@hasna/skills 0.7.1 → 0.7.2

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.7.1",
+    version: "0.7.2",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -43953,12 +43953,20 @@ function assertAgentPolicyCollections(policy) {
       requireBound(object(source));
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
+      if (source.hashMode !== undefined)
+        requireBound(source.hashMode === "bytes" && source.format === undefined && source.fields === undefined);
       if (source.format !== undefined)
         requireBound(["json", "toml", "yaml"].includes(source.format));
       if (source.fields !== undefined)
         for (const field of array(source.fields, AGENT_POLICY_LIMITS.fields))
           text(field, 256);
     }
+    if (value.directories !== undefined)
+      for (const directory of array(value.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+        requireBound(object(directory));
+        text(directory.path);
+        requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+      }
     if (value.builtinNames !== undefined)
       for (const name of array(value.builtinNames, AGENT_POLICY_LIMITS.builtinNames))
         text(name, 128);
@@ -43966,7 +43974,7 @@ function assertAgentPolicyCollections(policy) {
 }
 var AGENT_POLICY_LIMITS;
 var init_agent_policy_limits = __esm(() => {
-  AGENT_POLICY_LIMITS = Object.freeze({ bytes: 1024 * 1024, agents: 16, discoverySources: 2048, discoveryRoots: 512, builtinNames: 2048, rootAliases: 2, fields: 64, pathCharacters: 4096 });
+  AGENT_POLICY_LIMITS = Object.freeze({ bytes: 1024 * 1024, agents: 16, discoverySources: 2048, discoveryRawSourceBytes: 64 * 1024 * 1024, discoveryRawTotalBytes: 256 * 1024 * 1024, discoveryRoots: 512, discoveryDirectories: 64, discoveryDirectoryEntries: 20000, discoveryDirectoryBytes: 8 * 1024 * 1024, builtinNames: 2048, rootAliases: 2, fields: 64, pathCharacters: 4096 });
 });
 
 // src/lib/managed-policy.ts
@@ -51155,6 +51163,10 @@ function configureHermesHooks(text2, supervisor, previous) {
 function assertHermesEnvironment(home) {
   if (process.env.TERMINAL_CWD)
     throw new Error("NATIVE_SKILL_DRIFT: Hermes TERMINAL_CWD requires a separately reviewed effective project; unset it before using this adapter");
+  for (const variable of ["HERMES_BUNDLED_PLUGINS", "HERMES_BUNDLED_SKILLS"]) {
+    if (process.env[variable])
+      throw new Error(`NATIVE_SKILL_DRIFT: Hermes ${variable} requires a dedicated discovery adapter; unset it before using this adapter`);
+  }
   const selected = process.env.HERMES_HOME?.trim();
   if (selected && (!isAbsolute3(selected) || resolve5(selected) !== join17(resolve5(home), ".hermes")))
     throw new Error("NATIVE_SKILL_DRIFT: custom Hermes homes/profiles require their own reviewed bridge");
@@ -51306,10 +51318,155 @@ var init_agent_hermes = __esm(() => {
   EVENTS = ["pre_llm_call", "pre_tool_call"];
 });
 
-// src/lib/agent-discovery.ts
+// src/lib/agent-discovery-directories.ts
 import { createHash as createHash5 } from "crypto";
-import { lstatSync as lstatSync7, readFileSync as readFileSync11, readdirSync as readdirSync9, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join18, resolve as resolve6, sep as sep3 } from "path";
+import { lstatSync as lstatSync7, opendirSync as opendirSync2 } from "fs";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join18, resolve as resolve6 } from "path";
+function need(value, message) {
+  if (!value)
+    throw new Error(message);
+}
+function safe(path) {
+  need(typeof path === "string" && path.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute4(path) && resolve6(path) === path && !path.includes("\x00"), "Expected a canonical absolute discovery directory path");
+  for (let cursor = path;; cursor = dirname6(cursor)) {
+    need(!lstatSync7(cursor, { throwIfNoEntry: false })?.isSymbolicLink(), "Refusing symlink native discovery directory");
+    if (dirname6(cursor) === cursor)
+      break;
+  }
+}
+function same(before2, after2) {
+  return Boolean(after2 && after2.isDirectory() && before2.dev === after2.dev && before2.ino === after2.ino && before2.mtimeMs === after2.mtimeMs && before2.ctimeMs === after2.ctimeMs);
+}
+function capture(path, budget) {
+  safe(path);
+  const root = lstatSync7(path, { throwIfNoEntry: false });
+  if (!root)
+    return { path, sha256: null };
+  need(root.isDirectory(), "Unsupported native discovery directory input");
+  const hash2 = createHash5("sha256");
+  function walk2(current, relative4, before2, depth) {
+    need(depth <= 64, "Native discovery directory depth limit exceeded");
+    const names = [], directory = opendirSync2(current);
+    try {
+      for (let entry = directory.readSync();entry; entry = directory.readSync()) {
+        need(++budget.entries <= AGENT_POLICY_LIMITS.discoveryDirectoryEntries, "Native discovery directory entry limit exceeded");
+        names.push(entry.name);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    need(new Set(names).size === names.length, "Ambiguous native discovery directory names");
+    for (const name of names.sort()) {
+      const child = join18(current, name), childRelative = relative4 ? `${relative4}/${name}` : name;
+      need(child.length <= AGENT_POLICY_LIMITS.pathCharacters, "Native discovery directory path limit exceeded");
+      const stat = lstatSync7(child);
+      need(stat.isFile() || stat.isDirectory(), "Refusing symlink or special native discovery directory member");
+      const row = JSON.stringify([childRelative, stat.isDirectory() ? "directory" : "file"]) + `
+`;
+      budget.bytes += Buffer.byteLength(row);
+      need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
+      hash2.update(row);
+      if (stat.isDirectory())
+        walk2(child, childRelative, stat, depth + 1);
+    }
+    need(same(before2, lstatSync7(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
+  }
+  walk2(path, "", root, 0);
+  safe(path);
+  return { path, sha256: hash2.digest("hex") };
+}
+function captureDiscoveryDirectories(paths) {
+  need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
+  const budget = { entries: 0, bytes: 0 };
+  return paths.map((path) => capture(path, budget));
+}
+function verifyDiscoveryDirectories(directories) {
+  need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
+  for (const directory of directories)
+    need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  for (let i = 0;i < directories.length; i++)
+    need(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
+}
+var init_agent_discovery_directories = __esm(() => {
+  init_agent_policy_limits();
+});
+
+// src/lib/agent-discovery-bytes.ts
+import { createHash as createHash6 } from "crypto";
+import { closeSync as closeSync3, constants as constants4, fstatSync as fstatSync3, lstatSync as lstatSync8, openSync as openSync3, readSync as readSync3 } from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute5, resolve as resolve7 } from "path";
+function discoveryByteBudget() {
+  return { remaining: AGENT_POLICY_LIMITS.discoveryRawTotalBytes };
+}
+function safe2(path) {
+  if (typeof path !== "string" || !isAbsolute5(path) || path !== resolve7(path) || path.length > AGENT_POLICY_LIMITS.pathCharacters || path.includes("\x00"))
+    throw new Error("Expected a canonical absolute raw discovery path");
+  for (let cursor = path;; cursor = dirname7(cursor)) {
+    if (lstatSync8(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+      throw new Error("Refusing symlink raw discovery input");
+    if (dirname7(cursor) === cursor)
+      break;
+  }
+}
+function same2(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+function consume(budget, bytes) {
+  if (bytes > budget.remaining)
+    throw new Error("Raw discovery aggregate byte limit exceeded");
+  budget.remaining -= bytes;
+}
+function hashRawDiscoveryFile(path, budget, changes) {
+  safe2(path);
+  if (changes?.has(path)) {
+    const text2 = changes.get(path), bytes = Buffer.byteLength(text2);
+    if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+      throw new Error("Raw discovery file byte limit exceeded");
+    consume(budget, bytes);
+    return createHash6("sha256").update(text2).digest("hex");
+  }
+  const initial2 = lstatSync8(path, { throwIfNoEntry: false });
+  if (!initial2)
+    return null;
+  if (!initial2.isFile() || initial2.size > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+    throw new Error("Unsupported or oversized raw discovery input");
+  if (initial2.size > budget.remaining)
+    throw new Error("Raw discovery aggregate byte limit exceeded");
+  const fd = openSync3(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  try {
+    const opened = fstatSync3(fd);
+    if (!opened.isFile() || !same2(initial2, opened))
+      throw new Error("Raw discovery input changed during open");
+    const hash2 = createHash6("sha256"), buffer = Buffer.alloc(64 * 1024);
+    let bytes = 0;
+    while (true) {
+      const count = readSync3(fd, buffer, 0, Math.min(buffer.length, AGENT_POLICY_LIMITS.discoveryRawSourceBytes - bytes + 1), null);
+      if (!count)
+        break;
+      bytes += count;
+      if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+        throw new Error("Raw discovery file byte limit exceeded");
+      consume(budget, count);
+      hash2.update(buffer.subarray(0, count));
+    }
+    const final = fstatSync3(fd), current = lstatSync8(path, { throwIfNoEntry: false });
+    safe2(path);
+    if (!current?.isFile() || !same2(opened, final) || !same2(final, current) || bytes !== final.size)
+      throw new Error("Raw discovery input changed during read");
+    return hash2.digest("hex");
+  } finally {
+    closeSync3(fd);
+  }
+}
+var init_agent_discovery_bytes = __esm(() => {
+  init_agent_policy_limits();
+});
+
+// src/lib/agent-discovery.ts
+import { createHash as createHash7 } from "crypto";
+import { lstatSync as lstatSync9, readFileSync as readFileSync11, readdirSync as readdirSync9, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname8, isAbsolute as isAbsolute6, join as join19, resolve as resolve8, sep as sep3 } from "path";
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -51320,28 +51477,35 @@ function parseConfig(text2, path, toml = false) {
     throw new Error(`Invalid native discovery configuration: ${path}`);
   }
 }
-function safe(path) {
-  if (!isAbsolute4(path) || path.includes("\x00"))
+function safe3(path) {
+  if (!isAbsolute6(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname6(cursor)) {
-    if (lstatSync7(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname8(cursor)) {
+    if (lstatSync9(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname6(cursor) === cursor)
+    if (dirname8(cursor) === cursor)
       break;
   }
 }
 function read2(path, changes) {
-  safe(path);
+  safe3(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat = lstatSync7(path, { throwIfNoEntry: false });
+  const stat = lstatSync9(path, { throwIfNoEntry: false });
   if (!stat)
     return null;
   if (!stat.isFile() || stat.size > 16 * 1024 * 1024)
     throw new Error(`Unsupported or oversized native discovery input: ${path}`);
   return readFileSync11(path, "utf8");
 }
-function projected(source, changes) {
+function projected(source, changes, budget = discoveryByteBudget()) {
+  if (source.hashMode !== undefined) {
+    if (source.hashMode !== "bytes")
+      throw new Error("Invalid native discovery hash mode");
+    if (source.format !== undefined || source.fields !== undefined)
+      throw new Error("Raw discovery witnesses cannot project configuration fields");
+    return hashRawDiscoveryFile(source.path, budget, changes);
+  }
   const text2 = read2(source.path, changes);
   if (text2 === null)
     return null;
@@ -51355,23 +51519,29 @@ function projected(source, changes) {
 function verifyAgentDiscovery(binding) {
   if (!binding || !Array.isArray(binding.sources) || !Array.isArray(binding.roots) || binding.sources.length > AGENT_POLICY_LIMITS.discoverySources || binding.roots.length > AGENT_POLICY_LIMITS.discoveryRoots)
     throw new Error("Invalid native discovery binding");
+  if (binding.agent === "hermes" && !binding.directories?.length)
+    throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
+  if (binding.directories !== undefined)
+    verifyDiscoveryDirectories(binding.directories);
+  const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     if (source.format !== undefined && (!["json", "toml", "yaml"].includes(source.format) || !Array.isArray(source.fields) || !source.fields.length || source.fields.length > 64 || source.fields.some((field) => typeof field !== "string" || !field)))
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
-    if (projected(source) !== source.sha256)
+    if (projected(source, undefined, budget) !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
   }
   for (const root of binding.roots)
-    safe(root);
+    safe3(root);
 }
 function rebindAgentDiscovery(binding, changes) {
-  return { ...binding, sources: binding.sources.map((source) => ({ ...source, sha256: projected(source, changes) })) };
+  const budget = discoveryByteBudget();
+  return { ...binding, sources: binding.sources.map((source) => ({ ...source, sha256: projected(source, changes, budget) })) };
 }
-function assertProjectDiscovery(agent, directories, home, canonical = resolve6) {
+function assertProjectDiscovery(agent, directories, home, canonical = resolve8) {
   for (const directory of directories) {
-    const isHome = resolve6(directory) === resolve6(home);
+    const isHome = resolve8(directory) === resolve8(home);
     if (agent === "hermes") {
       assertHermesEnvironment(home);
       continue;
@@ -51380,7 +51550,7 @@ function assertProjectDiscovery(agent, directories, home, canonical = resolve6)
       continue;
     const paths = agent === "claude" ? [...isHome ? [] : [".claude/settings.json"], ".claude/settings.local.json"] : agent === "codex" ? [".codex/config.toml"] : agent === "gemini" ? [".gemini/settings.json"] : agent === "opencode" ? ["opencode.json", "opencode.jsonc", ".opencode/opencode.json", ".opencode/opencode.jsonc"] : [".cursor/hooks.json"];
     for (const suffix of paths) {
-      const path = canonical(join18(directory, suffix)), raw = read2(path);
+      const path = canonical(join19(directory, suffix)), raw = read2(path);
       if (raw === null)
         continue;
       if (suffix.endsWith(".jsonc"))
@@ -51391,15 +51561,15 @@ function assertProjectDiscovery(agent, directories, home, canonical = resolve6)
         throw new Error(`NATIVE_SKILL_DRIFT: higher-precedence project skill or hook configuration requires review: ${path}`);
     }
     if (agent === "claude") {
-      const commands = canonical(join18(directory, ".claude/commands"));
-      safe(commands);
-      if (lstatSync7(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+      const commands = canonical(join19(directory, ".claude/commands"));
+      safe3(commands);
+      if (lstatSync9(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
         throw new Error("NATIVE_SKILL_DRIFT: legacy project command discovery requires a dedicated format adapter");
     }
   }
 }
 function resolveAgentDiscovery(options) {
-  const canonical = options.canonical ?? resolve6, home = resolve6(options.home), agent = options.agent;
+  const canonical = options.canonical ?? resolve8, home = resolve8(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields) => {
     const source = { path: canonical(path), sha256: null, ...format ? { format, fields } : {} };
@@ -51409,14 +51579,14 @@ function resolveAgentDiscovery(options) {
   };
   if (agent === "hermes")
     assertHermesEnvironment(home);
-  const configPath = join18(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  const configPath = join19(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
   const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
   };
   if (agent === "hermes") {
-    const profile = witness(join18(home, ".hermes/active_profile"));
+    const profile = witness(join19(home, ".hermes/active_profile"));
     if (profile?.trim() && profile.trim() !== "default")
       unresolved("a non-default profile is active");
     const declared = config.skills?.external_dirs ?? [], paths = typeof declared === "string" ? [declared] : declared;
@@ -51430,8 +51600,8 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join18(home, normalized.slice(2)) : resolve6(home, ".hermes", normalized);
-      safe(path);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join19(home, normalized.slice(2)) : resolve8(home, ".hermes", normalized);
+      safe3(path);
       roots.add(path);
     }
   }
@@ -51439,24 +51609,24 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname6(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname6(directory), depth++) {
-        const path = join18(directory, "package.json"), raw = read2(path);
+      for (let directory = dirname8(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname8(directory), depth++) {
+        const path = join19(directory, "package.json"), raw = read2(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname6(directory) === directory)
+        if (dirname8(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
-      const builtinRoot = join18(packageRoot, "bundle/builtin");
-      safe(builtinRoot);
-      if (!lstatSync7(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      const builtinRoot = join19(packageRoot, "bundle/builtin");
+      safe3(builtinRoot);
+      if (!lstatSync9(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync9(builtinRoot).sort()) {
-        const text2 = witness(join18(builtinRoot, name, "SKILL.md"));
+        const text2 = witness(join19(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
           unresolved("installed Gemini builtin name is missing or ambiguous");
@@ -51470,7 +51640,7 @@ function resolveAgentDiscovery(options) {
   if (review) {
     if (review.pluginHooks !== "reviewed-no-skill-injection" || !Array.isArray(review.sources) || !review.sources.length || !Array.isArray(review.roots))
       throw new Error("Discovery review must bind sources and confirm plugin hooks do not inject retired skills");
-    const supplied = { agent, roots: review.roots, sources: review.sources, method: "reviewed" };
+    const supplied = { agent, roots: review.roots, sources: review.sources, ...review.directories !== undefined ? { directories: review.directories } : {}, method: "reviewed" };
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
@@ -51480,40 +51650,40 @@ function resolveAgentDiscovery(options) {
   }
   function plugin(root) {
     root = canonical(root);
-    safe(root);
-    const manifestPath = join18(root, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
+    safe3(root);
+    const manifestPath = join19(root, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
     if (raw === null)
       unresolved("plugin manifest missing");
     const manifest = parseConfig(raw, manifestPath);
-    const hooks = witness(join18(root, "hooks/hooks.json"));
+    const hooks = witness(join19(root, "hooks/hooks.json"));
     if (manifest.hooks !== undefined || hooks !== null)
       unresolved("plugin hooks require a separate no-skill-injection review");
-    const commands = join18(root, "commands");
-    safe(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync7(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
+    const commands = join19(root, "commands");
+    safe3(commands);
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync9(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
-    const rootSkill = witness(join18(root, "SKILL.md"));
+    const rootSkill = witness(join19(root, "SKILL.md"));
     if (rootSkill !== null)
       roots.add(root);
     const declared = manifest.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
     if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
       unresolved("unsupported plugin skill paths");
     if (agent === "claude")
-      roots.add(join18(root, "skills"));
+      roots.add(join19(root, "skills"));
     for (const value of declared) {
-      const path = resolve6(root, value);
+      const path = resolve8(root, value);
       if (path !== root && !path.startsWith(root + sep3))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname6(path) : path);
+      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname8(path) : path);
     }
   }
   if (agent === "claude") {
-    const registrations = witness(join18(home, ".claude/plugins/installed_plugins.json"));
-    const installed = registrations === null ? {} : parseConfig(registrations, join18(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical(join18(home, ".claude/commands"));
-    safe(commands);
-    if (lstatSync7(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+    const registrations = witness(join19(home, ".claude/plugins/installed_plugins.json"));
+    const installed = registrations === null ? {} : parseConfig(registrations, join19(home, ".claude/plugins/installed_plugins.json")).plugins;
+    const commands = canonical(join19(home, ".claude/commands"));
+    safe3(commands);
+    if (lstatSync9(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -51533,34 +51703,34 @@ function resolveAgentDiscovery(options) {
         unresolved("unsupported plugin enablement");
       const split2 = id.lastIndexOf("@"), name = id.slice(0, split2), marketplace = id.slice(split2 + 1);
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
-      if (split2 < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute4(market.source))
+      if (split2 < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute6(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
-      const catalogText = witness(join18(market.source, ".agents/plugins/marketplace.json"));
+      const catalogText = witness(join19(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
         unresolved("marketplace catalog missing");
-      const catalog = parseConfig(catalogText, join18(market.source, ".agents/plugins/marketplace.json")), matches2 = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
+      const catalog = parseConfig(catalogText, join19(market.source, ".agents/plugins/marketplace.json")), matches2 = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches2.length !== 1 || matches2[0]?.source?.source !== "local" || typeof matches2[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve6(market.source, matches2[0].source.path));
+      plugin(resolve8(market.source, matches2[0].source.path));
     }
   } else if (agent === "opencode") {
-    if (witness(join18(home, ".config/opencode/opencode.jsonc")) !== null || witness(join18(home, ".config/opencode/config.json")) !== null)
+    if (witness(join19(home, ".config/opencode/opencode.jsonc")) !== null || witness(join19(home, ".config/opencode/config.json")) !== null)
       unresolved("additional config layers require review");
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
     for (const path of config.skills?.paths ?? []) {
-      if (typeof path !== "string" || !isAbsolute4(path))
+      if (typeof path !== "string" || !isAbsolute6(path))
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
-    const localPlugins = join18(home, ".config/opencode/plugins");
-    safe(localPlugins);
-    if (lstatSync7(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
+    const localPlugins = join19(home, ".config/opencode/plugins");
+    safe3(localPlugins);
+    if (lstatSync9(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
-    for (const directory of [join18(home, ".hermes/plugins"), join18(home, ".hermes/hermes-agent")]) {
-      safe(directory);
-      if (lstatSync7(directory, { throwIfNoEntry: false }))
+    for (const directory of [join19(home, ".hermes/plugins"), join19(home, ".hermes/hermes-agent")]) {
+      safe3(directory);
+      if (lstatSync9(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -51568,29 +51738,32 @@ function resolveAgentDiscovery(options) {
   } else if (agent === "gemini") {
     if (Object.keys(config.extensions ?? {}).length || config.skills?.paths?.length)
       unresolved("custom extension or skill paths");
-    const directory = join18(home, ".gemini/extensions");
-    safe(directory);
-    if (lstatSync7(directory, { throwIfNoEntry: false }))
+    const directory = join19(home, ".gemini/extensions");
+    safe3(directory);
+    if (lstatSync9(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync9(directory)) {
-        const root = join18(directory, name);
-        safe(root);
-        if (!lstatSync7(root)?.isDirectory())
+        const root = join19(directory, name);
+        safe3(root);
+        if (!lstatSync9(root)?.isDirectory())
           continue;
-        const raw = witness(join18(root, "gemini-extension.json"));
+        const raw = witness(join19(root, "gemini-extension.json"));
         if (raw === null)
           unresolved("extension registration missing");
-        const manifest = parseConfig(raw, join18(root, "gemini-extension.json"));
-        if (manifest.hooks !== undefined || witness(join18(root, "hooks/hooks.json")) !== null || witness(join18(root, ".gemini-extension-install.json")) !== null)
+        const manifest = parseConfig(raw, join19(root, "gemini-extension.json"));
+        if (manifest.hooks !== undefined || witness(join19(root, "hooks/hooks.json")) !== null || witness(join19(root, ".gemini-extension-install.json")) !== null)
           unresolved("extension hooks or linked registration require review");
-        roots.add(join18(root, "skills"));
+        roots.add(join19(root, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join19(home, ".hermes/plugins"), join19(home, ".hermes/hermes-agent")].map((path) => canonical(path))) } : {} };
 }
-var digest = (text2) => createHash5("sha256").update(text2).digest("hex");
+var digest = (text2) => createHash7("sha256").update(text2).digest("hex");
 var init_agent_discovery = __esm(() => {
   init_agent_policy_limits();
   init_agent_hermes();
+  init_agent_discovery_directories();
+  init_agent_discovery_bytes();
+  init_agent_discovery_directories();
 });
 
 // src/lib/agent-adapters.ts
@@ -51669,16 +51842,16 @@ var init_agent_adapters = __esm(() => {
 });
 
 // src/lib/agent-integration.ts
-import { createHash as createHash6, randomUUID as randomUUID5 } from "crypto";
-import { existsSync as existsSync14, lstatSync as lstatSync8, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync10, readlinkSync, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync, writeFileSync as writeFileSync5, unlinkSync as unlinkSync2, chmodSync, openSync as openSync3, closeSync as closeSync3, fsyncSync, fstatSync as fstatSync3, readSync as readSync3, constants as constants4, linkSync } from "fs";
-import { dirname as dirname7, join as join19, resolve as resolve7, relative as relative4, isAbsolute as isAbsolute5, sep as sep4 } from "path";
+import { createHash as createHash8, randomUUID as randomUUID5 } from "crypto";
+import { existsSync as existsSync14, lstatSync as lstatSync10, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, readdirSync as readdirSync10, opendirSync as opendirSync3, readlinkSync, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync, writeFileSync as writeFileSync5, unlinkSync as unlinkSync2, chmodSync, openSync as openSync4, closeSync as closeSync4, fsyncSync, fstatSync as fstatSync4, readSync as readSync4, constants as constants5, linkSync } from "fs";
+import { dirname as dirname9, join as join20, resolve as resolve9, relative as relative4, isAbsolute as isAbsolute7, sep as sep4 } from "path";
 import { homedir as homedir3 } from "os";
 function assertSafePath(path) {
-  let cursor = resolve7(path);
+  let cursor = resolve9(path);
   while (true) {
-    if (lstatSync8(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync10(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname7(cursor);
+    const parent = dirname9(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -51686,17 +51859,17 @@ function assertSafePath(path) {
 }
 function readRootAlias(home, agent) {
   assertSafePath(home);
-  const realHome = realpathSync4(home), alias = join19(realHome, `.${agent}`);
-  const stat = lstatSync8(alias, { throwIfNoEntry: false, bigint: true });
+  const realHome = realpathSync4(home), alias = join20(realHome, `.${agent}`);
+  const stat = lstatSync10(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link2 = readlinkSync(alias), targetPath = resolve7(dirname7(alias), link2);
+  const link2 = readlinkSync(alias), targetPath = resolve9(dirname9(alias), link2);
   assertSafePath(targetPath);
-  const targetStat = lstatSync8(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync4(targetPath), inside = relative4(realHome, target);
-  if (!inside || inside === ".." || inside.startsWith(`..${sep4}`) || isAbsolute5(inside))
+  if (!inside || inside === ".." || inside.startsWith(`..${sep4}`) || isAbsolute7(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link: link2, aliasIdentity: `${stat.dev}:${stat.ino}:${stat.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
 }
@@ -51705,19 +51878,19 @@ function rootAliases(home, allowed = false) {
     return [];
   const result2 = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync8(join19(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync10(join20(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result2.push(readRootAlias(home, agent));
   if (result2.some((item, index) => result2.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep4) || other.target.startsWith(item.target + sep4))))
     throw new Error("Agent root alias targets must not overlap");
   return result2;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve7(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
-  return binding ? join19(binding.target, relative4(binding.alias, absolute)) : absolute;
+  const absolute = resolve9(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
+  return binding ? join20(binding.target, relative4(binding.alias, absolute)) : absolute;
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
-    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join19(binding.home, `.${binding.agent}`))
+    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join20(binding.home, `.${binding.agent}`))
       throw new Error("Invalid agent root alias binding");
     const current = readRootAlias(binding.home, binding.agent);
     if (JSON.stringify(current) !== JSON.stringify(binding))
@@ -51726,42 +51899,42 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before2 = lstatSync8(path);
+  const before2 = lstatSync10(path);
   if (!before2.isFile() || before2.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync3(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  const descriptor = openSync4(path, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
   try {
-    const opened = fstatSync3(descriptor);
+    const opened = fstatSync4(descriptor);
     if (!opened.isFile() || opened.dev !== before2.dev || opened.ino !== before2.ino || opened.size !== before2.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before2.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync3(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync4(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after2 = fstatSync3(descriptor);
+    const after2 = fstatSync4(descriptor);
     if (length !== before2.size || after2.size !== before2.size || after2.mtimeMs !== opened.mtimeMs || after2.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync3(descriptor);
+    closeSync4(descriptor);
   }
 }
 function treeHash(root) {
-  const hash2 = createHash6("sha256");
+  const hash2 = createHash8("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat = lstatSync8(path);
+    const stat = lstatSync10(path);
     if (stat.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative4(root, path);
     if (stat.isDirectory()) {
       hash2.update(`d\x00${rel}\x00`);
       for (const name of readdirSync10(path).sort())
-        visit2(join19(path, name));
+        visit2(join20(path, name));
       return;
     }
     if (!stat.isFile())
@@ -51779,37 +51952,50 @@ function treeHash(root) {
 }
 function inventoryNativeSkills(home = homedir3(), options = {}) {
   const aliases = rootAliases(home, options.allowRootAliases);
-  const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join19(home, path), aliases)]);
-  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join19(home, adapter.root, CLI_BRIDGE_NAME), aliases));
-  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve7(path)))) {
+  const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join20(home, path), aliases)]);
+  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join20(home, adapter.root, CLI_BRIDGE_NAME), aliases));
+  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve9(path)))) {
     for (const [agent, path] of ROOTS)
-      roots.push([agent, canonicalAgentPath(join19(project, path), aliases)]);
+      roots.push([agent, canonicalAgentPath(join20(project, path), aliases)]);
   }
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
+  let discoveryEntries = 0, discoveryPathBytes = 0;
+  function admit(path) {
+    if (++discoveryEntries > 20000)
+      throw new Error("Native skill discovery entry limit exceeded");
+    discoveryPathBytes += Buffer.byteLength(path, "utf8");
+    if (discoveryPathBytes > 4 * 1024 * 1024)
+      throw new Error("Native skill discovery metadata limit exceeded");
+  }
   function emptySiblingCacheAlias(path, parent) {
-    const link2 = readlinkSync(path), target = resolve7(parent, link2);
-    if (dirname7(target) !== parent || (isAbsolute5(link2) ? link2 !== target : dirname7(link2) !== "."))
+    const link2 = readlinkSync(path), target = resolve9(parent, link2);
+    if (dirname9(target) !== parent || (isAbsolute7(link2) ? link2 !== target : dirname9(link2) !== "."))
       return false;
-    if (!lstatSync8(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync10(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+    if (!admitted)
+      admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
     if (!existsSync14(path))
       return scan;
-    if (!lstatSync8(path).isDirectory())
+    const stat = lstatSync10(path);
+    if (stat.isFile())
       return scan;
-    if (existsSync14(join19(path, "SKILL.md"))) {
+    if (!stat.isDirectory())
+      throw new Error(`Unsupported native discovery entry: ${path}`);
+    if (existsSync14(join20(path, "SKILL.md"))) {
       scan.hasSkills = true;
       if (seen.has(path))
         return scan;
       seen.add(path);
       let managed = false;
-      const marker = join19(path, ".hasna-skills.json");
+      const marker = join20(path, ".hasna-skills.json");
       if (existsSync14(marker)) {
         try {
           managed = JSON.parse(readFileSync12(marker, "utf8")).managedBy === "@hasna/skills";
@@ -51817,12 +52003,22 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       }
       const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
       const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep4));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join19(home, ".codex", "skills", ".system"), aliases) + sep4) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve7(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join20(home, ".codex", "skills", ".system"), aliases) + sep4) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve9(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
-    if (depth > (vendor ? 8 : 3))
+    if (depth > (vendor ? 32 : 3))
       return { ...scan, complete: false };
-    const children = readdirSync10(path, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    const children = [], directory = opendirSync3(path);
+    try {
+      let child;
+      while ((child = directory.readSync()) !== null) {
+        admit(join20(path, child.name));
+        children.push(child);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     if (pluginCache)
       children.sort((a, b) => Number(a.isSymbolicLink()) - Number(b.isSymbolicLink()));
     for (const { name } of children) {
@@ -51833,15 +52029,15 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       const isVendor = vendor || name === ".system";
       if (isVendor && !options.includeVendor)
         continue;
-      const child = join19(path, name);
-      if (isVendor && lstatSync8(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      const child = join20(path, name);
+      if (isVendor && lstatSync10(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync8(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
           scan.entries++;
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -51860,8 +52056,8 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     scanRoot(agent, path);
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"])
-      scanRoot(agent, canonicalAgentPath(join19(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
-    scanRoot("gemini", join19(home, ".gemini", "extensions"), true);
+      scanRoot(agent, canonicalAgentPath(join20(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+    scanRoot("gemini", join20(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
@@ -51959,12 +52155,12 @@ function disableCodexSkills(text2, skills, aliases, bridgePath) {
   let result2 = text2;
   const selections = [...skills.filter((entry) => entry.agent === "codex" && !entry.bridge).map((skill) => ({ path: skill.path, enabled: false })), { path: bridgePath, enabled: true }];
   for (const skill of selections) {
-    const path = join19(skill.path, "SKILL.md");
+    const path = join20(skill.path, "SKILL.md");
     let found = false;
     result2 = result2.replace(/^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm, (section) => {
       const parsed = Bun.TOML.parse(section);
       const declared = parsed.skills?.config?.[0]?.path;
-      if (!declared || ![resolve7(path), resolve7(skill.path)].includes(canonicalAgentPath(declared, aliases)))
+      if (!declared || ![resolve9(path), resolve9(skill.path)].includes(canonicalAgentPath(declared, aliases)))
         return section;
       found = true;
       return /^\s*enabled\s*=/m.test(section) ? section.replace(/^\s*enabled\s*=.*$/m, `enabled = ${skill.enabled}`) : `${section.trimEnd()}
@@ -51988,7 +52184,7 @@ function planAgentIntegration(options) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(profileId) || profileId.includes(".."))
     throw new Error("Invalid selection profile id");
   const aliases = rootAliases(home, options.allowRootAliases);
-  const policyPath = join19(dataDir3, "agent-policy.json");
+  const policyPath = join20(dataDir3, "agent-policy.json");
   assertSafePath(policyPath);
   const priorSnapshot = readManagedSkillPolicySnapshot(dataDir3), previousPolicy = priorSnapshot?.text ?? null, policy = priorSnapshot?.value ?? {};
   if (policy.bridge !== undefined && (!policy.bridge || typeof policy.bridge !== "object" || Array.isArray(policy.bridge)))
@@ -52005,19 +52201,19 @@ function planAgentIntegration(options) {
     if (!INTEGRATION_AGENTS.includes(agent))
       throw new Error(`Unsupported agent: ${agent}`);
     const adapter = AGENT_ADAPTERS[agent];
-    const bridgePath = canonicalAgentPath(join19(home, adapter.root, CLI_BRIDGE_NAME), aliases);
+    const bridgePath = canonicalAgentPath(join20(home, adapter.root, CLI_BRIDGE_NAME), aliases);
     assertSafePath(bridgePath);
     if (existsSync14(bridgePath) && !isOwnedCliBridge(bridgePath, [bridgePath]))
       throw new Error(`Refusing to overwrite an unrecognized or modified Skills bridge: ${bridgePath}`);
     for (const [name, after3] of Object.entries(CLI_BRIDGE_FILES)) {
-      const path2 = join19(bridgePath, name), before3 = readOptional(path2);
+      const path2 = join20(bridgePath, name), before3 = readOptional(path2);
       if (before3 !== after3)
         changes.push({ path: path2, before: before3, after: after3 });
     }
-    const path = canonicalAgentPath(join19(home, adapter.config), aliases);
+    const path = canonicalAgentPath(join20(home, adapter.config), aliases);
     const before2 = readOptional(path);
     if (agent === "hermes") {
-      const supervisorPath = join19(dataDir3, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(options.command ?? "skills", profileId);
+      const supervisorPath = join20(dataDir3, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(options.command ?? "skills", profileId);
       const priorCommand = policy.bridge?.commands?.hermes, priorProfile = policy.bridge?.profiles?.hermes ?? policy.profileId;
       const previous = policy.bridge?.supervisors?.hermes;
       if (supervisorBefore !== null && supervisorBefore !== supervisorAfter && !(previous?.path === supervisorPath && typeof priorCommand === "string" && typeof priorProfile === "string" && supervisorBefore === renderHermesSupervisor(priorCommand, priorProfile)))
@@ -52028,7 +52224,7 @@ function planAgentIntegration(options) {
       const after3 = configureHermesHooks(before2, supervisor, previous);
       if (before2 !== after3)
         changes.push({ path, before: before2, after: after3 });
-      const optOut = join19(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
+      const optOut = join20(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
       if (optOutBefore === null)
         changes.push({ path: optOut, before: null, after: `Managed by @hasna/skills: bundled native skill reseeding is disabled.
 ` });
@@ -52040,7 +52236,7 @@ function planAgentIntegration(options) {
       if (!permission || typeof permission !== "object" || Array.isArray(permission))
         throw new Error("Expected OpenCode permission object");
       config.permission = { ...permission, skill: { "*": "deny", [CLI_BRIDGE_NAME]: "allow" } };
-      const pluginPath = join19(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
+      const pluginPath = join20(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
       const pluginAfter = renderOpenCodePlugin(options.command ?? "skills", profileId);
       const priorCommand = policy.bridge?.commands?.opencode;
       const ownedPrevious = typeof priorCommand === "string" && typeof policy.profileId === "string" && pluginBefore === renderOpenCodePlugin(priorCommand, policy.bridge?.profiles?.opencode ?? policy.profileId);
@@ -52057,7 +52253,7 @@ function planAgentIntegration(options) {
     if (before2 !== after2)
       changes.push({ path, before: before2, after: after2 });
     if (agent === "codex") {
-      const configPath = canonicalAgentPath(join19(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
+      const configPath = canonicalAgentPath(join20(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
       const next = disableCodexSkills(previous ?? "", nativeSkills, aliases, bridgePath);
       if (next !== (previous ?? ""))
         changes.push({ path: configPath, before: previous, after: next });
@@ -52070,12 +52266,12 @@ function planAgentIntegration(options) {
     version: CLI_BRIDGE_VERSION,
     digest: CLI_BRIDGE_DIGEST,
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
-    home: resolve7(home),
+    home: resolve9(home),
     includeVendor: true,
-    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join19(dataDir3, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(options.command ?? "skills", profileId)) } } } : {},
+    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join20(dataDir3, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(options.command ?? "skills", profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries(options.agents.map((agent) => [agent, options.command ?? "skills"])) },
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, options.agents.includes(agent) ? profileId : policy.bridge?.profiles?.[agent] ?? policy.profileId])),
-    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join19(home, ".codex", "skills", ".system"), aliases) + sep4)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
+    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join20(home, ".codex", "skills", ".system"), aliases) + sep4)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
@@ -52087,7 +52283,7 @@ function planAgentIntegration(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname7(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname9(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID5()}`;
   try {
     writeFileSync5(temporary, content, { mode: 384, flag: "wx" });
@@ -52098,12 +52294,12 @@ function atomicWrite2(path, content) {
   }
 }
 function applyAgentIntegration(plan) {
-  const policyPath = join19(plan.dataDir, "agent-policy.json");
+  const policyPath = join20(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve7(path) === resolve7(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve9(path) === resolve9(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve7(change.path) === resolve7(policyPath))
+    if (resolve9(change.path) === resolve9(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
@@ -52114,7 +52310,7 @@ function applyAgentIntegration(plan) {
   for (const change of plan.changes)
     if (currentText(change.path) !== change.before)
       throw new Error(`Configuration changed after planning: ${change.path}`);
-  const backupRoot = join19(plan.dataDir, "migration", randomUUID5()), backups = [], written = [], createdDirectories = new Set;
+  const backupRoot = join20(plan.dataDir, "migration", randomUUID5()), backups = [], written = [], createdDirectories = new Set;
   if (!plan.changes.length) {
     recheckRootAliases(aliases);
     return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
@@ -52124,7 +52320,7 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join19(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
+      const backup = join20(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
       writeFileSync5(backup, change.before, { mode: 384, flag: "wx" });
       backups.push(backup);
     }
@@ -52133,7 +52329,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname7(change.path);!existsSync14(directory); directory = dirname7(directory))
+      for (let directory = dirname9(change.path);!existsSync14(directory); directory = dirname9(directory))
         createdDirectories.add(directory);
       const after2 = change.after;
       atomicWrite2(change.path, after2);
@@ -52142,7 +52338,7 @@ function applyAgentIntegration(plan) {
     recheckRootAliases(aliases);
     for (const binding of plan.discoveryAfter ?? [])
       verifyAgentDiscovery(binding);
-    atomicWrite2(join19(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join20(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -52173,11 +52369,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync3(path, constants4.O_RDONLY | constants4.O_DIRECTORY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  const descriptor = openSync4(path, constants5.O_RDONLY | constants5.O_DIRECTORY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
   try {
     fsyncSync(descriptor);
   } finally {
-    closeSync3(descriptor);
+    closeSync4(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -52185,18 +52381,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID5()}`;
   let descriptor;
   try {
-    descriptor = openSync3(temporary, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, 384);
+    descriptor = openSync4(temporary, constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW, 384);
     writeFileSync5(descriptor, `${JSON.stringify(value)}
 `);
     fsyncSync(descriptor);
-    closeSync3(descriptor);
+    closeSync4(descriptor);
     descriptor = undefined;
     renameSync3(temporary, path);
-    syncArchiveDirectory(dirname7(path));
+    syncArchiveDirectory(dirname9(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync3(descriptor);
-    if (lstatSync8(temporary, { throwIfNoEntry: false }))
+      closeSync4(descriptor);
+    if (lstatSync10(temporary, { throwIfNoEntry: false }))
       unlinkSync2(temporary);
   }
 }
@@ -52207,7 +52403,7 @@ function archiveNativeSkills(inventory, options) {
   recheckRootAliases(aliases);
   for (const entry of inventory.filter((entry2) => entry2.bridge)) {
     const adapter = AGENT_ADAPTERS[entry.agent];
-    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join19(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
+    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join20(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
@@ -52217,11 +52413,11 @@ function archiveNativeSkills(inventory, options) {
       throw new Error(`Native skill changed after planning: ${entry.path}`);
   if (!selected.length)
     return { entries: [], ...aliases.length ? { rootAliases: aliases } : {} };
-  const operationId = randomUUID5(), archiveRoot = join19(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join19(archiveRoot, "receipt.json");
+  const operationId = randomUUID5(), archiveRoot = join20(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join20(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
-    source: entry.vendor ? join19(entry.path, "SKILL.md") : entry.path,
-    archive: join19(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
-    hash: entry.vendor ? sha(readNativeBytes(join19(entry.path, "SKILL.md"))) : entry.hash,
+    source: entry.vendor ? join20(entry.path, "SKILL.md") : entry.path,
+    archive: join20(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
+    hash: entry.vendor ? sha(readNativeBytes(join20(entry.path, "SKILL.md"))) : entry.hash,
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
@@ -52229,7 +52425,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat = lstatSync8(entry.archive);
+    const stat = lstatSync10(entry.archive);
     if (entry.discoveryOnly ? !stat.isFile() : !stat.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -52237,14 +52433,14 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync14(path); path = dirname7(path))
+  for (let path = archiveRoot;!existsSync14(path); path = dirname9(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname7(created.at(-1)));
+      syncArchiveDirectory(dirname9(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -52256,7 +52452,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync3(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname7(move.source));
+      syncArchiveDirectory(dirname9(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -52277,7 +52473,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync8(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync10(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -52291,10 +52487,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync(entry.archive, entry.source);
-          syncArchiveDirectory(dirname7(entry.source));
+          syncArchiveDirectory(dirname9(entry.source));
           unlinkSync2(entry.archive);
         } else {
-          if (lstatSync8(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync10(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -52302,7 +52498,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync3(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname7(entry.source));
+        syncArchiveDirectory(dirname9(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -52322,8 +52518,8 @@ function archiveNativeSkills(inventory, options) {
   return { entries: entries.map(({ status, conflict, ...entry }) => entry), receiptPath, ...aliases.length ? { rootAliases: aliases } : {} };
 }
 function assertManagedAgentBridge(agent, options = {}) {
-  const home = resolve7(options.home ?? homedir3()), dataDir3 = options.dataDir ?? getDataDirReadOnly();
-  assertSafePath(join19(dataDir3, "agent-policy.json"));
+  const home = resolve9(options.home ?? homedir3()), dataDir3 = options.dataDir ?? getDataDirReadOnly();
+  assertSafePath(join20(dataDir3, "agent-policy.json"));
   const snapshot = readManagedSkillPolicySnapshot(dataDir3);
   if (!snapshot)
     throw new Error("NATIVE_SKILL_DRIFT: install the Skills bridge with skills hook install");
@@ -52334,16 +52530,16 @@ function assertManagedAgentBridge(agent, options = {}) {
   if (!Array.isArray(aliases))
     throw new Error("NATIVE_SKILL_DRIFT: invalid root alias binding");
   recheckRootAliases(aliases);
-  const expected = canonicalAgentPath(join19(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
+  const expected = canonicalAgentPath(join20(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
   if (!isOwnedCliBridge(expected, [expected]))
     throw new Error("NATIVE_SKILL_DRIFT: the native Skills bridge is missing or modified; repair it before continuing");
   const roots = new Set;
   for (const project of [options.projectDir ?? process.cwd(), ...options.projectDirs ?? []]) {
-    for (let path = resolve7(project), depth = 0;; depth++) {
+    for (let path = resolve9(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       roots.add(path);
-      const parent = dirname7(path);
+      const parent = dirname9(path);
       if (parent === path)
         break;
       path = parent;
@@ -52351,17 +52547,19 @@ function assertManagedAgentBridge(agent, options = {}) {
   }
   const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep4}.agents${sep4}skills${sep4}`) || agent === "opencode" && entry.agent === "claude";
   assertProjectDiscovery(agent, [...roots], home, (path) => canonicalAgentPath(path, aliases));
-  const configPath = canonicalAgentPath(join19(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
+  const configPath = canonicalAgentPath(join20(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
   const command = binding.commands?.[agent], profile = binding.profiles?.[agent];
   if (typeof command !== "string" || typeof profile !== "string")
     throw new Error("NATIVE_SKILL_DRIFT: the native hook command/profile binding is missing");
+  if (options.profileId !== undefined && options.profileId !== profile)
+    throw new Error("NATIVE_SKILL_DRIFT: the hook selection profile differs from its managed binding; restart the native client after reviewing skills hook install");
   if (agent === "hermes") {
     const supervisor = binding.supervisors?.hermes;
-    if (supervisor?.path !== join19(dataDir3, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha(renderHermesSupervisor(command, profile)))
+    if (supervisor?.path !== join20(dataDir3, "agent-hooks", "hermes.js") || supervisor?.sha256 !== sha(renderHermesSupervisor(command, profile)))
       throw new Error("NATIVE_SKILL_DRIFT: Hermes supervisor binding changed; run skills hook install");
     assertHermesProtection(home, config, command, profile, supervisor);
   } else if (agent === "opencode") {
-    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join19(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
+    if (JSON.stringify(config.permission?.skill) !== JSON.stringify({ "*": "deny", [CLI_BRIDGE_NAME]: "allow" }) || readOptional(join20(home, ".config", "opencode", "plugins", "skills-cli.js")) !== renderOpenCodePlugin(command, profile))
       throw new Error("NATIVE_SKILL_DRIFT: OpenCode bridge protection changed; run skills hook install");
   } else {
     const required = {};
@@ -52376,13 +52574,13 @@ function assertManagedAgentBridge(agent, options = {}) {
     if (agent === "gemini" && (config.hooksConfig?.enabled === false || config.skills?.enabled !== true || !["antigravity-support", "skill-creator"].every((name) => config.skills?.disabled?.includes(name)) || config.skills?.disabled?.includes(CLI_BRIDGE_NAME)))
       throw new Error("NATIVE_SKILL_DRIFT: Gemini bridge or bundled-skill protection changed; run skills hook install");
   }
-  const codexPath = canonicalAgentPath(join19(home, ".codex", "config.toml"), aliases);
+  const codexPath = canonicalAgentPath(join20(home, ".codex", "config.toml"), aliases);
   const codexConfig = agent === "codex" ? Bun.TOML.parse(readOptional(codexPath) ?? "") : {};
-  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join19(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
+  const setting = (path) => (codexConfig.skills?.config ?? []).filter((entry) => typeof entry.path === "string" && [path, join20(path, "SKILL.md")].includes(canonicalAgentPath(entry.path, aliases)));
   if (agent === "codex" && setting(expected).some((entry) => entry.enabled === false))
     throw new Error("NATIVE_SKILL_DRIFT: the Codex CLI bridge is disabled; run skills hook install");
   const disabledBuiltin = (entry) => {
-    if (agent !== "codex" || !entry.vendor || !entry.path.startsWith(canonicalAgentPath(join19(home, ".codex", "skills", ".system"), aliases) + sep4))
+    if (agent !== "codex" || !entry.vendor || !entry.path.startsWith(canonicalAgentPath(join20(home, ".codex", "skills", ".system"), aliases) + sep4))
       return false;
     const matched = Array.isArray(binding.disabledBuiltins) && binding.disabledBuiltins.some((item) => item.path === entry.path && item.hash === entry.hash);
     const settings = setting(entry.path);
@@ -52408,12 +52606,30 @@ function assertManagedAgentBridge(agent, options = {}) {
     throw new Error("NATIVE_SKILL_DRIFT: unexpected native skill copies were found; review skills migrate native --include-unmanaged --include-vendor before continuing");
   recheckRootAliases(aliases);
 }
+function normalizeAgentHookPrompt(agent, event, prompt) {
+  if (agent !== "gemini" || event !== "BeforeAgent")
+    return prompt;
+  const prefix = `<hook_context>${SKILLS_LOADING_POLICY}`;
+  if (!prompt.startsWith(prefix))
+    return prompt;
+  const remainder = prompt.slice(prefix.length);
+  const closing = `</hook_context>
+
+`;
+  if (remainder.startsWith(closing))
+    return remainder.slice(closing.length);
+  if (remainder.startsWith(`
+
+`) && remainder.includes(closing))
+    return `<hook_context>${remainder.slice(2)}`;
+  return prompt;
+}
 function hookContextOutput(event, result2) {
   if (!HOOK_EVENTS.includes(event))
     throw new Error(`Unsupported context hook event: ${event}`);
   const omitted = result2.omitted?.slice(0, 10).map((entry) => `Additional selected skill ${entry.slug}@${entry.version}: ${entry.loadCommand}`).join(`
 `);
-  const policy = event === "SessionStart" || event === "SubagentStart" ? "Skills loading policy: discover skills with `skills list` or `skills search`, and read selected instructions with `skills load <slug>`. Use `skills sync` to refresh the shared profile. The only native skill is the owned skills-cli bridge. Create and edit payload skills in the Skills authoring workspace; do not copy payload instructions into native discovery folders. Context loading does not authorize execution; use `skills run` only when the task calls for running a skill." : "";
+  const policy = event === "SessionStart" || event === "SubagentStart" ? SKILLS_LOADING_POLICY : "";
   const context = [policy, result2.context, omitted].filter(Boolean).join(`
 
 `);
@@ -52425,7 +52641,7 @@ function assertNativeExportAllowed(dataDir3 = getDataDirReadOnly()) {
   if (requiresCliSkillLoading(dataDir3))
     throw new Error("NATIVE_SKILL_EXPORT_DISABLED: this station loads skills through the Skills CLI; use skills sync --selection-profile <id>");
 }
-var sha = (data) => createHash6("sha256").update(data).digest("hex"), HOOK_EVENTS, ROOTS;
+var sha = (data) => createHash8("sha256").update(data).digest("hex"), HOOK_EVENTS, ROOTS, SKILLS_LOADING_POLICY = "Skills loading policy: discover skills with `skills list` or `skills search`, and read selected instructions with `skills load <slug>`. Use `skills sync` to refresh the shared profile. The only native skill is the owned skills-cli bridge. Create and edit payload skills in the Skills authoring workspace; do not copy payload instructions into native discovery folders. Context loading does not authorize execution; use `skills run` only when the task calls for running a skill.";
 var init_agent_integration = __esm(() => {
   init_config();
   init_managed_policy();
@@ -52455,15 +52671,15 @@ var init_agent_integration = __esm(() => {
 
 // src/lib/home-migration.ts
 import { existsSync as existsSync15, mkdirSync as mkdirSync6, readdirSync as readdirSync11, renameSync as renameSync4, rmSync as rmSync2, statSync as statSync9, writeFileSync as writeFileSync6 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function layoutMigrationRecordPath(appDir) {
-  return join20(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD);
+  return join21(appDir, SKILLS_CACHE_DIRNAME, LAYOUT_MIGRATION_RECORD);
 }
 function resolveCorpusRoot(options = {}) {
   return getPortableSkillsRoot(options);
 }
 function migrationAppDir(homeDir) {
-  return homeDir ? join20(homeDir, ".hasna", "skills") : getDataDir();
+  return homeDir ? join21(homeDir, ".hasna", "skills") : getDataDir();
 }
 function looksLikeSkillDirectory2(path) {
   try {
@@ -52472,7 +52688,7 @@ function looksLikeSkillDirectory2(path) {
   } catch {
     return false;
   }
-  return existsSync15(join20(path, "SKILL.md")) || existsSync15(join20(path, "skill.json")) || existsSync15(join20(path, "package.json"));
+  return existsSync15(join21(path, "SKILL.md")) || existsSync15(join21(path, "skill.json")) || existsSync15(join21(path, "package.json"));
 }
 function listLegacyFlatSkillDirs(appDir) {
   const legacy = [];
@@ -52490,14 +52706,14 @@ function listLegacyFlatSkillDirs(appDir) {
     if (entry === SKILLS_CACHE_DIRNAME || entry === INSTALLED_SKILLS_DIRNAME || entry === LEGACY_CUSTOM_DIRNAME2 || entry === LOGS_DIRNAME || entry === OUTPUTS_DIRNAME) {
       continue;
     }
-    if (looksLikeSkillDirectory2(join20(appDir, entry)))
+    if (looksLikeSkillDirectory2(join21(appDir, entry)))
       legacy.push(entry);
   }
   return legacy;
 }
 function createLazyDirs(appDir, created) {
   for (const name of [LOGS_DIRNAME, OUTPUTS_DIRNAME]) {
-    const dir = join20(appDir, name);
+    const dir = join21(appDir, name);
     if (!existsSync15(dir)) {
       mkdirSync6(dir, { recursive: true });
       created.push(dir);
@@ -52506,8 +52722,8 @@ function createLazyDirs(appDir, created) {
 }
 function migrateOwnerLayout(options = {}) {
   const appDir = migrationAppDir(options.homeDir);
-  const cache3 = join20(appDir, SKILLS_CACHE_DIRNAME);
-  const installed = join20(appDir, INSTALLED_SKILLS_DIRNAME);
+  const cache3 = join21(appDir, SKILLS_CACHE_DIRNAME);
+  const installed = join21(appDir, INSTALLED_SKILLS_DIRNAME);
   const moved = [];
   const created = [];
   if (isOwnerLayoutMigrated(appDir)) {
@@ -52567,7 +52783,7 @@ function migrateOwnerLayout(options = {}) {
     mkdirSync6(cache3, { recursive: true });
   }
   for (const name of legacy) {
-    renameSync4(join20(appDir, name), join20(cache3, name));
+    renameSync4(join21(appDir, name), join21(cache3, name));
     moved.push(name);
   }
   createLazyDirs(appDir, created);
@@ -52592,7 +52808,7 @@ var init_home_migration = __esm(() => {
 import {
   cpSync as cpSync3,
   existsSync as existsSync16,
-  lstatSync as lstatSync9,
+  lstatSync as lstatSync11,
   mkdirSync as mkdirSync7,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync13,
@@ -52603,14 +52819,14 @@ import {
   writeFileSync as writeFileSync7
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename3, dirname as dirname8, join as join21 } from "path";
+import { basename as basename3, dirname as dirname10, join as join22 } from "path";
 function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
-  const path = join21(dir, SYNC_MARKER_FILE);
+  const path = join22(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync9(path).isFile())
+    if (!lstatSync11(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync13(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -52632,9 +52848,9 @@ function resolveSyncAgents(arg) {
 function agentGlobalSkillsDir(agent, homeDir = homedir4()) {
   switch (agent) {
     case "opencode":
-      return join21(homeDir, ".config", "opencode", "skills");
+      return join22(homeDir, ".config", "opencode", "skills");
     default:
-      return join21(homeDir, `.${agent}`, "skills");
+      return join22(homeDir, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -52692,7 +52908,7 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate = join21(source, sub);
+    const candidate = join22(source, sub);
     if (existsSync16(candidate) && isDirectory(candidate))
       roots.push(candidate);
   }
@@ -52708,10 +52924,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate = join21(path, entry);
+    const candidate = join22(path, entry);
     if (!isDirectory(candidate))
       return false;
-    return existsSync16(join21(candidate, "SKILL.md")) || existsSync16(join21(candidate, "skill.json")) || existsSync16(join21(candidate, "package.json"));
+    return existsSync16(join22(candidate, "SKILL.md")) || existsSync16(join22(candidate, "skill.json")) || existsSync16(join22(candidate, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -52751,7 +52967,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join21(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
+          path: join22(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -52781,7 +52997,7 @@ function syncSkillsToAgents(options = {}) {
 }
 function writeManagedAgentSkill(params) {
   const homeDir = params.homeDir ?? homedir4();
-  const dir = join21(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
+  const dir = join22(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
   const result2 = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -52798,8 +53014,8 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join21(dir, "SKILL.md");
-  const markerPath = join21(dir, SYNC_MARKER_FILE);
+  const skillMdPath = join22(dir, "SKILL.md");
+  const markerPath = join22(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync16(dir);
   const managed = hasSkillsOwnershipMarker(dir);
   const hasSkillMd = existsSync16(skillMdPath);
@@ -52835,13 +53051,13 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname8(dir);
+  const parentDir = dirname10(dir);
   mkdirSync7(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join21(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
-  const candidateDir = join21(transactionDir, "candidate");
-  const backupDir = join21(transactionDir, "backup");
-  const candidateSkillMdPath = join21(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join21(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join22(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
+  const candidateDir = join22(transactionDir, "candidate");
+  const backupDir = join22(transactionDir, "backup");
+  const candidateSkillMdPath = join22(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join22(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -52891,7 +53107,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join21(skillPath, "SKILL.md");
+    const skillMdPath = join22(skillPath, "SKILL.md");
     if (existsSync16(skillMdPath))
       return readFileSync13(skillMdPath, "utf-8");
   }
@@ -52931,12 +53147,12 @@ function normalizeSkillName(name) {
 
 // src/lib/project-state.ts
 import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join22(targetDir, SKILLS_PROJECT_DIR);
+  return join23(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join22(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join23(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
@@ -53098,31 +53314,31 @@ __export(exports_installer, {
   AGENT_LABELS: () => AGENT_LABELS
 });
 import { existsSync as existsSync18, readFileSync as readFileSync15, rmSync as rmSync4 } from "fs";
-import { dirname as dirname9, join as join23 } from "path";
+import { dirname as dirname11, join as join24 } from "path";
 import { homedir as homedir5 } from "os";
 import { fileURLToPath } from "url";
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join23(dir, "skills");
+    const candidate = join24(dir, "skills");
     if (existsSync18(candidate) && !dir.includes(".skills"))
       return candidate;
-    dir = dirname9(dir);
+    dir = dirname11(dir);
   }
-  return join23(__dirname2, "..", "skills");
+  return join24(__dirname2, "..", "skills");
 }
 function getSkillPath(name) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join23(getDataDir(), "custom", skillName);
+  const legacyCustomPath = join24(getDataDir(), "custom", skillName);
   if (existsSync18(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join23(SKILLS_DIR, skillName);
+  return join24(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -53208,7 +53424,7 @@ function createLocalSkillManifest(name, generateSkillMd) {
   if (!existsSync18(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join23(sourcePath, "SKILL.md");
+  const skillMdPath = join24(sourcePath, "SKILL.md");
   if (existsSync18(skillMdPath)) {
     skillMd = readFileSync15(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
@@ -53290,16 +53506,16 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base2 = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join23(base2, ".pi", "skills") : join23(homedir5(), ".pi", "agent", "skills");
+      return scope === "project" ? join24(base2, ".pi", "skills") : join24(homedir5(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join23(base2, ".opencode", "skills") : join23(homedir5(), ".config", "opencode", "skills");
+      return scope === "project" ? join24(base2, ".opencode", "skills") : join24(homedir5(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join23(base2, `.${agent}`, "skills") : join23(homedir5(), `.${agent}`, "skills");
+      return scope === "project" ? join24(base2, `.${agent}`, "skills") : join24(homedir5(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join23(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join24(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   assertNativeExportAllowed();
@@ -53335,7 +53551,7 @@ function removeSkillForAgent(name, options) {
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join23(sourcePath, "SKILL.md");
+  const skillMdPath = join24(sourcePath, "SKILL.md");
   if (existsSync18(skillMdPath))
     return readFileSync15(skillMdPath, "utf-8");
   if (generateSkillMd)
@@ -53370,7 +53586,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join23(sourcePath, "README.md")) || readFileIfExists(join23(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join24(sourcePath, "README.md")) || readFileIfExists(join24(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -53389,7 +53605,7 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join23(getSkillPath(name), "package.json");
+  const pkgPath = join24(getSkillPath(name), "package.json");
   if (!existsSync18(pkgPath))
     return "unknown";
   try {
@@ -53414,7 +53630,7 @@ var init_installer = __esm(() => {
   init_registry();
   init_skill_aliases();
   init_project_state();
-  __dirname2 = dirname9(fileURLToPath(import.meta.url));
+  __dirname2 = dirname11(fileURLToPath(import.meta.url));
   SKILLS_DIR = findSkillsDir();
   AGENT_TARGETS = ["claude", "codex", "gemini", "pi", "opencode", "cursor", "windsurf"];
   AGENT_LABELS = {
@@ -53518,11 +53734,11 @@ var init_discovery = __esm(() => {
 // ../contracts/dist/client/transport.js
 import { isIP as isIP2 } from "net";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync4, fstatSync as fstatSync4, openSync as openSync4, readFileSync as readFileSync16 } from "fs";
+import { closeSync as closeSync5, fstatSync as fstatSync5, openSync as openSync5, readFileSync as readFileSync16 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
 import { createRequire as createRequire2 } from "module";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute6, join as join24 } from "path";
+import { isAbsolute as isAbsolute8, join as join25 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -53545,21 +53761,21 @@ function homeDir(env3) {
 }
 function absoluteOverride(env3, key) {
   const value = env3[key]?.trim();
-  return value && isAbsolute6(value) ? value : null;
+  return value && isAbsolute8(value) ? value : null;
 }
 function hasnaHomeDir(env3) {
   const override = absoluteOverride(env3, HASNA_HOME_ENV_KEY);
   if (override)
     return override;
   const home = homeDir(env3);
-  return home ? join24(home, HASNA_HOME_DIR) : null;
+  return home ? join25(home, HASNA_HOME_DIR) : null;
 }
 function appConfigDir(name, env3) {
   const configRoot = absoluteOverride(env3, HASNA_CONFIG_HOME_ENV_KEY);
   if (configRoot)
-    return join24(configRoot, name);
+    return join25(configRoot, name);
   const root = hasnaHomeDir(env3);
-  return root ? join24(root, name, CONFIG_SUBDIR) : null;
+  return root ? join25(root, name, CONFIG_SUBDIR) : null;
 }
 function credentialDiskSourceList(name, env3, profile = null) {
   if (!SAFE_APP_SLUG.test(name))
@@ -53568,7 +53784,7 @@ function credentialDiskSourceList(name, env3, profile = null) {
   if (!directory)
     return [];
   const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
-  return [{ path: join24(directory, file), tier: "disk" }];
+  return [{ path: join25(directory, file), tier: "disk" }];
 }
 function credentialDiskSources(name, env3) {
   return credentialDiskSourceList(name, env3, null).map((s) => s.path);
@@ -53622,7 +53838,7 @@ function readAppConfigFile(path) {
   };
   let fd = -1;
   try {
-    fd = openSync4(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+    fd = openSync5(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -53632,7 +53848,7 @@ function readAppConfigFile(path) {
     unsafe(`the path could not be opened (${code ?? "unknown error"})`);
   }
   try {
-    const before2 = fstatSync4(fd);
+    const before2 = fstatSync5(fd);
     if (!before2.isFile())
       unsafe("the path is not a regular file");
     if (!configFileModeAllowed(before2.mode)) {
@@ -53644,14 +53860,14 @@ function readAppConfigFile(path) {
     if (before2.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync16(fd);
-    const after2 = fstatSync4(fd);
+    const after2 = fstatSync5(fd);
     if (!configFileReadsCoherent(before2, after2)) {
       unsafe("the file changed while being read");
     }
     return parseEnvFile(bytes.toString("utf8"));
   } finally {
     if (fd !== -1)
-      closeSync4(fd);
+      closeSync5(fd);
   }
 }
 function readCredentialFile(path, apiKeyKeys) {
@@ -54191,7 +54407,7 @@ var init_transport = __esm(() => {
 });
 
 // src/lib/instance-credentials.ts
-import { closeSync as closeSync5, constants as constants5, fstatSync as fstatSync5, lstatSync as lstatSync10, openSync as openSync5, readSync as readSync4 } from "fs";
+import { closeSync as closeSync6, constants as constants6, fstatSync as fstatSync6, lstatSync as lstatSync12, openSync as openSync6, readSync as readSync5 } from "fs";
 function selectedSkillsProfile(env3, explicit) {
   const selected = explicit ?? env3.HASNA_PROFILE;
   if (selected === undefined)
@@ -54206,7 +54422,7 @@ function skillsProfileCredentialFiles(env3, explicit) {
 }
 function fileIdentity(file) {
   try {
-    return lstatSync10(file);
+    return lstatSync12(file);
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
       return null;
@@ -54227,14 +54443,14 @@ function captureSkillsCredentialFiles(files) {
 function readMetadataText(file) {
   let fd;
   try {
-    fd = openSync5(file, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
+    fd = openSync6(file, constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
       return null;
     throw new Error("Cannot safely read Skills instance configuration");
   }
   try {
-    const before2 = fstatSync5(fd);
+    const before2 = fstatSync6(fd);
     const uid = process.getuid?.() ?? process.geteuid?.();
     if (!before2.isFile() || ![256, 384].includes(before2.mode & 4095) || uid !== undefined && before2.uid !== uid || before2.size > 64 * 1024) {
       throw new Error("Unsafe Skills instance configuration; expected a bounded owner-only regular file");
@@ -54242,17 +54458,17 @@ function readMetadataText(file) {
     const bytes = Buffer.alloc(64 * 1024 + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync4(fd, bytes, length, bytes.length - length, null);
+      const count = readSync5(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    if (length > 64 * 1024 || !unchanged(before2, fstatSync5(fd)) || !unchanged(before2, fileIdentity(file))) {
+    if (length > 64 * 1024 || !unchanged(before2, fstatSync6(fd)) || !unchanged(before2, fileIdentity(file))) {
       throw new Error("Skills instance configuration changed while reading");
     }
     return bytes.subarray(0, length).toString("utf8");
   } finally {
-    closeSync5(fd);
+    closeSync6(fd);
   }
 }
 function readSkillsInstanceMetadata(file) {
@@ -59215,13 +59431,13 @@ var init_remote_workspace_leave = __esm(() => {
 
 // src/lib/auth-store.ts
 import { chmodSync as chmodSync2, existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync17, renameSync as renameSync6, statSync as statSync11, unlinkSync as unlinkSync3, writeFileSync as writeFileSync9 } from "fs";
-import { basename as basename4, dirname as dirname10, join as join25 } from "path";
+import { basename as basename4, dirname as dirname12, join as join26 } from "path";
 function getAuthFilePath(env3 = process.env) {
   return skillsCredentialFilePath(env3);
 }
 function getIdentityFilePath(env3 = process.env) {
   const file = skillsCredentialFilePath(env3);
-  return join25(dirname10(file), basename4(file).replace(/^credentials/, "identity") + ".json");
+  return join26(dirname12(file), basename4(file).replace(/^credentials/, "identity") + ".json");
 }
 function getAuthIdentity(env3 = process.env) {
   return readIdentity(env3);
@@ -59255,7 +59471,7 @@ function getAuthConfig(env3 = process.env, options = {}) {
 }
 function writeCredentialValues(values2, env3 = process.env) {
   const file = skillsCredentialFilePath(env3);
-  mkdirSync9(dirname10(file), { recursive: true, mode: 448 });
+  mkdirSync9(dirname12(file), { recursive: true, mode: 448 });
   const lines = [];
   const written = new Set;
   if (existsSync19(file)) {
@@ -59526,7 +59742,7 @@ __export(exports_remote_files, {
   decodeRemoteFiles: () => decodeRemoteFiles,
   MAX_REMOTE_FILE_BYTES: () => MAX_REMOTE_FILE_BYTES
 });
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function describeRemoteFiles(files) {
   if (files.length > 10)
     throw new Error("At most 10 input files are supported");
@@ -59543,7 +59759,7 @@ function describeRemoteFiles(files) {
   });
 }
 function sha256(bytes) {
-  return createHash7("sha256").update(bytes).digest("hex");
+  return createHash9("sha256").update(bytes).digest("hex");
 }
 async function readBoundedResponse(response, maximum) {
   if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
@@ -59646,10 +59862,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve8) => {
+  const deadline = new Promise((resolve10) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve8(expired);
+      resolve10(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -60497,7 +60713,7 @@ var init_remote_client = __esm(() => {
 });
 
 // src/lib/revision.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function revisionIdOf(content) {
   const canonical = JSON.stringify({
     slug: content.slug,
@@ -60512,7 +60728,7 @@ function revisionIdOf(content) {
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
   });
-  return createHash8("sha256").update(canonical).digest("hex");
+  return createHash10("sha256").update(canonical).digest("hex");
 }
 var REVISION_ID_PATTERN;
 var init_revision = __esm(() => {
@@ -60542,7 +60758,7 @@ var init_skill_bundles = __esm(() => {
 
 // src/lib/pull.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync3, readFileSync as readFileSync18, renameSync as renameSync7, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname11, join as join26 } from "path";
+import { dirname as dirname13, join as join27 } from "path";
 async function pullSkills(options = {}) {
   const client = options.client !== undefined ? options.client : await createRemoteSkillsClient();
   if (!client) {
@@ -60598,7 +60814,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
       return reconcileTombstone(slug, corpusOptions);
     }
     if (bundleResponse.status === 404) {
-      const marker = readPullMarker(join26(getPortableSkillsRoot(corpusOptions), slug));
+      const marker = readPullMarker(join27(getPortableSkillsRoot(corpusOptions), slug));
       if (isPublishedInstallMarker(marker)) {
         return { name: slug, success: true, purged: true, removed: false };
       }
@@ -60637,7 +60853,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
     return { name: slug, success: false, error: `Skill '${slug}' was not found on the configured Skills instance.` };
   }
   if (!meta?.revisionId) {
-    const marker = readPullMarker(join26(getPortableSkillsRoot(corpusOptions), slug));
+    const marker = readPullMarker(join27(getPortableSkillsRoot(corpusOptions), slug));
     if (isPublishedInstallMarker(marker)) {
       return { name: slug, success: true, purged: true, removed: false };
     }
@@ -60694,7 +60910,7 @@ function provenRevision(meta, slug, bundle) {
   return declared;
 }
 function reconcileTombstone(slug, corpusOptions) {
-  const target = join26(getPortableSkillsRoot(corpusOptions), slug);
+  const target = join27(getPortableSkillsRoot(corpusOptions), slug);
   if (!hasSkillsOwnershipMarker(target)) {
     return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
@@ -60703,7 +60919,7 @@ function reconcileTombstone(slug, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync18(join26(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync18(join27(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
@@ -60838,15 +61054,15 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root = getPortableSkillsRoot(options);
   mkdirSync10(root, { recursive: true });
-  const target = join26(root, name);
+  const target = join27(root, name);
   const created = !existsSync20(target);
-  const staging = mkdtempSync3(join26(root, `.pull-${name}-`));
+  const staging = mkdtempSync3(join27(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
-      const destination = join26(staging, entry.path);
-      mkdirSync10(dirname11(destination), { recursive: true });
+      const destination = join27(staging, entry.path);
+      mkdirSync10(dirname13(destination), { recursive: true });
       writeFileSync10(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
@@ -60858,8 +61074,8 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
     if (existsSync20(target)) {
-      backup = mkdtempSync3(join26(root, `.pull-backup-${name}-`));
-      renameSync7(target, join26(backup, name));
+      backup = mkdtempSync3(join27(root, `.pull-backup-${name}-`));
+      renameSync7(target, join27(backup, name));
       moved = true;
     }
     renameSync7(staging, target);
@@ -60867,9 +61083,9 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       rmSync5(backup, { recursive: true, force: true });
   } catch (error) {
     rmSync5(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync20(join26(backup, name))) {
+    if (moved && backup && existsSync20(join27(backup, name))) {
       try {
-        renameSync7(join26(backup, name), target);
+        renameSync7(join27(backup, name), target);
       } catch {}
     }
     throw error;
@@ -60888,7 +61104,7 @@ function writePullMarker(dir, record5) {
     ...record5.revisionId ? { revisionId: record5.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync10(join26(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync10(join27(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client, slug) {
@@ -61135,19 +61351,19 @@ function capturePreparationProcess(child, platform2 = process.platform, signalGr
 }
 
 // src/lib/dependency-preparation.ts
-import { constants as constants6, closeSync as closeSync6, fstatSync as fstatSync6, lstatSync as lstatSync11, mkdirSync as mkdirSync11, openSync as openSync6, readFileSync as readFileSync19, readdirSync as readdirSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync4, ftruncateSync, writeSync } from "fs";
-import { join as join27 } from "path";
+import { constants as constants7, closeSync as closeSync7, fstatSync as fstatSync7, lstatSync as lstatSync13, mkdirSync as mkdirSync11, openSync as openSync7, readFileSync as readFileSync19, readdirSync as readdirSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync4, ftruncateSync, writeSync } from "fs";
+import { join as join28 } from "path";
 function hasDependencyPreparationMarker(skillPath) {
   try {
-    lstatSync11(join27(skillPath, DEPENDENCY_PREPARATION_MARKER));
+    lstatSync13(join28(skillPath, DEPENDENCY_PREPARATION_MARKER));
     return true;
   } catch (error) {
     return error.code !== "ENOENT";
   }
 }
 function claimPreparation(skillPath) {
-  const marker = join27(skillPath, DEPENDENCY_PREPARATION_MARKER);
-  const state = join27(marker, "state.json"), active = join27(marker, "active");
+  const marker = join28(skillPath, DEPENDENCY_PREPARATION_MARKER);
+  const state = join28(marker, "state.json"), active = join28(marker, "active");
   let created = false;
   try {
     mkdirSync11(marker, { mode: 448 });
@@ -61158,21 +61374,21 @@ function claimPreparation(skillPath) {
   }
   let fd;
   try {
-    if (!lstatSync11(marker).isDirectory() || lstatSync11(marker).isSymbolicLink())
+    if (!lstatSync13(marker).isDirectory() || lstatSync13(marker).isSymbolicLink())
       return;
     if (!created) {
       if (readdirSync13(marker).some((name) => name !== "state.json"))
         return;
-      if (!lstatSync11(state).isFile() || lstatSync11(state).isSymbolicLink() || lstatSync11(state).size > 1024)
+      if (!lstatSync13(state).isFile() || lstatSync13(state).isSymbolicLink() || lstatSync13(state).size > 1024)
         return;
       const previous = JSON.parse(readFileSync19(state, "utf8"));
       if (previous.version !== 1 || previous.status !== "failed" || Object.keys(previous).length !== 2)
         return;
     }
     mkdirSync11(active, { mode: 448 });
-    fd = openSync6(state, constants6.O_RDWR | constants6.O_NOFOLLOW | (created ? constants6.O_CREAT | constants6.O_EXCL : 0), 384);
-    if (!fstatSync6(fd).isFile()) {
-      closeSync6(fd);
+    fd = openSync7(state, constants7.O_RDWR | constants7.O_NOFOLLOW | (created ? constants7.O_CREAT | constants7.O_EXCL : 0), 384);
+    if (!fstatSync7(fd).isFile()) {
+      closeSync7(fd);
       return;
     }
     const descriptor = fd;
@@ -61184,7 +61400,7 @@ function claimPreparation(skillPath) {
     record5("pending");
     return { abandon() {
       try {
-        closeSync6(descriptor);
+        closeSync7(descriptor);
       } catch {}
     }, finish(success) {
       try {
@@ -61192,7 +61408,7 @@ function claimPreparation(skillPath) {
           unlinkSync4(state);
         else
           record5("failed");
-        closeSync6(descriptor);
+        closeSync7(descriptor);
         fd = undefined;
         rmdirSync2(active);
         if (success)
@@ -61200,7 +61416,7 @@ function claimPreparation(skillPath) {
         return true;
       } catch {
         try {
-          closeSync6(descriptor);
+          closeSync7(descriptor);
         } catch {}
         return false;
       }
@@ -61208,7 +61424,7 @@ function claimPreparation(skillPath) {
   } catch {
     if (fd !== undefined)
       try {
-        closeSync6(fd);
+        closeSync7(fd);
       } catch {}
     return;
   }
@@ -61312,11 +61528,11 @@ __export(exports_skillinfo, {
   detectProjectSkills: () => detectProjectSkills
 });
 import { existsSync as existsSync21, readFileSync as readFileSync20 } from "fs";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join28(skillPath, "SKILL.md");
+  const skillMdPath = join29(skillPath, "SKILL.md");
   if (!existsSync21(skillMdPath))
     return false;
   try {
@@ -61330,9 +61546,9 @@ function getSkillDocs(name) {
   if (!existsSync21(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join28(skillPath, "SKILL.md")),
-    readme: readIfExists(join28(skillPath, "README.md")),
-    claudeMd: readIfExists(join28(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join29(skillPath, "SKILL.md")),
+    readme: readIfExists(join29(skillPath, "README.md")),
+    claudeMd: readIfExists(join29(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -61347,14 +61563,14 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join28(skillPath, file));
+    const content = readIfExists(join29(skillPath, file));
     if (content)
       texts.push(content);
   }
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync20(join28(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync20(join29(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -61406,9 +61622,9 @@ function isHostedPremiumSkill(skillName, meta) {
 function isPackageResolvable(pkgName, fromDir) {
   let dir = fromDir;
   while (true) {
-    if (existsSync21(join28(dir, "node_modules", pkgName, "package.json")))
+    if (existsSync21(join29(dir, "node_modules", pkgName, "package.json")))
       return true;
-    const parent = join28(dir, "..");
+    const parent = join29(dir, "..");
     if (parent === dir)
       return false;
     dir = parent;
@@ -61437,7 +61653,7 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join28(skillPath, "package.json");
+  const pkgPath = join29(skillPath, "package.json");
   if (!existsSync21(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
@@ -61457,12 +61673,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join28(skillPath, entryPoint);
+  const entryPath = join29(skillPath, entryPoint);
   if (!existsSync21(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
   const env3 = { ...process.env, ...options.env };
-  if (!existsSync21(join28(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync21(join29(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env3, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -61486,7 +61702,7 @@ async function runSkill(name, args, options = {}) {
   return { exitCode };
 }
 function detectProjectSkills(cwd2 = process.cwd()) {
-  const pkgPath = join28(cwd2, "package.json");
+  const pkgPath = join29(cwd2, "package.json");
   if (!existsSync21(pkgPath)) {
     const alwaysRecommend = ["market-research-report", "repo-onboarding-report", "blog-article"];
     const recommended2 = alwaysRecommend.map((name) => loadRegistry().find((s) => s.name === name)).filter((s) => s !== undefined);
@@ -61623,10 +61839,10 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join28(skillPath, "README.md"));
-  const claudeMd = readIfExists(join28(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join29(skillPath, "README.md"));
+  const claudeMd = readIfExists(join29(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join28(skillPath, "package.json");
+  const pkgPath = join29(skillPath, "package.json");
   if (existsSync21(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync20(pkgPath, "utf-8"));
@@ -61899,8 +62115,8 @@ var init_selection_resolver = __esm(() => {
 });
 
 // src/lib/skill-context.ts
-import { createHash as createHash9 } from "crypto";
-import { resolve as resolve8 } from "path";
+import { createHash as createHash11 } from "crypto";
+import { resolve as resolve10 } from "path";
 function words2(value) {
   return new Set(value.toLowerCase().match(/[a-z0-9]+/g) ?? []);
 }
@@ -61934,7 +62150,7 @@ async function buildSkillContext(input, options = {}) {
   }
   const promptWords = words2(prompt);
   const loaded = new Set(resolved.session?.loaded ?? []);
-  const paths = [...input.paths ?? [], ...input.cwd ? [input.cwd, resolve8(input.cwd)] : []];
+  const paths = [...input.paths ?? [], ...input.cwd ? [input.cwd, resolve10(input.cwd)] : []];
   const candidates = profile.selections.map((selection) => {
     const key = selectionKey(selection);
     if (input.restore && loaded.has(key))
@@ -61986,7 +62202,7 @@ ${content}`;
 `);
   const receipt = {
     schemaVersion: 1,
-    id: createHash9("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
+    id: createHash11("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
     profileId: profile.profileId,
     profileRevision: profile.profileRevision,
     authority: profile.authority,
@@ -62016,7 +62232,7 @@ __export(exports_context, {
   parseSkillContextInput: () => parseSkillContextInput,
   contextResolverOptions: () => contextResolverOptions
 });
-import { readSync as readSync5 } from "fs";
+import { readSync as readSync6 } from "fs";
 function selectedProfileId(explicit) {
   return explicit ?? process.env.HASNA_SKILLS_SELECTION_PROFILE ?? readManagedSkillPolicy()?.profileId ?? "default";
 }
@@ -62075,7 +62291,7 @@ async function readContextStdin() {
   let size2 = 0;
   while (true) {
     const chunk2 = Buffer.allocUnsafe(8192);
-    const count = readSync5(0, chunk2, 0, chunk2.length, null);
+    const count = readSync6(0, chunk2, 0, chunk2.length, null);
     if (count === 0)
       break;
     size2 += count;
@@ -62551,12 +62767,12 @@ function handleBrowseError(error) {
 async function writeJson(value, space) {
   const text3 = `${JSON.stringify(value, null, space)}
 `;
-  await new Promise((resolve9, reject2) => {
+  await new Promise((resolve11, reject2) => {
     process.stdout.write(text3, (error) => {
       if (error)
         reject2(error);
       else
-        resolve9();
+        resolve11();
     });
   });
 }
@@ -62871,7 +63087,7 @@ __export(exports_introspect, {
   registerIntrospect: () => registerIntrospect
 });
 import { existsSync as existsSync22, readFileSync as readFileSync21 } from "fs";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 import { execSync } from "child_process";
 function registerIntrospect(parent) {
   parent.command("info").argument("<skill>", "Skill name").option("--json", "Output as JSON", false).option("--brief", "Single line: name \u2014 description [category] (tags: ...)", false).option("--remote", "Use the remote registry (the resolved Skills credential; HASNA_SKILLS_API_URL for your own instance)", false).description("Show details about a specific skill").action((name, options) => {
@@ -63104,8 +63320,8 @@ function handleDiff(name, options) {
   const bare = name;
   const normalized = normalizePortableSkillName(bare);
   const sourcePath = getSkillPath(bare);
-  const canonicalDir = join29(resolveCorpusRoot(), normalized);
-  const canonicalSkillMd = join29(canonicalDir, "SKILL.md");
+  const canonicalDir = join30(resolveCorpusRoot(), normalized);
+  const canonicalSkillMd = join30(canonicalDir, "SKILL.md");
   const canonical = {
     present: existsSync22(canonicalSkillMd),
     path: canonicalDir,
@@ -63115,7 +63331,7 @@ function handleDiff(name, options) {
   const pinned = getInstalledSkills().includes(bare);
   const installMeta = getInstallMeta();
   const installedVersion = installMeta.skills[bare]?.version ?? "unknown";
-  const registryPkgPath = join29(sourcePath, "package.json");
+  const registryPkgPath = join30(sourcePath, "package.json");
   let registryVersion = "unknown";
   if (existsSync22(registryPkgPath)) {
     try {
@@ -63125,10 +63341,10 @@ function handleDiff(name, options) {
   const upToDate = installedVersion === registryVersion;
   const homes = [];
   for (const agent of SYNC_AGENTS) {
-    const dir = join29(agentGlobalSkillsDir(agent), normalized);
+    const dir = join30(agentGlobalSkillsDir(agent), normalized);
     const present = existsSync22(dir);
-    const managed = existsSync22(join29(dir, SYNC_MARKER_FILE));
-    const skillMdPath = join29(dir, "SKILL.md");
+    const managed = existsSync22(join30(dir, SYNC_MARKER_FILE));
+    const skillMdPath = join30(dir, "SKILL.md");
     const hash2 = present && existsSync22(skillMdPath) ? hashSkillMarkdownFile(skillMdPath) : undefined;
     let stub;
     if (present && existsSync22(skillMdPath)) {
@@ -63671,7 +63887,7 @@ __export(exports_init, {
   registerSetup: () => registerSetup
 });
 import { existsSync as existsSync23, readFileSync as readFileSync22, writeFileSync as writeFileSync11, appendFileSync } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 function registerSetup(parent) {
   parent.command("init").option("--json", "Output as JSON", false).option("--for <agent>", "Detect project type and show MCP registration guidance for agent").option("--scope <scope>", "Deprecated; agent skill-folder installs are disabled", "global").description("Initialize project for pinned skills (.env.example, .gitignore)").action((options) => handleInit(options));
   parent.command("export").option("--json", "Output as JSON (default behavior)", false).description("Export pinned skills to JSON for sharing or backup").action((_options) => handleExport());
@@ -63755,7 +63971,7 @@ Use: skills render`));
       lines.push(`# Used by: ${skills.join(", ")}`);
       lines.push(`${envVar}=`);
     }
-    writeFileSync11(join30(cwd2, ".env.example"), lines.join(`
+    writeFileSync11(join31(cwd2, ".env.example"), lines.join(`
 `) + `
 `);
     envVarCount = envMap.size;
@@ -63763,7 +63979,7 @@ Use: skills render`));
       console.log(source_default.green(`\u2713 Generated .env.example (${envVarCount} variables from ${installed.length} skills)`));
   } else if (!options.json)
     console.log(source_default.dim("  No environment variables detected across pinned skills"));
-  const gitignorePath = join30(cwd2, ".gitignore");
+  const gitignorePath = join31(cwd2, ".gitignore");
   const gitignoreEntries = [".skills/runs/", ".skills/exports/", ".skills/tmp/"];
   let gitignoreContent = existsSync23(gitignorePath) ? readFileSync22(gitignorePath, "utf-8") : "";
   let gitignoreUpdated = false;
@@ -63917,9 +64133,9 @@ var init_init = __esm(() => {
 });
 
 // src/lib/home-adoption.ts
-import { constants as constants7, closeSync as closeSync7, fstatSync as fstatSync7, lstatSync as lstatSync12, openSync as openSync7, readSync as readSync6, existsSync as existsSync24, mkdirSync as mkdirSync12, readdirSync as readdirSync14, readFileSync as readFileSync23, rmSync as rmSync6, statSync as statSync12, writeFileSync as writeFileSync12 } from "fs";
+import { constants as constants8, closeSync as closeSync8, fstatSync as fstatSync8, lstatSync as lstatSync14, openSync as openSync8, readSync as readSync7, existsSync as existsSync24, mkdirSync as mkdirSync12, readdirSync as readdirSync14, readFileSync as readFileSync23, rmSync as rmSync6, statSync as statSync12, writeFileSync as writeFileSync12 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 function indexCanonicalCorpus(corpusRoot) {
   const byName = new Map;
   if (!existsSync24(corpusRoot))
@@ -63933,7 +64149,7 @@ function indexCanonicalCorpus(corpusRoot) {
   for (const entry of entries.sort()) {
     if (entry.startsWith("."))
       continue;
-    const skillMd = join31(corpusRoot, entry, "SKILL.md");
+    const skillMd = join32(corpusRoot, entry, "SKILL.md");
     if (!existsSync24(skillMd))
       continue;
     try {
@@ -63953,7 +64169,7 @@ function selectedHomeNames(options, index, homeDir2, agents) {
       continue;
     const present = agents.some((agent) => {
       try {
-        return statSync12(join31(agentGlobalSkillsDir(agent, homeDir2), name)).isDirectory();
+        return statSync12(join32(agentGlobalSkillsDir(agent, homeDir2), name)).isDirectory();
       } catch {
         return false;
       }
@@ -63985,18 +64201,18 @@ function scanUnmarkedHomes(options = {}) {
         continue;
       if (names && !names.has(skill))
         continue;
-      const dir = join31(home, skill);
+      const dir = join32(home, skill);
       try {
         if (!statSync12(dir).isDirectory())
           continue;
       } catch {
         continue;
       }
-      if (existsSync24(join31(dir, SYNC_MARKER_FILE))) {
+      if (existsSync24(join32(dir, SYNC_MARKER_FILE))) {
         scan.managed += 1;
         continue;
       }
-      const skillMdPath = join31(dir, "SKILL.md");
+      const skillMdPath = join32(dir, "SKILL.md");
       if (!existsSync24(skillMdPath))
         continue;
       const hash2 = hashSkillMarkdownFile(skillMdPath);
@@ -64017,7 +64233,7 @@ function scanUnmarkedHomes(options = {}) {
 function appendConflictsLedger(appDir, conflicts) {
   if (conflicts.length === 0)
     return;
-  const ledgerPath = join31(appDir, CONFLICTS_LEDGER_FILE);
+  const ledgerPath = join32(appDir, CONFLICTS_LEDGER_FILE);
   let ledger = { version: 1, entries: [] };
   if (existsSync24(ledgerPath)) {
     try {
@@ -64037,9 +64253,9 @@ function appendConflictsLedger(appDir, conflicts) {
 `);
 }
 function writeRollbackRecord(mode, entries, appDir = getDataDir()) {
-  const dir = join31(appDir, ROLLBACK_DIRNAME);
+  const dir = join32(appDir, ROLLBACK_DIRNAME);
   mkdirSync12(dir, { recursive: true });
-  const file = join31(dir, `${mode}-${Date.now()}.json`);
+  const file = join32(dir, `${mode}-${Date.now()}.json`);
   const record5 = { version: 1, mode, timestamp: new Date().toISOString(), entries };
   writeFileSync12(file, `${JSON.stringify(record5, null, 2)}
 `);
@@ -64050,7 +64266,7 @@ function adoptUnmarkedHomes(options = {}) {
   if (!options.apply) {
     return { ...scan, applied: false };
   }
-  const appDir = options.homeDir ? join31(options.homeDir, ".hasna", "skills") : getDataDir();
+  const appDir = options.homeDir ? join32(options.homeDir, ".hasna", "skills") : getDataDir();
   const markers = scan.adoptable.map((entry) => {
     const marker = {
       managedBy: SYNC_MARKER_MANAGED_BY,
@@ -64058,7 +64274,7 @@ function adoptUnmarkedHomes(options = {}) {
       source: "adopted",
       syncedAt: new Date().toISOString()
     };
-    writeFileSync12(join31(entry.path, SYNC_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+    writeFileSync12(join32(entry.path, SYNC_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
     return { agent: entry.agent, skill: entry.skill, path: entry.path, hash: entry.hash, marker };
   });
@@ -64072,25 +64288,25 @@ function adoptUnmarkedHomes(options = {}) {
 function pruneOwnership(dir) {
   let descriptor;
   try {
-    const directory = lstatSync12(dir);
+    const directory = lstatSync14(dir);
     if (!directory.isDirectory())
       return;
-    const markerPath = join31(dir, SYNC_MARKER_FILE), markerPathBefore = lstatSync12(markerPath);
+    const markerPath = join32(dir, SYNC_MARKER_FILE), markerPathBefore = lstatSync14(markerPath);
     if (!markerPathBefore.isFile())
       return;
-    descriptor = openSync7(markerPath, constants7.O_RDONLY | constants7.O_NOFOLLOW | constants7.O_NONBLOCK);
-    const before2 = fstatSync7(descriptor);
+    descriptor = openSync8(markerPath, constants8.O_RDONLY | constants8.O_NOFOLLOW | constants8.O_NONBLOCK);
+    const before2 = fstatSync8(descriptor);
     if (!before2.isFile() || before2.dev !== markerPathBefore.dev || before2.ino !== markerPathBefore.ino || before2.size !== markerPathBefore.size || before2.mtimeMs !== markerPathBefore.mtimeMs || before2.ctimeMs !== markerPathBefore.ctimeMs || before2.size < 1 || before2.size > 65536)
       return;
     const bytes = Buffer.alloc(before2.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync6(descriptor, bytes, length, bytes.length - length, length);
+      const count = readSync7(descriptor, bytes, length, bytes.length - length, length);
       if (!count)
         break;
       length += count;
     }
-    const after2 = fstatSync7(descriptor), current = lstatSync12(dir), markerPathAfter = lstatSync12(markerPath);
+    const after2 = fstatSync8(descriptor), current = lstatSync14(dir), markerPathAfter = lstatSync14(markerPath);
     if (!markerPathAfter.isFile() || markerPathAfter.dev !== before2.dev || markerPathAfter.ino !== before2.ino || markerPathAfter.size !== before2.size || markerPathAfter.mtimeMs !== before2.mtimeMs || markerPathAfter.ctimeMs !== before2.ctimeMs || length !== before2.size || after2.size !== before2.size || after2.mtimeMs !== before2.mtimeMs || after2.ctimeMs !== before2.ctimeMs || !current.isDirectory() || current.dev !== directory.dev || current.ino !== directory.ino)
       return;
     const text3 = bytes.subarray(0, length).toString("utf8"), marker = JSON.parse(text3);
@@ -64101,7 +64317,7 @@ function pruneOwnership(dir) {
     return;
   } finally {
     if (descriptor !== undefined)
-      closeSync7(descriptor);
+      closeSync8(descriptor);
   }
 }
 function pruneStrayHomes(options = {}) {
@@ -64127,7 +64343,7 @@ function pruneStrayHomes(options = {}) {
         continue;
       if (names && !names.has(skill))
         continue;
-      const dir = join31(home, skill);
+      const dir = join32(home, skill);
       try {
         if (!statSync12(dir).isDirectory())
           continue;
@@ -64141,7 +64357,7 @@ function pruneStrayHomes(options = {}) {
         continue;
       const marker = owned.marker;
       ownership.set(dir, owned.identity);
-      const skillMdPath = join31(dir, "SKILL.md");
+      const skillMdPath = join32(dir, "SKILL.md");
       const hash2 = existsSync24(skillMdPath) ? hashSkillMarkdownFile(skillMdPath) : "";
       candidates.push({ agent, skill, home, path: dir, hash: hash2, marker });
     }
@@ -64149,7 +64365,7 @@ function pruneStrayHomes(options = {}) {
   if (!options.apply) {
     return { candidates, pruned: 0, dryRun: true };
   }
-  const appDir = options.homeDir ? join31(options.homeDir, ".hasna", "skills") : getDataDir();
+  const appDir = options.homeDir ? join32(options.homeDir, ".hasna", "skills") : getDataDir();
   const rollbackFile = writeRollbackRecord("prune", candidates.map(({ agent, skill, path, hash: hash2, marker }) => ({ agent, skill, path, hash: hash2, marker })), appDir);
   let pruned = 0;
   for (const candidate of candidates) {
@@ -64172,7 +64388,7 @@ var init_home_adoption = __esm(() => {
 // src/lib/home-census.ts
 import { existsSync as existsSync25, readFileSync as readFileSync24, readdirSync as readdirSync15, statSync as statSync13 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 function sortEntries(entries) {
   return entries.sort((a, b) => {
     const left = `${a.agent}/${a.skill}/${a.kind}`;
@@ -64213,7 +64429,7 @@ function censusHomeDrift(options = {}) {
         continue;
       if (requested && !requested.has(skill))
         continue;
-      const dir = join32(home, skill);
+      const dir = join33(home, skill);
       try {
         if (!statSync13(dir).isDirectory())
           continue;
@@ -64221,7 +64437,7 @@ function censusHomeDrift(options = {}) {
         continue;
       }
       present.add(skill);
-      const markerPath = join32(dir, SYNC_MARKER_FILE);
+      const markerPath = join33(dir, SYNC_MARKER_FILE);
       if (!existsSync25(markerPath)) {
         unmarked += 1;
         continue;
@@ -64232,7 +64448,7 @@ function censusHomeDrift(options = {}) {
         entries.push({ agent, skill, kind: "stray-in-home", path: dir });
         continue;
       }
-      const skillMdPath = join32(dir, "SKILL.md");
+      const skillMdPath = join33(dir, "SKILL.md");
       if (!existsSync25(skillMdPath)) {
         entries.push({ agent, skill, kind: "diverged", path: dir, canonicalHash });
         continue;
@@ -64246,7 +64462,7 @@ function censusHomeDrift(options = {}) {
           homeStub = undefined;
         }
         let canonicalStub;
-        const canonicalSkillMd = join32(corpusRoot, skill, "SKILL.md");
+        const canonicalSkillMd = join33(corpusRoot, skill, "SKILL.md");
         try {
           canonicalStub = isPointerSkillMd(readFileSync24(canonicalSkillMd, "utf-8"));
         } catch {
@@ -64263,7 +64479,7 @@ function censusHomeDrift(options = {}) {
           agent,
           skill: name,
           kind: "missing-from-home",
-          path: join32(home, name),
+          path: join33(home, name),
           canonicalHash
         });
       }
@@ -64286,7 +64502,7 @@ var init_home_census = __esm(() => {
 });
 
 // src/cli/env-assignment.ts
-import { closeSync as closeSync8, constants as constants8, fstatSync as fstatSync8, ftruncateSync as ftruncateSync2, lstatSync as lstatSync13, openSync as openSync8, readFileSync as readFileSync25, writeSync as writeSync2 } from "fs";
+import { closeSync as closeSync9, constants as constants9, fstatSync as fstatSync9, ftruncateSync as ftruncateSync2, lstatSync as lstatSync15, openSync as openSync9, readFileSync as readFileSync25, writeSync as writeSync2 } from "fs";
 function serializeValue(value) {
   if (controls.test(value))
     throw new EnvAssignmentError("Environment values cannot contain control characters or newlines.");
@@ -64365,7 +64581,7 @@ function setEnvAssignment(path, assignment) {
   try {
     const previous = (() => {
       try {
-        return lstatSync13(path);
+        return lstatSync15(path);
       } catch (error) {
         if (error.code === "ENOENT")
           return;
@@ -64374,8 +64590,8 @@ function setEnvAssignment(path, assignment) {
     })();
     if (previous && !previous.isFile())
       throw new EnvAssignmentError("The project .env must be a regular file, not a symlink or special file.");
-    descriptor = openSync8(path, previous ? constants8.O_RDWR | constants8.O_NOFOLLOW | constants8.O_NONBLOCK : constants8.O_WRONLY | constants8.O_CREAT | constants8.O_EXCL | constants8.O_NOFOLLOW, 384);
-    const opened = fstatSync8(descriptor);
+    descriptor = openSync9(path, previous ? constants9.O_RDWR | constants9.O_NOFOLLOW | constants9.O_NONBLOCK : constants9.O_WRONLY | constants9.O_CREAT | constants9.O_EXCL | constants9.O_NOFOLLOW, 384);
+    const opened = fstatSync9(descriptor);
     if (!opened.isFile() || previous && (opened.ino !== previous.ino || opened.dev !== previous.dev)) {
       throw new EnvAssignmentError("The project .env changed while opening it; retry with a regular file.");
     }
@@ -64402,7 +64618,7 @@ function setEnvAssignment(path, assignment) {
     throw new EnvAssignmentError("Cannot safely read or write the project .env file.");
   } finally {
     if (descriptor !== undefined)
-      closeSync8(descriptor);
+      closeSync9(descriptor);
   }
 }
 var INVALID_LAYOUT = "Cannot safely update .env with multiline or unsupported assignments. Use single-line KEY=VALUE entries or edit the file manually.", controls, EnvAssignmentError;
@@ -64469,7 +64685,7 @@ __export(exports_diagnostic, {
   registerDiagnostic: () => registerDiagnostic
 });
 import { existsSync as existsSync26, readFileSync as readFileSync26, readdirSync as readdirSync16, statSync as statSync14 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 import { execSync as execSync2 } from "child_process";
 function registerDiagnostic(parent) {
   parent.command("doctor").option("--json", "Output as JSON", false).description("Check env vars, system deps, and readiness for pinned skills").action((options) => handleDoctor(options));
@@ -64585,7 +64801,7 @@ Skills Test (${results.length} skill${results.length === 1 ? "" : "s"}):
 }
 function handleAuth(name, options) {
   const cwd2 = process.cwd();
-  const envFilePath = join33(cwd2, ".env");
+  const envFilePath = join34(cwd2, ".env");
   if (options.set !== undefined) {
     let key;
     try {
@@ -64661,7 +64877,7 @@ function handleWhoami(options) {
     let skillCount = 0;
     if (exists)
       try {
-        skillCount = readdirSync16(agentSkillsPath).filter((f) => !f.startsWith(".") && statSync14(join33(agentSkillsPath, f)).isDirectory()).length;
+        skillCount = readdirSync16(agentSkillsPath).filter((f) => !f.startsWith(".") && statSync14(join34(agentSkillsPath, f)).isDirectory()).length;
       } catch {}
     agentConfigs.push({ agent, label: AGENT_LABELS[agent], path: agentSkillsPath, exists, skillCount });
   }
@@ -64705,7 +64921,7 @@ function handleOutdated(options) {
   for (const name of installed) {
     const installedVersion = meta.skills[name]?.version ?? "unknown";
     const registryPath = getSkillPath(name);
-    const registryPkgPath = join33(registryPath, "package.json");
+    const registryPkgPath = join34(registryPath, "package.json");
     let registryVersion = "unknown";
     if (existsSync26(registryPkgPath))
       try {
@@ -64914,10 +65130,10 @@ __export(exports_selected_run, {
   resolveSelectedRun: () => resolveSelectedRun,
   executeSelectedLocal: () => executeSelectedLocal
 });
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { spawn as spawn2 } from "child_process";
 import { mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync4, writeFileSync as writeFileSync13 } from "fs";
-import { dirname as dirname12, join as join34, resolve as resolve9 } from "path";
+import { dirname as dirname14, join as join35, resolve as resolve11 } from "path";
 import { tmpdir } from "os";
 function jsonEntry(entries, path) {
   const entry = entries.find((candidate) => candidate.path === path);
@@ -64995,7 +65211,7 @@ async function executeSelectedLocal(selected, options = {}) {
       throw new SkillSelectionError("LOCAL_ENV_REQUIRED", `The selected runtime requires an explicit value for ${name}; ambient credentials are not inherited.`);
     env3[name] = value;
   }
-  const runDirectory = mkdtempSync4(join34(tmpdir(), "skills-execution-"));
+  const runDirectory = mkdtempSync4(join35(tmpdir(), "skills-execution-"));
   const paths = new SkillEntryPaths;
   for (const entry of entries) {
     paths.add(entry.path, 100, () => {
@@ -65003,12 +65219,12 @@ async function executeSelectedLocal(selected, options = {}) {
     }, () => {
       throw new SkillSelectionError("INVALID_BUNDLE_PATH", "The execution bundle path exceeds its limit.");
     });
-    const destination = join34(runDirectory, entry.path);
-    mkdirSync13(dirname12(destination), { recursive: true, mode: 448 });
+    const destination = join35(runDirectory, entry.path);
+    mkdirSync13(dirname14(destination), { recursive: true, mode: 448 });
     writeFileSync13(destination, entry.bytes, { flag: "wx", mode: entry.mode & 511 });
   }
   env3.SKILLS_INPUT_JSON = input;
-  env3.SKILLS_WORKSPACE_DIR = resolve9(options.cwd ?? process.cwd());
+  env3.SKILLS_WORKSPACE_DIR = resolve11(options.cwd ?? process.cwd());
   env3.SKILLS_RUN_DIR = runDirectory;
   if (runtime.version) {
     const version = await subprocess([executable, "--version"], runDirectory, env3, "", Math.min(timeoutMs, 5000));
@@ -65016,9 +65232,9 @@ async function executeSelectedLocal(selected, options = {}) {
     if (version.exitCode !== 0 || actual !== runtime.version)
       throw new SkillSelectionError("LOCAL_RUNTIME_VERSION_MISMATCH", "The installed runtime version differs from the version selected by the skill.");
   }
-  const result2 = await subprocess([executable, join34(runDirectory, declaredEntry), ...args], runDirectory, env3, input, timeoutMs);
-  const receipt = { selection: selected.selection, target: "local", runtime: runtimeName, inputDigest: `sha256:${createHash10("sha256").update(input).digest("hex")}`, runDirectory, ...result2 };
-  writeFileSync13(join34(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
+  const result2 = await subprocess([executable, join35(runDirectory, declaredEntry), ...args], runDirectory, env3, input, timeoutMs);
+  const receipt = { selection: selected.selection, target: "local", runtime: runtimeName, inputDigest: `sha256:${createHash12("sha256").update(input).digest("hex")}`, runDirectory, ...result2 };
+  writeFileSync13(join35(runDirectory, ".execution-receipt.json"), JSON.stringify({ ...receipt, stdout: undefined, stderr: undefined }), { mode: 384 });
   return receipt;
 }
 async function subprocess(command, cwd2, env3, input, timeoutMs) {
@@ -65040,7 +65256,7 @@ async function subprocess(command, cwd2, env3, input, timeoutMs) {
       error = "LOCAL_RUN_TIMEOUT";
       kill();
     }, timeoutMs);
-    const capture = (target) => (chunk2) => {
+    const capture2 = (target) => (chunk2) => {
       outputBytes += chunk2.length;
       if (outputBytes > 1024 * 1024) {
         error = "LOCAL_RUN_OUTPUT_LIMIT";
@@ -65049,8 +65265,8 @@ async function subprocess(command, cwd2, env3, input, timeoutMs) {
       }
       target.push(chunk2);
     };
-    child.stdout.on("data", capture(stdout));
-    child.stderr.on("data", capture(stderr));
+    child.stdout.on("data", capture2(stdout));
+    child.stderr.on("data", capture2(stderr));
     const finish = (code) => {
       if (ended)
         return;
@@ -65247,21 +65463,21 @@ var init_runs = __esm(() => {
 });
 
 // src/lib/run-state.ts
-import { createHash as createHash11, randomBytes } from "crypto";
+import { createHash as createHash13, randomBytes } from "crypto";
 import { existsSync as existsSync27, mkdirSync as mkdirSync14, readFileSync as readFileSync27, readdirSync as readdirSync17, statSync as statSync15, writeFileSync as writeFileSync14 } from "fs";
-import { extname, join as join35, relative as relative5 } from "path";
+import { extname, join as join36, relative as relative5 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now3 = new Date;
   const id = createRunId(now3);
   const day = now3.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join35(root, "runs", day, id);
-  const logsDir = join35(runDir, "logs");
-  const exportDir = join35(root, "exports", skillName, id);
+  const runDir = join36(root, "runs", day, id);
+  const logsDir = join36(runDir, "logs");
+  const exportDir = join36(root, "exports", skillName, id);
   mkdirSync14(logsDir, { recursive: true });
   mkdirSync14(exportDir, { recursive: true });
-  mkdirSync14(join35(root, "tmp"), { recursive: true });
+  mkdirSync14(join36(root, "tmp"), { recursive: true });
   const record5 = {
     id,
     skill: skillName,
@@ -65313,27 +65529,27 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync14(join35(context.logsDir, "stdout.log"), stdout);
-  writeFileSync14(join35(context.logsDir, "stderr.log"), stderr);
+  writeFileSync14(join36(context.logsDir, "stdout.log"), stdout);
+  writeFileSync14(join36(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join35(context.runDir, "events.ndjson");
+  const path = join36(context.runDir, "events.ndjson");
   const previous = existsSync27(path) ? readFileSync27(path, "utf-8") : "";
   writeFileSync14(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
-  const runsRoot = join35(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join36(getProjectStateDir(targetDir), "runs");
   if (!existsSync27(runsRoot))
     return [];
   const records = [];
   for (const day of readdirSync17(runsRoot).sort().reverse()) {
-    const dayDir = join35(runsRoot, day);
+    const dayDir = join36(runsRoot, day);
     if (!statSync15(dayDir).isDirectory())
       continue;
     for (const runId2 of readdirSync17(dayDir).sort().reverse()) {
-      const record5 = readRunRecord(join35(dayDir, runId2));
+      const record5 = readRunRecord(join36(dayDir, runId2));
       if (record5)
         records.push(record5);
       if (records.length >= limit)
@@ -65343,11 +65559,11 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   return records;
 }
 function findSkillRun(runId2, targetDir = process.cwd()) {
-  const runsRoot = join35(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join36(getProjectStateDir(targetDir), "runs");
   if (!existsSync27(runsRoot))
     return null;
   for (const day of readdirSync17(runsRoot)) {
-    const record5 = readRunRecord(join35(runsRoot, day, runId2));
+    const record5 = readRunRecord(join36(runsRoot, day, runId2));
     if (record5)
       return record5;
   }
@@ -65364,14 +65580,14 @@ function skillRunEnv(context) {
   };
 }
 function getRunExportDir(runId2, skill, targetDir = process.cwd()) {
-  return join35(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId2);
+  return join36(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId2);
 }
 function writeRunRecord(context) {
-  writeFileSync14(join35(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync14(join36(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync14(join35(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync14(join36(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
@@ -65384,14 +65600,14 @@ function collectRunArtifacts(context) {
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
-      sha256: createHash11("sha256").update(bytes).digest("hex"),
+      sha256: createHash13("sha256").update(bytes).digest("hex"),
       sizeBytes: stat.size
     });
   }
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join35(runDir, "run.json");
+  const path = join36(runDir, "run.json");
   if (!existsSync27(path))
     return null;
   try {
@@ -65403,7 +65619,7 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync17(dir)) {
-    const full = join35(dir, entry);
+    const full = join36(dir, entry);
     if (statSync15(full).isDirectory())
       files.push(...walkFiles(full));
     else
@@ -70973,12 +71189,12 @@ class StdioServerTransport {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve10) => {
+    return new Promise((resolve12) => {
       const json = serializeMessage(message);
       if (this._stdout.write(json)) {
-        resolve10();
+        resolve12();
       } else {
-        this._stdout.once("drain", resolve10);
+        this._stdout.once("drain", resolve12);
       }
     });
   }
@@ -73148,7 +73364,7 @@ class Protocol {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1000;
-        await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
+        await new Promise((resolve12) => setTimeout(resolve12, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -73160,7 +73376,7 @@ class Protocol {
   }
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve10, reject2) => {
+    return new Promise((resolve12, reject2) => {
       const earlyReject = (error2) => {
         reject2(error2);
       };
@@ -73238,7 +73454,7 @@ class Protocol {
           if (!parseResult.success) {
             reject2(parseResult.error);
           } else {
-            resolve10(parseResult.data);
+            resolve12(parseResult.data);
           }
         } catch (error2) {
           reject2(error2);
@@ -73429,12 +73645,12 @@ class Protocol {
         interval = task.pollInterval;
       }
     } catch {}
-    return new Promise((resolve10, reject2) => {
+    return new Promise((resolve12, reject2) => {
       if (signal.aborted) {
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve10, interval);
+      const timeoutId = setTimeout(resolve12, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject2(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -73911,11 +74127,11 @@ var require_codegen = __commonJS((exports) => {
       const rhs = this.rhs === undefined ? "" : ` = ${this.rhs}`;
       return `${varKind} ${this.name}${rhs};` + _n;
     }
-    optimizeNames(names, constants9) {
+    optimizeNames(names, constants10) {
       if (!names[this.name.str])
         return;
       if (this.rhs)
-        this.rhs = optimizeExpr(this.rhs, names, constants9);
+        this.rhs = optimizeExpr(this.rhs, names, constants10);
       return this;
     }
     get names() {
@@ -73933,10 +74149,10 @@ var require_codegen = __commonJS((exports) => {
     render({ _n }) {
       return `${this.lhs} = ${this.rhs};` + _n;
     }
-    optimizeNames(names, constants9) {
+    optimizeNames(names, constants10) {
       if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
         return;
-      this.rhs = optimizeExpr(this.rhs, names, constants9);
+      this.rhs = optimizeExpr(this.rhs, names, constants10);
       return this;
     }
     get names() {
@@ -74002,8 +74218,8 @@ var require_codegen = __commonJS((exports) => {
     optimizeNodes() {
       return `${this.code}` ? this : undefined;
     }
-    optimizeNames(names, constants9) {
-      this.code = optimizeExpr(this.code, names, constants9);
+    optimizeNames(names, constants10) {
+      this.code = optimizeExpr(this.code, names, constants10);
       return this;
     }
     get names() {
@@ -74033,12 +74249,12 @@ var require_codegen = __commonJS((exports) => {
       }
       return nodes.length > 0 ? this : undefined;
     }
-    optimizeNames(names, constants9) {
+    optimizeNames(names, constants10) {
       const { nodes } = this;
       let i = nodes.length;
       while (i--) {
         const n = nodes[i];
-        if (n.optimizeNames(names, constants9))
+        if (n.optimizeNames(names, constants10))
           continue;
         subtractNames(names, n.names);
         nodes.splice(i, 1);
@@ -74095,12 +74311,12 @@ var require_codegen = __commonJS((exports) => {
         return;
       return this;
     }
-    optimizeNames(names, constants9) {
+    optimizeNames(names, constants10) {
       var _a;
-      this.else = (_a = this.else) === null || _a === undefined ? undefined : _a.optimizeNames(names, constants9);
-      if (!(super.optimizeNames(names, constants9) || this.else))
+      this.else = (_a = this.else) === null || _a === undefined ? undefined : _a.optimizeNames(names, constants10);
+      if (!(super.optimizeNames(names, constants10) || this.else))
         return;
-      this.condition = optimizeExpr(this.condition, names, constants9);
+      this.condition = optimizeExpr(this.condition, names, constants10);
       return this;
     }
     get names() {
@@ -74125,10 +74341,10 @@ var require_codegen = __commonJS((exports) => {
     render(opts) {
       return `for(${this.iteration})` + super.render(opts);
     }
-    optimizeNames(names, constants9) {
-      if (!super.optimizeNames(names, constants9))
+    optimizeNames(names, constants10) {
+      if (!super.optimizeNames(names, constants10))
         return;
-      this.iteration = optimizeExpr(this.iteration, names, constants9);
+      this.iteration = optimizeExpr(this.iteration, names, constants10);
       return this;
     }
     get names() {
@@ -74166,10 +74382,10 @@ var require_codegen = __commonJS((exports) => {
     render(opts) {
       return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
     }
-    optimizeNames(names, constants9) {
-      if (!super.optimizeNames(names, constants9))
+    optimizeNames(names, constants10) {
+      if (!super.optimizeNames(names, constants10))
         return;
-      this.iterable = optimizeExpr(this.iterable, names, constants9);
+      this.iterable = optimizeExpr(this.iterable, names, constants10);
       return this;
     }
     get names() {
@@ -74214,11 +74430,11 @@ var require_codegen = __commonJS((exports) => {
       (_b = this.finally) === null || _b === undefined || _b.optimizeNodes();
       return this;
     }
-    optimizeNames(names, constants9) {
+    optimizeNames(names, constants10) {
       var _a, _b;
-      super.optimizeNames(names, constants9);
-      (_a = this.catch) === null || _a === undefined || _a.optimizeNames(names, constants9);
-      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants9);
+      super.optimizeNames(names, constants10);
+      (_a = this.catch) === null || _a === undefined || _a.optimizeNames(names, constants10);
+      (_b = this.finally) === null || _b === undefined || _b.optimizeNames(names, constants10);
       return this;
     }
     get names() {
@@ -74492,7 +74708,7 @@ var require_codegen = __commonJS((exports) => {
   function addExprNames(names, from) {
     return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
   }
-  function optimizeExpr(expr, names, constants9) {
+  function optimizeExpr(expr, names, constants10) {
     if (expr instanceof code_1.Name)
       return replaceName(expr);
     if (!canOptimize(expr))
@@ -74507,14 +74723,14 @@ var require_codegen = __commonJS((exports) => {
       return items;
     }, []));
     function replaceName(n) {
-      const c = constants9[n.str];
+      const c = constants10[n.str];
       if (c === undefined || names[n.str] !== 1)
         return n;
       delete names[n.str];
       return c;
     }
     function canOptimize(e) {
-      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants9[c.str] !== undefined);
+      return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants10[c.str] !== undefined);
     }
   }
   function subtractNames(names, from) {
@@ -76419,7 +76635,7 @@ var require_compile = __commonJS((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve10.call(this, root, ref);
+    let _sch = resolve12.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a = root.localRefs) === null || _a === undefined ? undefined : _a[ref];
       const { schemaId } = this.opts;
@@ -76446,7 +76662,7 @@ var require_compile = __commonJS((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve10(root, ref) {
+  function resolve12(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -77248,7 +77464,7 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return uri;
   }
-  function resolve10(baseURI, relativeURI, options) {
+  function resolve12(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
     const {
       parsed: baseParsed,
@@ -77618,7 +77834,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   var fastUri = {
     SCHEMES,
     normalize: normalize3,
-    resolve: resolve10,
+    resolve: resolve12,
     resolveComponent,
     equal,
     serialize,
@@ -81404,7 +81620,7 @@ class McpServer {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5000;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve10) => setTimeout(resolve10, pollInterval));
+      await new Promise((resolve12) => setTimeout(resolve12, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -83314,7 +83530,7 @@ var init_run_routing = __esm(() => {
 
 // src/mcp/operation-tools.ts
 import { existsSync as existsSync28, readdirSync as readdirSync18, statSync as statSync16 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 function registerOperationTools(server) {
   server.registerTool("scaffold_skill", {
     title: "Scaffold Skill",
@@ -83779,7 +83995,7 @@ function registerOperationTools(server) {
       if (exists) {
         try {
           skillCount = readdirSync18(agentSkillsPath).filter((f) => {
-            const full = join36(agentSkillsPath, f);
+            const full = join37(agentSkillsPath, f);
             return !f.startsWith(".") && statSync16(full).isDirectory();
           }).length;
         } catch {}
@@ -83847,14 +84063,14 @@ var init_operation_tools = __esm(() => {
 
 // src/lib/feedback.ts
 import { appendFileSync as appendFileSync2, existsSync as existsSync29, mkdirSync as mkdirSync15 } from "fs";
-import { dirname as dirname13, join as join37 } from "path";
+import { dirname as dirname15, join as join38 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join37(getDataDir(), "skills.db");
+  return join38(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname13(dbPath);
+  const dir = dirname15(dbPath);
   if (!existsSync29(dir))
     mkdirSync15(dir, { recursive: true });
   const db = new Database(dbPath);
@@ -83882,8 +84098,8 @@ function saveFeedback(input) {
     throw new Error("Feedback message is required");
   const category = input.category ?? "general";
   if (isApiMode()) {
-    const path = join37(getDataDir(), "feedback.jsonl");
-    const dir = dirname13(path);
+    const path = join38(getDataDir(), "feedback.jsonl");
+    const dir = dirname15(path);
     if (!existsSync29(dir))
       mkdirSync15(dir, { recursive: true });
     appendFileSync2(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
@@ -84047,9 +84263,9 @@ var init_resource_meta_tools = __esm(() => {
 
 // src/lib/scheduler.ts
 import { existsSync as existsSync30, readFileSync as readFileSync28, writeFileSync as writeFileSync15, mkdirSync as mkdirSync16 } from "fs";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join38(targetDir, ".skills", "schedules.json");
+  return join39(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
@@ -84062,7 +84278,7 @@ function loadSchedules(targetDir = process.cwd()) {
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join38(targetDir, ".skills");
+  const dir = join39(targetDir, ".skills");
   if (!existsSync30(dir))
     mkdirSync16(dir, { recursive: true });
   writeFileSync15(path, JSON.stringify(data, null, 2));
@@ -84361,7 +84577,7 @@ var init_schedule_tools = __esm(() => {
 });
 
 // src/lib/native-storage.ts
-import { createHash as createHash12, createHmac as createHmac3 } from "crypto";
+import { createHash as createHash14, createHmac as createHmac3 } from "crypto";
 import {
   existsSync as existsSync31,
   mkdirSync as mkdirSync17,
@@ -84370,7 +84586,7 @@ import {
   statSync as statSync17,
   writeFileSync as writeFileSync16
 } from "fs";
-import { dirname as dirname14, join as join39, normalize as normalize3, relative as relative6, sep as sep5 } from "path";
+import { dirname as dirname16, join as join40, normalize as normalize3, relative as relative6, sep as sep5 } from "path";
 function resolveSkillsNativeStorageConfig(env3 = process.env) {
   assertNoRetiredModeEnvVars(env3, {
     app: SKILLS_ENV_NAMESPACE,
@@ -84411,7 +84627,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join39(getDataDir(), "skills.db")
+      feedbackDbPath: join40(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config2.databaseUrl),
@@ -84438,7 +84654,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
-        sha256: createHash12("sha256").update(bytes).digest("hex"),
+        sha256: createHash14("sha256").update(bytes).digest("hex"),
         ...options.includeFileContents ? { contentBase64: Buffer.from(bytes).toString("base64") } : {}
       });
     }
@@ -84492,7 +84708,7 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync19(dir)) {
-    const full = join39(dir, entry);
+    const full = join40(dir, entry);
     const stats = statSync17(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
@@ -84717,7 +84933,7 @@ var init_remote_invitation_recovery = __esm(() => {
 });
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash2(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -84962,12 +85178,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve10) => {
+      await new Promise((resolve12) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve10();
+          resolve12();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -84978,7 +85194,7 @@ var PRIVATE_PUBLICATION_MAX_BYTES, failures, PrivatePublicationError, bad = () =
   throw new PrivatePublicationError("INVALID_PUBLICATION_INPUT", "Invalid publication input or recovery data.");
 }, invalid4 = () => {
   throw new PrivatePublicationError("INVALID_PUBLICATION_RESPONSE", "The server returned an invalid publication result.");
-}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash2 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record8(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date4 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash13("sha256").update(bytes).digest("hex");
+}, publicationUuid = (v) => typeof v === "string" && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(v), hash2 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v), record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v), exact = (v, keys2) => record8(v) && Object.keys(v).sort().join(",") === keys2.sort().join(","), date4 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v)), publicationSha256 = (bytes) => createHash15("sha256").update(bytes).digest("hex");
 var init_remote_private_publications = __esm(() => {
   init_fleet_credentials();
   init_remote_workspace_selection();
@@ -85255,11 +85471,11 @@ var init_remote_auth = __esm(() => {
 });
 
 // src/lib/workspace-profile.ts
-import { constants as constants9, closeSync as closeSync9, fstatSync as fstatSync9, lstatSync as lstatSync14, mkdirSync as mkdirSync18, mkdtempSync as mkdtempSync5, openSync as openSync9, readFileSync as readFileSync30, renameSync as renameSync8, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname15, join as join40 } from "path";
+import { constants as constants10, closeSync as closeSync10, fstatSync as fstatSync10, lstatSync as lstatSync16, mkdirSync as mkdirSync18, mkdtempSync as mkdtempSync5, openSync as openSync10, readFileSync as readFileSync30, renameSync as renameSync8, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "fs";
+import { dirname as dirname17, join as join41 } from "path";
 function stat(path) {
   try {
-    return lstatSync14(path);
+    return lstatSync16(path);
   } catch (error2) {
     if (error2.code === "ENOENT")
       return null;
@@ -85269,14 +85485,14 @@ function stat(path) {
 function safeText(file) {
   if (stat(file) === null)
     return null;
-  const fd = openSync9(file, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
+  const fd = openSync10(file, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
   try {
-    const s = fstatSync9(fd);
+    const s = fstatSync10(fd);
     if (!s.isFile() || s.size > 65536 || ![256, 384].includes(s.mode & 4095) || process.getuid && s.uid !== process.getuid())
       return fail2("The selected profile must use bounded owner-only regular files.");
     return readFileSync30(fd, "utf8");
   } finally {
-    closeSync9(fd);
+    closeSync10(fd);
   }
 }
 function checkIdentityMetadata(file, identity3) {
@@ -85342,12 +85558,12 @@ async function prepareWorkspaceEnrollment(membershipId, source = process.env) {
   if (Buffer.byteLength(credentialBody("x".repeat(8192)), "utf8") > 65536)
     return fail2("The selected profile has insufficient space for a bounded credential. Reduce its unrelated configuration before signing in.");
   const parents = [];
-  for (let path = dirname15(file);; path = dirname15(path)) {
+  for (let path = dirname17(file);; path = dirname17(path)) {
     const before2 = stat(path);
     if (before2 && (!before2.isDirectory() || before2.isSymbolicLink()))
       return fail2("The profile directory must not be a symbolic link.");
     parents.push([path, before2]);
-    if (path === dirname15(path))
+    if (path === dirname17(path))
       break;
   }
   const unchanged2 = () => {
@@ -85406,12 +85622,12 @@ async function prepareWorkspaceEnrollment(membershipId, source = process.env) {
           return fail2("The new profile exceeds the credential reader size limit.");
         const identity3 = JSON.stringify({ email: verified.user.email, userId: verified.user.id, orgId: verified.organization.id, orgSlug: verified.organization.slug, apiUrl: origin }, null, 2) + `
 `;
-        mkdirSync18(dirname15(file), { recursive: true, mode: 448 });
-        const temp = mkdtempSync5(join40(dirname15(file), ".workspace-login-"));
+        mkdirSync18(dirname17(file), { recursive: true, mode: 448 });
+        const temp = mkdtempSync5(join41(dirname17(file), ".workspace-login-"));
         let identityInstalled = false;
         try {
-          writeFileSync17(join40(temp, "credentials"), body, { mode: 384, flag: "wx" });
-          writeFileSync17(join40(temp, "identity"), identity3, { mode: 384, flag: "wx" });
+          writeFileSync17(join41(temp, "credentials"), body, { mode: 384, flag: "wx" });
+          writeFileSync17(join41(temp, "identity"), identity3, { mode: 384, flag: "wx" });
           unchangedFiles();
           for (const [path, before2] of parents) {
             const now3 = stat(path);
@@ -85420,16 +85636,16 @@ async function prepareWorkspaceEnrollment(membershipId, source = process.env) {
             if (!before2 && now3 && ((now3.mode & 63) !== 0 || process.getuid && now3.uid !== process.getuid()))
               changed();
           }
-          renameSync8(join40(temp, "identity"), identityFile);
+          renameSync8(join41(temp, "identity"), identityFile);
           identityInstalled = true;
-          renameSync8(join40(temp, "credentials"), file);
+          renameSync8(join41(temp, "credentials"), file);
         } catch (error2) {
           if (identityInstalled) {
             if (oldIdentity === null)
               rmSync7(identityFile, { force: true });
             else {
-              writeFileSync17(join40(temp, "restore"), oldIdentity, { mode: 384, flag: "wx" });
-              renameSync8(join40(temp, "restore"), identityFile);
+              writeFileSync17(join41(temp, "restore"), oldIdentity, { mode: 384, flag: "wx" });
+              renameSync8(join41(temp, "restore"), identityFile);
             }
           }
           throw error2;
@@ -85587,20 +85803,20 @@ var init_private_publication_customer = __esm(() => {
 });
 
 // src/lib/private-publication-recovery.ts
-import { constants as constants10, closeSync as closeSync10, fsyncSync as fsyncSync2, fstatSync as fstatSync10, lstatSync as lstatSync15, mkdirSync as mkdirSync19, openSync as openSync10, readSync as readSync7, realpathSync as realpathSync5, renameSync as renameSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname16, isAbsolute as isAbsolute7, join as join41, resolve as resolve10 } from "path";
+import { constants as constants11, closeSync as closeSync11, fsyncSync as fsyncSync2, fstatSync as fstatSync11, lstatSync as lstatSync17, mkdirSync as mkdirSync19, openSync as openSync11, readSync as readSync8, realpathSync as realpathSync5, renameSync as renameSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname18, isAbsolute as isAbsolute9, join as join42, resolve as resolve12 } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
 function safeDirectory(directory) {
-  if (!isAbsolute7(directory) || directory !== resolve10(directory) || realpathSync5(directory) !== directory)
+  if (!isAbsolute9(directory) || directory !== resolve12(directory) || realpathSync5(directory) !== directory)
     return fail3();
-  for (let path = directory;; path = dirname16(path)) {
-    const stat2 = lstatSync15(path);
+  for (let path = directory;; path = dirname18(path)) {
+    const stat2 = lstatSync17(path);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail3();
-    if (path === dirname16(path))
+    if (path === dirname18(path))
       break;
   }
-  const own = lstatSync15(directory);
+  const own = lstatSync17(directory);
   if ((own.mode & 63) !== 0 || process.getuid && own.uid !== process.getuid())
     return fail3();
   return { dev: own.dev, ino: own.ino };
@@ -85611,36 +85827,36 @@ function unchangedDirectory(directory, identity3) {
     return fail3();
 }
 function readOwned(directory, name, max2) {
-  const identity3 = safeDirectory(directory), file = join41(directory, name);
-  const fd = openSync10(file, constants10.O_RDONLY | constants10.O_NOFOLLOW);
+  const identity3 = safeDirectory(directory), file = join42(directory, name);
+  const fd = openSync11(file, constants11.O_RDONLY | constants11.O_NOFOLLOW);
   try {
-    const stat2 = fstatSync10(fd);
+    const stat2 = fstatSync11(fd);
     if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max2 || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
       return fail3();
     const buffer = Buffer.alloc(Math.min(max2, stat2.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync7(fd, buffer, length, buffer.length - length, length);
+      const count = readSync8(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after2 = fstatSync10(fd);
+    const bytes = buffer.subarray(0, length), after2 = fstatSync11(fd);
     unchangedDirectory(directory, identity3);
     if (bytes.length !== stat2.size || stat2.size !== after2.size || stat2.mtimeMs !== after2.mtimeMs || stat2.ctimeMs !== after2.ctimeMs)
       return fail3();
     return bytes;
   } finally {
-    closeSync10(fd);
+    closeSync11(fd);
   }
 }
 function writeOwned(directory, name, bytes) {
-  const fd = openSync10(join41(directory, name), constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW, 384);
+  const fd = openSync11(join42(directory, name), constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
   try {
     writeFileSync18(fd, bytes);
     fsyncSync2(fd);
   } finally {
-    closeSync10(fd);
+    closeSync11(fd);
   }
 }
 function save(directory, value) {
@@ -85648,12 +85864,12 @@ function save(directory, value) {
   writeOwned(directory, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory, identity3);
-  renameSync9(join41(directory, temporary), join41(directory, "receipt.json"));
-  const fd = openSync10(directory, constants10.O_RDONLY | constants10.O_NOFOLLOW);
+  renameSync9(join42(directory, temporary), join42(directory, "receipt.json"));
+  const fd = openSync11(directory, constants11.O_RDONLY | constants11.O_NOFOLLOW);
   try {
     fsyncSync2(fd);
   } finally {
-    closeSync10(fd);
+    closeSync11(fd);
   }
 }
 function bind2(client, receipt) {
@@ -85661,23 +85877,23 @@ function bind2(client, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory, action) {
-  const identity3 = safeDirectory(directory), file = join41(directory, "operation.lock");
+  const identity3 = safeDirectory(directory), file = join42(directory, "operation.lock");
   let fd;
   try {
-    fd = openSync10(file, constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW, 384);
+    fd = openSync11(file, constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync10(fd);
+  const lock = fstatSync11(fd);
   try {
     writeFileSync18(fd, JSON.stringify({ pid: process.pid }) + `
 `);
     fsyncSync2(fd);
     return await action();
   } finally {
-    closeSync10(fd);
+    closeSync11(fd);
     unchangedDirectory(directory, identity3);
-    const now3 = lstatSync15(file);
+    const now3 = lstatSync17(file);
     if (now3.dev !== lock.dev || now3.ino !== lock.ino || !now3.isFile() || now3.isSymbolicLink())
       fail3();
     unlinkSync5(file);
@@ -85729,15 +85945,15 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute7(recoveryDirectory) || resolve10(recoveryDirectory) !== recoveryDirectory || realpathSync5(dirname16(recoveryDirectory)) !== dirname16(recoveryDirectory))
+  if (!isAbsolute9(recoveryDirectory) || resolve12(recoveryDirectory) !== recoveryDirectory || realpathSync5(dirname18(recoveryDirectory)) !== dirname18(recoveryDirectory))
     return fail3();
   mkdirSync19(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync10(dirname16(recoveryDirectory), constants10.O_RDONLY | constants10.O_NOFOLLOW);
+  const parent = openSync11(dirname18(recoveryDirectory), constants11.O_RDONLY | constants11.O_NOFOLLOW);
   try {
     fsyncSync2(parent);
   } finally {
-    closeSync10(parent);
+    closeSync11(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);
@@ -85830,10 +86046,10 @@ var init_private_publication_recovery = __esm(() => {
 });
 
 // src/mcp/private-publication-tools.ts
-import { isAbsolute as isAbsolute8 } from "path";
+import { isAbsolute as isAbsolute10 } from "path";
 function registerPrivatePublicationTools(server) {
   const uuid6 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
-  const directory = exports_external.string().max(4096).refine(isAbsolute8, "Use an absolute local directory");
+  const directory = exports_external.string().max(4096).refine(isAbsolute10, "Use an absolute local directory");
   const verification = { email: exports_external.string().email().max(254), code: exports_external.string().regex(/^\d{6}$/), userId: uuid6, membershipId: uuid6, recoveryDirectory: directory };
   const description = "Manage a private source publication using fresh workspace-bound verification and a host-local recovery directory. Publishing requires explicit UUID current-version comparison and upload consent. Resume reuses immutable saved bytes and intent; an uncertain PUT is finalized for server verification, never uploaded twice. Sessions and signed URLs are not returned or persisted. Private execution is unavailable. Host request history may contain the supplied verification code.";
   const handler = (action) => async (value) => {
@@ -86143,7 +86359,7 @@ var init_mcp2 = __esm(() => {
 // src/cli/commands/runtime-mcp.ts
 import { existsSync as existsSync32, mkdirSync as mkdirSync20, readFileSync as readFileSync31, writeFileSync as writeFileSync19 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname17, join as join42 } from "path";
+import { dirname as dirname19, join as join43 } from "path";
 async function handleMcp(options) {
   if (options.register) {
     let agents;
@@ -86186,24 +86402,24 @@ async function registerMcpForAgent(agent, command) {
     case "codex":
       return registerCodexMcp(command);
     case "gemini":
-      return registerJsonMcpServer(agent, join42(homedir8(), ".gemini", "settings.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join43(homedir8(), ".gemini", "settings.json"), "mcpServers", {
         command,
         args: []
       });
     case "pi":
-      return registerJsonMcpServer(agent, join42(homedir8(), ".pi", "agent", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join43(homedir8(), ".pi", "agent", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "opencode":
       return registerOpenCodeMcp(command);
     case "cursor":
-      return registerJsonMcpServer(agent, join42(homedir8(), ".cursor", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join43(homedir8(), ".cursor", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
     case "windsurf":
-      return registerJsonMcpServer(agent, join42(homedir8(), ".windsurf", "mcp.json"), "mcpServers", {
+      return registerJsonMcpServer(agent, join43(homedir8(), ".windsurf", "mcp.json"), "mcpServers", {
         command,
         args: []
       });
@@ -86226,7 +86442,7 @@ async function registerClaudeMcp(command) {
     if (exitCode === 0) {
       return { agent: "claude", success: true, command: cliCommand };
     }
-    const fallback = registerJsonMcpServer("claude", join42(homedir8(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join43(homedir8(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -86236,7 +86452,7 @@ async function registerClaudeMcp(command) {
       error: fallback.success ? undefined : `claude exited with ${exitCode}: ${(stderr || stdout).trim()}`
     };
   } catch (err) {
-    const fallback = registerJsonMcpServer("claude", join42(homedir8(), ".claude", ".mcp.json"), "mcpServers", {
+    const fallback = registerJsonMcpServer("claude", join43(homedir8(), ".claude", ".mcp.json"), "mcpServers", {
       command,
       args: []
     });
@@ -86248,7 +86464,7 @@ async function registerClaudeMcp(command) {
   }
 }
 function registerCodexMcp(command) {
-  const path = join42(homedir8(), ".codex", "config.toml");
+  const path = join43(homedir8(), ".codex", "config.toml");
   const config2 = `[mcp_servers.${MCP_SERVER_NAME}]
 command = ${JSON.stringify(command)}`;
   try {
@@ -86260,7 +86476,7 @@ command = ${JSON.stringify(command)}`;
   }
 }
 function registerOpenCodeMcp(command) {
-  const path = join42(homedir8(), ".config", "opencode", "opencode.json");
+  const path = join43(homedir8(), ".config", "opencode", "opencode.json");
   const config2 = JSON.stringify({
     $schema: "https://opencode.ai/config.json",
     mcp: {
@@ -86317,7 +86533,7 @@ function writeJsonObject(path, data) {
 `);
 }
 function writeTextFile(path, content) {
-  mkdirSync20(dirname17(path), { recursive: true });
+  mkdirSync20(dirname19(path), { recursive: true });
   writeFileSync19(path, content.endsWith(`
 `) ? content : `${content}
 `);
@@ -86348,7 +86564,7 @@ function findCommandOnPath(command) {
   for (const dir of pathValue.split(":")) {
     if (!dir)
       continue;
-    const candidate = join42(dir, command);
+    const candidate = join43(dir, command);
     if (existsSync32(candidate))
       return candidate;
   }
@@ -86410,9 +86626,9 @@ var exports_runtime = {};
 __export(exports_runtime, {
   registerRuntime: () => registerRuntime
 });
-import { createHash as createHash14, randomUUID as randomUUID7 } from "crypto";
-import { lstatSync as lstatSync16, mkdirSync as mkdirSync21, readFileSync as readFileSync32, realpathSync as realpathSync6, writeFileSync as writeFileSync20 } from "fs";
-import { basename as basename5, isAbsolute as isAbsolute9, join as join43 } from "path";
+import { createHash as createHash16, randomUUID as randomUUID7 } from "crypto";
+import { lstatSync as lstatSync18, mkdirSync as mkdirSync21, readFileSync as readFileSync32, realpathSync as realpathSync6, writeFileSync as writeFileSync20 } from "fs";
+import { basename as basename5, isAbsolute as isAbsolute11, join as join44 } from "path";
 import { createInterface } from "readline";
 function registerRuntime(parent) {
   parent.command("run").argument("<skill>", "Skill name").argument("[args...]", "Arguments to pass to the skill").allowUnknownOption(true).passThroughOptions(true).option("--json", "Output result as JSON", false).option("--remote", "Run on the configured server, using its catalog and quote", false).option("--target <target>", "Execution target: local or cloud").option("--input <json>", "Structured cloud execution input").option("--skill-version <version>", "Exact selected skill version").option("--selection-profile <id>", "Selected Skills profile").option("--session <id>", "Pinned Skills session").option("--cached", "Use the explicit verified selected cache", false).option("--yes", "Approve the server's quoted credit cost for this run", false).option("--idempotency-key <key>", "Reuse this key when retrying the same remote submission").option("--file <path>", "Attach a local input file to a remote run (repeatable)", (value, prior) => [...prior, value], []).option("--wait", "Poll remote runs until a terminal status", false).option("--poll-interval-ms <ms>", "Remote polling interval in milliseconds", "1000").option("--poll-timeout-ms <ms>", "Maximum time to wait for a remote run", "300000").description("Run a skill directly").action(async (name, args2, options) => handleRun(name, args2, options));
@@ -86437,7 +86653,7 @@ function registerRuntime(parent) {
       if (!expected)
         throw new Error("Cloud artifact not found");
       const bytes = await client.download(id, name);
-      if (bytes.length !== expected.byteSize || createHash14("sha256").update(bytes).digest("hex") !== expected.sha256)
+      if (bytes.length !== expected.byteSize || createHash16("sha256").update(bytes).digest("hex") !== expected.sha256)
         throw new Error("Cloud artifact integrity verification failed");
       writeFileSync20(options.output, bytes, { flag: "wx", mode: 384 });
       console.log(JSON.stringify({ path: options.output, sha256: expected.sha256, byteSize: bytes.length }));
@@ -86525,7 +86741,7 @@ Updating ${name}...
 async function readUpdatedVersion(bunExecutable) {
   const output = await readUpdateCommand([bunExecutable, "pm", "bin", "-g"]);
   const globalBin = output.replace(/\r?\n$/, "");
-  if (!globalBin || !isAbsolute9(globalBin) || /[\r\n\0]/.test(globalBin))
+  if (!globalBin || !isAbsolute11(globalBin) || /[\r\n\0]/.test(globalBin))
     throw new Error("Update bin discovery failed");
   const installed = Bun.which("skills", { PATH: globalBin, cwd: globalBin });
   const selected = Bun.which("skills");
@@ -86661,14 +86877,14 @@ function requireHttpUrl(value) {
 }
 function promptLine(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve11) => {
+  return new Promise((resolve13) => {
     let settled = false;
     const finish = (answer) => {
       if (settled)
         return;
       settled = true;
       rl.close();
-      resolve11(answer);
+      resolve13(answer);
     };
     rl.once("SIGINT", () => finish(null));
     rl.once("close", () => finish(null));
@@ -86829,7 +87045,7 @@ async function handleRun(name, args2, options) {
     try {
       parsePollingOptions(options);
       inputFiles = (options.file ?? []).map((path) => {
-        const info = lstatSync16(path);
+        const info = lstatSync18(path);
         if (!info.isFile() || info.size > 20 * 1024 * 1024)
           throw new Error("Input must be a regular file no larger than 20 MiB");
         return { name: basename5(path), bytes: new Uint8Array(readFileSync32(path)) };
@@ -87218,7 +87434,7 @@ async function handleExportsDownload(runId2, options) {
         continue;
       const verified = await client.getVerifiedRunArtifact(runId2, artifactId);
       const relativePath = safeArtifactRelativePath(typeof artifact.relativePath === "string" ? artifact.relativePath : artifact.fileName, String(artifact.fileName || artifactId));
-      const outputPath = join43(exportDir, relativePath);
+      const outputPath = join44(exportDir, relativePath);
       ensureSafeExportParent(exportDir, relativePath);
       writeFileSync20(outputPath, verified.bytes, { flag: "wx", mode: 384 });
       downloaded.push({ id: artifactId, path: outputPath, byteSize: verified.byteSize });
@@ -87257,9 +87473,9 @@ function ensureSafeExportParent(root, relativePath) {
   let parent = root;
   for (const part of ["", ...parts]) {
     if (part)
-      parent = join43(parent, part);
+      parent = join44(parent, part);
     try {
-      if (!lstatSync16(parent).isDirectory() || lstatSync16(parent).isSymbolicLink())
+      if (!lstatSync18(parent).isDirectory() || lstatSync18(parent).isSymbolicLink())
         throw new Error("Unsafe artifact directory");
     } catch (error2) {
       if (error2.code !== "ENOENT")
@@ -87297,7 +87513,7 @@ async function pollRemoteRun(client, runId2, options) {
     const remaining = deadline - Date.now();
     if (remaining <= 0)
       break;
-    await new Promise((resolve11) => setTimeout(resolve11, Math.min(options.intervalMs, remaining)));
+    await new Promise((resolve13) => setTimeout(resolve13, Math.min(options.intervalMs, remaining)));
   }
   return {
     run: current ?? { id: runId2, status: "queued" },
@@ -87611,7 +87827,7 @@ var init_completion = __esm(() => {
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync20, statSync as statSync18 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join44, sep as sep6 } from "path";
+import { join as join45, sep as sep6 } from "path";
 function isExcludedSkillFileName(fileName) {
   if (EXCLUDE_FILE_NAMES.has(fileName)) {
     return true;
@@ -87634,16 +87850,16 @@ function isPortableWithinSkill(relativeParts) {
 function homePathFor(definition, homesRoot) {
   const home = homesRoot ?? homedir9();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
-    return join44(skillsDataRootForHome(home), definition.name);
+    return join45(skillsDataRootForHome(home), definition.name);
   }
   if (definition.agent === "opencode") {
-    return join44(home, ".config", "opencode", "skills");
+    return join45(home, ".config", "opencode", "skills");
   }
-  return join44(home, `.${definition.agent}`, "skills");
+  return join45(home, `.${definition.agent}`, "skills");
 }
 function destinationFor(definition, stationId, relativePath) {
-  const category = definition.subClass === "agent-homes" ? join44("agent-homes", definition.agent ?? "") : definition.name;
-  return join44("resources", stationId, "skills", category, ...relativePath.split(sep6));
+  const category = definition.subClass === "agent-homes" ? join45("agent-homes", definition.agent ?? "") : definition.name;
+  return join45("resources", stationId, "skills", category, ...relativePath.split(sep6));
 }
 function walkEntries(absoluteRoot) {
   let entries;
@@ -87654,7 +87870,7 @@ function walkEntries(absoluteRoot) {
   }
   const output = [];
   for (const entry of entries) {
-    const childFull = join44(absoluteRoot, entry.name);
+    const childFull = join45(absoluteRoot, entry.name);
     if (entry.isSymbolicLink()) {
       output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
       continue;
@@ -87665,7 +87881,7 @@ function walkEntries(absoluteRoot) {
       }
       const nested = walkEntries(childFull);
       for (const item of nested) {
-        output.push({ ...item, relativePath: join44(entry.name, item.relativePath) });
+        output.push({ ...item, relativePath: join45(entry.name, item.relativePath) });
       }
       continue;
     }
@@ -87758,7 +87974,7 @@ var init_portable_snapshot_filter = __esm(() => {
 });
 
 // src/lib/station-snapshot.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync22,
@@ -87766,14 +87982,14 @@ import {
   statSync as statSync19,
   writeFileSync as writeFileSync21
 } from "fs";
-import { dirname as dirname19, isAbsolute as isAbsolute10, relative as relative7, resolve as resolve11, sep as sep7 } from "path";
+import { dirname as dirname21, isAbsolute as isAbsolute12, relative as relative7, resolve as resolve13, sep as sep7 } from "path";
 function validateStationId(stationId) {
   if (!/^[a-z0-9-]+$/.test(stationId)) {
     throw new StationSnapshotError("INVALID_STATION", `station id must be a slug, got: ${stationId}`);
   }
 }
 function sha256File(filePath) {
-  return createHash15("sha256").update(readFileSync33(filePath)).digest("hex");
+  return createHash17("sha256").update(readFileSync33(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -87844,7 +88060,7 @@ function humanHomes(scanned) {
   }));
 }
 function writeStationSnapshot(options) {
-  const repoRoot = resolve11(options.repoRoot ?? process.cwd());
+  const repoRoot = resolve13(options.repoRoot ?? process.cwd());
   const { scanned, plans, totalBytes } = planStationSnapshot(options);
   const manifestFiles = plans.map((plan) => ({
     relativePath: plan.source.relativePath,
@@ -87870,9 +88086,9 @@ function writeStationSnapshot(options) {
   const conflicts = [];
   const untouched = [];
   for (const plan of plans) {
-    const destination = resolve11(repoRoot, plan.destination);
+    const destination = resolve13(repoRoot, plan.destination);
     const destinationRelative = relative7(repoRoot, destination);
-    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep7) || isAbsolute10(destinationRelative)) {
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep7) || isAbsolute12(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
     let existingDigest = null;
@@ -87893,8 +88109,8 @@ function writeStationSnapshot(options) {
   }
   let written = 0;
   for (const plan of untouched) {
-    const destination = resolve11(repoRoot, plan.destination);
-    mkdirSync22(dirname19(destination), { recursive: true });
+    const destination = resolve13(repoRoot, plan.destination);
+    mkdirSync22(dirname21(destination), { recursive: true });
     copyFileSync2(plan.source.fullPath, destination);
     written += 1;
   }
@@ -87912,8 +88128,8 @@ function writeStationSnapshot(options) {
     },
     files: manifestFiles
   };
-  const manifestPath = resolve11(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync22(dirname19(manifestPath), { recursive: true });
+  const manifestPath = resolve13(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  mkdirSync22(dirname21(manifestPath), { recursive: true });
   writeFileSync21(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
@@ -87946,7 +88162,7 @@ __export(exports_create_sync_config, {
   registerCreateSync: () => registerCreateSync
 });
 import { existsSync as existsSync33 } from "fs";
-import { join as join45 } from "path";
+import { join as join46 } from "path";
 function registerCreateSync(parent) {
   const configCmd = parent.command("config").description("Manage skills configuration");
   configCmd.command("show", { isDefault: true }).option("--json", "Output as JSON", false).description("Show current merged configuration").action((options) => {
@@ -88056,7 +88272,7 @@ function handleCreate(name, options) {
       console.log(source_default.green(`\u2713 Created custom skill '${result2.name}' at ${result2.path}`));
       console.log(source_default.dim(`  Category: ${result2.manifest.category}`));
       console.log(source_default.dim(`  Tags: ${result2.manifest.tags?.join(", ")}`));
-      console.log(`  ${source_default.cyan("Edit:")} ${join45(result2.path, options.kind === "instruction" ? "SKILL.md" : "src/index.ts")}`);
+      console.log(`  ${source_default.cyan("Edit:")} ${join46(result2.path, options.kind === "instruction" ? "SKILL.md" : "src/index.ts")}`);
       console.log(`  ${source_default.cyan("Prepare:")} skills prepare ${result2.name} --version <new-semver>`);
     }
   } catch (error2) {
@@ -88350,7 +88566,7 @@ __export(exports_agent_integration, {
   registerAgentIntegration: () => registerAgentIntegration
 });
 import { readFileSync as readFileSync34 } from "fs";
-import { isAbsolute as isAbsolute11 } from "path";
+import { isAbsolute as isAbsolute13 } from "path";
 function agents(value) {
   if (value === "all")
     return [...INTEGRATION_AGENTS];
@@ -88396,25 +88612,26 @@ function registerAgentIntegration(parent) {
       input.hook_event_name = event;
       const projects = [process.cwd()];
       if (input.cwd !== undefined) {
-        if (typeof input.cwd !== "string" || !isAbsolute11(input.cwd) || input.cwd.includes("\x00"))
+        if (typeof input.cwd !== "string" || !isAbsolute13(input.cwd) || input.cwd.includes("\x00"))
           throw new Error("Invalid native hook working directory");
         projects.push(input.cwd);
       }
       if (options.agent === "cursor") {
-        if (!Array.isArray(input.workspace_roots) || input.workspace_roots.length > 32 || input.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute11(path) || path.includes("\x00")))
+        if (!Array.isArray(input.workspace_roots) || input.workspace_roots.length > 32 || input.workspace_roots.some((path) => typeof path !== "string" || !isAbsolute13(path) || path.includes("\x00")))
           throw new Error("Invalid Cursor workspace roots");
         projects.push(...input.workspace_roots);
         input.cwd ??= input.workspace_roots[0] ?? process.cwd();
         input.session_id ??= input.conversation_id;
       }
+      const selectionProfile = selectedProfileId(options.selectionProfile);
       if (options.agent === "hermes" && event === "pre_tool_call") {
-        assertManagedAgentBridge("hermes", { projectDirs: projects });
+        assertManagedAgentBridge("hermes", { projectDirs: projects, profileId: selectionProfile });
         assertHermesTool(input);
         await writeCliOutput(JSON.stringify({ action: "continue" }));
         return;
       }
       if (options.agent === "claude" && event === "PreToolUse" || options.agent === "gemini" && event === "BeforeTool") {
-        assertManagedAgentBridge(options.agent, { projectDirs: projects });
+        assertManagedAgentBridge(options.agent, { projectDirs: projects, profileId: selectionProfile });
         const skill = options.agent === "claude" ? input.tool_input?.skill : input.tool_input?.name;
         if (skill !== "skills-cli")
           throw new Error("NATIVE_SKILL_DRIFT: invoke only skills-cli; load selected payload instructions with skills load");
@@ -88422,9 +88639,11 @@ function registerAgentIntegration(parent) {
         return;
       }
       hookContextOutput(event, { context: "" });
-      assertManagedAgentBridge(options.agent, { projectDirs: projects });
+      assertManagedAgentBridge(options.agent, { projectDirs: projects, profileId: selectionProfile });
+      if (typeof input.prompt === "string")
+        input.prompt = normalizeAgentHookPrompt(options.agent, nativeEvent, input.prompt);
       if (event === "SessionStart") {
-        const refresh = Bun.spawn([process.execPath, process.argv[1], "sync", "--selection-profile", selectedProfileId(options.selectionProfile), "--json"], { stdin: "ignore", stdout: "pipe", stderr: "pipe", env: { ...process.env, NO_COLOR: "1" } });
+        const refresh = Bun.spawn([process.execPath, process.argv[1], "sync", "--selection-profile", selectionProfile, "--json"], { stdin: "ignore", stdout: "pipe", stderr: "pipe", env: { ...process.env, NO_COLOR: "1" } });
         const timer2 = setTimeout(() => refresh.kill("SIGKILL"), 6500);
         try {
           const [, , status] = await Promise.all([new Response(refresh.stdout).text(), new Response(refresh.stderr).text(), refresh.exited]);
@@ -88434,9 +88653,7 @@ function registerAgentIntegration(parent) {
           clearTimeout(timer2);
         }
       }
-      const args2 = [process.execPath, process.argv[1], "context", "--stdin", "--json", "--cached"];
-      if (options.selectionProfile)
-        args2.push("--selection-profile", options.selectionProfile);
+      const args2 = [process.execPath, process.argv[1], "context", "--stdin", "--json", "--cached", "--selection-profile", selectionProfile];
       const child = Bun.spawn(args2, { stdin: new Blob([JSON.stringify(input)]), stdout: "pipe", stderr: "pipe", env: { ...process.env, NO_COLOR: "1" } });
       const timer = setTimeout(() => child.kill("SIGKILL"), 6500);
       try {
@@ -88578,17 +88795,17 @@ var exports_profiles = {};
 __export(exports_profiles, {
   registerProfiles: () => registerProfiles
 });
-import { closeSync as closeSync11, constants as constants11, fstatSync as fstatSync11, openSync as openSync11, readSync as readSync8, writeFileSync as writeFileSync22 } from "fs";
+import { closeSync as closeSync12, constants as constants12, fstatSync as fstatSync12, openSync as openSync12, readSync as readSync9, writeFileSync as writeFileSync22 } from "fs";
 function readProfileInput(path) {
-  const fd = openSync11(path, constants11.O_RDONLY | constants11.O_NONBLOCK);
+  const fd = openSync12(path, constants12.O_RDONLY | constants12.O_NONBLOCK);
   try {
-    const stat2 = fstatSync11(fd);
+    const stat2 = fstatSync12(fd);
     if (!stat2.isFile() || stat2.size > MAX_PROFILE_DOCUMENT_BYTES)
       throw new Error("Profile input exceeds the size limit or is not a regular file");
     const bytes = Buffer.alloc(MAX_PROFILE_DOCUMENT_BYTES + 1);
     let size2 = 0;
     while (size2 < bytes.length) {
-      const read3 = readSync8(fd, bytes, size2, bytes.length - size2, null);
+      const read3 = readSync9(fd, bytes, size2, bytes.length - size2, null);
       if (!read3)
         break;
       size2 += read3;
@@ -88597,7 +88814,7 @@ function readProfileInput(path) {
       throw new Error("Profile input exceeds the size limit");
     return new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, size2));
   } finally {
-    closeSync11(fd);
+    closeSync12(fd);
   }
 }
 function registerProfiles(parent) {
@@ -88639,7 +88856,7 @@ var init_profiles = __esm(() => {
 });
 
 // src/lib/station-hydrate.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync23,
@@ -88648,16 +88865,16 @@ import {
   statSync as statSync20,
   writeFileSync as writeFileSync23
 } from "fs";
-import { dirname as dirname20, join as join46, resolve as resolve12, sep as sep8 } from "path";
+import { dirname as dirname22, join as join47, resolve as resolve14, sep as sep8 } from "path";
 function fail4(code, message, detail = []) {
   throw new StationSnapshotError(code, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join46(repoRoot, "resources", stationId, "skills");
+  return join47(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join46(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join47(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
     manifest = JSON.parse(readFileSync35(manifestPath, "utf8"));
@@ -88684,7 +88901,7 @@ function planStationHydration(stationId, repoRoot) {
   const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join46(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join47(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
       identEntries = readdirSync21(agentRoot, { withFileTypes: true });
@@ -88695,7 +88912,7 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join46(agentRoot, identEntry.name);
+      const identRoot = join47(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
         const relativeParts = [identEntry.name, ...entry.relativePath.split(sep8)];
@@ -88842,12 +89059,12 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file) => sha256File(file.winner.fullPath));
-  return createHash16("sha256").update(joined.sort().join(`
+  return createHash18("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
-  const repoRoot = resolve12(options.repoRoot ?? process.cwd());
-  const cacheRoot = resolve12(options.cacheRoot ?? resolveCorpusRoot());
+  const repoRoot = resolve14(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve14(options.cacheRoot ?? resolveCorpusRoot());
   const plan = planStationHydration(options.stationId, repoRoot);
   const resultSkills = plan.winners.map((skill) => ({
     ident: skill.ident,
@@ -88880,7 +89097,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file of skill.files) {
-      const destination = join46(cacheRoot, skill.ident, file.withinIdent);
+      const destination = join47(cacheRoot, skill.ident, file.withinIdent);
       const digest2 = sha256File(file.winner.fullPath);
       let existingDigest = null;
       try {
@@ -88901,7 +89118,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync23(dirname20(entry.destination), { recursive: true });
+    mkdirSync23(dirname22(entry.destination), { recursive: true });
     copyFileSync3(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -88922,8 +89139,8 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join46(dirname20(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync23(dirname20(hydrationManifestPath), { recursive: true });
+  const hydrationManifestPath = join47(dirname22(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync23(dirname22(hydrationManifestPath), { recursive: true });
   writeFileSync23(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
@@ -88999,15 +89216,15 @@ var init_hydrate = __esm(() => {
 });
 
 // src/lib/prepare-skill.ts
-import { createHash as createHash17, randomUUID as randomUUID8 } from "crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync17, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync6, readFileSync as readFileSync36, readdirSync as readdirSync22, renameSync as renameSync10, rmSync as rmSync8, writeFileSync as writeFileSync24 } from "fs";
+import { createHash as createHash19, randomUUID as randomUUID8 } from "crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync34, lstatSync as lstatSync19, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync6, readFileSync as readFileSync36, readdirSync as readdirSync22, renameSync as renameSync10, rmSync as rmSync8, writeFileSync as writeFileSync24 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname21, isAbsolute as isAbsolute12, join as join47, relative as relative8, resolve as resolve13, sep as sep9 } from "path";
+import { dirname as dirname23, isAbsolute as isAbsolute14, join as join48, relative as relative8, resolve as resolve15, sep as sep9 } from "path";
 function prepareSkill(name, options) {
   const normalized = normalizePortableSkillName(name);
   if (!new RegExp(SEMVER_PATTERN).test(options.version))
     throw new Error("--version must be a semantic version, for example 0.2.0.");
-  const path = join47(getPortableSkillsRootReadOnly(options), normalized);
+  const path = join48(getPortableSkillsRootReadOnly(options), normalized);
   const before2 = snapshot(path);
   const manifestFile = before2.files.find((file) => file.path === "skill.json");
   if (!manifestFile)
@@ -89041,16 +89258,16 @@ function prepareSkill(name, options) {
     throw new Error("skill.json provenance must be an object.");
   const provenance = manifest.provenance;
   const candidate = { ...manifest, version: options.version, kind, provenance: { ...provenance } };
-  const staging = mkdtempSync6(join47(tmpdir2(), "skills-prepare-"));
+  const staging = mkdtempSync6(join48(tmpdir2(), "skills-prepare-"));
   try {
     for (const directory of before2.directories)
-      mkdirSync24(join47(staging, directory), { recursive: true });
+      mkdirSync24(join48(staging, directory), { recursive: true });
     for (const file of before2.files) {
-      const destination = join47(staging, file.path);
-      mkdirSync24(dirname21(destination), { recursive: true });
+      const destination = join48(staging, file.path);
+      mkdirSync24(dirname23(destination), { recursive: true });
       writeFileSync24(destination, file.bytes, { mode: file.mode });
     }
-    const stagedManifest = join47(staging, "skill.json");
+    const stagedManifest = join48(staging, "skill.json");
     writeFileSync24(stagedManifest, `${JSON.stringify(candidate, null, 2)}
 `);
     const contentHash = computeContentHash(staging);
@@ -89073,11 +89290,11 @@ ${validation.issues.map((issue2) => `${issue2.code}: ${issue2.message}`).join(`
     if (snapshot(path).identity !== before2.identity)
       throw new Error("Skill changed during preparation; review the draft and run prepare again.");
     if (changed2 && !options.dryRun) {
-      const temporary = join47(path, `.skill-prepare-${randomUUID8()}.tmp`);
+      const temporary = join48(path, `.skill-prepare-${randomUUID8()}.tmp`);
       try {
         writeFileSync24(temporary, candidateBytes, { flag: "wx", mode: manifestFile.mode });
         chmodSync3(temporary, manifestFile.mode);
-        renameSync10(temporary, join47(path, "skill.json"));
+        renameSync10(temporary, join48(path, "skill.json"));
       } finally {
         rmSync8(temporary, { force: true });
       }
@@ -89107,8 +89324,8 @@ function validateRuntimeEntrypoint(candidate, root) {
   const entry = candidate.runtime.entrypoint;
   if (typeof entry !== "string")
     return;
-  const target = resolve13(root, entry), rel = relative8(root, target);
-  if (isAbsolute12(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep9}`) || isAbsolute12(rel) || !existsSync34(target) || !lstatSync17(target).isFile()) {
+  const target = resolve15(root, entry), rel = relative8(root, target);
+  if (isAbsolute14(entry) || /^[a-zA-Z]:/.test(entry) || entry.includes("\\") || !rel || rel === ".." || rel.startsWith(`..${sep9}`) || isAbsolute14(rel) || !existsSync34(target) || !lstatSync19(target).isFile()) {
     throw new Error("Executable runtime.entrypoint must name an existing regular file inside the skill directory.");
   }
 }
@@ -89180,20 +89397,20 @@ function compareVersions(left, right) {
   return 0;
 }
 function snapshot(root) {
-  const rootStat = lstatSync17(root);
+  const rootStat = lstatSync19(root);
   if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
     throw new Error("Skill root must be a real directory, not a symlink.");
   const files = [], directories = [];
-  const hash3 = createHash17("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
+  const hash3 = createHash19("sha256").update(`${rootStat.dev}:${rootStat.ino}\x00`);
   let count = 0, bytes = 0;
   const walk2 = (relative9) => {
-    for (const name of readdirSync22(join47(root, relative9)).sort()) {
+    for (const name of readdirSync22(join48(root, relative9)).sort()) {
       if (IGNORED.has(name.toLowerCase()) || !relative9 && ROOT_IGNORED.has(name.toLowerCase()))
         continue;
       const path = relative9 ? `${relative9}/${name}` : name;
       if (++count > 20000)
         throw new Error("Skill exceeds the preparation entry limit (20000).");
-      const absolute = join47(root, path), stat2 = lstatSync17(absolute);
+      const absolute = join48(root, path), stat2 = lstatSync19(absolute);
       if (stat2.isSymbolicLink())
         throw new Error(`Skill contains a symlink: ${path}. No files were changed.`);
       if (stat2.isDirectory() && name === "node_modules")
@@ -89608,7 +89825,7 @@ var init_schedule = __esm(() => {
 
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync25, writeFileSync as writeFileSync25 } from "fs";
-import { dirname as dirname22, relative as relative9 } from "path";
+import { dirname as dirname24, relative as relative9 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -89665,7 +89882,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync25(dirname22(path), { recursive: true });
+  mkdirSync25(dirname24(path), { recursive: true });
   writeFileSync25(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -89698,12 +89915,12 @@ function registerRegistry(parent) {
 async function writeJson2(value, space) {
   const text3 = `${JSON.stringify(value, null, space)}
 `;
-  await new Promise((resolve14, reject2) => {
+  await new Promise((resolve16, reject2) => {
     process.stdout.write(text3, (error2) => {
       if (error2)
         reject2(error2);
       else
-        resolve14();
+        resolve16();
     });
   });
 }
@@ -89869,7 +90086,7 @@ __export(exports_publish, {
 import { execFileSync } from "child_process";
 import { existsSync as existsSync35, readFileSync as readFileSync37 } from "fs";
 import { hostname as hostname3 } from "os";
-import { join as join48 } from "path";
+import { join as join49 } from "path";
 function registerPublish(parent) {
   parent.command("push").argument("<name>", "Name of a skill in the local corpus (~/.hasna/skills/installed or the migrated ~/.hasna/skills/skills)").option("--version <version>", "Override the version recorded on the instance").option("--force-new-version", "If name@version already exists with different content, publish as the next patch version", false).option("--dry-run", "Pack and validate without uploading", false).option("--json", "Output result as JSON", false).description("Publish a local skill to the configured skills instance").action(async (name, options) => {
     try {
@@ -89920,7 +90137,7 @@ async function pushSkill(name, options = {}) {
   const packed = packSkillBundle(skill.path, { maxUnpackedBytes: MAX_UNPACKED_BYTES });
   await verifyPackedCanonicalHash(skill.name, packed);
   const versionManifest = buildVersionManifest(skill.path, packed);
-  const skillMdPath = join48(skill.path, "SKILL.md");
+  const skillMdPath = join49(skill.path, "SKILL.md");
   const skillMd = existsSync35(skillMdPath) ? readFileSync37(skillMdPath, "utf-8") : undefined;
   const base2 = {
     slug: skill.name,
@@ -90172,7 +90389,7 @@ async function readCode() {
 function promptCode() {
   const { stdin, stderr: output } = process;
   const { isRaw: wasRaw, readableFlowing: wasFlowing } = stdin;
-  return new Promise((resolve14) => {
+  return new Promise((resolve16) => {
     let value = "", settled = false;
     const finish = (answer) => {
       if (settled)
@@ -90189,7 +90406,7 @@ function promptCode() {
 `);
       if (answer === null)
         process.exitCode = 130;
-      resolve14(answer);
+      resolve16(answer);
     };
     const cancel = () => finish(null);
     const keypress = (text3, key) => {
@@ -90234,7 +90451,7 @@ var exports_private_publications = {};
 __export(exports_private_publications, {
   registerPrivatePublications: () => registerPrivatePublications
 });
-import { resolve as resolve14 } from "path";
+import { resolve as resolve16 } from "path";
 function verifyOptions(options, action) {
   if (options.userId === undefined !== (options.membershipId === undefined) || options.userId !== undefined && (!publicationUuid(options.userId) || !publicationUuid(options.membershipId)))
     throw new PrivatePublicationError("PUBLICATION_CONTEXT_REQUIRED", "Provide both observed --user-id and --membership-id UUIDs.");
@@ -90279,9 +90496,9 @@ function registerPrivatePublications(parent) {
         if (code === null)
           return;
         const context = options.userId ? { userId: options.userId, membershipId: options.membershipId } : undefined;
-        const client = await privatePublicationSession(options.email, code, context), directory = resolve14(options.recoveryDir);
+        const client = await privatePublicationSession(options.email, code, context), directory = resolve16(options.recoveryDir);
         if (action === "publish")
-          await preparePrivatePublication(client, resolve14(args2[0]), directory, { skillId: options.skillId, expectedCurrentVersionId: options.expectedCurrentVersion ?? null, idempotencyKey: options.idempotencyKey });
+          await preparePrivatePublication(client, resolve16(args2[0]), directory, { skillId: options.skillId, expectedCurrentVersionId: options.expectedCurrentVersion ?? null, idempotencyKey: options.idempotencyKey });
         const result2 = action === "publish" || action === "resume" ? await continuePrivatePublication(client, directory, { confirm: true, waitMs: Number(options.waitSeconds) * 1000 }) : await inspectPrivatePublication(client, directory, action === "cancel");
         print2(result2, options.json);
       } catch (error2) {
@@ -90382,7 +90599,7 @@ __export(exports_auth, {
 import { createInterface as createInterface2 } from "readline";
 function prompt(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve15) => {
+  return new Promise((resolve17) => {
     let settled = false;
     const finish = (answer) => {
       if (settled)
@@ -90391,7 +90608,7 @@ function prompt(question) {
       rl.close();
       if (answer === null)
         process.exitCode = 130;
-      resolve15(answer);
+      resolve17(answer);
     };
     rl.once("SIGINT", () => finish(null));
     rl.once("close", () => finish(null));
@@ -90493,7 +90710,7 @@ function printWhoami(payload) {
     console.log(source_default.dim("(offline \u2014 showing cached info)"));
 }
 function sleep(ms) {
-  return new Promise((resolve15) => setTimeout(resolve15, ms));
+  return new Promise((resolve17) => setTimeout(resolve17, ms));
 }
 function browserCommand(url) {
   if (process.platform === "darwin")
@@ -90986,7 +91203,7 @@ function promptInvitationProof(kind) {
   const label = kind === "token" ? "invitation token" : "recovery code";
   const character = kind === "token" ? /^[A-Za-z0-9_-]$/ : /^\d$/;
   const { stdin, stderr: output } = process, wasRaw = stdin.isRaw, wasFlowing = stdin.readableFlowing;
-  return new Promise((resolve15) => {
+  return new Promise((resolve17) => {
     let value = "", settled = false, overflow = false;
     const finish = (answer) => {
       if (settled)
@@ -91003,7 +91220,7 @@ function promptInvitationProof(kind) {
 `);
       if (answer === null)
         process.exitCode = 130;
-      resolve15(answer);
+      resolve17(answer);
     };
     const cancel = () => finish(null);
     const keypress = (text3, key) => {
@@ -91576,7 +91793,7 @@ var init_storage = __esm(() => {
 
 // src/lib/registry-reconcile.ts
 import { existsSync as existsSync36, readFileSync as readFileSync38, statSync as statSync21, writeFileSync as writeFileSync26 } from "fs";
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 function isDirectory2(path) {
   try {
     return statSync21(path).isDirectory();
@@ -91587,11 +91804,11 @@ function isDirectory2(path) {
 function migrationNeeded(options) {
   if (options.rootDir)
     return false;
-  const appDir = options.homeDir ? join49(options.homeDir, ".hasna", "skills") : getDataDir();
-  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join49(appDir, SKILLS_CACHE_DIRNAME)));
+  const appDir = options.homeDir ? join50(options.homeDir, ".hasna", "skills") : getDataDir();
+  return !(isOwnerLayoutMigrated(appDir) && isDirectory2(join50(appDir, SKILLS_CACHE_DIRNAME)));
 }
 function readBaseline(skillDir) {
-  const markerPath = join49(skillDir, PULL_MARKER_FILE);
+  const markerPath = join50(skillDir, PULL_MARKER_FILE);
   if (!existsSync36(markerPath))
     return;
   try {
@@ -91607,7 +91824,7 @@ function readBaseline(skillDir) {
   }
 }
 function readCursor(root) {
-  const path = join49(root, SYNC_CURSOR_FILE);
+  const path = join50(root, SYNC_CURSOR_FILE);
   if (!existsSync36(path))
     return { runCount: 0 };
   try {
@@ -91620,12 +91837,12 @@ function readCursor(root) {
 function resolveCorpusRootReadOnly(options) {
   if (options.rootDir)
     return { root: options.rootDir, migrationPending: false };
-  const appDir = options.homeDir ? join49(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
-  const cache3 = join49(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join50(options.homeDir, ".hasna", "skills") : getDataDirReadOnly();
+  const cache3 = join50(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && isDirectory2(cache3)) {
     return { root: cache3, migrationPending: false };
   }
-  return { root: join49(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
+  return { root: join50(appDir, INSTALLED_SKILLS_DIRNAME), migrationPending: true };
 }
 function remoteRowToSkill(record9) {
   const slug = typeof record9.slug === "string" ? record9.slug : typeof record9.name === "string" ? record9.name : undefined;
@@ -91759,7 +91976,7 @@ async function reconcileRegistry(options = {}) {
   for (const slug of allSlugs) {
     const local = locals.get(slug);
     const remote = remotes.get(slug);
-    const baseline = local ? readBaseline(join49(root, slug)) : undefined;
+    const baseline = local ? readBaseline(join50(root, slug)) : undefined;
     const { state, reason } = classifySkill(local, remote, baseline);
     let { action, reason: actionReason } = resolveAction(state, direction, conflict);
     if (state === "remote-only" && isDigestless(remote)) {
@@ -91818,7 +92035,7 @@ async function reconcileRegistry(options = {}) {
       try {
         await pushSkill(slug, { rootDir: root, client });
         const pushed = locals.get(slug);
-        writePullMarker(join49(root, slug), {
+        writePullMarker(join50(root, slug), {
           skill: slug,
           ...pushed?.version ? { version: pushed.version } : {},
           ...pushed?.sha256 ? { contentHash: pushed.sha256 } : {},
@@ -91890,7 +92107,7 @@ async function reconcileRegistry(options = {}) {
         runCount: readCursor(root).runCount + 1,
         summary
       };
-      writeFileSync26(join49(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
+      writeFileSync26(join50(root, SYNC_CURSOR_FILE), `${JSON.stringify(cursor2, null, 2)}
 `);
       return {
         corpusRoot: root,