false, error: `Skill '${slug2}' was not found on the configured Skills instance.` };
   }
   if (!meta3?.revisionId) {
-    const marker = readPullMarker(join33(getPortableSkillsRoot(corpusOptions), slug2));
+    const marker = readPullMarker(join34(getPortableSkillsRoot(corpusOptions), slug2));
     if (isPublishedInstallMarker(marker)) {
       return { name: slug2, success: true, purged: true, removed: false };
     }
@@ -41673,7 +41857,7 @@ function provenRevision(meta3, slug2, bundle2) {
   return declared;
 }
 function reconcileTombstone(slug2, corpusOptions) {
-  const target = join33(getPortableSkillsRoot(corpusOptions), slug2);
+  const target = join34(getPortableSkillsRoot(corpusOptions), slug2);
   if (!hasSkillsOwnershipMarker(target)) {
     return { name: slug2, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
@@ -41682,7 +41866,7 @@ function reconcileTombstone(slug2, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync21(join33(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync21(join34(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
@@ -41817,14 +42001,14 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root2 = getPortableSkillsRoot(options);
   mkdirSync12(root2, { recursive: true });
-  const target = join33(root2, name);
-  const created = !existsSync17(target);
-  const staging = mkdtempSync3(join33(root2, `.pull-${name}-`));
+  const target = join34(root2, name);
+  const created = !existsSync18(target);
+  const staging = mkdtempSync3(join34(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
-      const destination = join33(staging, entry.path);
+      const destination = join34(staging, entry.path);
       mkdirSync12(dirname20(destination), { recursive: true });
       writeFileSync11(destination, entry.bytes, { mode: entry.mode });
     }
@@ -41836,9 +42020,9 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.signature ? { signature: marker.signature } : {},
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
-    if (existsSync17(target)) {
-      backup = mkdtempSync3(join33(root2, `.pull-backup-${name}-`));
-      renameSync6(target, join33(backup, name));
+    if (existsSync18(target)) {
+      backup = mkdtempSync3(join34(root2, `.pull-backup-${name}-`));
+      renameSync6(target, join34(backup, name));
       moved = true;
     }
     renameSync6(staging, target);
@@ -41846,9 +42030,9 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       rmSync5(backup, { recursive: true, force: true });
   } catch (error61) {
     rmSync5(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync17(join33(backup, name))) {
+    if (moved && backup && existsSync18(join34(backup, name))) {
       try {
-        renameSync6(join33(backup, name), target);
+        renameSync6(join34(backup, name), target);
       } catch {}
     }
     throw error61;
@@ -41867,7 +42051,7 @@ function writePullMarker(dir, record8) {
     ...record8.revisionId ? { revisionId: record8.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync11(join33(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync11(join34(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client2, slug2) {
@@ -42309,12 +42493,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve18) => {
+      await new Promise((resolve19) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve18();
+          resolve19();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -43870,16 +44054,16 @@ function clone3(value) {
   return JSON.parse(JSON.stringify(value));
 }
 // src/lib/feedback.ts
-import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
-import { dirname as dirname22, join as join34 } from "path";
+import { appendFileSync, existsSync as existsSync19, mkdirSync as mkdirSync14 } from "fs";
+import { dirname as dirname22, join as join35 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join34(getDataDir(), "skills.db");
+  return join35(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
   const dir = dirname22(dbPath);
-  if (!existsSync18(dir))
+  if (!existsSync19(dir))
     mkdirSync14(dir, { recursive: true });
   const db = new Database(dbPath);
   db.exec("PRAGMA journal_mode = WAL");
@@ -43906,9 +44090,9 @@ function saveFeedback(input2) {
     throw new Error("Feedback message is required");
   const category = input2.category ?? "general";
   if (isApiMode()) {
-    const path = join34(getDataDir(), "feedback.jsonl");
+    const path = join35(getDataDir(), "feedback.jsonl");
     const dir = dirname22(path);
-    if (!existsSync18(dir))
+    if (!existsSync19(dir))
       mkdirSync14(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input2.email ?? null, agent: input2.agent ?? null, version: input2.version ?? null, createdAt: new Date().toISOString() }) + `
 `);
@@ -43932,14 +44116,14 @@ function isApiMode(env = process.env) {
 // src/lib/native-storage.ts
 import { createHash as createHash23, createHmac as createHmac2 } from "crypto";
 import {
-  existsSync as existsSync19,
+  existsSync as existsSync20,
   mkdirSync as mkdirSync15,
   readFileSync as readFileSync23,
   readdirSync as readdirSync14,
   statSync as statSync12,
   writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname23, join as join35, normalize as normalize5, relative as relative9, sep as sep9 } from "path";
+import { dirname as dirname23, join as join36, normalize as normalize5, relative as relative9, sep as sep9 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -44076,7 +44260,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join35(getDataDir(), "skills.db")
+      feedbackDbPath: join36(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config2.databaseUrl),
@@ -44099,7 +44283,7 @@ function getStorageStatus(options = {}) {
 function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const projectStateDir = getProjectStateDir(targetDir);
   const files = [];
-  if (existsSync19(projectStateDir)) {
+  if (existsSync20(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
       const bytes = readFileSync23(filePath);
       const relativePath = toPosix(relative9(targetDir, filePath));
@@ -44126,7 +44310,7 @@ function importSkillsLocalSnapshot(snapshot2, targetDir = process.cwd(), options
       continue;
     }
     const absolutePath4 = resolveSnapshotPath(targetDir, file2.path);
-    if (existsSync19(absolutePath4) && !options.overwrite) {
+    if (existsSync20(absolutePath4) && !options.overwrite) {
       skipped += 1;
       continue;
     }
@@ -44433,7 +44617,7 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync14(dir)) {
-    const full = join35(dir, entry);
+    const full = join36(dir, entry);
     const stats = statSync12(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
@@ -44450,7 +44634,7 @@ function resolveSnapshotPath(targetDir, snapshotPath) {
   if (!toPosix(normalizedPath).startsWith(".skills/")) {
     throw new Error(`Snapshot path must stay inside .skills: ${snapshotPath}`);
   }
-  return join35(targetDir, normalizedPath);
+  return join36(targetDir, normalizedPath);
 }
 function normalizeS3Prefix(prefix) {
   return (prefix ?? "").trim().replace(/^\/+|\/+$/g, "");
@@ -44523,12 +44707,12 @@ import {
   statSync as statSync14,
   writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname24, isAbsolute as isAbsolute19, relative as relative10, resolve as resolve18, sep as sep11 } from "path";
+import { dirname as dirname24, isAbsolute as isAbsolute19, relative as relative10, resolve as resolve19, sep as sep11 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync15, statSync as statSync13 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join36, sep as sep10 } from "path";
+import { join as join37, sep as sep10 } from "path";
 var SYNC_HOMES = [
   { name: "skills", subClass: "skills", agent: null },
   { name: "custom", subClass: "custom", agent: null },
@@ -44621,16 +44805,16 @@ function isPortableWithinSkill(relativeParts) {
 function homePathFor(definition, homesRoot) {
   const home = homesRoot ?? homedir7();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
-    return join36(skillsDataRootForHome(home), definition.name);
+    return join37(skillsDataRootForHome(home), definition.name);
   }
   if (definition.agent === "opencode") {
-    return join36(home, ".config", "opencode", "skills");
+    return join37(home, ".config", "opencode", "skills");
   }
-  return join36(home, `.${definition.agent}`, "skills");
+  return join37(home, `.${definition.agent}`, "skills");
 }
 function destinationFor(definition, stationId, relativePath) {
-  const category = definition.subClass === "agent-homes" ? join36("agent-homes", definition.agent ?? "") : definition.name;
-  return join36("resources", stationId, "skills", category, ...relativePath.split(sep10));
+  const category = definition.subClass === "agent-homes" ? join37("agent-homes", definition.agent ?? "") : definition.name;
+  return join37("resources", stationId, "skills", category, ...relativePath.split(sep10));
 }
 function walkEntries(absoluteRoot) {
   let entries;
@@ -44641,7 +44825,7 @@ function walkEntries(absoluteRoot) {
   }
   const output2 = [];
   for (const entry of entries) {
-    const childFull = join36(absoluteRoot, entry.name);
+    const childFull = join37(absoluteRoot, entry.name);
     if (entry.isSymbolicLink()) {
       output2.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
       continue;
@@ -44652,7 +44836,7 @@ function walkEntries(absoluteRoot) {
       }
       const nested = walkEntries(childFull);
       for (const item of nested) {
-        output2.push({ ...item, relativePath: join36(entry.name, item.relativePath) });
+        output2.push({ ...item, relativePath: join37(entry.name, item.relativePath) });
       }
       continue;
     }
@@ -44761,7 +44945,7 @@ function humanHomes(scanned) {
   }));
 }
 function writeStationSnapshot(options) {
-  const repoRoot = resolve18(options.repoRoot ?? process.cwd());
+  const repoRoot = resolve19(options.repoRoot ?? process.cwd());
   const { scanned, plans, totalBytes } = planStationSnapshot(options);
   const manifestFiles = plans.map((plan) => ({
     relativePath: plan.source.relativePath,
@@ -44787,7 +44971,7 @@ function writeStationSnapshot(options) {
   const conflicts = [];
   const untouched = [];
   for (const plan of plans) {
-    const destination = resolve18(repoRoot, plan.destination);
+    const destination = resolve19(repoRoot, plan.destination);
     const destinationRelative = relative10(repoRoot, destination);
     if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep11) || isAbsolute19(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
@@ -44810,7 +44994,7 @@ function writeStationSnapshot(options) {
   }
   let written = 0;
   for (const plan of untouched) {
-    const destination = resolve18(repoRoot, plan.destination);
+    const destination = resolve19(repoRoot, plan.destination);
     mkdirSync16(dirname24(destination), { recursive: true });
     copyFileSync(plan.source.fullPath, destination);
     written += 1;
@@ -44829,7 +45013,7 @@ function writeStationSnapshot(options) {
     },
     files: manifestFiles
   };
-  const manifestPath = resolve18(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  const manifestPath = resolve19(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
   mkdirSync16(dirname24(manifestPath), { recursive: true });
   writeFileSync14(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
@@ -44850,7 +45034,7 @@ import {
   statSync as statSync15,
   writeFileSync as writeFileSync15
 } from "fs";
-import { dirname as dirname25, join as join37, resolve as resolve19, sep as sep12 } from "path";
+import { dirname as dirname25, join as join38, resolve as resolve20, sep as sep12 } from "path";
 var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1";
 var STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
 var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
@@ -44858,11 +45042,11 @@ function fail(code2, message, detail = []) {
   throw new StationSnapshotError(code2, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join37(repoRoot, "resources", stationId, "skills");
+  return join38(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join37(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join38(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
     manifest = JSON.parse(readFileSync26(manifestPath, "utf8"));
@@ -44889,7 +45073,7 @@ function planStationHydration(stationId, repoRoot) {
   const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join37(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join38(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
       identEntries = readdirSync16(agentRoot, { withFileTypes: true });
@@ -44900,7 +45084,7 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join37(agentRoot, identEntry.name);
+      const identRoot = join38(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
         const relativeParts = [identEntry.name, ...entry.relativePath.split(sep12)];
@@ -45051,8 +45235,8 @@ function skillSha256(skill) {
 `)).digest("hex");
 }
 function writeStationHydration(options) {
-  const repoRoot = resolve19(options.repoRoot ?? process.cwd());
-  const cacheRoot = resolve19(options.cacheRoot ?? resolveCorpusRoot());
+  const repoRoot = resolve20(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve20(options.cacheRoot ?? resolveCorpusRoot());
   const plan = planStationHydration(options.stationId, repoRoot);
   const resultSkills = plan.winners.map((skill) => ({
     ident: skill.ident,
@@ -45085,7 +45269,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file2 of skill.files) {
-      const destination = join37(cacheRoot, skill.ident, file2.withinIdent);
+      const destination = join38(cacheRoot, skill.ident, file2.withinIdent);
       const digest3 = sha256File(file2.winner.fullPath);
       let existingDigest = null;
       try {
@@ -45127,7 +45311,7 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join37(dirname25(cacheRoot), `hydration-${options.stationId}.json`);
+  const hydrationManifestPath = join38(dirname25(cacheRoot), `hydration-${options.stationId}.json`);
   mkdirSync17(dirname25(hydrationManifestPath), { recursive: true });
   writeFileSync15(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
@@ -45139,23 +45323,23 @@ function writeStationHydration(options) {
   };
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants12, closeSync as closeSync13, fsyncSync as fsyncSync5, fstatSync as fstatSync13, lstatSync as lstatSync23, mkdirSync as mkdirSync18, openSync as openSync13, readSync as readSync11, realpathSync as realpathSync10, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
-import { dirname as dirname26, isAbsolute as isAbsolute20, join as join38, resolve as resolve20 } from "path";
+import { constants as constants12, closeSync as closeSync13, fsyncSync as fsyncSync5, fstatSync as fstatSync13, lstatSync as lstatSync24, mkdirSync as mkdirSync18, openSync as openSync13, readSync as readSync11, realpathSync as realpathSync11, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
+import { dirname as dirname26, isAbsolute as isAbsolute20, join as join39, resolve as resolve21 } from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 var fail2 = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory2) {
-  if (!isAbsolute20(directory2) || directory2 !== resolve20(directory2) || realpathSync10(directory2) !== directory2)
+  if (!isAbsolute20(directory2) || directory2 !== resolve21(directory2) || realpathSync11(directory2) !== directory2)
     return fail2();
   for (let path = directory2;; path = dirname26(path)) {
-    const stat2 = lstatSync23(path);
+    const stat2 = lstatSync24(path);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail2();
     if (path === dirname26(path))
       break;
   }
-  const own2 = lstatSync23(directory2);
+  const own2 = lstatSync24(directory2);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail2();
   return { dev: own2.dev, ino: own2.ino };
@@ -45166,7 +45350,7 @@ function unchangedDirectory(directory2, identity4) {
     return fail2();
 }
 function readOwned(directory2, name, max) {
-  const identity4 = safeDirectory(directory2), file2 = join38(directory2, name);
+  const identity4 = safeDirectory(directory2), file2 = join39(directory2, name);
   const fd = openSync13(file2, constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
     const stat2 = fstatSync13(fd);
@@ -45190,7 +45374,7 @@ function readOwned(directory2, name, max) {
   }
 }
 function writeOwned(directory2, name, bytes) {
-  const fd = openSync13(join38(directory2, name), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
+  const fd = openSync13(join39(directory2, name), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
   try {
     writeFileSync16(fd, bytes);
     fsyncSync5(fd);
@@ -45203,7 +45387,7 @@ function save(directory2, value) {
   writeOwned(directory2, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory2, identity4);
-  renameSync7(join38(directory2, temporary), join38(directory2, "receipt.json"));
+  renameSync7(join39(directory2, temporary), join39(directory2, "receipt.json"));
   const fd = openSync13(directory2, constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
     fsyncSync5(fd);
@@ -45216,7 +45400,7 @@ function bind(client2, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory2, action) {
-  const identity4 = safeDirectory(directory2), file2 = join38(directory2, "operation.lock");
+  const identity4 = safeDirectory(directory2), file2 = join39(directory2, "operation.lock");
   let fd;
   try {
     fd = openSync13(file2, constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
@@ -45232,7 +45416,7 @@ async function locked(directory2, action) {
   } finally {
     closeSync13(fd);
     unchangedDirectory(directory2, identity4);
-    const now = lstatSync23(file2);
+    const now = lstatSync24(file2);
     if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
       fail2();
     unlinkSync5(file2);
@@ -45284,7 +45468,7 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute20(recoveryDirectory) || resolve20(recoveryDirectory) !== recoveryDirectory || realpathSync10(dirname26(recoveryDirectory)) !== dirname26(recoveryDirectory))
+  if (!isAbsolute20(recoveryDirectory) || resolve21(recoveryDirectory) !== recoveryDirectory || realpathSync11(dirname26(recoveryDirectory)) !== dirname26(recoveryDirectory))
     return fail2();
   mkdirSync18(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
@@ -45376,7 +45560,7 @@ async function inspectLocked(client2, directory2, cancel) {
 }
 // src/lib/skill-context.ts
 import { createHash as createHash26 } from "crypto";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 function words(value) {
   return new Set(value.toLowerCase().match(/[a-z0-9]+/g) ?? []);
 }
@@ -45398,7 +45582,11 @@ async function buildSkillContext(input2, options = {}) {
   }
   const profileId = input2.profileId ?? "default";
   const sessionId = input2.sessionId ? input2.agentId ? `${input2.sessionId}:${input2.agentId}` : input2.sessionId : undefined;
-  const resolverOptions = { ...options, projectDir: input2.cwd ?? options.projectDir, sessionId, parentSessionId: input2.agentId ? input2.sessionId : undefined };
+  if (input2.parentSessionId !== undefined) {
+    if (input2.agentId !== undefined || !sessionId || input2.parentSessionId === sessionId || input2.parentSessionId !== null && (typeof input2.parentSessionId !== "string" || !input2.parentSessionId.trim()))
+      throw new SkillSelectionError("INVALID_SESSION", "Native session custody requires its own session id and a distinct parent, without a legacy agent id.");
+  }
+  const resolverOptions = { ...options, projectDir: input2.cwd ?? options.projectDir, sessionId, nativeParentSessionId: input2.parentSessionId, parentSessionId: input2.parentSessionId ?? (input2.agentId ? input2.sessionId : undefined) };
   const resolved = await resolveSelectionContext(profileId, resolverOptions);
   const profile = resolved.receipt.profile;
   const explicit = new Set((input2.skills ?? []).map((spec) => selectionKey(exactProfileSelection(spec, profile))));
@@ -45411,7 +45599,7 @@ async function buildSkillContext(input2, options = {}) {
   const promptWords = words(prompt);
   const promptNames = new Set(prompt.toLowerCase().match(/[a-z0-9]+(?:-[a-z0-9]+)*/g) ?? []);
   const loaded = new Set(resolved.session?.loaded ?? []);
-  const paths = [...input2.paths ?? [], ...input2.cwd ? [input2.cwd, resolve21(input2.cwd)] : []];
+  const paths = [...input2.paths ?? [], ...input2.cwd ? [input2.cwd, resolve22(input2.cwd)] : []];
   const candidates = profile.selections.map((selection) => {
     const key = selectionKey(selection);
     if (input2.restore && loaded.has(key))