@hasna/skills 0.10.28 → 0.10.30

package/dist/sdk/index.js

@@ -8209,7 +8209,7 @@ var require_client = __commonJS((exports) => {
     };
   };
   var sleep = (seconds) => {
-    return new Promise((resolve19) => setTimeout(resolve19, seconds * 1000));
+    return new Promise((resolve20) => setTimeout(resolve20, seconds * 1000));
   };
   var waiterServiceDefaults = {
     minDelay: 2,
@@ -8338,8 +8338,8 @@ var require_client = __commonJS((exports) => {
   };
   var abortTimeout = (abortSignal) => {
     let onAbort;
-    const promise = new Promise((resolve19) => {
-      onAbort = () => resolve19({ state: WaiterState.ABORTED });
+    const promise = new Promise((resolve20) => {
+      onAbort = () => resolve20({ state: WaiterState.ABORTED });
       if (typeof abortSignal.addEventListener === "function") {
         abortSignal.addEventListener("abort", onAbort);
       } else {
@@ -9477,7 +9477,7 @@ var require_config = __commonJS((exports) => {
   };
   var imdsRequest = async (options) => {
     const { request: request2 } = __require("http");
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve20, reject) => {
       const req = request2({
         hostname: options.hostname,
         port: options.port,
@@ -9505,7 +9505,7 @@ var require_config = __commonJS((exports) => {
         const chunks = [];
         res.on("data", (chunk) => chunks.push(chunk));
         res.on("end", () => {
-          resolve19(Buffer.concat(chunks));
+          resolve20(Buffer.concat(chunks));
           req.destroy();
         });
       });
@@ -10514,7 +10514,7 @@ var require_serde = __commonJS((exports) => {
   var { createHmac: createHmac2, createHash: createHash21, getRandomValues } = __require("crypto");
   var { hasOwn: hasOwn2, HttpResponse } = require_transport();
   exports.hasOwn = hasOwn2;
-  var { ReadStream, lstatSync: lstatSync23, fstatSync: fstatSync4 } = __require("fs");
+  var { ReadStream, lstatSync: lstatSync24, fstatSync: fstatSync4 } = __require("fs");
   var { toEndpointV1 } = require_endpoints();
   var { Readable, Writable, PassThrough } = __require("stream");
   var isArrayBuffer = (arg) => typeof ArrayBuffer === "function" && arg instanceof ArrayBuffer || Object.prototype.toString.call(arg) === "[object ArrayBuffer]";
@@ -11280,7 +11280,7 @@ var require_serde = __commonJS((exports) => {
       return body.end + 1 - body.start;
     } else if (body instanceof ReadStream) {
       if (body.path != null) {
-        return lstatSync23(body.path).size;
+        return lstatSync24(body.path).size;
       } else if (typeof body.fd === "number") {
         return fstatSync4(body.fd).size;
       }
@@ -11861,7 +11861,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return headStream$1(stream, bytes);
     }
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve20, reject) => {
       const collector = new Collector$1;
       collector.limit = bytes;
       stream.pipe(collector);
@@ -11872,7 +11872,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes2 = concatBytes(this.buffers);
-        resolve19(bytes2);
+        resolve20(bytes2);
       });
     });
   };
@@ -11986,7 +11986,7 @@ ${value}\r
     if (isReadableStream(stream)) {
       return collectReadableStream(stream);
     }
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve20, reject) => {
       const collector = new Collector;
       const nodeStream = stream;
       nodeStream.pipe(collector);
@@ -11997,7 +11997,7 @@ ${value}\r
       collector.on("error", reject);
       collector.on("finish", function() {
         const bytes = concatBytes(this.bufferedBytes);
-        resolve19(bytes);
+        resolve20(bytes);
       });
     });
   };
@@ -12189,7 +12189,7 @@ var require_checksum = __commonJS((exports) => {
       callback();
     }
   }
-  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve19, reject) => {
+  var fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve20, reject) => {
     if (!isReadStream(fileStream)) {
       reject(new Error("Unable to calculate hash for non-file streams."));
       return;
@@ -12207,7 +12207,7 @@ var require_checksum = __commonJS((exports) => {
     });
     hashCalculator.on("error", reject);
     hashCalculator.on("finish", function() {
-      hash2.digest().then(resolve19).catch(reject);
+      hash2.digest().then(resolve20).catch(reject);
     });
   });
   var isReadStream = (stream) => typeof stream.path === "string";
@@ -12218,14 +12218,14 @@ var require_checksum = __commonJS((exports) => {
     const hash2 = new hashCtor;
     const hashCalculator = new HashCalculator(hash2);
     readableStream.pipe(hashCalculator);
-    return new Promise((resolve19, reject) => {
+    return new Promise((resolve20, reject) => {
       readableStream.on("error", (err) => {
         hashCalculator.end();
         reject(err);
       });
       hashCalculator.on("error", reject);
       hashCalculator.on("finish", () => {
-        hash2.digest().then(resolve19).catch(reject);
+        hash2.digest().then(resolve20).catch(reject);
       });
     });
   };
@@ -13334,7 +13334,7 @@ var require_event_streams = __commonJS((exports) => {
       streamEnded = true;
     });
     while (!generationEnded) {
-      const value = await new Promise((resolve19) => setTimeout(() => resolve19(records.shift()), 0));
+      const value = await new Promise((resolve20) => setTimeout(() => resolve20(records.shift()), 0));
       if (value) {
         yield value;
       }
@@ -14852,7 +14852,7 @@ var require_retry = __commonJS((exports) => {
       }
     };
   }
-  var cooldown = (ms) => new Promise((resolve19) => setTimeout(resolve19, ms));
+  var cooldown = (ms) => new Promise((resolve20) => setTimeout(resolve20, ms));
   var isRetryStrategyV2 = (retryStrategy) => typeof retryStrategy.acquireInitialRetryToken !== "undefined" && typeof retryStrategy.refreshRetryTokenForRetry !== "undefined" && typeof retryStrategy.recordSuccess !== "undefined";
   var getRetryErrorInfo = (error, logger) => {
     const errorInfo = {
@@ -14951,7 +14951,7 @@ var require_retry = __commonJS((exports) => {
       this.refillTokenBucket();
       while (amount > this.availableTokens) {
         const delay = (amount - this.availableTokens) / this.fillRate * 1000;
-        await new Promise((resolve19) => DefaultRateLimiter.setTimeoutFn(resolve19, delay));
+        await new Promise((resolve20) => DefaultRateLimiter.setTimeoutFn(resolve20, delay));
         this.refillTokenBucket();
       }
       this.availableTokens = this.availableTokens - amount;
@@ -15293,7 +15293,7 @@ var require_retry = __commonJS((exports) => {
             const delayFromResponse = getDelayFromRetryAfterHeader(err.$response);
             const delay = Math.max(delayFromResponse || 0, delayFromDecider);
             totalDelay += delay;
-            await new Promise((resolve19) => setTimeout(resolve19, delay));
+            await new Promise((resolve20) => setTimeout(resolve20, delay));
             continue;
           }
           if (!err.$metadata) {
@@ -24646,7 +24646,7 @@ var init_node_http = () => {};
 
 // node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js
 function httpRequest(options) {
-  return new Promise((resolve19, reject) => {
+  return new Promise((resolve20, reject) => {
     const req = node_http.request({
       method: "GET",
       ...options,
@@ -24671,7 +24671,7 @@ function httpRequest(options) {
         chunks.push(chunk);
       });
       res.on("end", () => {
-        resolve19(Buffer.concat(chunks));
+        resolve20(Buffer.concat(chunks));
         req.destroy();
       });
     });
@@ -25168,21 +25168,21 @@ var require_dist_cjs6 = __commonJS((exports) => {
     let sendBody = true;
     if (!externalAgent && expect === "100-continue") {
       sendBody = await Promise.race([
-        new Promise((resolve19) => {
-          timeoutId = Number(timing.setTimeout(() => resolve19(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
+        new Promise((resolve20) => {
+          timeoutId = Number(timing.setTimeout(() => resolve20(true), Math.max(MIN_WAIT_TIME, maxContinueTimeoutMs)));
         }),
-        new Promise((resolve19) => {
+        new Promise((resolve20) => {
           httpRequest2.on("continue", () => {
             timing.clearTimeout(timeoutId);
-            resolve19(true);
+            resolve20(true);
           });
           httpRequest2.on("response", () => {
             timing.clearTimeout(timeoutId);
-            resolve19(false);
+            resolve20(false);
           });
           httpRequest2.on("error", () => {
             timing.clearTimeout(timeoutId);
-            resolve19(false);
+            resolve20(false);
           });
         })
       ]);
@@ -25259,13 +25259,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return socketWarningTimestamp;
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve19, reject) => {
+      this.configProvider = new Promise((resolve20, reject) => {
         if (typeof options === "function") {
           options().then((_options) => {
-            resolve19(this.resolveDefaultConfig(_options));
+            resolve20(this.resolveDefaultConfig(_options));
           }).catch(reject);
         } else {
-          resolve19(this.resolveDefaultConfig(options));
+          resolve20(this.resolveDefaultConfig(options));
         }
       });
     }
@@ -25297,7 +25297,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           timing.clearTimeout(socketTimeoutId);
           timing.clearTimeout(keepAliveTimeoutId);
         };
-        const resolve19 = async (arg) => {
+        const resolve20 = async (arg) => {
           await writeRequestBodyPromise;
           clearTimeouts();
           _resolve(arg);
@@ -25361,7 +25361,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: getTransformedHeaders(res.headers),
             body: res
           });
-          resolve19({ response: httpResponse });
+          resolve20({ response: httpResponse });
         });
         req.on("error", (err) => {
           if (NODEJS_TIMEOUT_ERROR_CODES.includes(err.code)) {
@@ -25693,13 +25693,13 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new NodeHttp2Handler(instanceOrOptions);
     }
     constructor(options) {
-      this.configProvider = new Promise((resolve19, reject) => {
+      this.configProvider = new Promise((resolve20, reject) => {
         if (typeof options === "function") {
           options().then((opts) => {
-            resolve19(opts || {});
+            resolve20(opts || {});
           }).catch(reject);
         } else {
-          resolve19(options || {});
+          resolve20(options || {});
         }
       });
     }
@@ -25724,7 +25724,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       return new Promise((_resolve, _reject) => {
         let fulfilled = false;
         let writeRequestBodyPromise = undefined;
-        const resolve19 = async (arg) => {
+        const resolve20 = async (arg) => {
           await writeRequestBodyPromise;
           _resolve(arg);
         };
@@ -25809,7 +25809,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             body: clientHttp2Stream
           });
           fulfilled = true;
-          resolve19({ response: httpResponse });
+          resolve20({ response: httpResponse });
           if (useIsolatedSession) {
             session.close();
             clientHttp2Stream.on("end", () => {
@@ -25942,7 +25942,7 @@ var retryWrapper = (toRetry, maxRetries, delayMs) => {
       try {
         return await toRetry();
       } catch (e3) {
-        await new Promise((resolve19) => setTimeout(resolve19, delayMs));
+        await new Promise((resolve20) => setTimeout(resolve20, delayMs));
       }
     }
     return await toRetry();
@@ -29446,7 +29446,7 @@ var require_signin = __commonJS((exports) => {
 import { createHash as createHash21, createPrivateKey, createPublicKey, sign } from "crypto";
 import { promises as fs2 } from "fs";
 import { homedir as homedir7 } from "os";
-import { dirname as dirname21, join as join33 } from "path";
+import { dirname as dirname21, join as join34 } from "path";
 var import_config28, import_protocols3, LoginCredentialsFetcher;
 var init_LoginCredentialsFetcher = __esm(() => {
   import_config28 = __toESM(require_config(), 1);
@@ -29613,10 +29613,10 @@ var init_LoginCredentialsFetcher = __esm(() => {
       await fs2.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
     }
     getTokenFilePath() {
-      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join33(homedir7(), ".aws", "login", "cache");
+      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join34(homedir7(), ".aws", "login", "cache");
       const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
       const loginSessionSha256 = createHash21("sha256").update(loginSessionBytes).digest("hex");
-      return join33(directory, `${loginSessionSha256}.json`);
+      return join34(directory, `${loginSessionSha256}.json`);
     }
     derToRawSignature(derSignature) {
       let offset = 2;
@@ -31065,9 +31065,9 @@ import { chmod, mkdir, readFile, rename, writeFile as writeFile2 } from "fs/prom
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync22 } from "fs";
 import { join as join210 } from "path";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join37, resolve as resolve19 } from "path";
+import { join as join38, resolve as resolve20 } from "path";
 import { homedir as pathsResolverHomedir2 } from "os";
 import { join as pathsResolverJoin2 } from "path";
 import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
@@ -31228,7 +31228,7 @@ function effectiveHome2() {
   return process.env["HOME"] || process.env["USERPROFILE"] || homedir8();
 }
 function legacyHomeDir() {
-  return join37(effectiveHome2(), ".hasna", "events");
+  return join38(effectiveHome2(), ".hasna", "events");
 }
 function resolverHome() {
   return dataDir2({ app: "events", home: effectiveHome2() || undefined });
@@ -31237,7 +31237,7 @@ function adoptResolverHome(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync16(join37(resolved, EVENTS_STORE_SENTINEL_FILE));
+  return existsSync17(join38(resolved, EVENTS_STORE_SENTINEL_FILE));
 }
 function exactEventsHome() {
   const dir = process.env[HASNA_EVENTS_DIR_ENV];
@@ -31251,9 +31251,9 @@ function exactEventsHome() {
 function getEventsHome() {
   const exact = exactEventsHome();
   if (exact)
-    return resolve19(exact);
+    return resolve20(exact);
   const resolved = resolverHome();
-  return adoptResolverHome(resolved) ? resolve19(resolved) : resolve19(legacyHomeDir());
+  return adoptResolverHome(resolved) ? resolve20(resolved) : resolve20(legacyHomeDir());
 }
 function getEventsDataDir(override) {
   return override || getEventsHome();
@@ -32373,7 +32373,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.28",
+  version: "0.10.30",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -37457,8 +37457,8 @@ async function reconcileSkillSession(input, options = {}) {
 // src/lib/selected-run.ts
 import { createHash as createHash20 } from "crypto";
 import { spawn as spawn2 } from "child_process";
-import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync9, realpathSync as realpathSync11 } from "fs";
-import { dirname as dirname20, join as join32, resolve as resolve18 } from "path";
+import { mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync9, realpathSync as realpathSync12 } from "fs";
+import { dirname as dirname20, join as join33, resolve as resolve19 } from "path";
 import { tmpdir, hostname as stationHostname2 } from "os";
 
 // src/lib/dependency-preparation.ts
@@ -37669,19 +37669,19 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 }
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync14, readFileSync as readFileSync21 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync21 } from "fs";
+import { join as join32 } from "path";
 
 // src/lib/installer.ts
-import { existsSync as existsSync13, readFileSync as readFileSync20, rmSync as rmSync4 } from "fs";
-import { join as join30 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync20, rmSync as rmSync4 } from "fs";
+import { join as join31 } from "path";
 import { homedir as homedir6 } from "os";
 
 // src/lib/agent-sync.ts
 import {
   cpSync as cpSync2,
-  existsSync as existsSync10,
-  lstatSync as lstatSync22,
+  existsSync as existsSync11,
+  lstatSync as lstatSync23,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync17,
@@ -37692,7 +37692,7 @@ import {
   writeFileSync as writeFileSync7
 } from "fs";
 import { homedir as homedir5 } from "os";
-import { basename as basename11, dirname as dirname19, join as join27 } from "path";
+import { basename as basename11, dirname as dirname19, join as join28 } from "path";
 
 // src/lib/codex-local-mcp-controls.ts
 function isCodexLocalStdioMcpServer(name, server) {
@@ -39072,6 +39072,8 @@ var NATIVE_SKILL_ROOTS = [
   ["codex", ".codex/skills"],
   ["codex", ".agents/skills"],
   ["gemini", ".gemini/skills"],
+  ["sumi", ".sumi/skills"],
+  ["sumi", ".sumi/skill"],
   ["codewith", ".codewith/skills"],
   ["opencode", ".config/opencode/skills"],
   ["opencode", ".opencode/skills"],
@@ -39088,8 +39090,8 @@ var NATIVE_SKILL_ROOTS = [
 // src/lib/agent-integration.ts
 import { createHash as createHash18, randomUUID as randomUUID3 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual6 } from "util";
-import { existsSync as existsSync6, lstatSync as lstatSync19, statSync as statSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync14, readdirSync as readdirSync8, opendirSync as opendirSync5, readlinkSync as readlinkSync4, realpathSync as realpathSync7, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4, chmodSync, openSync as openSync16, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, readSync as readSync11, constants as constants12, linkSync as linkSync2 } from "fs";
-import { dirname as dirname15, join as join22, resolve as resolve15, relative as relative4, isAbsolute as isAbsolute17, sep as sep5 } from "path";
+import { existsSync as existsSync7, lstatSync as lstatSync20, statSync as statSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync14, readdirSync as readdirSync8, opendirSync as opendirSync5, readlinkSync as readlinkSync4, realpathSync as realpathSync8, renameSync as renameSync3, rmdirSync as rmdirSync3, writeFileSync as writeFileSync4, unlinkSync as unlinkSync4, chmodSync, openSync as openSync16, closeSync as closeSync16, fsyncSync as fsyncSync4, fstatSync as fstatSync16, readSync as readSync11, constants as constants12, linkSync as linkSync2 } from "fs";
+import { dirname as dirname15, join as join23, resolve as resolve16, relative as relative4, isAbsolute as isAbsolute17, sep as sep5 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/lib/managed-policy.ts
@@ -39368,8 +39370,8 @@ function isOwnedCliBridge(path, expectedPaths) {
 
 // src/lib/agent-discovery.ts
 import { createHash as createHash17 } from "crypto";
-import { lstatSync as lstatSync18, readFileSync as readFileSync13, readdirSync as readdirSync7, realpathSync as realpathSync6 } from "fs";
-import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute16, join as join21, resolve as resolve14, sep as sep4 } from "path";
+import { lstatSync as lstatSync19, readFileSync as readFileSync13, readdirSync as readdirSync7, realpathSync as realpathSync7 } from "fs";
+import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute16, join as join22, resolve as resolve15, sep as sep4 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 
 // node_modules/yaml/dist/index.js
@@ -41680,6 +41682,114 @@ function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witnes
   return true;
 }
 
+// src/lib/agent-sumi.ts
+import { existsSync as existsSync6, lstatSync as lstatSync18, realpathSync as realpathSync6 } from "fs";
+import { join as join21, resolve as resolve14 } from "path";
+function sumiConfigDirectory(home, env = process.env) {
+  for (const key of ["SUMI_CONFIG", "SUMI_CONFIG_CONTENT"])
+    if (env[key] !== undefined)
+      throw new Error(`Sumi ${key} requires a dedicated discovery adapter; unset it before Skills integration`);
+  const selected = (key) => env[key]?.trim() ? env[key] : undefined;
+  const expand = (value) => resolve14(value === "~" ? home : value.startsWith("~/") ? join21(home, value.slice(2)) : value);
+  const explicit = selected("SUMI_CONFIG_DIR");
+  const xdg = selected("XDG_CONFIG_HOME");
+  const custom = selected("SUMI_HOME");
+  const canonical6 = explicit ? expand(explicit) : xdg ? join21(expand(xdg), "sumi") : join21(custom ? expand(custom) : join21(home, ".hasna-internal/sumi"), "config");
+  if (explicit || xdg || custom)
+    return canonical6;
+  const legacy = join21(home, ".config/sumi");
+  const a = lstatSync18(canonical6, { throwIfNoEntry: false }), b = lstatSync18(legacy, { throwIfNoEntry: false });
+  if (a && b && realpathSync6(canonical6) !== realpathSync6(legacy))
+    throw new Error("Sumi config roots conflict; complete native home adoption before Skills integration");
+  const path = a ? canonical6 : b ? legacy : canonical6;
+  if (!existsSync6(path))
+    return path;
+  const physical = realpathSync6(path);
+  if ((a?.isSymbolicLink() || b?.isSymbolicLink()) && ![canonical6, legacy].includes(physical))
+    throw new Error("Sumi config alias must resolve to its canonical or legacy root");
+  return physical;
+}
+function sumiBridgeRoot(home) {
+  return join21(sumiConfigDirectory(home), "skills");
+}
+function sumiConfigPath(home) {
+  return join21(sumiConfigDirectory(home), "sumi.json");
+}
+function renderSumiPlugin(command, profile) {
+  return `// Managed by @hasna/skills. Regenerate with skills hook install --agent sumi.
+import { spawn } from "node:child_process";
+const command = ${JSON.stringify(command)};
+const profile = ${JSON.stringify(profile)};
+function context(input) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, ["hook", "user-prompt", "--agent", "sumi", "--selection-profile", profile], { cwd: input.cwd, stdio: ["pipe", "pipe", "pipe"] });
+    const chunks = []; let bytes = 0, failure;
+    const timer = setTimeout(() => { failure = new Error("Skills prompt hook timed out"); child.kill("SIGKILL"); }, 15000);
+    child.stdout.on("data", chunk => { bytes += chunk.length; if (bytes > 1048576) { failure = new Error("Skills prompt hook output exceeded its limit"); child.kill("SIGKILL"); } else chunks.push(chunk); });
+    child.stderr.on("data", () => {});
+    child.stdin.on("error", () => {});
+    child.on("error", error => { clearTimeout(timer); reject(error); });
+    child.on("close", code => {
+      clearTimeout(timer);
+      if (failure || code !== 0) return reject(failure ?? new Error("Skills prompt hook failed"));
+      try {
+        const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+        if (!result || typeof result !== "object" || Array.isArray(result)) throw new Error("Invalid Skills hook response");
+        if (result.decision === "block" || result.continue === false) throw new Error("Skills prompt hook refused");
+        if (Object.keys(result).length && (!result.hookSpecificOutput || result.hookSpecificOutput.hookEventName !== input.hook_event_name)) throw new Error("Invalid Skills hook response");
+        const text = result.hookSpecificOutput?.additionalContext ?? "";
+        if (typeof text !== "string") throw new Error("Invalid Skills prompt context");
+        resolve(text);
+      } catch (error) { reject(error); }
+    });
+    child.stdin.end(JSON.stringify(input));
+  });
+}
+export default {
+  id: "local.hasna-skills-cli",
+  async setup(ctx) {
+    if (!ctx?.session?.hook || !ctx?.session?.get || !ctx?.skill?.transform || !ctx?.tool?.hook) throw new Error("Unsupported Sumi native Skills contract");
+    const registrations = [];
+    const sessions = new Set();
+    async function input(sessionID, prompt, first) {
+      // The Promise adapter unwraps single-data endpoint responses.
+      const session = await ctx.session.get({ sessionID });
+      if (!session || session.id !== sessionID || typeof session.location?.directory !== "string" || (session.parentID !== undefined && typeof session.parentID !== "string") || session.parentID === sessionID) throw new Error("Invalid Sumi session custody");
+      return { hook_event_name: first ? session.parentID ? "SubagentStart" : "SessionStart" : "UserPromptSubmit", cwd: session.location.directory, session_id: sessionID, parent_session_id: session.parentID ?? null, prompt, restore: true };
+    }
+    registrations.push(await ctx.skill.transform(editor => {
+      for (const skill of editor.list()) if (skill.id !== "skills-cli" || skill.name !== "skills-cli") editor.remove(skill.id);
+    }));
+    // Native config transforms may add skills after this transform. Guard
+    // both direct tool calls and prompt attachments at the consumption edge.
+    registrations.push(await ctx.tool.hook("execute.before", event => {
+      if (event.tool === "skill" && event.input?.id !== "skills-cli") throw new Error("Native Sumi skill payload refused; use Skills CLI");
+    }));
+    registrations.push(await ctx.session.hook("prompt", async event => {
+      if (typeof event.prompt?.text !== "string") throw new Error("Invalid Sumi prompt");
+      if (event.prompt.skills !== undefined && (!Array.isArray(event.prompt.skills) || event.prompt.skills.some(skill => skill?.id !== "skills-cli"))) throw new Error("Native Sumi skill attachment refused; use Skills CLI");
+      await context(await input(event.sessionID, event.prompt.text, !sessions.has(event.sessionID)));
+      sessions.add(event.sessionID);
+    }));
+    registrations.push(await ctx.session.hook("context", async event => {
+      const last = event.messages.findLast(message => message.role === "user");
+      const prompt = (last?.content ?? []).filter(part => part.type === "text").map(part => part.text).join("\\n");
+      // Recheck on every primary request, including resumed and synthetic
+      // sessions. The CLI owns optional failures versus explicit refusals.
+      const text = await context(await input(event.sessionID, prompt, !sessions.has(event.sessionID)));
+      if (text) event.system.push({ type: "text", text });
+      sessions.add(event.sessionID);
+    }));
+    return async () => { for (const registration of registrations) await registration.dispose(); };
+  },
+};
+`;
+}
+var SUMI_SKILL_PERMISSIONS = [
+  { action: "skill", resource: "*", effect: "deny" },
+  { action: "skill", resource: "skills-cli", effect: "allow" }
+];
+
 // src/lib/agent-discovery.ts
 var digest2 = (text2) => createHash17("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
@@ -41696,7 +41806,7 @@ function safe4(path) {
   if (!isAbsolute16(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
   for (let cursor = path;; cursor = dirname14(cursor)) {
-    if (lstatSync18(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync19(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
     if (dirname14(cursor) === cursor)
       break;
@@ -41706,7 +41816,7 @@ function read2(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync18(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync19(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
@@ -41817,12 +41927,12 @@ function codexInstallationRoots(binding) {
   if (binding.agent !== "codex" || binding.method !== "reviewed" || proof.version !== "codex-cli 0.160.0" || !/^[a-f0-9]{64}$/.test(proof.catalogSha256) || !Array.isArray(proof.plugins) || !proof.plugins.length)
     throw new Error("Invalid native installation input proof");
   const cache = dirname14(dirname14(proof.plugins[0].pluginParent));
-  const config = join21(dirname14(dirname14(cache)), "config.toml"), home = dirname14(dirname14(dirname14(cache)));
+  const config = join22(dirname14(dirname14(cache)), "config.toml"), home = dirname14(dirname14(dirname14(cache)));
   const configSource = binding.sources.find((source) => source.path === config && source.sha256 !== null && (!source.format || source.format === "toml" && source.fields?.includes("plugins")));
-  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join21(home, path));
+  const nativeRoots = NATIVE_SKILL_ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => join22(home, path));
   if (!configSource || proof.plugins.some((input) => nativeRoots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep4) || input.sourceRoot.startsWith(root2 + sep4)) || binding.sources.some((source) => basename7(source.path) === "config.toml" && (source.path === input.sourceRoot || source.path.startsWith(input.sourceRoot + sep4)))))
     throw new Error("Native installation input overlaps configuration or loading roots");
-  if (proof.plugins.some((input) => dirname14(dirname14(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join21(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
+  if (proof.plugins.some((input) => dirname14(dirname14(input.pluginParent)) !== cache || !binding.sources.some((source) => source.path === join22(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined)))
     throw new Error("Missing native installation input source witness");
   return reviewedCodexPluginSourceRoots(cache, proof.plugins, (path) => {
     const text2 = read2(path);
@@ -41864,19 +41974,19 @@ function captureDiscoveryPathSources(paths) {
   const budget = discoveryByteBudget();
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
-function assertProjectDiscovery(agent, directories, home, canonical6 = resolve14, reviewed) {
+function assertProjectDiscovery(agent, directories, home, canonical6 = resolve15, reviewed) {
   const homeConfigPath = canonical6(agentDiscoveryConfigPath(home, agent));
   for (const directory of directories) {
-    const isHome = resolve14(directory) === resolve14(home);
+    const isHome = resolve15(directory) === resolve15(home);
     if (agent === "hermes") {
       assertHermesEnvironment(home);
       continue;
     }
-    if (isHome && agent !== "claude")
+    if (isHome && agent !== "claude" && agent !== "sumi")
       continue;
-    const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : [".cursor/hooks.json"];
+    const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : agent === "sumi" ? ["sumi.json", "sumi.jsonc", ".sumi/sumi.json", ".sumi/sumi.jsonc"] : [".cursor/hooks.json"];
     for (const suffix of paths) {
-      const path = canonical6(join21(directory, suffix)), raw = read2(path);
+      const path = canonical6(join22(directory, suffix)), raw = read2(path);
       if (raw === null)
         continue;
       const isRootAliasedHomeConfig = agent === "claude" && suffix === ".claude/settings.json" || agent === "codex" && suffix === ".codex/config.toml";
@@ -41885,7 +41995,7 @@ function assertProjectDiscovery(agent, directories, home, canonical6 = resolve14
       if (suffix.endsWith(".jsonc"))
         throw new Error(`NATIVE_SKILL_DRIFT: project JSONC discovery configuration requires review: ${path}`);
       const config = parseConfig(raw, path, suffix.endsWith(".toml"));
-      const keys2 = agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces", "skillOverrides"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions"] : agent === "opencode" ? ["plugin", "skills"] : ["hooks"];
+      const keys2 = agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces", "skillOverrides"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions"] : agent === "opencode" ? ["plugin", "skills"] : agent === "sumi" ? ["plugin", "plugins", "skills", "permissions"] : ["hooks"];
       let admittedPlugins = false;
       if (agent === "claude" && reviewed?.agent === agent && reviewed.method === "reviewed" && config.enabledPlugins && typeof config.enabledPlugins === "object" && !Array.isArray(config.enabledPlugins)) {
         const exact = reviewed.sources.find((source) => source.path === path && source.format === undefined && source.fields === undefined && (source.hashMode === undefined || source.hashMode === "bytes"));
@@ -41898,19 +42008,28 @@ function assertProjectDiscovery(agent, directories, home, canonical6 = resolve14
       if (keys2.some((key) => config[key] !== undefined && !(key === "enabledPlugins" && admittedPlugins)) || config.disableAllHooks === true || config.disableBundledSkills === false || config.hooksConfig?.enabled === false || config.permission?.skill !== undefined || config.permissions?.deny?.some((rule) => typeof rule === "string" && /^Skill(?:\(|$)/.test(rule)))
         throw new Error(`NATIVE_SKILL_DRIFT: higher-precedence project skill or hook configuration requires review: ${path}`);
     }
+    if (agent === "sumi")
+      for (const name of ["plugin", "plugins"]) {
+        const path = canonical6(join22(directory, ".sumi", name));
+        safe4(path);
+        if (lstatSync19(path, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(path).length)
+          throw new Error(`NATIVE_SKILL_DRIFT: project Sumi plugins require a dedicated discovery review: ${path}`);
+      }
     if (agent === "claude") {
-      const commands = canonical6(join21(directory, ".claude/commands"));
+      const commands = canonical6(join22(directory, ".claude/commands"));
       safe4(commands);
-      if (lstatSync18(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length)
+      if (lstatSync19(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length)
         throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
     }
   }
 }
 function agentDiscoveryConfigPath(home, agent) {
-  return join21(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  if (agent === "sumi")
+    return sumiConfigPath(home);
+  return join22(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
 }
 function resolveAgentDiscovery(options) {
-  const canonical6 = options.canonical ?? resolve14, home = resolve14(options.home), agent = options.agent;
+  const canonical6 = options.canonical ?? resolve15, home = resolve15(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields2) => {
     const source = { path: canonical6(path), sha256: null, ...format ? { format, fields: fields2 } : {} };
@@ -41921,13 +42040,49 @@ function resolveAgentDiscovery(options) {
   if (agent === "hermes")
     assertHermesEnvironment(home);
   const configPath = agentDiscoveryConfigPath(home, agent);
-  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
+  const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? [...CODEX_DISCOVERY_PROJECTION_FIELDS] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : agent === "sumi" ? ["skills", "plugin", "plugins", "permissions"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
   };
+  if (agent === "sumi") {
+    const directory = sumiConfigDirectory(home);
+    if (witness(join22(directory, "sumi.jsonc")) !== null)
+      unresolved("JSONC configuration requires a supported format adapter");
+    for (const root2 of [directory, join22(home, ".claude"), join22(home, ".agents")])
+      for (const name of ["skill", "skills"])
+        roots.add(join22(root2, name));
+    if (config.skills !== undefined && (!Array.isArray(config.skills) || config.skills.some((path) => typeof path !== "string")))
+      unresolved("skills must be a string array");
+    for (const value of config.skills ?? []) {
+      if (typeof value !== "string" || /[\0$]/.test(value) || !value || !(isAbsolute16(value) || value.startsWith("~/")))
+        unresolved("remote or relative skill sources need a dedicated discovery adapter");
+      roots.add(value.startsWith("~/") ? join22(home, value.slice(2)) : value);
+    }
+    for (const key of ["plugin", "plugins"])
+      if (config[key] !== undefined && !Array.isArray(config[key]))
+        unresolved(`${key} must be an array`);
+    const plugins = [join22(directory, "plugin"), join22(directory, "plugins")];
+    for (const path of plugins) {
+      safe4(path);
+      if (lstatSync19(path, { throwIfNoEntry: false })?.isDirectory())
+        for (const name of readdirSync7(path).sort()) {
+          if (name === "skills-cli.js" && path === plugins[1])
+            continue;
+          const target = join22(path, name);
+          if (!lstatSync19(target).isFile())
+            unresolved("local plugin packages need a dedicated discovery adapter");
+          witness(target);
+        }
+    }
+    for (const root2 of roots) {
+      safe4(root2);
+      if (lstatSync19(root2, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(root2).some((name) => name.endsWith(".md")))
+        unresolved("flat markdown skills require a dedicated native migration adapter");
+    }
+  }
   if (agent === "hermes") {
-    const profile = witness(join21(home, ".hermes/active_profile"));
+    const profile = witness(join22(home, ".hermes/active_profile"));
     if (profile?.trim() && profile.trim() !== "default")
       unresolved("a non-default profile is active");
     const declared = config.skills?.external_dirs ?? [], paths = typeof declared === "string" ? [declared] : declared;
@@ -41941,7 +42096,7 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join21(home, normalized.slice(2)) : resolve14(home, ".hermes", normalized);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join22(home, normalized.slice(2)) : resolve15(home, ".hermes", normalized);
       safe4(path);
       roots.add(path);
     }
@@ -41950,8 +42105,8 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname14(realpathSync6(executable)), depth = 0;depth < 8; directory = dirname14(directory), depth++) {
-        const path = join21(directory, "package.json"), raw = read2(path);
+      for (let directory = dirname14(realpathSync7(executable)), depth = 0;depth < 8; directory = dirname14(directory), depth++) {
+        const path = join22(directory, "package.json"), raw = read2(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
@@ -41962,12 +42117,12 @@ function resolveAgentDiscovery(options) {
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
-      const builtinRoot = join21(packageRoot, "bundle/builtin");
+      const builtinRoot = join22(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync18(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync19(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync7(builtinRoot).sort()) {
-        const text2 = witness(join21(builtinRoot, name, "SKILL.md"));
+        const text2 = witness(join22(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
           unresolved("installed Gemini builtin name is missing or ambiguous");
@@ -42009,39 +42164,39 @@ function resolveAgentDiscovery(options) {
   function plugin(root2) {
     root2 = canonical6(root2);
     safe4(root2);
-    const manifestPath = join21(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
+    const manifestPath = join22(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
     if (raw === null)
       unresolved("plugin manifest missing");
     const manifest = parseConfig(raw, manifestPath);
-    const hooks = witness(join21(root2, "hooks/hooks.json"));
+    const hooks = witness(join22(root2, "hooks/hooks.json"));
     if (manifest.hooks !== undefined || hooks !== null)
       unresolved("plugin hooks require a separate no-skill-injection review");
-    const commands = join21(root2, "commands");
+    const commands = join22(root2, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync18(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync19(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
-    const rootSkill = witness(join21(root2, "SKILL.md"));
+    const rootSkill = witness(join22(root2, "SKILL.md"));
     if (rootSkill !== null)
       roots.add(root2);
     const declared = manifest.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
     if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
       unresolved("unsupported plugin skill paths");
     if (agent === "claude")
-      roots.add(join21(root2, "skills"));
+      roots.add(join22(root2, "skills"));
     for (const value of declared) {
-      const path = resolve14(root2, value);
+      const path = resolve15(root2, value);
       if (path !== root2 && !path.startsWith(root2 + sep4))
         unresolved("plugin skill path escapes its root");
       roots.add(path.endsWith(`${sep4}SKILL.md`) ? dirname14(path) : path);
     }
   }
   if (agent === "claude") {
-    const registrations = witness(join21(home, ".claude/plugins/installed_plugins.json"));
-    const installed = registrations === null ? {} : parseConfig(registrations, join21(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical6(join21(home, ".claude/commands"));
+    const registrations = witness(join22(home, ".claude/plugins/installed_plugins.json"));
+    const installed = registrations === null ? {} : parseConfig(registrations, join22(home, ".claude/plugins/installed_plugins.json")).plugins;
+    const commands = canonical6(join22(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync18(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length)
+    if (lstatSync19(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync7(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id2, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -42063,16 +42218,16 @@ function resolveAgentDiscovery(options) {
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
       if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute16(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
-      const catalogText = witness(join21(market.source, ".agents/plugins/marketplace.json"));
+      const catalogText = witness(join22(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
         unresolved("marketplace catalog missing");
-      const catalog = parseConfig(catalogText, join21(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
+      const catalog = parseConfig(catalogText, join22(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve14(market.source, matches[0].source.path));
+      plugin(resolve15(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
-    if (witness(join21(home, ".config/opencode/opencode.jsonc")) !== null || witness(join21(home, ".config/opencode/config.json")) !== null)
+    if (witness(join22(home, ".config/opencode/opencode.jsonc")) !== null || witness(join22(home, ".config/opencode/config.json")) !== null)
       unresolved("additional config layers require review");
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
@@ -42081,14 +42236,17 @@ function resolveAgentDiscovery(options) {
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
-    const localPlugins = join21(home, ".config/opencode/plugins");
+    const localPlugins = join22(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync18(localPlugins, { throwIfNoEntry: false }) && readdirSync7(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync19(localPlugins, { throwIfNoEntry: false }) && readdirSync7(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
+  } else if (agent === "sumi") {
+    if ((config.plugin?.length ?? 0) > 0 || (config.plugins?.length ?? 0) > 0 || sources.some((source) => source.path !== canonical6(configPath) && source.path !== canonical6(join22(sumiConfigDirectory(home), "sumi.jsonc")) && source.sha256 !== null))
+      unresolved("external or foreign local plugins require review");
   } else if (agent === "hermes") {
-    for (const directory of [join21(home, ".hermes/plugins"), join21(home, ".hermes/hermes-agent")]) {
+    for (const directory of [join22(home, ".hermes/plugins"), join22(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync18(directory, { throwIfNoEntry: false }))
+      if (lstatSync19(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -42096,28 +42254,28 @@ function resolveAgentDiscovery(options) {
   } else if (agent === "gemini") {
     if (Object.keys(config.extensions ?? {}).length || config.skills?.paths?.length)
       unresolved("custom extension or skill paths");
-    const directory = join21(home, ".gemini/extensions");
+    const directory = join22(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync18(directory, { throwIfNoEntry: false }))
+    if (lstatSync19(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync7(directory)) {
-        const root2 = join21(directory, name);
+        const root2 = join22(directory, name);
         safe4(root2);
-        if (!lstatSync18(root2)?.isDirectory())
+        if (!lstatSync19(root2)?.isDirectory())
           continue;
-        const raw = witness(join21(root2, "gemini-extension.json"));
+        const raw = witness(join22(root2, "gemini-extension.json"));
         if (raw === null)
           unresolved("extension registration missing");
-        const manifest = parseConfig(raw, join21(root2, "gemini-extension.json"));
-        if (manifest.hooks !== undefined || witness(join21(root2, "hooks/hooks.json")) !== null || witness(join21(root2, ".gemini-extension-install.json")) !== null)
+        const manifest = parseConfig(raw, join22(root2, "gemini-extension.json"));
+        if (manifest.hooks !== undefined || witness(join22(root2, "hooks/hooks.json")) !== null || witness(join22(root2, ".gemini-extension-install.json")) !== null)
           unresolved("extension hooks or linked registration require review");
-        roots.add(join21(root2, "skills"));
+        roots.add(join22(root2, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join21(home, ".hermes/plugins"), join21(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join22(home, ".hermes/plugins"), join22(home, ".hermes/hermes-agent")].map((path) => canonical6(path))) } : {} };
 }
 
 // src/lib/agent-adapters.ts
-var INTEGRATION_AGENTS = ["claude", "codex", "gemini", "opencode", "cursor", "hermes"];
+var INTEGRATION_AGENTS = ["claude", "codex", "gemini", "opencode", "cursor", "hermes", "sumi"];
 function renderAgentHookCommand(command, agent, profileId, event) {
   if (typeof profileId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(profileId) || profileId.includes(".."))
     throw new Error("Invalid selection profile id");
@@ -42128,6 +42286,7 @@ var AGENT_ADAPTERS = {
   codex: { root: ".codex/skills", config: ".codex/hooks.json", events: ["UserPromptSubmit", "SessionStart", "SubagentStart"], promptContext: true },
   gemini: { root: ".gemini/skills", config: ".gemini/settings.json", events: ["BeforeAgent", "SessionStart"], promptContext: true },
   opencode: { root: ".config/opencode/skills", config: ".config/opencode/opencode.json", events: ["chat.message"], promptContext: true },
+  sumi: { root: ".hasna-internal/sumi/config/skills", config: ".hasna-internal/sumi/config/sumi.json", events: ["prompt", "context"], promptContext: true },
   hermes: { root: ".hermes/skills", config: ".hermes/config.yaml", events: ["pre_llm_call", "pre_tool_call"], promptContext: true, promptFailureMode: "open", toolFailureMode: "supervised-child-errors-block", requiresNativeTrust: true },
   cursor: { root: ".cursor/skills", config: ".cursor/hooks.json", events: ["beforeSubmitPrompt", "sessionStart"], promptContext: false }
 };
@@ -42484,11 +42643,11 @@ function isSystemRootAlias(path) {
   const target = `/private${path}`, link = `private${path}`;
   const identity4 = (stat2) => `${stat2.dev}:${stat2.ino}:${stat2.ctimeNs}:${stat2.uid}:${stat2.mode}`;
   try {
-    const before = lstatSync19(path, { bigint: true });
+    const before = lstatSync20(path, { bigint: true });
     if (!before.isSymbolicLink() || before.uid !== 0n || readlinkSync4(path) !== link)
       return false;
     const directories = ["/", "/private", target].map((directory) => {
-      const stat2 = lstatSync19(directory, { bigint: true });
+      const stat2 = lstatSync20(directory, { bigint: true });
       if (!stat2.isDirectory() || stat2.uid !== 0n)
         throw new Error("Untrusted system alias directory");
       if (directory !== "/private/tmp") {
@@ -42505,23 +42664,23 @@ function isSystemRootAlias(path) {
       }
       return { directory, identity: identity4(stat2) };
     });
-    return realpathSync7(path) === target && readlinkSync4(path) === link && identity4(lstatSync19(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync19(item.directory, { bigint: true })) === item.identity);
+    return realpathSync8(path) === target && readlinkSync4(path) === link && identity4(lstatSync20(path, { bigint: true })) === identity4(before) && directories.every((item) => identity4(lstatSync20(item.directory, { bigint: true })) === item.identity);
   } catch {
     return false;
   }
 }
 function canonicalSystemPath(path) {
-  const absolute = resolve15(path), root2 = `/${absolute.split(sep5)[1]}`;
-  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root2) || !lstatSync19(root2, { throwIfNoEntry: false })?.isSymbolicLink())
+  const absolute = resolve16(path), root2 = `/${absolute.split(sep5)[1]}`;
+  if (process.platform !== "darwin" || !["/var", "/tmp", "/etc"].includes(root2) || !lstatSync20(root2, { throwIfNoEntry: false })?.isSymbolicLink())
     return absolute;
   if (!isSystemRootAlias(root2))
     throw new Error(`Refusing symlink path: ${root2}`);
   return `/private${absolute}`;
 }
 function assertSafePath(path) {
-  let cursor = resolve15(path);
+  let cursor = resolve16(path);
   while (true) {
-    if (lstatSync19(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
+    if (lstatSync20(cursor, { throwIfNoEntry: false })?.isSymbolicLink() && !isSystemRootAlias(cursor))
       throw new Error(`Refusing symlink path: ${cursor}`);
     const parent = dirname15(cursor);
     if (parent === cursor)
@@ -42531,16 +42690,16 @@ function assertSafePath(path) {
 }
 function readRootAlias(home, agent) {
   assertSafePath(home);
-  const realHome = realpathSync7(home), alias = join22(realHome, `.${agent}`);
-  const stat2 = lstatSync19(alias, { throwIfNoEntry: false, bigint: true });
+  const realHome = realpathSync8(home), alias = join23(realHome, `.${agent}`);
+  const stat2 = lstatSync20(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat2?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync4(alias), targetPath = resolve15(dirname15(alias), link);
+  const link = readlinkSync4(alias), targetPath = resolve16(dirname15(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync19(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync20(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
-  const target = realpathSync7(targetPath), inside = relative4(realHome, target);
+  const target = realpathSync8(targetPath), inside = relative4(realHome, target);
   if (!inside || inside === ".." || inside.startsWith(`..${sep5}`) || isAbsolute17(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link, aliasIdentity: `${stat2.dev}:${stat2.ino}:${stat2.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
@@ -42550,7 +42709,7 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync19(join22(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync20(join23(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep5) || other.target.startsWith(item.target + sep5))))
     throw new Error("Agent root alias targets must not overlap");
@@ -42558,7 +42717,7 @@ function rootAliases(home, allowed = false) {
 }
 function canonicalAgentPath(path, aliases) {
   const absolute = canonicalSystemPath(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep5));
-  return binding ? join22(binding.target, relative4(binding.alias, absolute)) : absolute;
+  return binding ? join23(binding.target, relative4(binding.alias, absolute)) : absolute;
 }
 function disabledCodexSkillPaths(config, aliases) {
   const skills = config.skills;
@@ -42577,7 +42736,7 @@ function disabledCodexSkillPaths(config, aliases) {
       continue;
     let document2;
     try {
-      document2 = realpathSync7(canonicalAgentPath(entry.path, aliases));
+      document2 = realpathSync8(canonicalAgentPath(entry.path, aliases));
     } catch {
       continue;
     }
@@ -42589,7 +42748,7 @@ function disabledCodexSkillPaths(config, aliases) {
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
-    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join22(binding.home, `.${binding.agent}`))
+    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join23(binding.home, `.${binding.agent}`))
       throw new Error("Invalid agent root alias binding");
     const current = readRootAlias(binding.home, binding.agent);
     if (JSON.stringify(current) !== JSON.stringify(binding))
@@ -42598,7 +42757,7 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync19(path);
+  const before = lstatSync20(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
   const descriptor = openSync16(path, constants12.O_RDONLY | constants12.O_NOFOLLOW | constants12.O_NONBLOCK);
@@ -42614,7 +42773,7 @@ function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
         break;
       length += count;
     }
-    const after = fstatSync16(descriptor), current = lstatSync19(path);
+    const after = fstatSync16(descriptor), current = lstatSync20(path);
     if (current.dev !== opened.dev || current.ino !== opened.ino || current.size !== after.size || current.mtimeMs !== after.mtimeMs || current.ctimeMs !== after.ctimeMs || length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
@@ -42626,14 +42785,14 @@ function treeHash(root2) {
   const hash2 = createHash18("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat2 = lstatSync19(path);
+    const stat2 = lstatSync20(path);
     if (stat2.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative4(root2, path);
     if (stat2.isDirectory()) {
       hash2.update(`d\x00${rel}\x00`);
       for (const name of readdirSync8(path).sort())
-        visit2(join22(path, name));
+        visit2(join23(path, name));
       return;
     }
     if (!stat2.isFile())
@@ -42655,10 +42814,10 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const identities = new Set;
   const selected = [];
   for (const target of manifest.targets) {
-    if (!isAbsolute17(target.projectRoot) || resolve15(target.projectRoot) !== target.projectRoot)
+    if (!isAbsolute17(target.projectRoot) || resolve16(target.projectRoot) !== target.projectRoot)
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
-    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative4(projectRoot, resolve15(projectRoot, target.path));
-    if (!existsSync6(projectRoot) || !lstatSync19(projectRoot).isDirectory())
+    const projectRoot = canonicalSystemPath(target.projectRoot), normalized = relative4(projectRoot, resolve16(projectRoot, target.path));
+    if (!existsSync7(projectRoot) || !lstatSync20(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute17(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep5}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
@@ -42667,8 +42826,8 @@ function selectNativeMigrationTargets(inventory, manifest) {
     if (identities.has(identity4))
       throw new Error(`Duplicate native migration target: ${target.path}`);
     identities.add(identity4);
-    const expected = canonicalSystemPath(resolve15(target.projectRoot, target.path));
-    const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve15(entry2.path) === expected);
+    const expected = canonicalSystemPath(resolve16(target.projectRoot, target.path));
+    const matches = inventory.filter((entry2) => entry2.agent === target.agent && resolve16(entry2.path) === expected);
     if (matches.length !== 1)
       throw new Error(`Native migration target was not found exactly once: ${target.agent} ${target.projectRoot}/${target.path}`);
     const entry = matches[0];
@@ -42697,9 +42856,9 @@ function projectAncestorDirectories(projects) {
 }
 function inventoryNativeSkills(home = homedir3(), options = {}) {
   home = canonicalSystemPath(home);
-  if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute17(options.reviewedCacheAlias) || resolve15(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
+  if (options.reviewedCacheAlias !== undefined && (!options.includeVendor || !isAbsolute17(options.reviewedCacheAlias) || resolve16(options.reviewedCacheAlias) !== options.reviewedCacheAlias))
     throw new Error("A reviewed cache alias requires vendor inventory and an exact absolute path");
-  if (options.disabledVendorPaths?.some((path) => !isAbsolute17(path) || resolve15(path) !== path))
+  if (options.disabledVendorPaths?.some((path) => !isAbsolute17(path) || resolve16(path) !== path))
     throw new Error("Disabled vendor paths must be exact absolute paths");
   const reviewedCacheAlias = options.reviewedCacheAlias === undefined ? undefined : canonicalSystemPath(options.reviewedCacheAlias);
   const disabledVendorPaths = new Set((options.disabledVendorPaths ?? []).map(canonicalSystemPath));
@@ -42707,14 +42866,18 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   const selectedAgents = options.agents ? new Set(options.agents) : undefined;
   const includesAgent = (agent) => !selectedAgents || selectedAgents.has(agent);
   const rootDefinitions = selectedAgents ? ROOTS.filter(([agent, path]) => selectedAgents.has(agent) || selectedAgents.has("hermes") && agent === "codex" && path === ".agents/skills") : ROOTS;
-  const roots = rootDefinitions.map(([agent, path]) => [agent, canonicalAgentPath(join22(home, path), aliases)]);
-  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join22(home, adapter.root, CLI_BRIDGE_NAME), aliases));
+  const roots = rootDefinitions.map(([agent, path]) => [agent, canonicalAgentPath(join23(home, path), aliases)]);
+  const bridgePaths = Object.entries(AGENT_ADAPTERS).filter(([agent]) => agent !== "sumi" || includesAgent("sumi")).map(([agent, adapter]) => canonicalAgentPath(join23(agent === "sumi" ? sumiBridgeRoot(home) : join23(home, adapter.root), CLI_BRIDGE_NAME), aliases));
   for (const project of projectAncestorDirectories([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []])) {
     for (const [agent, path] of rootDefinitions)
-      roots.push([agent, canonicalAgentPath(join22(project, path), aliases)]);
+      roots.push([agent, canonicalAgentPath(join23(project, path), aliases)]);
+    if (selectedAgents?.has("sumi"))
+      for (const directory of [".claude", ".agents"])
+        for (const name of ["skill", "skills"])
+          roots.push(["sumi", canonicalAgentPath(join23(project, directory, name), aliases)]);
   }
   const installationInputs = options.codexInstallationInputRoots ?? [];
-  if (installationInputs.some((input) => resolve15(input) !== input || realpathSync7(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
+  if (installationInputs.some((input) => resolve16(input) !== input || realpathSync8(input) !== input || roots.some(([agent, path]) => agent === "codex" && (path === input || path.startsWith(input + sep5) || input.startsWith(path + sep5)))))
     throw new Error("Native installation input overlaps an unconditional skill-loading root");
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
@@ -42728,13 +42891,13 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   }
   let reviewedCacheAliasFound = false;
   function verifiedSiblingCacheAlias(agent, path, parent) {
-    const link = readlinkSync4(path), lexicalTarget = resolve15(parent, link);
+    const link = readlinkSync4(path), lexicalTarget = resolve16(parent, link);
     if (isAbsolute17(link) ? link !== lexicalTarget : dirname15(link) !== ".")
       return false;
     const target = canonicalSystemPath(lexicalTarget);
     if (dirname15(target) !== parent)
       return false;
-    if (!lstatSync19(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync20(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     if (!scan?.complete || scan.entries > maxAliasProofEntries)
@@ -42757,37 +42920,40 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     assertSafePath(path);
     if (configuredRoot && agent === "codex" && installationInputs.some((root2) => path === root2 || path.startsWith(`${root2}${sep5}`)))
       return scan;
-    if (!existsSync6(path))
+    if (!existsSync7(path))
       return scan;
-    const stat2 = lstatSync19(path);
-    if (stat2.isFile())
+    const stat2 = lstatSync20(path);
+    if (stat2.isFile()) {
+      if (agent === "sumi" && depth === 1 && path.endsWith(".md"))
+        throw new Error("NATIVE_SKILL_DRIFT: flat Sumi skill documents require a dedicated migration adapter");
       return scan;
+    }
     if (!stat2.isDirectory())
       throw new Error(`Unsupported native discovery entry: ${path}`);
-    if (existsSync6(join22(path, "SKILL.md"))) {
+    if (existsSync7(join23(path, "SKILL.md"))) {
       scan.hasSkills = true;
       if (seen.has(path))
         return scan;
       seen.add(path);
       let managed = false;
-      const marker = join22(path, ".hasna-skills.json");
-      if (existsSync6(marker)) {
+      const marker = join23(path, ".hasna-skills.json");
+      if (existsSync7(marker)) {
         try {
           managed = JSON.parse(readFileSync14(marker, "utf8")).managedBy === "@hasna/skills";
         } catch {}
       }
-      const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
+      const bridge = (!vendor || agent === "sumi") && isOwnedCliBridge(path, bridgePaths);
       const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep5));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join22(home, ".codex", "skills", ".system"), aliases) + sep5) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve15(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join23(home, ".codex", "skills", ".system"), aliases) + sep5) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve16(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
-    if (depth > (vendor ? 32 : 3))
+    if (depth > (agent === "sumi" ? 32 : vendor ? 32 : 3))
       return { ...scan, complete: false };
     const children = [], directory = opendirSync5(path);
     try {
       let child;
       while ((child = directory.readSync()) !== null) {
-        admit(join22(path, child.name));
+        admit(join23(path, child.name));
         children.push(child);
       }
     } finally {
@@ -42799,13 +42965,13 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     for (const { name } of children) {
       if (name === "node_modules")
         continue;
-      if (name.startsWith(".") && name !== ".system" && agent !== "hermes" && !(options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`)))
+      if (name.startsWith(".") && name !== ".system" && agent !== "hermes" && agent !== "sumi" && !(options.guardHermes && `${path}${sep5}`.includes(`${sep5}.agents${sep5}skills${sep5}`)))
         continue;
       const isVendor = vendor || name === ".system";
       if (isVendor && !options.includeVendor)
         continue;
-      const child = join22(path, name);
-      if (isVendor && lstatSync19(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      const child = join23(path, name);
+      if (isVendor && lstatSync20(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync6(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && verifiedSiblingCacheAlias(agent, child, path)) {
           scan.entries++;
@@ -42831,11 +42997,11 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     scanRoot(agent, path);
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"].filter(includesAgent))
-      scanRoot(agent, canonicalAgentPath(join22(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+      scanRoot(agent, canonicalAgentPath(join23(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
     if (includesAgent("claude"))
-      scanRoot("claude", canonicalAgentPath(join22(home, ".claude", "plugins", "synced"), aliases), true);
+      scanRoot("claude", canonicalAgentPath(join23(home, ".claude", "plugins", "synced"), aliases), true);
     if (includesAgent("gemini"))
-      scanRoot("gemini", join22(home, ".gemini", "extensions"), true);
+      scanRoot("gemini", join23(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.filter(includesAgent).flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root2 of [...options.agentRoots ?? [], ...configured])
@@ -42848,7 +43014,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
 }
 function readOptional(path) {
   assertSafePath(path);
-  return existsSync6(path) ? readFileSync14(path, "utf8") : null;
+  return existsSync7(path) ? readFileSync14(path, "utf8") : null;
 }
 function jsonObject(text2, path) {
   if (text2 === null)
@@ -42948,19 +43114,19 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
   let result = normalizeCodexInlinePathConfig(bundled);
-  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve15(bridgePath), resolve15(join22(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
+  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve16(bridgePath), resolve16(join23(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
     throw new Error("Codex skill controls require one path or name selector per [[skills.config]] entry; review ambiguous entries before running skills hook install");
   const bridgeNeedsRepair = previousConfig?.some((entry) => entry.enabled === false && bridgeSelector(entry));
   const selections = [...skills.filter((entry) => entry.agent === "codex" && !entry.bridge).map((skill) => ({ path: skill.path, enabled: false })), { path: bridgePath, enabled: true }];
   for (const skill of selections) {
-    const path = join22(skill.path, "SKILL.md");
+    const path = join23(skill.path, "SKILL.md");
     let found = false;
     result = result.replace(CODEX_SKILL_CONFIG_SECTIONS, (section) => {
       const parsed = Bun.TOML.parse(section);
       const declared = parsed.skills?.config?.[0];
-      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve15(path), resolve15(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
+      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve16(path), resolve16(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
         return section;
       found = true;
       return /^\s*enabled\s*=/m.test(section) ? section.replace(/^\s*enabled\s*=.*$/m, `enabled = ${skill.enabled}`) : `${section.trimEnd()}
@@ -42981,14 +43147,14 @@ enabled = false
   return result;
 }
 function assertCodexInstallationInputs(home, projectDirs, inputs) {
-  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve15(directory, path)));
+  const nativeRoots = [home, ...projectAncestorDirectories(projectDirs)].flatMap((directory) => ROOTS.filter(([agent]) => agent === "codex").map(([, path]) => resolve16(directory, path)));
   if (inputs.some((input) => nativeRoots.some((root2) => root2 === input || root2.startsWith(input + sep5) || input.startsWith(root2 + sep5))))
     throw new Error("Native installation input overlaps an unconditional skill-loading root");
 }
 function planAgentIntegration(options) {
   const home = options.home ?? homedir3(), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const aliases = rootAliases(home, options.allowRootAliases);
-  const policyPath = join22(dataDir2, "agent-policy.json");
+  const policyPath = join23(dataDir2, "agent-policy.json");
   assertSafePath(policyPath);
   const priorSnapshot = readManagedSkillPolicySnapshot(dataDir2), previousPolicy = priorSnapshot?.text ?? null, policy = priorSnapshot?.value ?? {};
   if (policy.bridge !== undefined && (!policy.bridge || typeof policy.bridge !== "object" || Array.isArray(policy.bridge)))
@@ -43020,10 +43186,10 @@ function planAgentIntegration(options) {
     }
     return resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, retainedReview, canonical: (path) => canonicalAgentPath(path, aliases) });
   });
-  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join22(home, ".codex", "config.toml"), aliases)) ?? "") : {};
+  const codexConfig = options.agents.includes("codex") ? Bun.TOML.parse(readOptional(canonicalAgentPath(join23(home, ".codex", "config.toml"), aliases)) ?? "") : {};
   const nativeSkills = inventoryNativeSkills(home, { includeVendor: true, guardHermes: options.agents.includes("hermes"), agents: options.agents, projectDir: options.projectDir, agentRoots: discoveries.flatMap((binding) => binding.roots.map((path) => ({ agent: binding.agent, path }))), allowRootAliases: options.allowRootAliases, reviewedCacheAlias: options.reviewedCacheAlias, disabledVendorPaths: disabledCodexSkillPaths(codexConfig, aliases) });
   const observedNativeSources = [];
-  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join22(entry.path, "SKILL.md")), canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), resolve15(options.projectDir ?? home), (path) => {
+  const codexPluginControls = options.codexNativeCatalog ? reviewCodexPluginControls(options.codexNativeCatalog, nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor).map((entry) => join23(entry.path, "SKILL.md")), canonicalAgentPath(join23(home, ".codex/plugins/cache"), aliases), resolve16(options.projectDir ?? home), (path) => {
     const bytes = readNativeBytes(path, 1024 * 1024);
     observedNativeSources.push({ path, sha256: sha4(bytes) });
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
@@ -43031,7 +43197,7 @@ function planAgentIntegration(options) {
   const codexPluginSkills = codexPluginControls.skills;
   const codexInactivePlugins = codexPluginControls.inactivePlugins;
   const codexDiscovery = discoveries.find((binding) => binding.agent === "codex");
-  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root2 + sep5)) && codexDiscovery.sources.some((source) => source.path === join22(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
+  const codexPluginSourceInputs = codexPluginControls.sourceInputs.filter((input) => codexDiscovery?.method === "reviewed" && codexDiscovery.roots.some((root2) => root2 === input.sourceRoot || root2.startsWith(input.sourceRoot + sep5) || input.sourceRoot.startsWith(root2 + sep5)) && codexDiscovery.sources.some((source) => source.path === join23(input.sourceRoot, ".codex-plugin/plugin.json") && source.sha256 !== null && source.format === undefined && source.fields === undefined));
   assertCodexInstallationInputs(home, [options.projectDir ?? home], codexPluginSourceInputs.map((input) => input.sourceRoot));
   const changes = [];
   for (const agent of [...new Set(options.agents)]) {
@@ -43039,19 +43205,19 @@ function planAgentIntegration(options) {
       throw new Error(`Unsupported agent: ${agent}`);
     const { command, profileId: profileId2 } = bindings.get(agent);
     const adapter = AGENT_ADAPTERS[agent];
-    const bridgePath = canonicalAgentPath(join22(home, adapter.root, CLI_BRIDGE_NAME), aliases);
+    const bridgePath = canonicalAgentPath(join23(agent === "sumi" ? sumiBridgeRoot(home) : join23(home, adapter.root), CLI_BRIDGE_NAME), aliases);
     assertSafePath(bridgePath);
-    if (existsSync6(bridgePath) && !isOwnedCliBridge(bridgePath, [bridgePath]))
+    if (existsSync7(bridgePath) && !isOwnedCliBridge(bridgePath, [bridgePath]))
       throw new Error(`Refusing to overwrite an unrecognized or modified Skills bridge: ${bridgePath}`);
     for (const [name, after2] of Object.entries(CLI_BRIDGE_FILES)) {
-      const path2 = join22(bridgePath, name), before2 = readOptional(path2);
+      const path2 = join23(bridgePath, name), before2 = readOptional(path2);
       if (before2 !== after2)
         changes.push({ path: path2, before: before2, after: after2 });
     }
-    const path = canonicalAgentPath(join22(home, adapter.config), aliases);
+    const path = canonicalAgentPath(agent === "sumi" ? sumiConfigPath(home) : join23(home, adapter.config), aliases);
     const before = readOptional(path);
     if (agent === "hermes") {
-      const supervisorPath = join22(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(command, profileId2);
+      const supervisorPath = join23(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(command, profileId2);
       const priorCommand = policy.bridge?.commands?.hermes, priorProfile = policy.bridge?.profiles?.hermes ?? policy.profileId;
       const previous = policy.bridge?.supervisors?.hermes;
       if (supervisorBefore !== null && supervisorBefore !== supervisorAfter && !(previous?.path === supervisorPath && typeof priorCommand === "string" && typeof priorProfile === "string" && supervisorBefore === renderHermesSupervisor(priorCommand, priorProfile)))
@@ -43062,19 +43228,30 @@ function planAgentIntegration(options) {
       const after2 = configureHermesHooks(before, supervisor, previous);
       if (before !== after2)
         changes.push({ path, before, after: after2 });
-      const optOut = join22(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
+      const optOut = join23(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
       if (optOutBefore === null)
         changes.push({ path: optOut, before: null, after: `Managed by @hasna/skills: bundled native skill reseeding is disabled.
 ` });
       continue;
     }
     const config = jsonObject(before, path);
-    if (agent === "opencode") {
+    if (agent === "sumi") {
+      if (config.permissions !== undefined && (!Array.isArray(config.permissions) || config.permissions.some((rule) => !rule || typeof rule.action !== "string" || typeof rule.resource !== "string" || !["allow", "deny", "ask"].includes(rule.effect))))
+        throw new Error("Expected Sumi native permission rules");
+      config.permissions = [...(config.permissions ?? []).filter((rule) => rule.action !== "skill"), ...SUMI_SKILL_PERMISSIONS];
+      const pluginPath = join23(sumiConfigDirectory(home), "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
+      const pluginAfter = renderSumiPlugin(command, profileId2);
+      const priorCommand = policy.bridge?.commands?.sumi, priorProfile = policy.bridge?.profiles?.sumi ?? policy.profileId;
+      if (pluginBefore !== null && pluginBefore !== pluginAfter && !(typeof priorCommand === "string" && typeof priorProfile === "string" && pluginBefore === renderSumiPlugin(priorCommand, priorProfile)))
+        throw new Error("Refusing to overwrite a modified Sumi Skills plugin; preserve and review it first");
+      if (pluginBefore !== pluginAfter)
+        changes.push({ path: pluginPath, before: pluginBefore, after: pluginAfter });
+    } else if (agent === "opencode") {
       const permission = config.permission ?? {};
       if (!permission || typeof permission !== "object" || Array.isArray(permission))
         throw new Error("Expected OpenCode permission object");
       config.permission = { ...permission, skill: { "*": "deny", [CLI_BRIDGE_NAME]: "allow" } };
-      const pluginPath = join22(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
+      const pluginPath = join23(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
       const pluginAfter = renderOpenCodePlugin(command, profileId2);
       const priorCommand = policy.bridge?.commands?.opencode;
       const ownedPrevious = typeof priorCommand === "string" && typeof policy.profileId === "string" && pluginBefore === renderOpenCodePlugin(priorCommand, policy.bridge?.profiles?.opencode ?? policy.profileId);
@@ -43091,13 +43268,13 @@ function planAgentIntegration(options) {
     if (before !== after)
       changes.push({ path, before, after });
     if (agent === "codex") {
-      const configPath = canonicalAgentPath(join22(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
+      const configPath = canonicalAgentPath(join23(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
       const next = disableReviewedCodexPluginNames(disableCodexSkills(previous ?? "", nativeSkills, aliases, bridgePath), codexPluginSkills);
       if (next !== (previous ?? ""))
         changes.push({ path: configPath, before: previous, after: next });
     }
   }
-  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha4(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join22(home, ".codex/config.toml"), aliases))?.before === null ? null : sha4(readOptional(canonicalAgentPath(join22(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
+  const codexPluginSkillReview = options.codexNativeCatalog ? { version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, catalogSha256: sha4(JSON.stringify({ version: options.codexNativeCatalog.version, cwd: options.codexNativeCatalog.cwd, skills: projectCodexNativeSkillCatalog({ data: [{ cwd: options.codexNativeCatalog.cwd, errors: [], skills: options.codexNativeCatalog.skills }] }, options.codexNativeCatalog.cwd), ...options.codexNativeCatalog.plugins === undefined ? {} : { plugins: projectCodexInstalledPluginEntries(options.codexNativeCatalog.plugins) } })), configSha256: changes.find((change) => change.path === canonicalAgentPath(join23(home, ".codex/config.toml"), aliases))?.before === null ? null : sha4(readOptional(canonicalAgentPath(join23(home, ".codex/config.toml"), aliases)) ?? "") } : policy.bridge?.codexPluginSkillReview;
   const discoveryAfter = discoveries.map((binding) => {
     const rebound = rebindAgentDiscovery(binding, new Map(changes.map((change) => [change.path, change.after])));
     if (binding.agent !== "codex")
@@ -43112,12 +43289,12 @@ function planAgentIntegration(options) {
     version: CLI_BRIDGE_VERSION,
     digest: CLI_BRIDGE_DIGEST,
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
-    home: resolve15(home),
+    home: resolve16(home),
     includeVendor: true,
-    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join22(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha4(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
+    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join23(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha4(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries([...bindings].map(([agent, binding]) => [agent, binding.command])) },
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
-    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join22(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
+    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join23(home, ".codex", "skills", ".system"), aliases) + sep5)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
     ...options.codexNativeCatalog || codexPluginSkills.length || codexInactivePlugins.length || codexPluginSourceInputs.length ? { codexPluginSkills, codexInactivePlugins, codexPluginSkillReview } : {},
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
@@ -43140,7 +43317,7 @@ function claudeSettingsConsumers(home, path, discoveries, aliases) {
     const distance = relative4(canonical6(root2), path);
     return distance === "" || distance !== ".." && !distance.startsWith(`..${sep5}`) && !isAbsolute17(distance);
   };
-  return discoveries.filter((binding) => binding.agent === "claude" || binding.agent === "opencode" || canonical6(join22(home, AGENT_ADAPTERS[binding.agent].config)) === path || binding.sources.some((source) => canonical6(source.path) === path) || binding.roots.some(containsSettings) || binding.directories?.some((directory) => containsSettings(directory.path))).map((binding) => binding.agent);
+  return discoveries.filter((binding) => binding.agent === "claude" || binding.agent === "opencode" || canonical6(join23(home, AGENT_ADAPTERS[binding.agent].config)) === path || binding.sources.some((source) => canonical6(source.path) === path) || binding.roots.some(containsSettings) || binding.directories?.some((directory) => containsSettings(directory.path))).map((binding) => binding.agent);
 }
 function verifyCoordinatedDiscovery(binding, home, aliases) {
   try {
@@ -43157,8 +43334,8 @@ function verifyCoordinatedDiscovery(binding, home, aliases) {
   }
 }
 function planClaudeHookEventsUpdate(options) {
-  const home = resolve15(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
-  const policyPath = join22(dataDir2, "agent-policy.json");
+  const home = resolve16(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const policyPath = join23(dataDir2, "agent-policy.json");
   assertSafePath(policyPath);
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot2)
@@ -43169,9 +43346,9 @@ function planClaudeHookEventsUpdate(options) {
   }
   const aliases = bridge.rootAliases ?? [];
   recheckRootAliases(aliases);
-  const path = canonicalAgentPath(join22(home, ".claude", "settings.json"), aliases);
+  const path = canonicalAgentPath(join23(home, ".claude", "settings.json"), aliases);
   assertSafePath(path);
-  const before = lstatSync19(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
+  const before = lstatSync20(path, { throwIfNoEntry: false }) ? new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readNativeBytes(path, 1024 * 1024)) : null;
   if ((before === null ? "absent" : sha4(before)) !== options.expectedSettingsSha256)
     throw new Error("Claude settings preimage changed");
   assertClaudeHookEventsReplacement(before, options.replacement, options.events);
@@ -43231,14 +43408,14 @@ function atomicWrite2(path, content) {
     writeFileSync4(temporary, content, { mode: 384, flag: "wx" });
     renameSync3(temporary, path);
   } finally {
-    if (existsSync6(temporary))
+    if (existsSync7(temporary))
       unlinkSync4(temporary);
   }
 }
 function planAgentSettingsWitnessUpgrade(options) {
   if (options.targetCodexVersion !== undefined && (options.agent !== "codex" || ![2, 3].includes(options.targetCodexVersion)))
     throw new Error("Invalid Codex witness target version");
-  const home = resolve15(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  const home = resolve16(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot2 || sha4(snapshot2.text) !== options.expectedPolicySha256)
     throw new Error("Managed policy preimage changed");
@@ -43247,7 +43424,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   const binding = policy.bridge?.discovery?.[options.agent];
   if (!binding || binding.agent !== options.agent || binding.method !== "reviewed")
     throw new Error("Settings witness upgrade requires an existing reviewed native binding");
-  const configPath = canonicalAgentPath(join22(home, options.agent === "claude" ? ".claude/settings.json" : ".codex/config.toml"), aliases);
+  const configPath = canonicalAgentPath(join23(home, options.agent === "claude" ? ".claude/settings.json" : ".codex/config.toml"), aliases);
   const settings = readOptional(configPath);
   if (settings === null || sha4(settings) !== options.expectedSettingsSha256)
     throw new Error("Native settings preimage changed");
@@ -43286,7 +43463,7 @@ function planAgentSettingsWitnessUpgrade(options) {
   const replacement = { ...binding, sources: rebound };
   verifyAgentDiscovery(replacement);
   const after = serializeManagedSkillPolicy({ ...policy, bridge: { ...policy.bridge, discovery: { ...policy.bridge.discovery, [options.agent]: replacement } } });
-  return { dataDir: dataDir2, profileId: policy.profileId, changes: [{ path: join22(dataDir2, "agent-policy.json"), before: snapshot2.text, after }], nativeSkills: [], observedPolicy: { path: join22(dataDir2, "agent-policy.json"), before: snapshot2.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
+  return { dataDir: dataDir2, profileId: policy.profileId, changes: [{ path: join23(dataDir2, "agent-policy.json"), before: snapshot2.text, after }], nativeSkills: [], observedPolicy: { path: join23(dataDir2, "agent-policy.json"), before: snapshot2.text }, observedSettings: { path: configPath, before: settings }, discoveryBefore: [replacement], discoveryAfter: [replacement], rootAliases: aliases, managedAgentChecks: { home, agents: [options.agent] }, settingsWitnessUpgrade: { agent: options.agent, path: configPath, fromHashMode: previous.hashMode ?? "bytes", fromSha256: previous.sha256, toHashMode: next.hashMode, toSha256: next.sha256, reviewedPreimage: options.reviewedPreimage, currentSettingsSha256: options.expectedSettingsSha256, replacedWitnesses: replaced.map((source) => ({ hashMode: source.hashMode ?? "bytes", sha256: source.sha256 })) } };
 }
 function applyAgentIntegration(plan) {
   for (const source of plan.observedNativeSources ?? [])
@@ -43294,12 +43471,12 @@ function applyAgentIntegration(plan) {
       throw new Error("Native identity source changed after planning");
   if (plan.observedSettings && readOptional(plan.observedSettings.path) !== plan.observedSettings.before)
     throw new Error("Native settings changed after witness planning");
-  const policyPath = join22(plan.dataDir, "agent-policy.json");
+  const policyPath = join23(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve15(path) === resolve15(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve16(path) === resolve16(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve15(change.path) === resolve15(policyPath))
+    if (resolve16(change.path) === resolve16(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
@@ -43328,7 +43505,7 @@ function applyAgentIntegration(plan) {
   for (const change of plan.changes)
     if (currentText(change.path) !== change.before)
       throw new Error(`Configuration changed after planning: ${change.path}`);
-  const backupRoot = join22(plan.dataDir, "migration", randomUUID3()), backups = [], written = [], createdDirectories = new Set;
+  const backupRoot = join23(plan.dataDir, "migration", randomUUID3()), backups = [], written = [], createdDirectories = new Set;
   if (!plan.changes.length) {
     recheckRootAliases(aliases);
     return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
@@ -43338,7 +43515,7 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join22(backupRoot, `${index}-${sha4(change.path).slice(0, 12)}.backup`);
+      const backup = join23(backupRoot, `${index}-${sha4(change.path).slice(0, 12)}.backup`);
       writeFileSync4(backup, change.before, { mode: 384, flag: "wx" });
       if (readFileSync14(backup, "utf8") !== change.before)
         throw new Error("Native configuration preservation readback failed");
@@ -43349,7 +43526,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname15(change.path);!existsSync6(directory); directory = dirname15(directory))
+      for (let directory = dirname15(change.path);!existsSync7(directory); directory = dirname15(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -43369,7 +43546,7 @@ function applyAgentIntegration(plan) {
     }
     for (const agent of plan.managedAgentChecks?.agents ?? [])
       assertManagedAgentBridge(agent, { home: plan.managedAgentChecks.home, dataDir: plan.dataDir, projectDir: plan.managedAgentChecks.home });
-    atomicWrite2(join22(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha4(change.before), afterHash: sha4(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join23(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha4(change.before), afterHash: sha4(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -43423,7 +43600,7 @@ function writeArchiveJournal(path, value) {
   } finally {
     if (descriptor !== undefined)
       closeSync16(descriptor);
-    if (lstatSync19(temporary, { throwIfNoEntry: false }))
+    if (lstatSync20(temporary, { throwIfNoEntry: false }))
       unlinkSync4(temporary);
   }
 }
@@ -43434,7 +43611,7 @@ function archiveNativeSkills(inventory, options) {
   recheckRootAliases(aliases);
   for (const entry of inventory.filter((entry2) => entry2.bridge)) {
     const adapter = AGENT_ADAPTERS[entry.agent];
-    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join22(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
+    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join23(entry.agent === "sumi" ? sumiBridgeRoot(entry.bridgeHome) : join23(entry.bridgeHome, adapter.root), CLI_BRIDGE_NAME), aliases) : undefined;
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
@@ -43445,11 +43622,11 @@ function archiveNativeSkills(inventory, options) {
   const targetManifest = options.targetManifest ? { schema: options.targetManifest.schema, digest: options.targetManifest.digest, targetCount: options.targetManifest.targets.length } : undefined;
   if (!selected.length)
     return { entries: [], ...targetManifest ? { targetManifest } : {}, ...aliases.length ? { rootAliases: aliases } : {} };
-  const operationId = randomUUID3(), archiveRoot = join22(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join22(archiveRoot, "receipt.json");
+  const operationId = randomUUID3(), archiveRoot = join23(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join23(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
-    source: entry.vendor ? join22(entry.path, "SKILL.md") : entry.path,
-    archive: join22(archiveRoot, `${index}-${sha4(entry.path).slice(0, 12)}`),
-    hash: entry.vendor ? sha4(readNativeBytes(join22(entry.path, "SKILL.md"))) : entry.hash,
+    source: entry.vendor ? join23(entry.path, "SKILL.md") : entry.path,
+    archive: join23(archiveRoot, `${index}-${sha4(entry.path).slice(0, 12)}`),
+    hash: entry.vendor ? sha4(readNativeBytes(join23(entry.path, "SKILL.md"))) : entry.hash,
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
@@ -43457,7 +43634,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat2 = lstatSync19(entry.archive);
+    const stat2 = lstatSync20(entry.archive);
     if (entry.discoveryOnly ? !stat2.isFile() : !stat2.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha4(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -43465,7 +43642,7 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync6(path); path = dirname15(path))
+  for (let path = archiveRoot;!existsSync7(path); path = dirname15(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
@@ -43505,7 +43682,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync19(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync20(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -43522,7 +43699,7 @@ function archiveNativeSkills(inventory, options) {
           syncArchiveDirectory(dirname15(entry.source));
           unlinkSync4(entry.archive);
         } else {
-          if (lstatSync19(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync20(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -43553,8 +43730,8 @@ function assertManagedAgentBridge(agent, options = {}) {
   assertManagedAgentBridgeWithDiscovery(agent, options);
 }
 function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscovery) {
-  const home = resolve15(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
-  assertSafePath(join22(dataDir2, "agent-policy.json"));
+  const home = resolve16(options.home ?? homedir3()), dataDir2 = options.dataDir ?? getDataDirReadOnly();
+  assertSafePath(join23(dataDir2, "agent-policy.json"));
   const snapshot2 = readManagedSkillPolicySnapshot(dataDir2);
   if (!snapshot2)
     throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
@@ -43565,14 +43742,14 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   if (!Array.isArray(aliases))
     throw new Error("NATIVE_SKILL_DRIFT: invalid root alias binding");
   recheckRootAliases(aliases);
-  const expected = canonicalAgentPath(join22(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
+  const expected = canonicalAgentPath(join23(agent === "sumi" ? sumiBridgeRoot(home) : join23(home, AGENT_ADAPTERS[agent].root), CLI_BRIDGE_NAME), aliases);
   if (!isOwnedCliBridge(expected, [expected]))
     throw new Error("NATIVE_SKILL_DRIFT: the native Skills bridge is missing or modified; repair it before continuing");
   const roots = projectAncestorDirectories([options.projectDir ?? process.cwd(), ...options.projectDirs ?? [], ...agent === "hermes" && process.env.TERMINAL_CWD ? [process.cwd()] : []]);
-  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep5}.agents${sep5}skills${sep5}`) || agent === "opencode" && entry.agent === "claude";
+  const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes", "sumi"].includes(agent) && entry.path.includes(`${sep5}.agents${sep5}skills${sep5}`) || ["opencode", "sumi"].includes(agent) && entry.agent === "claude";
   const discovery = provenDiscovery ?? binding.discovery?.[agent];
   assertProjectDiscovery(agent, [...roots], home, (path) => canonicalAgentPath(path, aliases), discovery);
-  const configPath = canonicalAgentPath(join22(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
+  const configPath = canonicalAgentPath(agent === "sumi" ? sumiConfigPath(home) : join23(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
   const command = binding.commands?.[agent], profile = binding.profiles?.[agent];
   if (typeof command !== "string" || typeof profile !== "string")
     throw new Error("NATIVE_SKILL_DRIFT: the native hook command/profile binding is missing");
@@ -43580,11 +43757,14 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: the hook selection profile differs from its managed binding; restart the native client after reviewing skills hook install");
   if (agent === "hermes") {
     const supervisor = binding.supervisors?.hermes;
-    if (supervisor?.path !== join22(dataDir2, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha4(renderHermesSupervisor(command, profile)))
+    if (supervisor?.path !== join23(dataDir2, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha4(renderHermesSupervisor(command, profile)))
       throw new Error("NATIVE_SKILL_DRIFT: Hermes supervisor binding changed; run skills hook install");
     assertHermesProtection(home, config, command, profile, supervisor);
+  } else if (agent === "sumi") {
+    if (JSON.stringify(config.permissions?.filter((rule) => rule.action === "skill")) !== JSON.stringify(SUMI_SKILL_PERMISSIONS) || readOptional(join23(sumiConfigDirectory(home), "plugins", "skills-cli.js")) !== renderSumiPlugin(command, profile))
+      throw new Error("NATIVE_SKILL_DRIFT: Sumi bridge protection changed; run skills hook install");
   } else if (agent === "opencode") {
-    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join22(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
+    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join23(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
       throw new Error("NATIVE_SKILL_DRIFT: OpenCode bridge protection changed; run skills hook install");
   } else {
     const required = {};
@@ -43601,21 +43781,21 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     if (agent === "gemini" && (config.hooksConfig?.enabled === false || config.skills?.enabled !== true || !["antigravity-support", "skill-creator"].every((name) => config.skills?.disabled?.includes(name)) || config.skills?.disabled?.includes(CLI_BRIDGE_NAME)))
       throw new Error("NATIVE_SKILL_DRIFT: Gemini bridge or bundled-skill protection changed; run skills hook install");
   }
-  const codexPath = canonicalAgentPath(join22(home, ".codex", "config.toml"), aliases);
+  const codexPath = canonicalAgentPath(join23(home, ".codex", "config.toml"), aliases);
   if (options.codexDiscoveryRecovery && (agent !== "codex" || options.codexDiscoveryRecovery.configPath !== codexPath))
     throw new Error("NATIVE_SKILL_DRIFT: Codex trust recovery names a different configuration root");
   const codexConfig = agent === "codex" ? Bun.TOML.parse(readOptional(codexPath) ?? "") : {};
   if (agent === "codex" && codexConfig.skills?.bundled?.enabled !== false)
     throw new Error("NATIVE_SKILL_DRIFT: Codex bundled skill reseeding is not disabled (skills.bundled.enabled); run skills hook install");
-  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join22(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
+  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join23(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
   if (agent === "codex" && [...setting(expected), ...(codexConfig.skills?.config ?? []).filter((entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME)].some((entry) => entry.enabled === false))
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
-  if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
+  if (agent === "codex" && !reviewedCodexPluginCapabilitiesUnchanged(canonicalAgentPath(join23(home, ".codex/plugins/cache"), aliases), binding.codexPluginSkills ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024))))
     throw new Error("NATIVE_SKILL_DRIFT: reviewed native plugin capability controls changed; run skills hook install with a fresh discovery review");
   const disabledPlugin = (entry) => {
     if (agent !== "codex" || !entry.vendor)
       return false;
-    const document2 = join22(entry.path, "SKILL.md"), cache = canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), read3 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
+    const document2 = join23(entry.path, "SKILL.md"), cache = canonicalAgentPath(join23(home, ".codex/plugins/cache"), aliases), read3 = (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024));
     return isReviewedCodexPluginInactive(document2, cache, binding.codexInactivePlugins ?? [], codexConfig.plugins, codexConfig.skills?.config ?? [], read3) || isReviewedCodexPluginSkillDisabled(document2, cache, binding.codexPluginSkills ?? [], codexConfig.skills?.config, read3);
   };
   const disabledPaths = new Set(disabledCodexSkillPaths(codexConfig, aliases));
@@ -43628,15 +43808,15 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
       return true;
     if (!disabledPaths.has(entry.path))
       return false;
-    if (entry.path.startsWith(canonicalAgentPath(join22(home, ".codex", "plugins", "cache"), aliases) + sep5))
+    if (entry.path.startsWith(canonicalAgentPath(join23(home, ".codex", "plugins", "cache"), aliases) + sep5))
       return true;
-    const runtimeCache = canonicalAgentPath(join22(home, ".cache", "codex-runtimes"), aliases);
+    const runtimeCache = canonicalAgentPath(join23(home, ".cache", "codex-runtimes"), aliases);
     if (entry.path.startsWith(runtimeCache + sep5) && discovery?.method === "automatic" && discovery.roots.some((root2) => entry.path.startsWith(root2 + sep5)))
       return true;
-    const bundledMarketplaces = canonicalAgentPath(join22(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
+    const bundledMarketplaces = canonicalAgentPath(join23(home, ".codex", ".tmp", "bundled-marketplaces"), aliases);
     if (entry.path.startsWith(bundledMarketplaces + sep5) && discovery?.method === "automatic" && discovery.roots.some((root2) => entry.path.startsWith(root2 + sep5)))
       return true;
-    if (!entry.path.startsWith(canonicalAgentPath(join22(home, ".codex", "skills", ".system"), aliases) + sep5))
+    if (!entry.path.startsWith(canonicalAgentPath(join23(home, ".codex", "skills", ".system"), aliases) + sep5))
       return false;
     return Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
   };
@@ -43646,6 +43826,8 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
     throw new Error("NATIVE_SKILL_DRIFT: an installed Gemini builtin is not disabled");
   try {
     verifyAgentDiscovery(discovery, options.codexDiscoveryRecovery);
+    if (agent === "sumi" && discovery.method === "reviewed")
+      resolveAgentDiscovery({ home, agent, retainedReview: discovery, canonical: (path) => canonicalAgentPath(path, aliases) });
     if (discovery.method === "automatic") {
       const current = resolveAgentDiscovery({ home, agent, canonical: (path) => canonicalAgentPath(path, aliases) });
       if (JSON.stringify(current) !== JSON.stringify(discovery))
@@ -43657,7 +43839,7 @@ function assertManagedAgentBridgeWithDiscovery(agent, options = {}, provenDiscov
   let installationInputRoots = [];
   if (agent === "codex") {
     try {
-      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join22(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
+      installationInputRoots = reviewedCodexPluginSourceRoots(canonicalAgentPath(join23(home, ".codex/plugins/cache"), aliases), discovery.codexInstallationInputs?.plugins ?? [], (path) => new TextDecoder("utf-8", { fatal: true }).decode(readNativeBytes(path, 1024 * 1024)));
     } catch {
       throw new Error("NATIVE_SKILL_DRIFT: native installation input identity changed; review discovery and catalog");
     }
@@ -43681,25 +43863,25 @@ function assertNativeExportAllowed(dataDir2 = getDataDirReadOnly()) {
 
 // src/lib/portable-skills.ts
 import {
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   mkdirSync as mkdirSync7,
   mkdtempSync,
   readdirSync as readdirSync10,
-  realpathSync as realpathSync10,
+  realpathSync as realpathSync11,
   renameSync as renameSync4,
   rmSync as rmSync2,
   statSync as statSync9,
   writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename10, dirname as dirname18, isAbsolute as isAbsolute18, join as join26, normalize as normalize4, relative as relative6, resolve as resolve17, sep as sep8 } from "path";
+import { basename as basename10, dirname as dirname18, isAbsolute as isAbsolute18, join as join27, normalize as normalize4, relative as relative6, resolve as resolve18, sep as sep8 } from "path";
 
 // src/lib/registry-data/index.ts
 var SKILLS = [];
 
 // src/lib/skill-hash.ts
 import { createHash as createHash19 } from "crypto";
-import { existsSync as existsSync7, readdirSync as readdirSync9, readFileSync as readFileSync15, statSync as statSync7 } from "fs";
-import { join as join23, sep as sep6 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync9, readFileSync as readFileSync15, statSync as statSync7 } from "fs";
+import { join as join24, sep as sep6 } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
 function excludedHashEntry(name, directory) {
@@ -43761,8 +43943,8 @@ function collectBundleFiles(skillPath) {
     if (seen.has(entry))
       continue;
     seen.add(entry);
-    const absolute = join23(skillPath, entry);
-    if (!existsSync7(absolute))
+    const absolute = join24(skillPath, entry);
+    if (!existsSync8(absolute))
       continue;
     if (statSync7(absolute).isDirectory())
       collectDirectory(files, absolute, entry);
@@ -43775,7 +43957,7 @@ function collectDirectory(files, dir, rel) {
   for (const entry of readdirSync9(dir).sort()) {
     if (entry.startsWith("."))
       continue;
-    const absolute = join23(dir, entry);
+    const absolute = join24(dir, entry);
     const childRel = `${rel}/${entry}`;
     let stats;
     try {
@@ -43836,7 +44018,7 @@ async function hashBundleFilesCooperatively(files, check) {
       hash2.update(chunk);
       bytesSinceYield += chunk.byteLength;
       if (bytesSinceYield >= 256 * 1024) {
-        await new Promise((resolve16) => setImmediate(resolve16));
+        await new Promise((resolve17) => setImmediate(resolve17));
         bytesSinceYield = 0;
       }
     }
@@ -43989,7 +44171,7 @@ async function hashContentEntries(entries, options) {
     const normalized = [];
     let normalizedBytes = 0;
     let manifest;
-    await new Promise((resolve16) => setImmediate(resolve16));
+    await new Promise((resolve17) => setImmediate(resolve17));
     for (const entry of snapshot2) {
       check();
       if (!coveredContentPath(entry.path))
@@ -44002,7 +44184,7 @@ async function hashContentEntries(entries, options) {
         contentLimit("Content hash normalized byte limit exceeded");
       normalizedBytes += file.content.byteLength;
       normalized.push(file);
-      await new Promise((resolve16) => setImmediate(resolve16));
+      await new Promise((resolve17) => setImmediate(resolve17));
     }
     normalized.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
     check();
@@ -44209,14 +44391,14 @@ function validateRuntimeContract(manifest, issues, strict) {
 // src/lib/portable-skills-files.ts
 import {
   cpSync,
-  existsSync as existsSync8,
-  lstatSync as lstatSync20,
+  existsSync as existsSync9,
+  lstatSync as lstatSync21,
   mkdirSync as mkdirSync6,
   readFileSync as readFileSync16,
-  realpathSync as realpathSync8,
+  realpathSync as realpathSync9,
   writeFileSync as writeFileSync5
 } from "fs";
-import { basename as basename8, dirname as dirname16, join as join24, relative as relative5 } from "path";
+import { basename as basename8, dirname as dirname16, join as join25, relative as relative5 } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -44273,12 +44455,12 @@ function readPortableSkillManifestForImport(skillPath) {
   return readManifest(skillPath, basename8(skillPath), normalizeNewPortableSkillName);
 }
 function readManifest(skillPath, fallbackName, normalizeName) {
-  const skillJsonPath = join24(skillPath, "skill.json");
-  const skillMdPath = join24(skillPath, "SKILL.md");
-  const pkgPath = join24(skillPath, "package.json");
-  const jsonManifest = existsSync8(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
-  const frontmatter = existsSync8(skillMdPath) ? parseSkillFrontmatter(readFileSync16(skillMdPath, "utf-8")) ?? undefined : undefined;
-  const pkg = existsSync8(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  const skillJsonPath = join25(skillPath, "skill.json");
+  const skillMdPath = join25(skillPath, "SKILL.md");
+  const pkgPath = join25(skillPath, "package.json");
+  const jsonManifest = existsSync9(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync9(skillMdPath) ? parseSkillFrontmatter(readFileSync16(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync9(pkgPath) ? readJsonObject(pkgPath) : undefined;
   const name = normalizeName(stringField(jsonManifest, "name") ?? frontmatter?.name ?? stringValue(pkg?.name) ?? fallbackName);
   const description = stringField(jsonManifest, "description") ?? frontmatter?.description ?? stringValue(pkg?.description) ?? `${name} skill`;
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
@@ -44307,12 +44489,12 @@ function parseSkillKind(value) {
   return;
 }
 function readDeclaredSkillVersion(skillPath) {
-  const skillJsonPath = join24(skillPath, "skill.json");
-  const skillMdPath = join24(skillPath, "SKILL.md");
-  const pkgPath = join24(skillPath, "package.json");
-  const jsonManifest = existsSync8(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
-  const frontmatter = existsSync8(skillMdPath) ? parseSkillFrontmatter(readFileSync16(skillMdPath, "utf-8")) ?? undefined : undefined;
-  const pkg = existsSync8(pkgPath) ? readJsonObject(pkgPath) : undefined;
+  const skillJsonPath = join25(skillPath, "skill.json");
+  const skillMdPath = join25(skillPath, "SKILL.md");
+  const pkgPath = join25(skillPath, "package.json");
+  const jsonManifest = existsSync9(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
+  const frontmatter = existsSync9(skillMdPath) ? parseSkillFrontmatter(readFileSync16(skillMdPath, "utf-8")) ?? undefined : undefined;
+  const pkg = existsSync9(pkgPath) ? readJsonObject(pkgPath) : undefined;
   return stringField(jsonManifest, "version") ?? frontmatter?.version ?? stringValue(pkg?.version);
 }
 function createInstructionManifest(name, options) {
@@ -44333,7 +44515,7 @@ function createInstructionManifest(name, options) {
 }
 function writeInstructionSkillTemplate(skillPath, manifest) {
   mkdirSync6(skillPath, { recursive: true });
-  writeFileSync5(join24(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
+  writeFileSync5(join25(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function renderInstructionSkillMd(manifest) {
@@ -44383,12 +44565,12 @@ function createPortableManifest(name, options) {
   };
 }
 function writePortableSkillTemplate(skillPath, manifest) {
-  mkdirSync6(join24(skillPath, "src"), { recursive: true });
-  writeFileSync5(join24(skillPath, "SKILL.md"), renderSkillMd(manifest));
-  writeFileSync5(join24(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
-  writeFileSync5(join24(skillPath, "package.json"), renderPackageJson(manifest));
-  writeFileSync5(join24(skillPath, "tsconfig.json"), renderTsconfig());
-  writeFileSync5(join24(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
+  mkdirSync6(join25(skillPath, "src"), { recursive: true });
+  writeFileSync5(join25(skillPath, "SKILL.md"), renderSkillMd(manifest));
+  writeFileSync5(join25(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
+  writeFileSync5(join25(skillPath, "package.json"), renderPackageJson(manifest));
+  writeFileSync5(join25(skillPath, "tsconfig.json"), renderTsconfig());
+  writeFileSync5(join25(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function fillContractDefaults(manifest, entrypoint) {
@@ -44413,7 +44595,7 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: undefined
     }
   };
-  writeFileSync5(join24(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
+  writeFileSync5(join25(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
 `);
   const hash2 = computeContentHash(skillPath);
   const withHash = {
@@ -44423,13 +44605,13 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: hash2
     }
   };
-  writeFileSync5(join24(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
+  writeFileSync5(join25(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
 `);
   return withHash;
 }
 function readExistingSkillJson(skillPath) {
-  const path = join24(skillPath, "skill.json");
-  if (!existsSync8(path))
+  const path = join25(skillPath, "skill.json");
+  if (!existsSync9(path))
     return {};
   try {
     const parsed = JSON.parse(readFileSync16(path, "utf-8"));
@@ -44462,28 +44644,28 @@ function ensurePortableSkillFiles(skillPath, manifest) {
     tags: next.tags?.length ? next.tags : ["custom", next.name]
   };
   const entry = next.commands[0]?.entry ?? "src/index.ts";
-  if (entry && !existsSync8(join24(skillPath, entry))) {
-    mkdirSync6(dirname16(join24(skillPath, entry)), { recursive: true });
-    writeFileSync5(join24(skillPath, entry), renderEntrypoint(next));
+  if (entry && !existsSync9(join25(skillPath, entry))) {
+    mkdirSync6(dirname16(join25(skillPath, entry)), { recursive: true });
+    writeFileSync5(join25(skillPath, entry), renderEntrypoint(next));
   }
-  if (!existsSync8(join24(skillPath, "SKILL.md")))
-    writeFileSync5(join24(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync9(join25(skillPath, "SKILL.md")))
+    writeFileSync5(join25(skillPath, "SKILL.md"), renderSkillMd(next));
   else
-    writeFileSync5(join24(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync16(join24(skillPath, "SKILL.md"), "utf-8"), next));
-  if (!existsSync8(join24(skillPath, "AGENTS.md")))
-    writeFileSync5(join24(skillPath, "AGENTS.md"), renderAgentsMd(next));
+    writeFileSync5(join25(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync16(join25(skillPath, "SKILL.md"), "utf-8"), next));
+  if (!existsSync9(join25(skillPath, "AGENTS.md")))
+    writeFileSync5(join25(skillPath, "AGENTS.md"), renderAgentsMd(next));
   ensurePackageJson(skillPath, next);
-  if (!existsSync8(join24(skillPath, "tsconfig.json")))
-    writeFileSync5(join24(skillPath, "tsconfig.json"), renderTsconfig());
+  if (!existsSync9(join25(skillPath, "tsconfig.json")))
+    writeFileSync5(join25(skillPath, "tsconfig.json"), renderTsconfig());
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
 function ensurePackageJson(skillPath, manifest) {
-  const pkgPath = join24(skillPath, "package.json");
+  const pkgPath = join25(skillPath, "package.json");
   const first = manifest.commands[0] ?? { name: manifest.name, entry: "src/index.ts" };
   const commandName = normalizePortableSkillName(first.name || manifest.name);
   const entry = (first.entry ?? "src/index.ts").replace(/^\.\//, "");
-  if (!existsSync8(pkgPath)) {
+  if (!existsSync9(pkgPath)) {
     writeFileSync5(pkgPath, renderPackageJson(manifest));
     return;
   }
@@ -44526,18 +44708,18 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
     inputs: [],
     commands: []
   };
-  if (!existsSync8(join24(skillPath, "SKILL.md"))) {
-    writeFileSync5(join24(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync9(join25(skillPath, "SKILL.md"))) {
+    writeFileSync5(join25(skillPath, "SKILL.md"), renderSkillMd(next));
   } else {
-    const path = join24(skillPath, "SKILL.md");
+    const path = join25(skillPath, "SKILL.md");
     const content = readFileSync16(path, "utf8");
     const declaredName = parseSkillFrontmatter(content)?.name;
     if (declaredName && declaredName !== next.name) {
       writeFileSync5(path, renameInstructionFrontmatter(content, next.name));
     }
   }
-  const packagePath = join24(skillPath, "package.json");
-  if (existsSync8(packagePath)) {
+  const packagePath = join25(skillPath, "package.json");
+  if (existsSync9(packagePath)) {
     const pkg = readJsonObject(packagePath);
     if (typeof pkg.name === "string" && pkg.name !== next.name) {
       writeFileSync5(packagePath, `${JSON.stringify({ ...pkg, name: next.name }, null, 2)}
@@ -44568,7 +44750,7 @@ function renameInstructionFrontmatter(content, name) {
   return renamed + content.slice(frontmatter[0].length);
 }
 function copySkillDirectory(source, destination) {
-  const resolvedSource = lstatSync20(source).isSymbolicLink() ? realpathSync8(source) : source;
+  const resolvedSource = lstatSync21(source).isSymbolicLink() ? realpathSync9(source) : source;
   mkdirSync6(destination, { recursive: true });
   cpSync(resolvedSource, destination, {
     recursive: true,
@@ -44581,7 +44763,7 @@ function copySkillDirectory(source, destination) {
         if (isExcludedCopyEntry(segments[i], i === 0))
           return false;
       }
-      if (lstatSync20(src).isSymbolicLink())
+      if (lstatSync21(src).isSymbolicLink())
         return false;
       return true;
     }
@@ -44860,12 +45042,12 @@ function escapeJsString(value) {
 }
 
 // src/lib/authoring-path.ts
-import { lstatSync as lstatSync21, realpathSync as realpathSync9 } from "fs";
+import { lstatSync as lstatSync22, realpathSync as realpathSync10 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename9, dirname as dirname17, join as join25, resolve as resolve16, sep as sep7 } from "path";
+import { basename as basename9, dirname as dirname17, join as join26, resolve as resolve17, sep as sep7 } from "path";
 var NATIVE_DISCOVERY_ROOTS = NATIVE_SKILL_ROOTS.map(([, path]) => path.split("/"));
 function pathParts(path) {
-  return resolve16(path).split(sep7).filter(Boolean);
+  return resolve17(path).split(sep7).filter(Boolean);
 }
 function nativeRootMatch(path) {
   const parts = pathParts(path);
@@ -44879,24 +45061,24 @@ function nativeRootMatch(path) {
   return;
 }
 function physicalPath(path) {
-  let cursor = resolve16(path);
+  let cursor = resolve17(path);
   const suffix = [];
-  while (!lstatSync21(cursor, { throwIfNoEntry: false })) {
+  while (!lstatSync22(cursor, { throwIfNoEntry: false })) {
     suffix.unshift(basename9(cursor));
     const parent = dirname17(cursor);
     if (parent === cursor)
-      return resolve16(path);
+      return resolve17(path);
     cursor = parent;
   }
-  return resolve16(realpathSync9(cursor), ...suffix);
+  return resolve17(realpathSync10(cursor), ...suffix);
 }
 function contains(root2, path) {
   return path === root2 || path.startsWith(root2 + sep7);
 }
 function configuredRoots(home, explicitHome) {
-  const homeData = join25(home, ".hasna", "skills");
+  const homeData = join26(home, ".hasna", "skills");
   const homePolicy = readManagedSkillPolicySnapshot(homeData);
-  const configuredPolicy = !explicitHome && resolve16(getDataDirReadOnly()) !== resolve16(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
+  const configuredPolicy = !explicitHome && resolve17(getDataDirReadOnly()) !== resolve17(homeData) ? readManagedSkillPolicySnapshot(getDataDirReadOnly()) : null;
   const policy = homePolicy ?? configuredPolicy;
   const bridge = policy?.value.bridge;
   if (bridge && (typeof bridge.home !== "string" || physicalPath(bridge.home) !== physicalPath(home))) {
@@ -44925,8 +45107,8 @@ function configuredRoots(home, explicitHome) {
       admitBinding(binding);
       continue;
     }
-    const nativeHome = join25(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
-    if (!lstatSync21(nativeHome, { throwIfNoEntry: false }))
+    const nativeHome = join26(home, agent === "opencode" ? ".config/opencode" : `.${agent}`);
+    if (!lstatSync22(nativeHome, { throwIfNoEntry: false }))
       continue;
     roots.push(...resolveAgentDiscovery({ home, agent, canonical: physicalPath }).roots);
   }
@@ -44935,22 +45117,22 @@ function configuredRoots(home, explicitHome) {
 function assertPortableAuthoringPath(path, options = {}) {
   if (typeof path !== "string" || !path || path.includes("\x00"))
     throw new Error("Invalid portable authoring path");
-  const lexical = resolve16(path);
+  const lexical = resolve17(path);
   const physical = physicalPath(lexical);
   const candidates = [lexical, physical];
   let native = candidates.map(nativeRootMatch).find(Boolean);
-  const home = resolve16(options.homeDir ?? homedir4());
-  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join25(home, ...parts));
-  defaults.push(join25(home, ".codex/plugins/cache"), join25(home, ".claude/plugins/cache"), join25(home, ".claude/plugins/synced"), join25(home, ".gemini/extensions"));
+  const home = resolve17(options.homeDir ?? homedir4());
+  const defaults = NATIVE_DISCOVERY_ROOTS.map((parts) => join26(home, ...parts));
+  defaults.push(join26(home, ".codex/plugins/cache"), join26(home, ".claude/plugins/cache"), join26(home, ".claude/plugins/synced"), join26(home, ".gemini/extensions"));
   for (const root2 of defaults) {
-    if (candidates.some((candidate2) => contains(resolve16(root2), candidate2) || contains(physicalPath(root2), candidate2)))
+    if (candidates.some((candidate2) => contains(resolve17(root2), candidate2) || contains(physicalPath(root2), candidate2)))
       native ??= root2;
   }
   if (native) {
     throw new Error(`Refusing portable Skills authoring below native discovery root '${native}': ${lexical}. Set HASNA_SKILLS_DIR to a private authoring corpus outside native roots.`);
   }
   for (const root2 of configuredRoots(home, options.homeDir !== undefined)) {
-    if (candidates.some((candidate2) => contains(resolve16(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
+    if (candidates.some((candidate2) => contains(resolve17(root2), candidate2) || contains(physicalPath(root2), candidate2))) {
       throw new Error(`Refusing portable Skills authoring below configured native discovery root: ${lexical}`);
     }
   }
@@ -44962,15 +45144,15 @@ function getPortableSkillsRoot(options = {}) {
 function resolvePortableSkillsRoot(options, migrate) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join26(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
-  const cache = join26(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join27(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
+  const cache = join27(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache))
     return cache;
-  const installed = join26(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join27(appDir, INSTALLED_SKILLS_DIRNAME);
   return installed;
 }
 function getPortableSkillPath(name, options = {}) {
-  return join26(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join27(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -44980,7 +45162,7 @@ function findPortableSkill(name, options = {}) {
     return null;
   }
   const path = getPortableSkillPath(normalized, options);
-  if (!existsSync9(path) || !statSync9(path).isDirectory())
+  if (!existsSync10(path) || !statSync9(path).isDirectory())
     return null;
   try {
     return summarizePortableSkill(path, normalized);
@@ -44996,7 +45178,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync10(root2).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join26(root2, entry);
+    const path = join27(root2, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -45030,11 +45212,11 @@ function isOfficialSkillName(name) {
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizeNewPortableSkillName(name);
   const readOnlyRoot = resolvePortableSkillsRoot(options, false);
-  assertPortableAuthoringPath(join26(readOnlyRoot, skillName), options);
+  assertPortableAuthoringPath(join27(readOnlyRoot, skillName), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join26(root2, skillName);
+  const skillPath = join27(root2, skillName);
   assertPortableAuthoringPath(skillPath, options);
-  if (existsSync9(skillPath)) {
+  if (existsSync10(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
     rmSync2(skillPath, { recursive: true, force: true });
@@ -45052,7 +45234,7 @@ function scaffoldPortableSkill(name, options = {}) {
 }
 function portPortableSkillDirectory(sourceDir, options = {}) {
   const absoluteSource = normalize4(sourceDir);
-  if (!existsSync9(absoluteSource) || !statSync9(absoluteSource).isDirectory()) {
+  if (!existsSync10(absoluteSource) || !statSync9(absoluteSource).isDirectory()) {
     throw new Error(`Import directory not found: ${sourceDir}`);
   }
   const continueOnError = options.continueOnError ?? true;
@@ -45066,7 +45248,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   const skipped = [];
   const entries = readdirSync10(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
-    const childPath = join26(absoluteSource, entryName);
+    const childPath = join27(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
       continue;
     if (!isSkillCandidate(childPath)) {
@@ -45095,19 +45277,19 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
 }
 function isSkillCandidate(dir) {
-  return existsSync9(join26(dir, "SKILL.md")) || existsSync9(join26(dir, "skill.json")) || existsSync9(join26(dir, "package.json"));
+  return existsSync10(join27(dir, "SKILL.md")) || existsSync10(join27(dir, "skill.json")) || existsSync10(join27(dir, "package.json"));
 }
 function physicalImportPath(path) {
-  let ancestor = resolve17(path);
+  let ancestor = resolve18(path);
   const suffix = [];
-  while (!existsSync9(ancestor)) {
+  while (!existsSync10(ancestor)) {
     suffix.unshift(basename10(ancestor));
     ancestor = dirname18(ancestor);
   }
-  return join26(realpathSync10(ancestor), ...suffix);
+  return join27(realpathSync11(ancestor), ...suffix);
 }
 function assertDisjointImportPaths(source, destination) {
-  const sourcePath = realpathSync10(source);
+  const sourcePath = realpathSync11(source);
   const destinationPath = physicalImportPath(destination);
   const contains2 = (parent, child) => {
     const path = relative6(parent, child);
@@ -45119,7 +45301,7 @@ function assertDisjointImportPaths(source, destination) {
 }
 function portPortableSkill(sourcePath, options = {}) {
   const absoluteSource = normalize4(sourcePath);
-  if (!existsSync9(absoluteSource) || !statSync9(absoluteSource).isDirectory()) {
+  if (!existsSync10(absoluteSource) || !statSync9(absoluteSource).isDirectory()) {
     throw new Error(`Skill source directory not found: ${sourcePath}`);
   }
   const inferred = readPortableSkillManifestForImport(absoluteSource);
@@ -45130,14 +45312,14 @@ function portPortableSkill(sourcePath, options = {}) {
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename10(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
-  const readOnlyDestination = join26(resolvePortableSkillsRoot(options, false), skillName);
+  const readOnlyDestination = join27(resolvePortableSkillsRoot(options, false), skillName);
   assertPortableAuthoringPath(readOnlyDestination, options);
   assertDisjointImportPaths(absoluteSource, readOnlyDestination);
   const root2 = getPortableSkillsRoot(options);
-  const destination = join26(root2, skillName);
+  const destination = join27(root2, skillName);
   assertPortableAuthoringPath(destination, options);
   assertDisjointImportPaths(absoluteSource, destination);
-  if (existsSync9(destination)) {
+  if (existsSync10(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync2(destination, { recursive: true, force: true });
@@ -45179,13 +45361,13 @@ function buildCorpusManifest(input, name) {
 function writeCorpusSkill(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const readOnlyRoot = resolvePortableSkillsRoot(options, false);
-  assertPortableAuthoringPath(join26(readOnlyRoot, name), options);
+  assertPortableAuthoringPath(join27(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const skillPath = join26(root2, name);
+  const skillPath = join27(root2, name);
   assertPortableAuthoringPath(skillPath, options);
-  const created = !existsSync9(skillPath);
+  const created = !existsSync10(skillPath);
   mkdirSync7(skillPath, { recursive: true });
-  writeFileSync6(join26(skillPath, "SKILL.md"), input.skillMd);
+  writeFileSync6(join27(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
   return { name, path: skillPath, manifest, created };
@@ -45193,22 +45375,22 @@ function writeCorpusSkill(input, options = {}) {
 function installCorpusSkillAtomically(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const readOnlyRoot = resolvePortableSkillsRoot(options, false);
-  assertPortableAuthoringPath(join26(readOnlyRoot, name), options);
+  assertPortableAuthoringPath(join27(readOnlyRoot, name), options);
   const root2 = getPortableSkillsRoot(options);
-  const target = join26(root2, name);
+  const target = join27(root2, name);
   assertPortableAuthoringPath(target, options);
-  const created = !existsSync9(target);
+  const created = !existsSync10(target);
   mkdirSync7(root2, { recursive: true });
-  const staging = mkdtempSync(join26(root2, `.pull-${name}-`));
+  const staging = mkdtempSync(join27(root2, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
-    writeFileSync6(join26(staging, "SKILL.md"), input.skillMd);
+    writeFileSync6(join27(staging, "SKILL.md"), input.skillMd);
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
-    if (existsSync9(target)) {
-      backup = mkdtempSync(join26(root2, `.pull-backup-${name}-`));
-      renameSync4(target, join26(backup, name));
+    if (existsSync10(target)) {
+      backup = mkdtempSync(join27(root2, `.pull-backup-${name}-`));
+      renameSync4(target, join27(backup, name));
       moved = true;
     }
     renameSync4(staging, target);
@@ -45217,9 +45399,9 @@ function installCorpusSkillAtomically(input, options = {}) {
     return { name, path: target, manifest, created };
   } catch (error) {
     rmSync2(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync9(join26(backup, name))) {
+    if (moved && backup && existsSync10(join27(backup, name))) {
       try {
-        renameSync4(join26(backup, name), target);
+        renameSync4(join27(backup, name), target);
       } catch {}
     }
     throw error;
@@ -45231,10 +45413,10 @@ function validatePortableSkillDirectory(name, skillPath) {
   const issues = [...base.issues];
   const warnings = [...base.warnings];
   let manifest;
-  if (existsSync9(skillPath)) {
-    const skillJsonPath = join26(skillPath, "skill.json");
-    const skillMdPath = join26(skillPath, "SKILL.md");
-    if (!existsSync9(skillJsonPath) && !existsSync9(skillMdPath)) {
+  if (existsSync10(skillPath)) {
+    const skillJsonPath = join27(skillPath, "skill.json");
+    const skillMdPath = join27(skillPath, "SKILL.md");
+    if (!existsSync10(skillJsonPath) && !existsSync10(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
     try {
@@ -45253,7 +45435,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync9(join26(skillPath, "skill.json")),
+        strict: existsSync10(join27(skillPath, "skill.json")),
         skillPath
       });
       for (const issue of contractIssues)
@@ -45293,8 +45475,8 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command.name}' entry '${command.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join26(skillPath, command.entry);
-            if (!existsSync9(entryPath))
+            const entryPath = join27(skillPath, command.entry);
+            if (!existsSync10(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command.name}' entry '${command.entry}' is missing`);
             else if (statSync9(entryPath).isDirectory())
               add3(issues, "portable.command_entry_directory", `Command '${command.name}' entry '${command.entry}' must be a file`);
@@ -45304,7 +45486,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error) {
       add3(issues, "portable.manifest_invalid", error.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync9(join26(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync10(join27(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -45340,13 +45522,13 @@ async function runPortableSkill(name, args, options = {}) {
   if (!isSafeRelativePath2(command.entry)) {
     return { exitCode: 1, error: `Portable skill '${name}' command entry is unsafe` };
   }
-  const entryPath = join26(skill.path, command.entry);
-  if (!existsSync9(entryPath)) {
+  const entryPath = join27(skill.path, command.entry);
+  if (!existsSync10(entryPath)) {
     return { exitCode: 1, error: `Entry point '${command.entry}' not found in portable skill '${name}'` };
   }
-  const pkgPath = join26(skill.path, "package.json");
-  const nodeModules = join26(skill.path, "node_modules");
-  if (existsSync9(pkgPath) && !existsSync9(nodeModules) && hasPackageDependencies(pkgPath)) {
+  const pkgPath = join27(skill.path, "package.json");
+  const nodeModules = join27(skill.path, "node_modules");
+  if (existsSync10(pkgPath) && !existsSync10(nodeModules) && hasPackageDependencies(pkgPath)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skill.path,
       stdout: "pipe",
@@ -45417,9 +45599,9 @@ function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
-  const path = join27(dir, SYNC_MARKER_FILE);
+  const path = join28(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync22(path).isFile())
+    if (!lstatSync23(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync17(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -45441,9 +45623,9 @@ function resolveSyncAgents(arg) {
 function agentGlobalSkillsDir(agent, homeDir3 = homedir5()) {
   switch (agent) {
     case "opencode":
-      return join27(homeDir3, ".config", "opencode", "skills");
+      return join28(homeDir3, ".config", "opencode", "skills");
     default:
-      return join27(homeDir3, `.${agent}`, "skills");
+      return join28(homeDir3, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -45502,8 +45684,8 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate2 = join27(source, sub);
-    if (existsSync10(candidate2) && isDirectory(candidate2))
+    const candidate2 = join28(source, sub);
+    if (existsSync11(candidate2) && isDirectory(candidate2))
       roots.push(candidate2);
   }
   if (roots.length > 0)
@@ -45518,10 +45700,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate2 = join27(path, entry);
+    const candidate2 = join28(path, entry);
     if (!isDirectory(candidate2))
       return false;
-    return existsSync10(join27(candidate2, "SKILL.md")) || existsSync10(join27(candidate2, "skill.json")) || existsSync10(join27(candidate2, "package.json"));
+    return existsSync11(join28(candidate2, "SKILL.md")) || existsSync11(join28(candidate2, "skill.json")) || existsSync11(join28(candidate2, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -45561,7 +45743,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join27(agentGlobalSkillsDir(agent, homeDir3), name, "SKILL.md"),
+          path: join28(agentGlobalSkillsDir(agent, homeDir3), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -45591,7 +45773,7 @@ function syncSkillsToAgents(options = {}) {
 }
 function writeManagedAgentSkill(params) {
   const homeDir3 = params.homeDir ?? homedir5();
-  const dir = join27(agentGlobalSkillsDir(params.agent, homeDir3), params.skill);
+  const dir = join28(agentGlobalSkillsDir(params.agent, homeDir3), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -45608,11 +45790,11 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join27(dir, "SKILL.md");
-  const markerPath = join27(dir, SYNC_MARKER_FILE);
-  const dirExists = existsSync10(dir);
+  const skillMdPath = join28(dir, "SKILL.md");
+  const markerPath = join28(dir, SYNC_MARKER_FILE);
+  const dirExists = existsSync11(dir);
   const managed = hasSkillsOwnershipMarker(dir);
-  const hasSkillMd = existsSync10(skillMdPath);
+  const hasSkillMd = existsSync11(skillMdPath);
   if (dirExists && !managed && !hasSkillMd) {
     return {
       action: "skip",
@@ -45624,7 +45806,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return {
       action: "skip",
       path: skillMdPath,
-      reason: existsSync10(markerPath) ? "an unmanaged SKILL.md already exists here (invalid or foreign ownership marker); pass --force to overwrite" : "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
+      reason: existsSync11(markerPath) ? "an unmanaged SKILL.md already exists here (invalid or foreign ownership marker); pass --force to overwrite" : "an unmanaged SKILL.md already exists here (hand-authored); pass --force to overwrite"
     };
   }
   if (dirExists && managed && hasSkillMd && !options.force && isPointerSkillMd(skillMd)) {
@@ -45647,11 +45829,11 @@ function writeManagedSkillDir(dir, skillMd, options) {
     return { action, path: skillMdPath };
   const parentDir = dirname19(dir);
   mkdirSync8(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join27(parentDir, `.hasna-skills-write-${basename11(dir)}-`));
-  const candidateDir = join27(transactionDir, "candidate");
-  const backupDir = join27(transactionDir, "backup");
-  const candidateSkillMdPath = join27(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join27(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join28(parentDir, `.hasna-skills-write-${basename11(dir)}-`));
+  const candidateDir = join28(transactionDir, "candidate");
+  const backupDir = join28(transactionDir, "backup");
+  const candidateSkillMdPath = join28(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join28(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -45678,9 +45860,9 @@ function writeManagedSkillDir(dir, skillMd, options) {
     }
     renameDirectory(candidateDir, dir);
   } catch (error) {
-    if (originalMoved && existsSync10(backupDir)) {
+    if (originalMoved && existsSync11(backupDir)) {
       try {
-        if (existsSync10(dir))
+        if (existsSync11(dir))
           rmSync3(dir, { recursive: true, force: true });
         renameDirectory(backupDir, dir);
         originalMoved = false;
@@ -45700,7 +45882,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir3 = homedir5()) {
-  const dir = join27(agentGlobalSkillsDir(agent, homeDir3), skill);
+  const dir = join28(agentGlobalSkillsDir(agent, homeDir3), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync3(dir, { recursive: true, force: true });
@@ -45708,8 +45890,8 @@ function removeManagedAgentSkill(skill, agent, homeDir3 = homedir5()) {
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join27(skillPath, "SKILL.md");
-    if (existsSync10(skillMdPath))
+    const skillMdPath = join28(skillPath, "SKILL.md");
+    if (existsSync11(skillMdPath))
       return readFileSync17(skillMdPath, "utf-8");
   }
   return pointerSkillMd(name, description);
@@ -45740,8 +45922,8 @@ function normalizeSkillName(name) {
 }
 
 // src/lib/registry.ts
-import { existsSync as existsSync11, readFileSync as readFileSync18, readdirSync as readdirSync12 } from "fs";
-import { join as join28 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync18, readdirSync as readdirSync12 } from "fs";
+import { join as join29 } from "path";
 
 // src/lib/registry-merge.ts
 var SKILL_SOURCE_PRECEDENCE = {
@@ -45943,7 +46125,7 @@ function parseSkillMdFrontmatter(content) {
   return Object.keys(result).length > 0 ? result : null;
 }
 function discoverSkillsInDir(dir, source = "custom") {
-  if (!existsSync11(dir))
+  if (!existsSync12(dir))
     return [];
   const result = [];
   try {
@@ -45951,8 +46133,8 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join28(dir, entry.name, "SKILL.md");
-      if (!existsSync11(skillMdPath))
+      const skillMdPath = join29(dir, entry.name, "SKILL.md");
+      if (!existsSync12(skillMdPath))
         continue;
       let content;
       try {
@@ -45971,7 +46153,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join28(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join29(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -45980,16 +46162,16 @@ function discoverSkillsInDir(dir, source = "custom") {
 }
 function findExtensionSkillPath(name) {
   const config = loadConfig();
-  if (!config.extensionsDir || !existsSync11(config.extensionsDir))
+  if (!config.extensionsDir || !existsSync12(config.extensionsDir))
     return null;
   try {
     const entries = readdirSync12(config.extensionsDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join28(config.extensionsDir, entry.name);
-      const skillMdPath = join28(skillDir, "SKILL.md");
-      if (!existsSync11(skillMdPath))
+      const skillDir = join29(config.extensionsDir, entry.name);
+      const skillMdPath = join29(skillDir, "SKILL.md");
+      if (!existsSync12(skillMdPath))
         continue;
       let content;
       try {
@@ -46036,21 +46218,21 @@ function clearRegistryCache() {
   registryCacheTime = 0;
   registryCacheKey = null;
 }
-function getSkillsByCategory(category) {
-  return loadRegistry().filter((s) => s.category === category);
+function getSkillsByCategory(category, catalog) {
+  return (catalog ?? loadRegistry()).filter((s) => s.category === category);
 }
 function getSkill(name) {
   const registry = loadRegistry();
   const slug = normalizeSkillSlug(name);
   return registry.find((s) => s.name === slug) ?? registry.find((s) => s.name === resolveSkillAlias(slug));
 }
-function getSkillsByTag(tag) {
+function getSkillsByTag(tag, catalog) {
   const needle = tag.toLowerCase();
-  return loadRegistry().filter((s) => s.tags.some((t2) => t2.toLowerCase().includes(needle)));
+  return (catalog ?? loadRegistry()).filter((s) => s.tags.some((t2) => t2.toLowerCase().includes(needle)));
 }
-function getAllTags() {
+function getAllTags(catalog) {
   const tagSet = new Set;
-  for (const skill of loadRegistry()) {
+  for (const skill of catalog ?? loadRegistry()) {
     for (const tag of skill.tags)
       tagSet.add(tag.toLowerCase());
   }
@@ -46058,8 +46240,8 @@ function getAllTags() {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "fs";
-import { join as join29 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync19, writeFileSync as writeFileSync8 } from "fs";
+import { join as join30 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -46074,14 +46256,14 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join29(targetDir, SKILLS_PROJECT_DIR);
+  return join30(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join29(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join30(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
-  if (!existsSync12(path))
+  if (!existsSync13(path))
     return null;
   try {
     return normalizeProjectConfig(JSON.parse(readFileSync19(path, "utf-8")));
@@ -46206,19 +46388,19 @@ function getSkillPath(name) {
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join30(getPortableSkillsRoot(), skillName);
+  return join31(getPortableSkillsRoot(), skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
 }
 function skillExists(name) {
-  return existsSync13(getSkillPath(name));
+  return existsSync14(getSkillPath(name));
 }
 function installSkill(name, options = {}) {
   const { targetDir = process.cwd(), overwrite = false } = options;
   const canonicalName = getCanonicalSkillName(name);
   const skillName = normalizeSkillName(canonicalName);
-  if (!existsSync13(getSkillPath(name))) {
+  if (!existsSync14(getSkillPath(name))) {
     const knownOfficial = Boolean(getSkill(name));
     return {
       skill: canonicalName,
@@ -46245,7 +46427,7 @@ function installSkill(name, options = {}) {
 }
 function installSkillSource(name, _options = {}) {
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync13(getSkillPath(name))) {
+  if (!existsSync14(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found`, mode: "source" };
   }
   return {
@@ -46266,11 +46448,11 @@ function installSkillManifest(manifest, _options = {}) {
 }
 function createLocalSkillManifest(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync13(sourcePath))
+  if (!existsSync14(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join30(sourcePath, "SKILL.md");
-  if (existsSync13(skillMdPath)) {
+  const skillMdPath = join31(sourcePath, "SKILL.md");
+  if (existsSync14(skillMdPath)) {
     skillMd = readFileSync20(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
     skillMd = generateSkillMd(name) ?? "";
@@ -46343,21 +46525,21 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join30(base, ".pi", "skills") : join30(homedir6(), ".pi", "agent", "skills");
+      return scope === "project" ? join31(base, ".pi", "skills") : join31(homedir6(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join30(base, ".opencode", "skills") : join30(homedir6(), ".config", "opencode", "skills");
+      return scope === "project" ? join31(base, ".opencode", "skills") : join31(homedir6(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join30(base, `.${agent}`, "skills") : join30(homedir6(), `.${agent}`, "skills");
+      return scope === "project" ? join31(base, `.${agent}`, "skills") : join31(homedir6(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join30(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join31(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   assertNativeExportAllowed();
   const canonicalName = getCanonicalSkillName(name);
-  if (!existsSync13(getSkillPath(name))) {
+  if (!existsSync14(getSkillPath(name))) {
     return { skill: canonicalName, success: false, error: `Skill '${name}' not found` };
   }
   const scope = options.scope ?? "global";
@@ -46388,8 +46570,8 @@ function removeSkillForAgent(name, options) {
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join30(sourcePath, "SKILL.md");
-  if (existsSync13(skillMdPath))
+  const skillMdPath = join31(sourcePath, "SKILL.md");
+  if (existsSync14(skillMdPath))
     return readFileSync20(skillMdPath, "utf-8");
   if (generateSkillMd)
     return generateSkillMd(name);
@@ -46408,7 +46590,7 @@ function warnMissingDependencies(name, targetDir) {
 }
 function generateMinimalSkillMd(name) {
   const sourcePath = getSkillPath(name);
-  if (!existsSync13(sourcePath))
+  if (!existsSync14(sourcePath))
     return null;
   const canonicalName = getCanonicalSkillName(name);
   const meta = getSkill(canonicalName);
@@ -46423,7 +46605,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join30(sourcePath, "README.md")) || readFileIfExists(join30(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join31(sourcePath, "README.md")) || readFileIfExists(join31(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -46442,8 +46624,8 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join30(getSkillPath(name), "package.json");
-  if (!existsSync13(pkgPath))
+  const pkgPath = join31(getSkillPath(name), "package.json");
+  if (!existsSync14(pkgPath))
     return "unknown";
   try {
     const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
@@ -46453,7 +46635,7 @@ function readBundledSkillVersion(name) {
   }
 }
 function readFileIfExists(path) {
-  return existsSync13(path) ? readFileSync20(path, "utf-8") : null;
+  return existsSync14(path) ? readFileSync20(path, "utf-8") : null;
 }
 function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
@@ -46497,8 +46679,8 @@ function selectSkillDoc(docs, file) {
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join31(skillPath, "SKILL.md");
-  if (!existsSync14(skillMdPath))
+  const skillMdPath = join32(skillPath, "SKILL.md");
+  if (!existsSync15(skillMdPath))
     return false;
   try {
     return parseSkillFrontmatter(readFileSync21(skillMdPath, "utf-8"))?.kind === "instruction";
@@ -46524,12 +46706,12 @@ var HOSTED_PROVIDER_ENV_PREFIXES = [
 ];
 function getSkillDocs(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync14(skillPath))
+  if (!existsSync15(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join31(skillPath, "SKILL.md")),
-    readme: readIfExists(join31(skillPath, "README.md")),
-    claudeMd: readIfExists(join31(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join32(skillPath, "SKILL.md")),
+    readme: readIfExists(join32(skillPath, "README.md")),
+    claudeMd: readIfExists(join32(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name, file) {
@@ -46541,18 +46723,18 @@ function getSkillBestDoc(name, file) {
 }
 function getSkillRequirements(name) {
   const skillPath = getSkillPath(name);
-  if (!existsSync14(skillPath))
+  if (!existsSync15(skillPath))
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join31(skillPath, file));
+    const content = readIfExists(join32(skillPath, file));
     if (content)
       texts.push(content);
   }
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync21(join31(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync21(join32(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -46605,7 +46787,7 @@ async function runSkill(name, args, options = {}) {
   const meta = getSkill(name);
   const canonicalName = meta?.name ?? name;
   const skillPath = getSkillPath(canonicalName);
-  if (!existsSync14(skillPath)) {
+  if (!existsSync15(skillPath)) {
     return { exitCode: 1, error: `Skill '${name}' not found` };
   }
   if (isInstructionSkillDir(skillPath, meta)) {
@@ -46614,8 +46796,8 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join31(skillPath, "package.json");
-  if (!existsSync14(pkgPath)) {
+  const pkgPath = join32(skillPath, "package.json");
+  if (!existsSync15(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
   let entryPoint2;
@@ -46634,12 +46816,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join31(skillPath, entryPoint2);
-  if (!existsSync14(entryPath)) {
+  const entryPath = join32(skillPath, entryPoint2);
+  if (!existsSync15(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint2}' not found in skill '${name}'` };
   }
   const env = { ...process.env, ...options.env };
-  if (!existsSync14(join31(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync15(join32(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -46708,7 +46890,7 @@ function generateSkillMd(name) {
   if (!meta)
     return null;
   const skillPath = getSkillPath(name);
-  if (!existsSync14(skillPath))
+  if (!existsSync15(skillPath))
     return null;
   const frontmatter = [
     "---",
@@ -46717,11 +46899,11 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join31(skillPath, "README.md"));
-  const claudeMd = readIfExists(join31(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join32(skillPath, "README.md"));
+  const claudeMd = readIfExists(join32(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join31(skillPath, "package.json");
-  if (existsSync14(pkgPath)) {
+  const pkgPath = join32(skillPath, "package.json");
+  if (existsSync15(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync21(pkgPath, "utf-8"));
       if (pkg.bin) {
@@ -46798,7 +46980,7 @@ function extractEnvVars(text2) {
 }
 function readIfExists(path) {
   try {
-    if (existsSync14(path)) {
+    if (existsSync15(path)) {
       return readFileSync21(path, "utf-8");
     }
   } catch {}
@@ -46865,6 +47047,8 @@ async function syncSelectionProfile(profileId, options = {}) {
 async function resolveSelectionContext(profileId, options = {}) {
   const sessionState = options.sessionId ? readSkillSessionSnapshotIfExists(options.sessionId, options) : null;
   const session = sessionState?.receipt ?? null;
+  if (options.nativeParentSessionId !== undefined && session && (session.parent?.sessionId ?? null) !== options.nativeParentSessionId)
+    throw new SkillSelectionError("SESSION_PARENT_MISMATCH", "The native session id is already bound to different parent custody.");
   const parentState = !session && options.parentSessionId ? readSkillSessionSnapshotIfExists(options.parentSessionId, options) : null;
   if (!session && options.parentSessionId && !parentState) {
     throw new SkillSelectionError("SESSION_PARENT_NOT_FOUND", "A child Skills session requires an existing parent receipt so its inherited pin can be bound exactly.");
@@ -47002,7 +47186,7 @@ async function executeSelectedLocal(selected, options = {}) {
         throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Explicit environment values must be bounded strings without NUL bytes.");
       secretEnv[name] = value;
     }
-  const runDirectory = mkdtempSync3(join32(tmpdir(), "skills-execution-"));
+  const runDirectory = mkdtempSync3(join33(tmpdir(), "skills-execution-"));
   const paths = new SkillEntryPaths;
   for (const entry of entries) {
     paths.add(entry.path, 100, () => {
@@ -47010,12 +47194,12 @@ async function executeSelectedLocal(selected, options = {}) {
     }, () => {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
-    const destination = join32(runDirectory, entry.path);
+    const destination = join33(runDirectory, entry.path);
     mkdirSync10(dirname20(destination), { recursive: true, mode: 448 });
     writeFileSync9(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env.SKILLS_INPUT_JSON = input;
-  env.SKILLS_WORKSPACE_DIR = resolve18(options.cwd ?? process.cwd());
+  env.SKILLS_WORKSPACE_DIR = resolve19(options.cwd ?? process.cwd());
   env.SKILLS_RUN_DIR = runDirectory;
   if (runtime.version) {
     const version = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], "--version"], runDirectory, env, "", Math.min(timeoutMs, 5000));
@@ -47028,7 +47212,7 @@ async function executeSelectedLocal(selected, options = {}) {
     const { authority: authority2, workspaceId, profileRevision, slug, version, bundleDigest } = selection2;
     const request2 = {
       selection: { authority: authority2, workspaceId, profileId, profileRevision, slug, version, bundleDigest },
-      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync11(options.cwd ?? process.cwd()) }
+      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync12(options.cwd ?? process.cwd()) }
     };
     const grant = await (options.resolveExecutionGrant ?? resolveExecutionGrant)(request2);
     if (!grant || !grantIdentifier(grant.policyRevision) || !grantIdentifier(grant.grantId))
@@ -47038,7 +47222,7 @@ async function executeSelectedLocal(selected, options = {}) {
   }
   if (bindings)
     secretEnv = await resolveSelectedSecrets(bindings, options.createSecretsClient);
-  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join32(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input, timeoutMs);
+  const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join33(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input, timeoutMs);
   result.stdout = redactExecutionSecrets(result.stdout, secretEnv);
   result.stderr = redactExecutionSecrets(result.stderr, secretEnv);
   const receipt = {
@@ -47051,7 +47235,7 @@ async function executeSelectedLocal(selected, options = {}) {
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
     ...result
   };
-  writeFileSync9(join32(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
+  writeFileSync9(join33(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
   return receipt;
 }
 async function subprocess(command, cwd, env, input, timeoutMs) {
@@ -57116,7 +57300,7 @@ import { mkdirSync as mkdirSync12 } from "fs";
 import { dirname as dirname24 } from "path";
 
 // src/server/database-url.ts
-import { isAbsolute as isAbsolute19, join as join34 } from "path";
+import { isAbsolute as isAbsolute19, join as join35 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var DEFAULT_SQLITE_FILENAME2 = "server.db";
 var SQLITE_MEMORY_PATH = ":memory:";
@@ -57125,7 +57309,7 @@ var SQLITE_SCHEMES = new Set(["sqlite", "sqlite3", "file"]);
 var MEMORY_SCHEMES = new Set(["memory"]);
 var SQLITE_EXTENSIONS = [".db", ".sqlite", ".sqlite3", ".db3"];
 function defaultSqlitePath() {
-  return join34(getDataDir(), DEFAULT_SQLITE_FILENAME2);
+  return join35(getDataDir(), DEFAULT_SQLITE_FILENAME2);
 }
 function resolveDatabaseTarget(raw) {
   const value = raw?.trim();
@@ -57152,7 +57336,7 @@ function resolveDatabaseTarget(raw) {
     throw new Error(`unsupported database scheme "${scheme}:". Supported: postgres://, postgresql://, sqlite:, file:, ` + `an absolute or relative path to a .db/.sqlite file, ":memory:", or "memory:" (non-durable, tests only). ` + `Leave the setting empty to use the default SQLite database at ${defaultSqlitePath()}.`);
   }
   if (looksLikeSqlitePath(value)) {
-    const path = isAbsolute19(value) ? value : join34(process.cwd(), value);
+    const path = isAbsolute19(value) ? value : join35(process.cwd(), value);
     return { kind: "sqlite", path, durable: true, label: `sqlite (${path})` };
   }
   throw new Error(`could not resolve a database backend from "${value}". Use postgres://\u2026, sqlite:\u2026, an absolute or ` + `relative path ending in ${SQLITE_EXTENSIONS.join("/")}, ":memory:", or leave it empty for the ` + `default SQLite database at ${defaultSqlitePath()}.`);
@@ -57176,7 +57360,7 @@ function sqlitePathFromUrl(value, scheme) {
     }
     return rest.slice(2).replace(/^\/\/+/, "/");
   }
-  return isAbsolute19(rest) ? rest : join34(process.cwd(), rest);
+  return isAbsolute19(rest) ? rest : join35(process.cwd(), rest);
 }
 function looksLikeSqlitePath(value) {
   if (value.includes("/"))
@@ -57409,7 +57593,7 @@ class PostgresSkillSelectionStore {
 // src/server/sqlite-store.ts
 import { randomUUID as randomUUID7 } from "crypto";
 import { mkdirSync as mkdirSync11, readFileSync as readFileSync23, readdirSync as readdirSync13 } from "fs";
-import { dirname as dirname23, join as join36 } from "path";
+import { dirname as dirname23, join as join37 } from "path";
 
 // src/server/auth.ts
 import { createHash as createHash23 } from "crypto";
@@ -57467,16 +57651,16 @@ function permitsSkillsRoute(principal, method, resource) {
 }
 
 // src/server/migrations-dir.ts
-import { existsSync as existsSync15 } from "fs";
-import { dirname as dirname22, join as join35 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { dirname as dirname22, join as join36 } from "path";
 var MIGRATION_DIALECTS = ["postgres", "sqlite"];
 var MAX_WALK_UP = 6;
 function findMigrationsRoot(startDirs = defaultStartDirs()) {
   for (const start of startDirs) {
     let dir = start;
     for (let level = 0;level < MAX_WALK_UP; level += 1) {
-      const candidate2 = join35(dir, "migrations");
-      if (MIGRATION_DIALECTS.some((dialect) => existsSync15(join35(candidate2, dialect))))
+      const candidate2 = join36(dir, "migrations");
+      if (MIGRATION_DIALECTS.some((dialect) => existsSync16(join36(candidate2, dialect))))
         return candidate2;
       const parent = dirname22(dir);
       if (parent === dir)
@@ -57490,8 +57674,8 @@ function resolveMigrationsDir(dialect, root4 = findMigrationsRoot()) {
   if (!root4) {
     throw new Error(`could not locate the migrations directory for dialect "${dialect}". ` + `Expected a migrations/${dialect}/ folder alongside the package root.`);
   }
-  const dir = join35(root4, dialect);
-  if (!existsSync15(dir)) {
+  const dir = join36(root4, dialect);
+  if (!existsSync16(dir)) {
     throw new Error(`migrations directory not found: ${dir}`);
   }
   return dir;
@@ -58462,7 +58646,7 @@ function applySqliteMigrations(db, migrationsDir = resolveMigrationsDir("sqlite"
   const appliedNow = [];
   for (const file of files) {
     const version2 = file.replace(/\.sql$/, "");
-    const text2 = readFileSync23(join36(migrationsDir, file), "utf8");
+    const text2 = readFileSync23(join37(migrationsDir, file), "utf8");
     const apply = db.transaction(() => {
       const already = db.query("SELECT 1 AS present FROM schema_migrations WHERE version = ? LIMIT 1").get(version2);
       if (already)
@@ -90719,10 +90903,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve20) => {
+  const deadline = new Promise((resolve21) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve20(expired);
+      resolve21(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -92208,12 +92392,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve20) => {
+      await new Promise((resolve21) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve20();
+          resolve21();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -92445,23 +92629,23 @@ class RemoteSkillsAuthClient {
   }
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants13, closeSync as closeSync17, fsyncSync as fsyncSync5, fstatSync as fstatSync17, lstatSync as lstatSync23, mkdirSync as mkdirSync14, openSync as openSync17, readSync as readSync12, realpathSync as realpathSync12, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname26, isAbsolute as isAbsolute20, join as join38, resolve as resolve20 } from "path";
+import { constants as constants13, closeSync as closeSync17, fsyncSync as fsyncSync5, fstatSync as fstatSync17, lstatSync as lstatSync24, mkdirSync as mkdirSync14, openSync as openSync17, readSync as readSync12, realpathSync as realpathSync13, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname26, isAbsolute as isAbsolute20, join as join39, resolve as resolve21 } from "path";
 import { randomUUID as randomUUID11 } from "crypto";
 var fail = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory) {
-  if (!isAbsolute20(directory) || directory !== resolve20(directory) || realpathSync12(directory) !== directory)
+  if (!isAbsolute20(directory) || directory !== resolve21(directory) || realpathSync13(directory) !== directory)
     return fail();
   for (let path2 = directory;; path2 = dirname26(path2)) {
-    const stat2 = lstatSync23(path2);
+    const stat2 = lstatSync24(path2);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail();
     if (path2 === dirname26(path2))
       break;
   }
-  const own2 = lstatSync23(directory);
+  const own2 = lstatSync24(directory);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail();
   return { dev: own2.dev, ino: own2.ino };
@@ -92472,7 +92656,7 @@ function unchangedDirectory(directory, identity4) {
     return fail();
 }
 function readOwned(directory, name, max) {
-  const identity4 = safeDirectory(directory), file2 = join38(directory, name);
+  const identity4 = safeDirectory(directory), file2 = join39(directory, name);
   const fd = openSync17(file2, constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
     const stat2 = fstatSync17(fd);
@@ -92496,7 +92680,7 @@ function readOwned(directory, name, max) {
   }
 }
 function writeOwned(directory, name, bytes) {
-  const fd = openSync17(join38(directory, name), constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
+  const fd = openSync17(join39(directory, name), constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
   try {
     writeFileSync10(fd, bytes);
     fsyncSync5(fd);
@@ -92509,7 +92693,7 @@ function save(directory, value) {
   writeOwned(directory, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory, identity4);
-  renameSync6(join38(directory, temporary), join38(directory, "receipt.json"));
+  renameSync6(join39(directory, temporary), join39(directory, "receipt.json"));
   const fd = openSync17(directory, constants13.O_RDONLY | constants13.O_NOFOLLOW);
   try {
     fsyncSync5(fd);
@@ -92522,7 +92706,7 @@ function bind(client2, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory, action) {
-  const identity4 = safeDirectory(directory), file2 = join38(directory, "operation.lock");
+  const identity4 = safeDirectory(directory), file2 = join39(directory, "operation.lock");
   let fd;
   try {
     fd = openSync17(file2, constants13.O_WRONLY | constants13.O_CREAT | constants13.O_EXCL | constants13.O_NOFOLLOW, 384);
@@ -92538,7 +92722,7 @@ async function locked(directory, action) {
   } finally {
     closeSync17(fd);
     unchangedDirectory(directory, identity4);
-    const now2 = lstatSync23(file2);
+    const now2 = lstatSync24(file2);
     if (now2.dev !== lock.dev || now2.ino !== lock.ino || !now2.isFile() || now2.isSymbolicLink())
       fail();
     unlinkSync5(file2);
@@ -92590,7 +92774,7 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute20(recoveryDirectory) || resolve20(recoveryDirectory) !== recoveryDirectory || realpathSync12(dirname26(recoveryDirectory)) !== dirname26(recoveryDirectory))
+  if (!isAbsolute20(recoveryDirectory) || resolve21(recoveryDirectory) !== recoveryDirectory || realpathSync13(dirname26(recoveryDirectory)) !== dirname26(recoveryDirectory))
     return fail();
   mkdirSync14(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);