@hasna/skills 0.7.1 → 0.7.2

package/dist/index.js

@@ -10421,7 +10421,7 @@ function getAllTags() {
 }
 // src/lib/installer.ts
 import { existsSync as existsSync13, readFileSync as readFileSync14, rmSync as rmSync3 } from "fs";
-import { dirname as dirname9, join as join18 } from "path";
+import { dirname as dirname11, join as join19 } from "path";
 import { homedir as homedir4 } from "os";
 import { fileURLToPath } from "url";
 
@@ -10429,7 +10429,7 @@ import { fileURLToPath } from "url";
 import {
   cpSync as cpSync3,
   existsSync as existsSync11,
-  lstatSync as lstatSync9,
+  lstatSync as lstatSync11,
   mkdirSync as mkdirSync6,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync12,
@@ -10440,12 +10440,12 @@ import {
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename3, dirname as dirname8, join as join16 } from "path";
+import { basename as basename3, dirname as dirname10, join as join17 } from "path";
 
 // src/lib/agent-integration.ts
-import { createHash as createHash6, randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync10, lstatSync as lstatSync8, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, readdirSync as readdirSync10, readlinkSync, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync, writeFileSync as writeFileSync5, unlinkSync as unlinkSync2, chmodSync, openSync as openSync3, closeSync as closeSync3, fsyncSync, fstatSync as fstatSync3, readSync as readSync3, constants as constants3, linkSync } from "fs";
-import { dirname as dirname7, join as join15, resolve as resolve6, relative as relative4, isAbsolute as isAbsolute5, sep as sep4 } from "path";
+import { createHash as createHash8, randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync10, lstatSync as lstatSync10, statSync as statSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, readdirSync as readdirSync10, opendirSync as opendirSync3, readlinkSync, realpathSync as realpathSync4, renameSync as renameSync3, rmdirSync, writeFileSync as writeFileSync5, unlinkSync as unlinkSync2, chmodSync, openSync as openSync4, closeSync as closeSync4, fsyncSync, fstatSync as fstatSync4, readSync as readSync4, constants as constants4, linkSync } from "fs";
+import { dirname as dirname9, join as join16, resolve as resolve8, relative as relative4, isAbsolute as isAbsolute7, sep as sep4 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/lib/managed-policy.ts
@@ -11336,7 +11336,7 @@ function readSkillSession(sessionId, options = {}) {
 }
 
 // src/lib/agent-policy-limits.ts
-var AGENT_POLICY_LIMITS = Object.freeze({ bytes: 1024 * 1024, agents: 16, discoverySources: 2048, discoveryRoots: 512, builtinNames: 2048, rootAliases: 2, fields: 64, pathCharacters: 4096 });
+var AGENT_POLICY_LIMITS = Object.freeze({ bytes: 1024 * 1024, agents: 16, discoverySources: 2048, discoveryRawSourceBytes: 64 * 1024 * 1024, discoveryRawTotalBytes: 256 * 1024 * 1024, discoveryRoots: 512, discoveryDirectories: 64, discoveryDirectoryEntries: 20000, discoveryDirectoryBytes: 8 * 1024 * 1024, builtinNames: 2048, rootAliases: 2, fields: 64, pathCharacters: 4096 });
 function object(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -11400,12 +11400,20 @@ function assertAgentPolicyCollections(policy) {
       requireBound(object(source));
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
+      if (source.hashMode !== undefined)
+        requireBound(source.hashMode === "bytes" && source.format === undefined && source.fields === undefined);
       if (source.format !== undefined)
         requireBound(["json", "toml", "yaml"].includes(source.format));
       if (source.fields !== undefined)
         for (const field of array(source.fields, AGENT_POLICY_LIMITS.fields))
           text(field, 256);
     }
+    if (value.directories !== undefined)
+      for (const directory of array(value.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+        requireBound(object(directory));
+        text(directory.path);
+        requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+      }
     if (value.builtinNames !== undefined)
       for (const name of array(value.builtinNames, AGENT_POLICY_LIMITS.builtinNames))
         text(name, 128);
@@ -11534,9 +11542,9 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-discovery.ts
-import { createHash as createHash5 } from "crypto";
-import { lstatSync as lstatSync7, readFileSync as readFileSync10, readdirSync as readdirSync9, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname6, isAbsolute as isAbsolute4, join as join14, resolve as resolve5, sep as sep3 } from "path";
+import { createHash as createHash7 } from "crypto";
+import { lstatSync as lstatSync9, readFileSync as readFileSync10, readdirSync as readdirSync9, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname8, isAbsolute as isAbsolute6, join as join15, resolve as resolve7, sep as sep3 } from "path";
 
 // ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -11654,6 +11662,10 @@ function configureHermesHooks(text2, supervisor, previous) {
 function assertHermesEnvironment(home) {
   if (process.env.TERMINAL_CWD)
     throw new Error("NATIVE_SKILL_DRIFT: Hermes TERMINAL_CWD requires a separately reviewed effective project; unset it before using this adapter");
+  for (const variable of ["HERMES_BUNDLED_PLUGINS", "HERMES_BUNDLED_SKILLS"]) {
+    if (process.env[variable])
+      throw new Error(`NATIVE_SKILL_DRIFT: Hermes ${variable} requires a dedicated discovery adapter; unset it before using this adapter`);
+  }
   const selected = process.env.HERMES_HOME?.trim();
   if (selected && (!isAbsolute3(selected) || resolve4(selected) !== join13(resolve4(home), ".hermes")))
     throw new Error("NATIVE_SKILL_DRIFT: custom Hermes homes/profiles require their own reviewed bridge");
@@ -11745,8 +11757,147 @@ if (failed) process.exitCode = 2;
 `;
 }
 
+// src/lib/agent-discovery-directories.ts
+import { createHash as createHash5 } from "crypto";
+import { lstatSync as lstatSync7, opendirSync as opendirSync2 } from "fs";
+import { dirname as dirname6, isAbsolute as isAbsolute4, join as join14, resolve as resolve5 } from "path";
+function need(value, message) {
+  if (!value)
+    throw new Error(message);
+}
+function safe(path) {
+  need(typeof path === "string" && path.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute4(path) && resolve5(path) === path && !path.includes("\x00"), "Expected a canonical absolute discovery directory path");
+  for (let cursor = path;; cursor = dirname6(cursor)) {
+    need(!lstatSync7(cursor, { throwIfNoEntry: false })?.isSymbolicLink(), "Refusing symlink native discovery directory");
+    if (dirname6(cursor) === cursor)
+      break;
+  }
+}
+function same(before, after) {
+  return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
+}
+function capture(path, budget) {
+  safe(path);
+  const root = lstatSync7(path, { throwIfNoEntry: false });
+  if (!root)
+    return { path, sha256: null };
+  need(root.isDirectory(), "Unsupported native discovery directory input");
+  const hash2 = createHash5("sha256");
+  function walk2(current, relative4, before, depth) {
+    need(depth <= 64, "Native discovery directory depth limit exceeded");
+    const names = [], directory = opendirSync2(current);
+    try {
+      for (let entry = directory.readSync();entry; entry = directory.readSync()) {
+        need(++budget.entries <= AGENT_POLICY_LIMITS.discoveryDirectoryEntries, "Native discovery directory entry limit exceeded");
+        names.push(entry.name);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    need(new Set(names).size === names.length, "Ambiguous native discovery directory names");
+    for (const name of names.sort()) {
+      const child = join14(current, name), childRelative = relative4 ? `${relative4}/${name}` : name;
+      need(child.length <= AGENT_POLICY_LIMITS.pathCharacters, "Native discovery directory path limit exceeded");
+      const stat = lstatSync7(child);
+      need(stat.isFile() || stat.isDirectory(), "Refusing symlink or special native discovery directory member");
+      const row = JSON.stringify([childRelative, stat.isDirectory() ? "directory" : "file"]) + `
+`;
+      budget.bytes += Buffer.byteLength(row);
+      need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
+      hash2.update(row);
+      if (stat.isDirectory())
+        walk2(child, childRelative, stat, depth + 1);
+    }
+    need(same(before, lstatSync7(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
+  }
+  walk2(path, "", root, 0);
+  safe(path);
+  return { path, sha256: hash2.digest("hex") };
+}
+function captureDiscoveryDirectories(paths) {
+  need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
+  const budget = { entries: 0, bytes: 0 };
+  return paths.map((path) => capture(path, budget));
+}
+function verifyDiscoveryDirectories(directories) {
+  need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
+  for (const directory of directories)
+    need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  for (let i = 0;i < directories.length; i++)
+    need(current[i].sha256 === directories[i].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i].path}`);
+}
+
+// src/lib/agent-discovery-bytes.ts
+import { createHash as createHash6 } from "crypto";
+import { closeSync as closeSync3, constants as constants3, fstatSync as fstatSync3, lstatSync as lstatSync8, openSync as openSync3, readSync as readSync3 } from "fs";
+import { dirname as dirname7, isAbsolute as isAbsolute5, resolve as resolve6 } from "path";
+function discoveryByteBudget() {
+  return { remaining: AGENT_POLICY_LIMITS.discoveryRawTotalBytes };
+}
+function safe2(path) {
+  if (typeof path !== "string" || !isAbsolute5(path) || path !== resolve6(path) || path.length > AGENT_POLICY_LIMITS.pathCharacters || path.includes("\x00"))
+    throw new Error("Expected a canonical absolute raw discovery path");
+  for (let cursor = path;; cursor = dirname7(cursor)) {
+    if (lstatSync8(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+      throw new Error("Refusing symlink raw discovery input");
+    if (dirname7(cursor) === cursor)
+      break;
+  }
+}
+function same2(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+function consume(budget, bytes) {
+  if (bytes > budget.remaining)
+    throw new Error("Raw discovery aggregate byte limit exceeded");
+  budget.remaining -= bytes;
+}
+function hashRawDiscoveryFile(path, budget, changes) {
+  safe2(path);
+  if (changes?.has(path)) {
+    const text2 = changes.get(path), bytes = Buffer.byteLength(text2);
+    if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+      throw new Error("Raw discovery file byte limit exceeded");
+    consume(budget, bytes);
+    return createHash6("sha256").update(text2).digest("hex");
+  }
+  const initial = lstatSync8(path, { throwIfNoEntry: false });
+  if (!initial)
+    return null;
+  if (!initial.isFile() || initial.size > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+    throw new Error("Unsupported or oversized raw discovery input");
+  if (initial.size > budget.remaining)
+    throw new Error("Raw discovery aggregate byte limit exceeded");
+  const fd = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+  try {
+    const opened = fstatSync3(fd);
+    if (!opened.isFile() || !same2(initial, opened))
+      throw new Error("Raw discovery input changed during open");
+    const hash2 = createHash6("sha256"), buffer = Buffer.alloc(64 * 1024);
+    let bytes = 0;
+    while (true) {
+      const count = readSync3(fd, buffer, 0, Math.min(buffer.length, AGENT_POLICY_LIMITS.discoveryRawSourceBytes - bytes + 1), null);
+      if (!count)
+        break;
+      bytes += count;
+      if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+        throw new Error("Raw discovery file byte limit exceeded");
+      consume(budget, count);
+      hash2.update(buffer.subarray(0, count));
+    }
+    const final = fstatSync3(fd), current = lstatSync8(path, { throwIfNoEntry: false });
+    safe2(path);
+    if (!current?.isFile() || !same2(opened, final) || !same2(final, current) || bytes !== final.size)
+      throw new Error("Raw discovery input changed during read");
+    return hash2.digest("hex");
+  } finally {
+    closeSync3(fd);
+  }
+}
+
 // src/lib/agent-discovery.ts
-var digest = (text2) => createHash5("sha256").update(text2).digest("hex");
+var digest = (text2) => createHash7("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -11757,28 +11908,35 @@ function parseConfig(text2, path, toml = false) {
     throw new Error(`Invalid native discovery configuration: ${path}`);
   }
 }
-function safe(path) {
-  if (!isAbsolute4(path) || path.includes("\x00"))
+function safe3(path) {
+  if (!isAbsolute6(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname6(cursor)) {
-    if (lstatSync7(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname8(cursor)) {
+    if (lstatSync9(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname6(cursor) === cursor)
+    if (dirname8(cursor) === cursor)
       break;
   }
 }
 function read(path, changes) {
-  safe(path);
+  safe3(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat = lstatSync7(path, { throwIfNoEntry: false });
+  const stat = lstatSync9(path, { throwIfNoEntry: false });
   if (!stat)
     return null;
   if (!stat.isFile() || stat.size > 16 * 1024 * 1024)
     throw new Error(`Unsupported or oversized native discovery input: ${path}`);
   return readFileSync10(path, "utf8");
 }
-function projected(source, changes) {
+function projected(source, changes, budget = discoveryByteBudget()) {
+  if (source.hashMode !== undefined) {
+    if (source.hashMode !== "bytes")
+      throw new Error("Invalid native discovery hash mode");
+    if (source.format !== undefined || source.fields !== undefined)
+      throw new Error("Raw discovery witnesses cannot project configuration fields");
+    return hashRawDiscoveryFile(source.path, budget, changes);
+  }
   const text2 = read(source.path, changes);
   if (text2 === null)
     return null;
@@ -11792,22 +11950,34 @@ function projected(source, changes) {
 function verifyAgentDiscovery(binding) {
   if (!binding || !Array.isArray(binding.sources) || !Array.isArray(binding.roots) || binding.sources.length > AGENT_POLICY_LIMITS.discoverySources || binding.roots.length > AGENT_POLICY_LIMITS.discoveryRoots)
     throw new Error("Invalid native discovery binding");
+  if (binding.agent === "hermes" && !binding.directories?.length)
+    throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
+  if (binding.directories !== undefined)
+    verifyDiscoveryDirectories(binding.directories);
+  const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     if (source.format !== undefined && (!["json", "toml", "yaml"].includes(source.format) || !Array.isArray(source.fields) || !source.fields.length || source.fields.length > 64 || source.fields.some((field) => typeof field !== "string" || !field)))
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
-    if (projected(source) !== source.sha256)
+    if (projected(source, undefined, budget) !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
   }
   for (const root of binding.roots)
-    safe(root);
+    safe3(root);
 }
 function rebindAgentDiscovery(binding, changes) {
-  return { ...binding, sources: binding.sources.map((source) => ({ ...source, sha256: projected(source, changes) })) };
+  const budget = discoveryByteBudget();
+  return { ...binding, sources: binding.sources.map((source) => ({ ...source, sha256: projected(source, changes, budget) })) };
+}
+function captureDiscoveryByteSources(paths) {
+  if (!Array.isArray(paths) || paths.length > AGENT_POLICY_LIMITS.discoverySources || new Set(paths).size !== paths.length)
+    throw new Error("Invalid raw discovery source collection");
+  const budget = discoveryByteBudget();
+  return paths.map((path) => ({ path, hashMode: "bytes", sha256: hashRawDiscoveryFile(path, budget) }));
 }
 function resolveAgentDiscovery(options) {
-  const canonical = options.canonical ?? resolve5, home = resolve5(options.home), agent = options.agent;
+  const canonical = options.canonical ?? resolve7, home = resolve7(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields) => {
     const source = { path: canonical(path), sha256: null, ...format ? { format, fields } : {} };
@@ -11817,14 +11987,14 @@ function resolveAgentDiscovery(options) {
   };
   if (agent === "hermes")
     assertHermesEnvironment(home);
-  const configPath = join14(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  const configPath = join15(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
   const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
   };
   if (agent === "hermes") {
-    const profile = witness(join14(home, ".hermes/active_profile"));
+    const profile = witness(join15(home, ".hermes/active_profile"));
     if (profile?.trim() && profile.trim() !== "default")
       unresolved("a non-default profile is active");
     const declared = config.skills?.external_dirs ?? [], paths = typeof declared === "string" ? [declared] : declared;
@@ -11838,8 +12008,8 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join14(home, normalized.slice(2)) : resolve5(home, ".hermes", normalized);
-      safe(path);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join15(home, normalized.slice(2)) : resolve7(home, ".hermes", normalized);
+      safe3(path);
       roots.add(path);
     }
   }
@@ -11847,24 +12017,24 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname6(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname6(directory), depth++) {
-        const path = join14(directory, "package.json"), raw = read(path);
+      for (let directory = dirname8(realpathSync3(executable)), depth = 0;depth < 8; directory = dirname8(directory), depth++) {
+        const path = join15(directory, "package.json"), raw = read(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname6(directory) === directory)
+        if (dirname8(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
-      const builtinRoot = join14(packageRoot, "bundle/builtin");
-      safe(builtinRoot);
-      if (!lstatSync7(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      const builtinRoot = join15(packageRoot, "bundle/builtin");
+      safe3(builtinRoot);
+      if (!lstatSync9(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync9(builtinRoot).sort()) {
-        const text2 = witness(join14(builtinRoot, name, "SKILL.md"));
+        const text2 = witness(join15(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
           unresolved("installed Gemini builtin name is missing or ambiguous");
@@ -11878,7 +12048,7 @@ function resolveAgentDiscovery(options) {
   if (review) {
     if (review.pluginHooks !== "reviewed-no-skill-injection" || !Array.isArray(review.sources) || !review.sources.length || !Array.isArray(review.roots))
       throw new Error("Discovery review must bind sources and confirm plugin hooks do not inject retired skills");
-    const supplied = { agent, roots: review.roots, sources: review.sources, method: "reviewed" };
+    const supplied = { agent, roots: review.roots, sources: review.sources, ...review.directories !== undefined ? { directories: review.directories } : {}, method: "reviewed" };
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
@@ -11888,40 +12058,40 @@ function resolveAgentDiscovery(options) {
   }
   function plugin(root) {
     root = canonical(root);
-    safe(root);
-    const manifestPath = join14(root, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
+    safe3(root);
+    const manifestPath = join15(root, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
     if (raw === null)
       unresolved("plugin manifest missing");
     const manifest = parseConfig(raw, manifestPath);
-    const hooks = witness(join14(root, "hooks/hooks.json"));
+    const hooks = witness(join15(root, "hooks/hooks.json"));
     if (manifest.hooks !== undefined || hooks !== null)
       unresolved("plugin hooks require a separate no-skill-injection review");
-    const commands = join14(root, "commands");
-    safe(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync7(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
+    const commands = join15(root, "commands");
+    safe3(commands);
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync9(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
-    const rootSkill = witness(join14(root, "SKILL.md"));
+    const rootSkill = witness(join15(root, "SKILL.md"));
     if (rootSkill !== null)
       roots.add(root);
     const declared = manifest.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
     if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
       unresolved("unsupported plugin skill paths");
     if (agent === "claude")
-      roots.add(join14(root, "skills"));
+      roots.add(join15(root, "skills"));
     for (const value of declared) {
-      const path = resolve5(root, value);
+      const path = resolve7(root, value);
       if (path !== root && !path.startsWith(root + sep3))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname6(path) : path);
+      roots.add(path.endsWith(`${sep3}SKILL.md`) ? dirname8(path) : path);
     }
   }
   if (agent === "claude") {
-    const registrations = witness(join14(home, ".claude/plugins/installed_plugins.json"));
-    const installed = registrations === null ? {} : parseConfig(registrations, join14(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical(join14(home, ".claude/commands"));
-    safe(commands);
-    if (lstatSync7(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+    const registrations = witness(join15(home, ".claude/plugins/installed_plugins.json"));
+    const installed = registrations === null ? {} : parseConfig(registrations, join15(home, ".claude/plugins/installed_plugins.json")).plugins;
+    const commands = canonical(join15(home, ".claude/commands"));
+    safe3(commands);
+    if (lstatSync9(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -11941,34 +12111,34 @@ function resolveAgentDiscovery(options) {
         unresolved("unsupported plugin enablement");
       const split = id.lastIndexOf("@"), name = id.slice(0, split), marketplace = id.slice(split + 1);
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
-      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute4(market.source))
+      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute6(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
-      const catalogText = witness(join14(market.source, ".agents/plugins/marketplace.json"));
+      const catalogText = witness(join15(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
         unresolved("marketplace catalog missing");
-      const catalog = parseConfig(catalogText, join14(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
+      const catalog = parseConfig(catalogText, join15(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve5(market.source, matches[0].source.path));
+      plugin(resolve7(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
-    if (witness(join14(home, ".config/opencode/opencode.jsonc")) !== null || witness(join14(home, ".config/opencode/config.json")) !== null)
+    if (witness(join15(home, ".config/opencode/opencode.jsonc")) !== null || witness(join15(home, ".config/opencode/config.json")) !== null)
       unresolved("additional config layers require review");
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
     for (const path of config.skills?.paths ?? []) {
-      if (typeof path !== "string" || !isAbsolute4(path))
+      if (typeof path !== "string" || !isAbsolute6(path))
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
-    const localPlugins = join14(home, ".config/opencode/plugins");
-    safe(localPlugins);
-    if (lstatSync7(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
+    const localPlugins = join15(home, ".config/opencode/plugins");
+    safe3(localPlugins);
+    if (lstatSync9(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
-    for (const directory of [join14(home, ".hermes/plugins"), join14(home, ".hermes/hermes-agent")]) {
-      safe(directory);
-      if (lstatSync7(directory, { throwIfNoEntry: false }))
+    for (const directory of [join15(home, ".hermes/plugins"), join15(home, ".hermes/hermes-agent")]) {
+      safe3(directory);
+      if (lstatSync9(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -11976,24 +12146,24 @@ function resolveAgentDiscovery(options) {
   } else if (agent === "gemini") {
     if (Object.keys(config.extensions ?? {}).length || config.skills?.paths?.length)
       unresolved("custom extension or skill paths");
-    const directory = join14(home, ".gemini/extensions");
-    safe(directory);
-    if (lstatSync7(directory, { throwIfNoEntry: false }))
+    const directory = join15(home, ".gemini/extensions");
+    safe3(directory);
+    if (lstatSync9(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync9(directory)) {
-        const root = join14(directory, name);
-        safe(root);
-        if (!lstatSync7(root)?.isDirectory())
+        const root = join15(directory, name);
+        safe3(root);
+        if (!lstatSync9(root)?.isDirectory())
           continue;
-        const raw = witness(join14(root, "gemini-extension.json"));
+        const raw = witness(join15(root, "gemini-extension.json"));
         if (raw === null)
           unresolved("extension registration missing");
-        const manifest = parseConfig(raw, join14(root, "gemini-extension.json"));
-        if (manifest.hooks !== undefined || witness(join14(root, "hooks/hooks.json")) !== null || witness(join14(root, ".gemini-extension-install.json")) !== null)
+        const manifest = parseConfig(raw, join15(root, "gemini-extension.json"));
+        if (manifest.hooks !== undefined || witness(join15(root, "hooks/hooks.json")) !== null || witness(join15(root, ".gemini-extension-install.json")) !== null)
           unresolved("extension hooks or linked registration require review");
-        roots.add(join14(root, "skills"));
+        roots.add(join15(root, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join15(home, ".hermes/plugins"), join15(home, ".hermes/hermes-agent")].map((path) => canonical(path))) } : {} };
 }
 
 // src/lib/agent-adapters.ts
@@ -12058,7 +12228,7 @@ export default async ({ directory }) => {
 }
 
 // src/lib/agent-integration.ts
-var sha = (data) => createHash6("sha256").update(data).digest("hex");
+var sha = (data) => createHash8("sha256").update(data).digest("hex");
 var ROOTS = [
   ["claude", ".claude/skills"],
   ["codex", ".codex/skills"],
@@ -12077,11 +12247,11 @@ var ROOTS = [
   ["copilot", ".github/skills"]
 ];
 function assertSafePath(path) {
-  let cursor = resolve6(path);
+  let cursor = resolve8(path);
   while (true) {
-    if (lstatSync8(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync10(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname7(cursor);
+    const parent = dirname9(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -12089,17 +12259,17 @@ function assertSafePath(path) {
 }
 function readRootAlias(home, agent) {
   assertSafePath(home);
-  const realHome = realpathSync4(home), alias = join15(realHome, `.${agent}`);
-  const stat = lstatSync8(alias, { throwIfNoEntry: false, bigint: true });
+  const realHome = realpathSync4(home), alias = join16(realHome, `.${agent}`);
+  const stat = lstatSync10(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync(alias), targetPath = resolve6(dirname7(alias), link);
+  const link = readlinkSync(alias), targetPath = resolve8(dirname9(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync8(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync10(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync4(targetPath), inside = relative4(realHome, target);
-  if (!inside || inside === ".." || inside.startsWith(`..${sep4}`) || isAbsolute5(inside))
+  if (!inside || inside === ".." || inside.startsWith(`..${sep4}`) || isAbsolute7(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link, aliasIdentity: `${stat.dev}:${stat.ino}:${stat.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
 }
@@ -12108,19 +12278,19 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync8(join15(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync10(join16(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep4) || other.target.startsWith(item.target + sep4))))
     throw new Error("Agent root alias targets must not overlap");
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve6(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
-  return binding ? join15(binding.target, relative4(binding.alias, absolute)) : absolute;
+  const absolute = resolve8(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep4));
+  return binding ? join16(binding.target, relative4(binding.alias, absolute)) : absolute;
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
-    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join15(binding.home, `.${binding.agent}`))
+    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join16(binding.home, `.${binding.agent}`))
       throw new Error("Invalid agent root alias binding");
     const current = readRootAlias(binding.home, binding.agent);
     if (JSON.stringify(current) !== JSON.stringify(binding))
@@ -12129,42 +12299,42 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync8(path);
+  const before = lstatSync10(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync3(path, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+  const descriptor = openSync4(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
   try {
-    const opened = fstatSync3(descriptor);
+    const opened = fstatSync4(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync3(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync4(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync3(descriptor);
+    const after = fstatSync4(descriptor);
     if (length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync3(descriptor);
+    closeSync4(descriptor);
   }
 }
 function treeHash(root) {
-  const hash2 = createHash6("sha256");
+  const hash2 = createHash8("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat = lstatSync8(path);
+    const stat = lstatSync10(path);
     if (stat.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative4(root, path);
     if (stat.isDirectory()) {
       hash2.update(`d\x00${rel}\x00`);
       for (const name of readdirSync10(path).sort())
-        visit2(join15(path, name));
+        visit2(join16(path, name));
       return;
     }
     if (!stat.isFile())
@@ -12182,37 +12352,50 @@ function treeHash(root) {
 }
 function inventoryNativeSkills(home = homedir2(), options = {}) {
   const aliases = rootAliases(home, options.allowRootAliases);
-  const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join15(home, path), aliases)]);
-  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join15(home, adapter.root, CLI_BRIDGE_NAME), aliases));
-  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve6(path)))) {
+  const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join16(home, path), aliases)]);
+  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join16(home, adapter.root, CLI_BRIDGE_NAME), aliases));
+  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve8(path)))) {
     for (const [agent, path] of ROOTS)
-      roots.push([agent, canonicalAgentPath(join15(project, path), aliases)]);
+      roots.push([agent, canonicalAgentPath(join16(project, path), aliases)]);
   }
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
+  let discoveryEntries = 0, discoveryPathBytes = 0;
+  function admit(path) {
+    if (++discoveryEntries > 20000)
+      throw new Error("Native skill discovery entry limit exceeded");
+    discoveryPathBytes += Buffer.byteLength(path, "utf8");
+    if (discoveryPathBytes > 4 * 1024 * 1024)
+      throw new Error("Native skill discovery metadata limit exceeded");
+  }
   function emptySiblingCacheAlias(path, parent) {
-    const link = readlinkSync(path), target = resolve6(parent, link);
-    if (dirname7(target) !== parent || (isAbsolute5(link) ? link !== target : dirname7(link) !== "."))
+    const link = readlinkSync(path), target = resolve8(parent, link);
+    if (dirname9(target) !== parent || (isAbsolute7(link) ? link !== target : dirname9(link) !== "."))
       return false;
-    if (!lstatSync8(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync10(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+    if (!admitted)
+      admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
     if (!existsSync10(path))
       return scan;
-    if (!lstatSync8(path).isDirectory())
+    const stat = lstatSync10(path);
+    if (stat.isFile())
       return scan;
-    if (existsSync10(join15(path, "SKILL.md"))) {
+    if (!stat.isDirectory())
+      throw new Error(`Unsupported native discovery entry: ${path}`);
+    if (existsSync10(join16(path, "SKILL.md"))) {
       scan.hasSkills = true;
       if (seen.has(path))
         return scan;
       seen.add(path);
       let managed = false;
-      const marker = join15(path, ".hasna-skills.json");
+      const marker = join16(path, ".hasna-skills.json");
       if (existsSync10(marker)) {
         try {
           managed = JSON.parse(readFileSync11(marker, "utf8")).managedBy === "@hasna/skills";
@@ -12220,12 +12403,22 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       }
       const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
       const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep4));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join15(home, ".codex", "skills", ".system"), aliases) + sep4) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve6(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join16(home, ".codex", "skills", ".system"), aliases) + sep4) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve8(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
-    if (depth > (vendor ? 8 : 3))
+    if (depth > (vendor ? 32 : 3))
       return { ...scan, complete: false };
-    const children = readdirSync10(path, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    const children = [], directory = opendirSync3(path);
+    try {
+      let child;
+      while ((child = directory.readSync()) !== null) {
+        admit(join16(path, child.name));
+        children.push(child);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    children.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
     if (pluginCache)
       children.sort((a, b) => Number(a.isSymbolicLink()) - Number(b.isSymbolicLink()));
     for (const { name } of children) {
@@ -12236,15 +12429,15 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
       const isVendor = vendor || name === ".system";
       if (isVendor && !options.includeVendor)
         continue;
-      const child = join15(path, name);
-      if (isVendor && lstatSync8(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      const child = join16(path, name);
+      if (isVendor && lstatSync10(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync8(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
           scan.entries++;
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -12263,8 +12456,8 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
     scanRoot(agent, path);
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"])
-      scanRoot(agent, canonicalAgentPath(join15(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
-    scanRoot("gemini", join15(home, ".gemini", "extensions"), true);
+      scanRoot(agent, canonicalAgentPath(join16(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+    scanRoot("gemini", join16(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root of [...options.agentRoots ?? [], ...configured])
@@ -12362,12 +12555,12 @@ function disableCodexSkills(text2, skills, aliases, bridgePath) {
   let result = text2;
   const selections = [...skills.filter((entry) => entry.agent === "codex" && !entry.bridge).map((skill) => ({ path: skill.path, enabled: false })), { path: bridgePath, enabled: true }];
   for (const skill of selections) {
-    const path = join15(skill.path, "SKILL.md");
+    const path = join16(skill.path, "SKILL.md");
     let found = false;
     result = result.replace(/^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm, (section) => {
       const parsed = Bun.TOML.parse(section);
       const declared = parsed.skills?.config?.[0]?.path;
-      if (!declared || ![resolve6(path), resolve6(skill.path)].includes(canonicalAgentPath(declared, aliases)))
+      if (!declared || ![resolve8(path), resolve8(skill.path)].includes(canonicalAgentPath(declared, aliases)))
         return section;
       found = true;
       return /^\s*enabled\s*=/m.test(section) ? section.replace(/^\s*enabled\s*=.*$/m, `enabled = ${skill.enabled}`) : `${section.trimEnd()}
@@ -12391,7 +12584,7 @@ function planAgentIntegration(options) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(profileId) || profileId.includes(".."))
     throw new Error("Invalid selection profile id");
   const aliases = rootAliases(home, options.allowRootAliases);
-  const policyPath = join15(dataDir2, "agent-policy.json");
+  const policyPath = join16(dataDir2, "agent-policy.json");
   assertSafePath(policyPath);
   const priorSnapshot = readManagedSkillPolicySnapshot(dataDir2), previousPolicy = priorSnapshot?.text ?? null, policy = priorSnapshot?.value ?? {};
   if (policy.bridge !== undefined && (!policy.bridge || typeof policy.bridge !== "object" || Array.isArray(policy.bridge)))
@@ -12408,19 +12601,19 @@ function planAgentIntegration(options) {
     if (!INTEGRATION_AGENTS.includes(agent))
       throw new Error(`Unsupported agent: ${agent}`);
     const adapter = AGENT_ADAPTERS[agent];
-    const bridgePath = canonicalAgentPath(join15(home, adapter.root, CLI_BRIDGE_NAME), aliases);
+    const bridgePath = canonicalAgentPath(join16(home, adapter.root, CLI_BRIDGE_NAME), aliases);
     assertSafePath(bridgePath);
     if (existsSync10(bridgePath) && !isOwnedCliBridge(bridgePath, [bridgePath]))
       throw new Error(`Refusing to overwrite an unrecognized or modified Skills bridge: ${bridgePath}`);
     for (const [name, after2] of Object.entries(CLI_BRIDGE_FILES)) {
-      const path2 = join15(bridgePath, name), before2 = readOptional(path2);
+      const path2 = join16(bridgePath, name), before2 = readOptional(path2);
       if (before2 !== after2)
         changes.push({ path: path2, before: before2, after: after2 });
     }
-    const path = canonicalAgentPath(join15(home, adapter.config), aliases);
+    const path = canonicalAgentPath(join16(home, adapter.config), aliases);
     const before = readOptional(path);
     if (agent === "hermes") {
-      const supervisorPath = join15(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(options.command ?? "skills", profileId);
+      const supervisorPath = join16(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(options.command ?? "skills", profileId);
       const priorCommand = policy.bridge?.commands?.hermes, priorProfile = policy.bridge?.profiles?.hermes ?? policy.profileId;
       const previous = policy.bridge?.supervisors?.hermes;
       if (supervisorBefore !== null && supervisorBefore !== supervisorAfter && !(previous?.path === supervisorPath && typeof priorCommand === "string" && typeof priorProfile === "string" && supervisorBefore === renderHermesSupervisor(priorCommand, priorProfile)))
@@ -12431,7 +12624,7 @@ function planAgentIntegration(options) {
       const after2 = configureHermesHooks(before, supervisor, previous);
       if (before !== after2)
         changes.push({ path, before, after: after2 });
-      const optOut = join15(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
+      const optOut = join16(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
       if (optOutBefore === null)
         changes.push({ path: optOut, before: null, after: `Managed by @hasna/skills: bundled native skill reseeding is disabled.
 ` });
@@ -12443,7 +12636,7 @@ function planAgentIntegration(options) {
       if (!permission || typeof permission !== "object" || Array.isArray(permission))
         throw new Error("Expected OpenCode permission object");
       config.permission = { ...permission, skill: { "*": "deny", [CLI_BRIDGE_NAME]: "allow" } };
-      const pluginPath = join15(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
+      const pluginPath = join16(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
       const pluginAfter = renderOpenCodePlugin(options.command ?? "skills", profileId);
       const priorCommand = policy.bridge?.commands?.opencode;
       const ownedPrevious = typeof priorCommand === "string" && typeof policy.profileId === "string" && pluginBefore === renderOpenCodePlugin(priorCommand, policy.bridge?.profiles?.opencode ?? policy.profileId);
@@ -12460,7 +12653,7 @@ function planAgentIntegration(options) {
     if (before !== after)
       changes.push({ path, before, after });
     if (agent === "codex") {
-      const configPath = canonicalAgentPath(join15(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
+      const configPath = canonicalAgentPath(join16(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
       const next = disableCodexSkills(previous ?? "", nativeSkills, aliases, bridgePath);
       if (next !== (previous ?? ""))
         changes.push({ path: configPath, before: previous, after: next });
@@ -12473,12 +12666,12 @@ function planAgentIntegration(options) {
     version: CLI_BRIDGE_VERSION,
     digest: CLI_BRIDGE_DIGEST,
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
-    home: resolve6(home),
+    home: resolve8(home),
     includeVendor: true,
-    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join15(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(options.command ?? "skills", profileId)) } } } : {},
+    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join16(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(options.command ?? "skills", profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries(options.agents.map((agent) => [agent, options.command ?? "skills"])) },
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, options.agents.includes(agent) ? profileId : policy.bridge?.profiles?.[agent] ?? policy.profileId])),
-    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join15(home, ".codex", "skills", ".system"), aliases) + sep4)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
+    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join16(home, ".codex", "skills", ".system"), aliases) + sep4)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
@@ -12490,7 +12683,7 @@ function planAgentIntegration(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname7(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname9(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID2()}`;
   try {
     writeFileSync5(temporary, content, { mode: 384, flag: "wx" });
@@ -12501,12 +12694,12 @@ function atomicWrite2(path, content) {
   }
 }
 function applyAgentIntegration(plan) {
-  const policyPath = join15(plan.dataDir, "agent-policy.json");
+  const policyPath = join16(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve6(path) === resolve6(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve8(path) === resolve8(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve6(change.path) === resolve6(policyPath))
+    if (resolve8(change.path) === resolve8(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
@@ -12517,7 +12710,7 @@ function applyAgentIntegration(plan) {
   for (const change of plan.changes)
     if (currentText(change.path) !== change.before)
       throw new Error(`Configuration changed after planning: ${change.path}`);
-  const backupRoot = join15(plan.dataDir, "migration", randomUUID2()), backups = [], written = [], createdDirectories = new Set;
+  const backupRoot = join16(plan.dataDir, "migration", randomUUID2()), backups = [], written = [], createdDirectories = new Set;
   if (!plan.changes.length) {
     recheckRootAliases(aliases);
     return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
@@ -12527,7 +12720,7 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join15(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
+      const backup = join16(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
       writeFileSync5(backup, change.before, { mode: 384, flag: "wx" });
       backups.push(backup);
     }
@@ -12536,7 +12729,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname7(change.path);!existsSync10(directory); directory = dirname7(directory))
+      for (let directory = dirname9(change.path);!existsSync10(directory); directory = dirname9(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -12545,7 +12738,7 @@ function applyAgentIntegration(plan) {
     recheckRootAliases(aliases);
     for (const binding of plan.discoveryAfter ?? [])
       verifyAgentDiscovery(binding);
-    atomicWrite2(join15(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join16(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -12576,11 +12769,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync3(path, constants3.O_RDONLY | constants3.O_DIRECTORY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
+  const descriptor = openSync4(path, constants4.O_RDONLY | constants4.O_DIRECTORY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
   try {
     fsyncSync(descriptor);
   } finally {
-    closeSync3(descriptor);
+    closeSync4(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -12588,18 +12781,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID2()}`;
   let descriptor;
   try {
-    descriptor = openSync3(temporary, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+    descriptor = openSync4(temporary, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, 384);
     writeFileSync5(descriptor, `${JSON.stringify(value)}
 `);
     fsyncSync(descriptor);
-    closeSync3(descriptor);
+    closeSync4(descriptor);
     descriptor = undefined;
     renameSync3(temporary, path);
-    syncArchiveDirectory(dirname7(path));
+    syncArchiveDirectory(dirname9(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync3(descriptor);
-    if (lstatSync8(temporary, { throwIfNoEntry: false }))
+      closeSync4(descriptor);
+    if (lstatSync10(temporary, { throwIfNoEntry: false }))
       unlinkSync2(temporary);
   }
 }
@@ -12610,7 +12803,7 @@ function archiveNativeSkills(inventory, options) {
   recheckRootAliases(aliases);
   for (const entry of inventory.filter((entry2) => entry2.bridge)) {
     const adapter = AGENT_ADAPTERS[entry.agent];
-    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join15(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
+    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join16(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
@@ -12620,11 +12813,11 @@ function archiveNativeSkills(inventory, options) {
       throw new Error(`Native skill changed after planning: ${entry.path}`);
   if (!selected.length)
     return { entries: [], ...aliases.length ? { rootAliases: aliases } : {} };
-  const operationId = randomUUID2(), archiveRoot = join15(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join15(archiveRoot, "receipt.json");
+  const operationId = randomUUID2(), archiveRoot = join16(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join16(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
-    source: entry.vendor ? join15(entry.path, "SKILL.md") : entry.path,
-    archive: join15(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
-    hash: entry.vendor ? sha(readNativeBytes(join15(entry.path, "SKILL.md"))) : entry.hash,
+    source: entry.vendor ? join16(entry.path, "SKILL.md") : entry.path,
+    archive: join16(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
+    hash: entry.vendor ? sha(readNativeBytes(join16(entry.path, "SKILL.md"))) : entry.hash,
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
@@ -12632,7 +12825,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat = lstatSync8(entry.archive);
+    const stat = lstatSync10(entry.archive);
     if (entry.discoveryOnly ? !stat.isFile() : !stat.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -12640,14 +12833,14 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync10(path); path = dirname7(path))
+  for (let path = archiveRoot;!existsSync10(path); path = dirname9(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname7(created.at(-1)));
+      syncArchiveDirectory(dirname9(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -12659,7 +12852,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync3(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname7(move.source));
+      syncArchiveDirectory(dirname9(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -12680,7 +12873,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync8(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync10(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -12694,10 +12887,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync(entry.archive, entry.source);
-          syncArchiveDirectory(dirname7(entry.source));
+          syncArchiveDirectory(dirname9(entry.source));
           unlinkSync2(entry.archive);
         } else {
-          if (lstatSync8(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync10(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -12705,7 +12898,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync3(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname7(entry.source));
+        syncArchiveDirectory(dirname9(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -12742,9 +12935,9 @@ function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
-  const path = join16(dir, SYNC_MARKER_FILE);
+  const path = join17(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync9(path).isFile())
+    if (!lstatSync11(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync12(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -12766,9 +12959,9 @@ function resolveSyncAgents(arg) {
 function agentGlobalSkillsDir(agent, homeDir = homedir3()) {
   switch (agent) {
     case "opencode":
-      return join16(homeDir, ".config", "opencode", "skills");
+      return join17(homeDir, ".config", "opencode", "skills");
     default:
-      return join16(homeDir, `.${agent}`, "skills");
+      return join17(homeDir, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -12827,7 +13020,7 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate = join16(source, sub);
+    const candidate = join17(source, sub);
     if (existsSync11(candidate) && isDirectory(candidate))
       roots.push(candidate);
   }
@@ -12843,10 +13036,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate = join16(path, entry);
+    const candidate = join17(path, entry);
     if (!isDirectory(candidate))
       return false;
-    return existsSync11(join16(candidate, "SKILL.md")) || existsSync11(join16(candidate, "skill.json")) || existsSync11(join16(candidate, "package.json"));
+    return existsSync11(join17(candidate, "SKILL.md")) || existsSync11(join17(candidate, "skill.json")) || existsSync11(join17(candidate, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -12886,7 +13079,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join16(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
+          path: join17(agentGlobalSkillsDir(agent, homeDir), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -12916,7 +13109,7 @@ function syncSkillsToAgents(options = {}) {
 }
 function writeManagedAgentSkill(params) {
   const homeDir = params.homeDir ?? homedir3();
-  const dir = join16(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
+  const dir = join17(agentGlobalSkillsDir(params.agent, homeDir), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -12933,8 +13126,8 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join16(dir, "SKILL.md");
-  const markerPath = join16(dir, SYNC_MARKER_FILE);
+  const skillMdPath = join17(dir, "SKILL.md");
+  const markerPath = join17(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync11(dir);
   const managed = hasSkillsOwnershipMarker(dir);
   const hasSkillMd = existsSync11(skillMdPath);
@@ -12970,13 +13163,13 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname8(dir);
+  const parentDir = dirname10(dir);
   mkdirSync6(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join16(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
-  const candidateDir = join16(transactionDir, "candidate");
-  const backupDir = join16(transactionDir, "backup");
-  const candidateSkillMdPath = join16(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join16(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join17(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
+  const candidateDir = join17(transactionDir, "candidate");
+  const backupDir = join17(transactionDir, "backup");
+  const candidateSkillMdPath = join17(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join17(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -13025,7 +13218,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir = homedir3()) {
-  const dir = join16(agentGlobalSkillsDir(agent, homeDir), skill);
+  const dir = join17(agentGlobalSkillsDir(agent, homeDir), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync2(dir, { recursive: true, force: true });
@@ -13033,7 +13226,7 @@ function removeManagedAgentSkill(skill, agent, homeDir = homedir3()) {
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join16(skillPath, "SKILL.md");
+    const skillMdPath = join17(skillPath, "SKILL.md");
     if (existsSync11(skillMdPath))
       return readFileSync12(skillMdPath, "utf-8");
   }
@@ -13066,7 +13259,7 @@ function normalizeSkillName(name) {
 
 // src/lib/project-state.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -13081,10 +13274,10 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join17(targetDir, SKILLS_PROJECT_DIR);
+  return join18(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join17(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join18(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
@@ -13205,16 +13398,16 @@ function isPinSource(value) {
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname9(fileURLToPath(import.meta.url));
+var __dirname2 = dirname11(fileURLToPath(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join18(dir, "skills");
+    const candidate = join19(dir, "skills");
     if (existsSync13(candidate) && !dir.includes(".skills"))
       return candidate;
-    dir = dirname9(dir);
+    dir = dirname11(dir);
   }
-  return join18(__dirname2, "..", "skills");
+  return join19(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -13222,13 +13415,13 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join18(getDataDir(), "custom", skillName);
+  const legacyCustomPath = join19(getDataDir(), "custom", skillName);
   if (existsSync13(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join18(SKILLS_DIR, skillName);
+  return join19(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -13291,7 +13484,7 @@ function createLocalSkillManifest(name, generateSkillMd) {
   if (!existsSync13(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join18(sourcePath, "SKILL.md");
+  const skillMdPath = join19(sourcePath, "SKILL.md");
   if (existsSync13(skillMdPath)) {
     skillMd = readFileSync14(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
@@ -13365,16 +13558,16 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join18(base, ".pi", "skills") : join18(homedir4(), ".pi", "agent", "skills");
+      return scope === "project" ? join19(base, ".pi", "skills") : join19(homedir4(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join18(base, ".opencode", "skills") : join18(homedir4(), ".config", "opencode", "skills");
+      return scope === "project" ? join19(base, ".opencode", "skills") : join19(homedir4(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join18(base, `.${agent}`, "skills") : join18(homedir4(), `.${agent}`, "skills");
+      return scope === "project" ? join19(base, `.${agent}`, "skills") : join19(homedir4(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join18(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join19(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   assertNativeExportAllowed();
@@ -13410,7 +13603,7 @@ function removeSkillForAgent(name, options) {
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join18(sourcePath, "SKILL.md");
+  const skillMdPath = join19(sourcePath, "SKILL.md");
   if (existsSync13(skillMdPath))
     return readFileSync14(skillMdPath, "utf-8");
   if (generateSkillMd)
@@ -13445,7 +13638,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join18(sourcePath, "README.md")) || readFileIfExists(join18(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join19(sourcePath, "README.md")) || readFileIfExists(join19(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -13464,7 +13657,7 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join18(getSkillPath(name), "package.json");
+  const pkgPath = join19(getSkillPath(name), "package.json");
   if (!existsSync13(pkgPath))
     return "unknown";
   try {
@@ -13481,21 +13674,21 @@ function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
 }
 // src/lib/run-state.ts
-import { createHash as createHash7, randomBytes } from "crypto";
+import { createHash as createHash9, randomBytes } from "crypto";
 import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync15, readdirSync as readdirSync12, statSync as statSync10, writeFileSync as writeFileSync8 } from "fs";
-import { extname, join as join19, relative as relative5 } from "path";
+import { extname, join as join20, relative as relative5 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
   const id = createRunId(now);
   const day = now.toISOString().slice(0, 10);
   const skillName = normalizeSkillName(params.skill);
   const root = getProjectStateDir(targetDir);
-  const runDir = join19(root, "runs", day, id);
-  const logsDir = join19(runDir, "logs");
-  const exportDir = join19(root, "exports", skillName, id);
+  const runDir = join20(root, "runs", day, id);
+  const logsDir = join20(runDir, "logs");
+  const exportDir = join20(root, "exports", skillName, id);
   mkdirSync8(logsDir, { recursive: true });
   mkdirSync8(exportDir, { recursive: true });
-  mkdirSync8(join19(root, "tmp"), { recursive: true });
+  mkdirSync8(join20(root, "tmp"), { recursive: true });
   const record2 = {
     id,
     skill: skillName,
@@ -13547,27 +13740,27 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync8(join19(context.logsDir, "stdout.log"), stdout);
-  writeFileSync8(join19(context.logsDir, "stderr.log"), stderr);
+  writeFileSync8(join20(context.logsDir, "stdout.log"), stdout);
+  writeFileSync8(join20(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
-  const path = join19(context.runDir, "events.ndjson");
+  const path = join20(context.runDir, "events.ndjson");
   const previous = existsSync14(path) ? readFileSync15(path, "utf-8") : "";
   writeFileSync8(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
-  const runsRoot = join19(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join20(getProjectStateDir(targetDir), "runs");
   if (!existsSync14(runsRoot))
     return [];
   const records = [];
   for (const day of readdirSync12(runsRoot).sort().reverse()) {
-    const dayDir = join19(runsRoot, day);
+    const dayDir = join20(runsRoot, day);
     if (!statSync10(dayDir).isDirectory())
       continue;
     for (const runId of readdirSync12(dayDir).sort().reverse()) {
-      const record2 = readRunRecord(join19(dayDir, runId));
+      const record2 = readRunRecord(join20(dayDir, runId));
       if (record2)
         records.push(record2);
       if (records.length >= limit)
@@ -13577,25 +13770,25 @@ function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   return records;
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
-  const runsRoot = join19(getProjectStateDir(targetDir), "runs");
+  const runsRoot = join20(getProjectStateDir(targetDir), "runs");
   if (!existsSync14(runsRoot))
     return null;
   for (const day of readdirSync12(runsRoot)) {
-    const record2 = readRunRecord(join19(runsRoot, day, runId));
+    const record2 = readRunRecord(join20(runsRoot, day, runId));
     if (record2)
       return record2;
   }
   return null;
 }
 function getRunExportDir(runId, skill, targetDir = process.cwd()) {
-  return join19(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
+  return join20(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
 }
 function writeRunRecord(context) {
-  writeFileSync8(join19(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync8(join20(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync8(join19(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync8(join20(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
@@ -13608,14 +13801,14 @@ function collectRunArtifacts(context) {
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
-      sha256: createHash7("sha256").update(bytes).digest("hex"),
+      sha256: createHash9("sha256").update(bytes).digest("hex"),
       sizeBytes: stat.size
     });
   }
   return artifacts.sort((a, b) => a.path.localeCompare(b.path));
 }
 function readRunRecord(runDir) {
-  const path = join19(runDir, "run.json");
+  const path = join20(runDir, "run.json");
   if (!existsSync14(path))
     return null;
   try {
@@ -13627,7 +13820,7 @@ function readRunRecord(runDir) {
 function walkFiles(dir) {
   const files = [];
   for (const entry of readdirSync12(dir)) {
-    const full = join19(dir, entry);
+    const full = join20(dir, entry);
     if (statSync10(full).isDirectory())
       files.push(...walkFiles(full));
     else
@@ -13673,8 +13866,8 @@ function mimeForPath(path) {
   }
 }
 // src/lib/dependency-preparation.ts
-import { constants as constants4, closeSync as closeSync4, fstatSync as fstatSync4, lstatSync as lstatSync10, mkdirSync as mkdirSync9, openSync as openSync4, readFileSync as readFileSync16, readdirSync as readdirSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3, ftruncateSync, writeSync } from "fs";
-import { join as join20 } from "path";
+import { constants as constants5, closeSync as closeSync5, fstatSync as fstatSync5, lstatSync as lstatSync12, mkdirSync as mkdirSync9, openSync as openSync5, readFileSync as readFileSync16, readdirSync as readdirSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3, ftruncateSync, writeSync } from "fs";
+import { join as join21 } from "path";
 
 // src/lib/preparation-process.ts
 function capturePreparationProcess(child, platform = process.platform, signalGroup = (pid, signal) => process.kill(pid, signal)) {
@@ -13721,15 +13914,15 @@ var DEPENDENCY_PREPARATION_MARKER = ".skills-dependency-preparation";
 var RECOVERY = "Skill dependency preparation is incomplete. Confirm no installer is running, successfully run bun install --no-save in the skill directory, then remove only .skills-dependency-preparation. See docs/skill-standard.md#recovering-interrupted-dependency-preparation.";
 function hasDependencyPreparationMarker(skillPath) {
   try {
-    lstatSync10(join20(skillPath, DEPENDENCY_PREPARATION_MARKER));
+    lstatSync12(join21(skillPath, DEPENDENCY_PREPARATION_MARKER));
     return true;
   } catch (error) {
     return error.code !== "ENOENT";
   }
 }
 function claimPreparation(skillPath) {
-  const marker = join20(skillPath, DEPENDENCY_PREPARATION_MARKER);
-  const state = join20(marker, "state.json"), active = join20(marker, "active");
+  const marker = join21(skillPath, DEPENDENCY_PREPARATION_MARKER);
+  const state = join21(marker, "state.json"), active = join21(marker, "active");
   let created = false;
   try {
     mkdirSync9(marker, { mode: 448 });
@@ -13740,21 +13933,21 @@ function claimPreparation(skillPath) {
   }
   let fd;
   try {
-    if (!lstatSync10(marker).isDirectory() || lstatSync10(marker).isSymbolicLink())
+    if (!lstatSync12(marker).isDirectory() || lstatSync12(marker).isSymbolicLink())
       return;
     if (!created) {
       if (readdirSync13(marker).some((name) => name !== "state.json"))
         return;
-      if (!lstatSync10(state).isFile() || lstatSync10(state).isSymbolicLink() || lstatSync10(state).size > 1024)
+      if (!lstatSync12(state).isFile() || lstatSync12(state).isSymbolicLink() || lstatSync12(state).size > 1024)
         return;
       const previous = JSON.parse(readFileSync16(state, "utf8"));
       if (previous.version !== 1 || previous.status !== "failed" || Object.keys(previous).length !== 2)
         return;
     }
     mkdirSync9(active, { mode: 448 });
-    fd = openSync4(state, constants4.O_RDWR | constants4.O_NOFOLLOW | (created ? constants4.O_CREAT | constants4.O_EXCL : 0), 384);
-    if (!fstatSync4(fd).isFile()) {
-      closeSync4(fd);
+    fd = openSync5(state, constants5.O_RDWR | constants5.O_NOFOLLOW | (created ? constants5.O_CREAT | constants5.O_EXCL : 0), 384);
+    if (!fstatSync5(fd).isFile()) {
+      closeSync5(fd);
       return;
     }
     const descriptor = fd;
@@ -13766,7 +13959,7 @@ function claimPreparation(skillPath) {
     record2("pending");
     return { abandon() {
       try {
-        closeSync4(descriptor);
+        closeSync5(descriptor);
       } catch {}
     }, finish(success) {
       try {
@@ -13774,7 +13967,7 @@ function claimPreparation(skillPath) {
           unlinkSync3(state);
         else
           record2("failed");
-        closeSync4(descriptor);
+        closeSync5(descriptor);
         fd = undefined;
         rmdirSync2(active);
         if (success)
@@ -13782,7 +13975,7 @@ function claimPreparation(skillPath) {
         return true;
       } catch {
         try {
-          closeSync4(descriptor);
+          closeSync5(descriptor);
         } catch {}
         return false;
       }
@@ -13790,7 +13983,7 @@ function claimPreparation(skillPath) {
   } catch {
     if (fd !== undefined)
       try {
-        closeSync4(fd);
+        closeSync5(fd);
       } catch {}
     return;
   }
@@ -13881,11 +14074,11 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 
 // src/lib/skillinfo.ts
 import { existsSync as existsSync15, readFileSync as readFileSync17 } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join21(skillPath, "SKILL.md");
+  const skillMdPath = join22(skillPath, "SKILL.md");
   if (!existsSync15(skillMdPath))
     return false;
   try {
@@ -13915,9 +14108,9 @@ function getSkillDocs(name) {
   if (!existsSync15(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join21(skillPath, "SKILL.md")),
-    readme: readIfExists(join21(skillPath, "README.md")),
-    claudeMd: readIfExists(join21(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join22(skillPath, "SKILL.md")),
+    readme: readIfExists(join22(skillPath, "README.md")),
+    claudeMd: readIfExists(join22(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -13932,14 +14125,14 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join21(skillPath, file));
+    const content = readIfExists(join22(skillPath, file));
     if (content)
       texts.push(content);
   }
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync17(join21(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync17(join22(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -14001,7 +14194,7 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join21(skillPath, "package.json");
+  const pkgPath = join22(skillPath, "package.json");
   if (!existsSync15(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
@@ -14021,12 +14214,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join21(skillPath, entryPoint);
+  const entryPath = join22(skillPath, entryPoint);
   if (!existsSync15(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
   const env = { ...process.env, ...options.env };
-  if (!existsSync15(join21(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync15(join22(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -14104,10 +14297,10 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join21(skillPath, "README.md"));
-  const claudeMd = readIfExists(join21(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join22(skillPath, "README.md"));
+  const claudeMd = readIfExists(join22(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join21(skillPath, "package.json");
+  const pkgPath = join22(skillPath, "package.json");
   if (existsSync15(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync17(pkgPath, "utf-8"));
@@ -18167,11 +18360,11 @@ var NEVER = INVALID;
 // ../contracts/dist/client/transport.js
 import { isIP } from "net";
 import { spawnSync } from "child_process";
-import { closeSync as closeSync5, fstatSync as fstatSync5, openSync as openSync5, readFileSync as readFileSync18 } from "fs";
+import { closeSync as closeSync6, fstatSync as fstatSync6, openSync as openSync6, readFileSync as readFileSync18 } from "fs";
 import { O_NOFOLLOW, O_NONBLOCK, O_RDONLY } from "constants";
 import { createRequire } from "module";
 import { hostname as osHostname } from "os";
-import { isAbsolute as isAbsolute6, join as join22 } from "path";
+import { isAbsolute as isAbsolute8, join as join23 } from "path";
 function envToken(name) {
   return name.toUpperCase().replace(/-/g, "_");
 }
@@ -18230,21 +18423,21 @@ function homeDir(env) {
 }
 function absoluteOverride(env, key) {
   const value = env[key]?.trim();
-  return value && isAbsolute6(value) ? value : null;
+  return value && isAbsolute8(value) ? value : null;
 }
 function hasnaHomeDir(env) {
   const override = absoluteOverride(env, HASNA_HOME_ENV_KEY);
   if (override)
     return override;
   const home = homeDir(env);
-  return home ? join22(home, HASNA_HOME_DIR) : null;
+  return home ? join23(home, HASNA_HOME_DIR) : null;
 }
 function appConfigDir(name, env) {
   const configRoot = absoluteOverride(env, HASNA_CONFIG_HOME_ENV_KEY);
   if (configRoot)
-    return join22(configRoot, name);
+    return join23(configRoot, name);
   const root = hasnaHomeDir(env);
-  return root ? join22(root, name, CONFIG_SUBDIR) : null;
+  return root ? join23(root, name, CONFIG_SUBDIR) : null;
 }
 function credentialDiskSourceList(name, env, profile = null) {
   if (!SAFE_APP_SLUG.test(name))
@@ -18253,7 +18446,7 @@ function credentialDiskSourceList(name, env, profile = null) {
   if (!directory)
     return [];
   const file = profile ? `${CREDENTIALS_FILE}-${profile}` : CREDENTIALS_FILE;
-  return [{ path: join22(directory, file), tier: "disk" }];
+  return [{ path: join23(directory, file), tier: "disk" }];
 }
 function credentialDiskSources(name, env) {
   return credentialDiskSourceList(name, env, null).map((s) => s.path);
@@ -18307,7 +18500,7 @@ function readAppConfigFile(path) {
   };
   let fd = -1;
   try {
-    fd = openSync5(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+    fd = openSync6(path, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT" || code === "ENOTDIR")
@@ -18317,7 +18510,7 @@ function readAppConfigFile(path) {
     unsafe(`the path could not be opened (${code ?? "unknown error"})`);
   }
   try {
-    const before = fstatSync5(fd);
+    const before = fstatSync6(fd);
     if (!before.isFile())
       unsafe("the path is not a regular file");
     if (!configFileModeAllowed(before.mode)) {
@@ -18329,14 +18522,14 @@ function readAppConfigFile(path) {
     if (before.size > MAX_CREDENTIAL_FILE_BYTES)
       unsafe("the file exceeds the size limit");
     const bytes = readFileSync18(fd);
-    const after = fstatSync5(fd);
+    const after = fstatSync6(fd);
     if (!configFileReadsCoherent(before, after)) {
       unsafe("the file changed while being read");
     }
     return parseEnvFile(bytes.toString("utf8"));
   } finally {
     if (fd !== -1)
-      closeSync5(fd);
+      closeSync6(fd);
   }
 }
 function readCredentialFile(path, apiKeyKeys) {
@@ -18851,7 +19044,7 @@ var AUTHORITY_OVERRIDE_HEADERS = new Set([
 ]);
 
 // src/lib/instance-credentials.ts
-import { closeSync as closeSync6, constants as constants5, fstatSync as fstatSync6, lstatSync as lstatSync11, openSync as openSync6, readSync as readSync4 } from "fs";
+import { closeSync as closeSync7, constants as constants6, fstatSync as fstatSync7, lstatSync as lstatSync13, openSync as openSync7, readSync as readSync5 } from "fs";
 var SKILLS_BOUND_API_URL = "HASNA_SKILLS_BOUND_API_URL";
 function selectedSkillsProfile(env, explicit) {
   const selected = explicit ?? env.HASNA_PROFILE;
@@ -18867,7 +19060,7 @@ function skillsProfileCredentialFiles(env, explicit) {
 }
 function fileIdentity(file) {
   try {
-    return lstatSync11(file);
+    return lstatSync13(file);
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
       return null;
@@ -18888,14 +19081,14 @@ function captureSkillsCredentialFiles(files) {
 function readMetadataText(file) {
   let fd;
   try {
-    fd = openSync6(file, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
+    fd = openSync7(file, constants6.O_RDONLY | constants6.O_NOFOLLOW | constants6.O_NONBLOCK);
   } catch (error) {
     if (["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
       return null;
     throw new Error("Cannot safely read Skills instance configuration");
   }
   try {
-    const before = fstatSync6(fd);
+    const before = fstatSync7(fd);
     const uid = process.getuid?.() ?? process.geteuid?.();
     if (!before.isFile() || ![256, 384].includes(before.mode & 4095) || uid !== undefined && before.uid !== uid || before.size > 64 * 1024) {
       throw new Error("Unsafe Skills instance configuration; expected a bounded owner-only regular file");
@@ -18903,17 +19096,17 @@ function readMetadataText(file) {
     const bytes = Buffer.alloc(64 * 1024 + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync4(fd, bytes, length, bytes.length - length, null);
+      const count = readSync5(fd, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    if (length > 64 * 1024 || !unchanged(before, fstatSync6(fd)) || !unchanged(before, fileIdentity(file))) {
+    if (length > 64 * 1024 || !unchanged(before, fstatSync7(fd)) || !unchanged(before, fileIdentity(file))) {
       throw new Error("Skills instance configuration changed while reading");
     }
     return bytes.subarray(0, length).toString("utf8");
   } finally {
-    closeSync6(fd);
+    closeSync7(fd);
   }
 }
 function readSkillsInstanceMetadata(file) {
@@ -20547,7 +20740,7 @@ function object3(value) {
 }
 
 // src/lib/remote-files.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 var MAX_REMOTE_FILE_BYTES = 64 * 1024 * 1024;
 function describeRemoteFiles(files) {
   if (files.length > 10)
@@ -20565,7 +20758,7 @@ function describeRemoteFiles(files) {
   });
 }
 function sha256(bytes) {
-  return createHash8("sha256").update(bytes).digest("hex");
+  return createHash10("sha256").update(bytes).digest("hex");
 }
 async function readBoundedResponse(response, maximum) {
   if (!Number.isSafeInteger(maximum) || maximum < 0 || maximum > MAX_REMOTE_FILE_BYTES)
@@ -20658,10 +20851,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve7) => {
+  const deadline = new Promise((resolve9) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve7(expired);
+      resolve9(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -21476,9 +21669,9 @@ async function createRemoteSkillsClient(env = process.env) {
 }
 // src/lib/scheduler.ts
 import { existsSync as existsSync16, readFileSync as readFileSync19, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
-  return join23(targetDir, ".skills", "schedules.json");
+  return join24(targetDir, ".skills", "schedules.json");
 }
 function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
@@ -21491,7 +21684,7 @@ function loadSchedules(targetDir = process.cwd()) {
 }
 function saveSchedules(data, targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
-  const dir = join23(targetDir, ".skills");
+  const dir = join24(targetDir, ".skills");
   if (!existsSync16(dir))
     mkdirSync10(dir, { recursive: true });
   writeFileSync9(path, JSON.stringify(data, null, 2));
@@ -21679,7 +21872,7 @@ function recordScheduleRun(id, status, targetDir) {
   saveSchedules(data, targetDir);
 }
 // src/lib/revision.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
   const canonical = JSON.stringify({
@@ -21695,14 +21888,14 @@ function revisionIdOf(content) {
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
   });
-  return createHash9("sha256").update(canonical).digest("hex");
+  return createHash11("sha256").update(canonical).digest("hex");
 }
 function revisionIdOfRecord(record5) {
   return revisionIdOf(record5);
 }
 // src/lib/pull.ts
 import { existsSync as existsSync17, mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync3, readFileSync as readFileSync20, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname10, join as join24 } from "path";
+import { dirname as dirname12, join as join25 } from "path";
 
 // src/lib/skill-bundles.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -21796,7 +21989,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
       return reconcileTombstone(slug, corpusOptions);
     }
     if (bundleResponse.status === 404) {
-      const marker = readPullMarker(join24(getPortableSkillsRoot(corpusOptions), slug));
+      const marker = readPullMarker(join25(getPortableSkillsRoot(corpusOptions), slug));
       if (isPublishedInstallMarker(marker)) {
         return { name: slug, success: true, purged: true, removed: false };
       }
@@ -21835,7 +22028,7 @@ async function pullOne(client, rawName, corpusOptions, verify) {
     return { name: slug, success: false, error: `Skill '${slug}' was not found on the configured Skills instance.` };
   }
   if (!meta?.revisionId) {
-    const marker = readPullMarker(join24(getPortableSkillsRoot(corpusOptions), slug));
+    const marker = readPullMarker(join25(getPortableSkillsRoot(corpusOptions), slug));
     if (isPublishedInstallMarker(marker)) {
       return { name: slug, success: true, purged: true, removed: false };
     }
@@ -21892,7 +22085,7 @@ function provenRevision(meta, slug, bundle) {
   return declared;
 }
 function reconcileTombstone(slug, corpusOptions) {
-  const target = join24(getPortableSkillsRoot(corpusOptions), slug);
+  const target = join25(getPortableSkillsRoot(corpusOptions), slug);
   if (!hasSkillsOwnershipMarker(target)) {
     return { name: slug, success: true, tombstoned: true, removed: false, leftInPlace: true };
   }
@@ -21901,7 +22094,7 @@ function reconcileTombstone(slug, corpusOptions) {
 }
 function readPullMarker(dir) {
   try {
-    return JSON.parse(readFileSync20(join24(dir, PULL_MARKER_FILE), "utf-8"));
+    return JSON.parse(readFileSync20(join25(dir, PULL_MARKER_FILE), "utf-8"));
   } catch {
     return null;
   }
@@ -22036,15 +22229,15 @@ function verifyBundleResponseBytes(buffer, response, verify = {}) {
 function installBundleAtomically(name, entries, options = {}, marker = {}) {
   const root = getPortableSkillsRoot(options);
   mkdirSync11(root, { recursive: true });
-  const target = join24(root, name);
+  const target = join25(root, name);
   const created = !existsSync17(target);
-  const staging = mkdtempSync3(join24(root, `.pull-${name}-`));
+  const staging = mkdtempSync3(join25(root, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
     for (const entry of entries) {
-      const destination = join24(staging, entry.path);
-      mkdirSync11(dirname10(destination), { recursive: true });
+      const destination = join25(staging, entry.path);
+      mkdirSync11(dirname12(destination), { recursive: true });
       writeFileSync10(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
@@ -22056,8 +22249,8 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       ...marker.revisionId ? { revisionId: marker.revisionId } : {}
     });
     if (existsSync17(target)) {
-      backup = mkdtempSync3(join24(root, `.pull-backup-${name}-`));
-      renameSync5(target, join24(backup, name));
+      backup = mkdtempSync3(join25(root, `.pull-backup-${name}-`));
+      renameSync5(target, join25(backup, name));
       moved = true;
     }
     renameSync5(staging, target);
@@ -22065,9 +22258,9 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
       rmSync4(backup, { recursive: true, force: true });
   } catch (error) {
     rmSync4(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync17(join24(backup, name))) {
+    if (moved && backup && existsSync17(join25(backup, name))) {
       try {
-        renameSync5(join24(backup, name), target);
+        renameSync5(join25(backup, name), target);
       } catch {}
     }
     throw error;
@@ -22086,7 +22279,7 @@ function writePullMarker(dir, record5) {
     ...record5.revisionId ? { revisionId: record5.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync10(join24(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync10(join25(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client, slug) {
@@ -22242,11 +22435,11 @@ function findSkillsParityForMcpTool(tool) {
 }
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname11, relative as relative6 } from "path";
+import { dirname as dirname13, relative as relative6 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.7.1",
+  version: "0.7.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -22428,7 +22621,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync12(dirname11(path), { recursive: true });
+  mkdirSync12(dirname13(path), { recursive: true });
   writeFileSync11(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -23502,14 +23695,14 @@ function clone2(value) {
 }
 // src/lib/feedback.ts
 import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync13 } from "fs";
-import { dirname as dirname12, join as join25 } from "path";
+import { dirname as dirname14, join as join26 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
-  return join25(getDataDir(), "skills.db");
+  return join26(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname12(dbPath);
+  const dir = dirname14(dbPath);
   if (!existsSync18(dir))
     mkdirSync13(dir, { recursive: true });
   const db = new Database(dbPath);
@@ -23537,8 +23730,8 @@ function saveFeedback(input) {
     throw new Error("Feedback message is required");
   const category = input.category ?? "general";
   if (isApiMode()) {
-    const path = join25(getDataDir(), "feedback.jsonl");
-    const dir = dirname12(path);
+    const path = join26(getDataDir(), "feedback.jsonl");
+    const dir = dirname14(path);
     if (!existsSync18(dir))
       mkdirSync13(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input.email ?? null, agent: input.agent ?? null, version: input.version ?? null, createdAt: new Date().toISOString() }) + `
@@ -23561,7 +23754,7 @@ function isApiMode(env = process.env) {
   }
 }
 // src/lib/native-storage.ts
-import { createHash as createHash10, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash12, createHmac as createHmac2 } from "crypto";
 import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync14,
@@ -23570,7 +23763,7 @@ import {
   statSync as statSync11,
   writeFileSync as writeFileSync12
 } from "fs";
-import { dirname as dirname13, join as join26, normalize as normalize3, relative as relative7, sep as sep5 } from "path";
+import { dirname as dirname15, join as join27, normalize as normalize3, relative as relative7, sep as sep5 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -23707,7 +23900,7 @@ function getSkillsNativeStorageStatus(options = {}) {
     local: {
       dataDir: getDataDir(),
       projectStateDir: getProjectStateDir(targetDir),
-      feedbackDbPath: join26(getDataDir(), "skills.db")
+      feedbackDbPath: join27(getDataDir(), "skills.db")
     },
     remote: {
       databaseConfigured: Boolean(config.databaseUrl),
@@ -23737,7 +23930,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
-        sha256: createHash10("sha256").update(bytes).digest("hex"),
+        sha256: createHash12("sha256").update(bytes).digest("hex"),
         ...options.includeFileContents ? { contentBase64: Buffer.from(bytes).toString("base64") } : {}
       });
     }
@@ -23762,11 +23955,11 @@ function importSkillsLocalSnapshot(snapshot, targetDir = process.cwd(), options
       continue;
     }
     const bytes = Buffer.from(file.contentBase64, "base64");
-    const hash2 = createHash10("sha256").update(bytes).digest("hex");
+    const hash2 = createHash12("sha256").update(bytes).digest("hex");
     if (hash2 !== file.sha256) {
       throw new Error(`Snapshot file checksum mismatch: ${file.path}`);
     }
-    mkdirSync14(dirname13(absolutePath), { recursive: true });
+    mkdirSync14(dirname15(absolutePath), { recursive: true });
     writeFileSync12(absolutePath, bytes);
     written += 1;
   }
@@ -24064,7 +24257,7 @@ function parsePositiveInteger(value) {
 function walkFiles2(dir) {
   const files = [];
   for (const entry of readdirSync14(dir)) {
-    const full = join26(dir, entry);
+    const full = join27(dir, entry);
     const stats = statSync11(full);
     if (stats.isDirectory())
       files.push(...walkFiles2(full));
@@ -24081,7 +24274,7 @@ function resolveSnapshotPath(targetDir, snapshotPath) {
   if (!toPosix(normalizedPath).startsWith(".skills/")) {
     throw new Error(`Snapshot path must stay inside .skills: ${snapshotPath}`);
   }
-  return join26(targetDir, normalizedPath);
+  return join27(targetDir, normalizedPath);
 }
 function normalizeS3Prefix(prefix) {
   return (prefix ?? "").trim().replace(/^\/+|\/+$/g, "");
@@ -24094,7 +24287,7 @@ function toIsoString(value) {
   return Number.isNaN(date.getTime()) ? value : date.toISOString();
 }
 function sha256Hex2(value) {
-  return createHash10("sha256").update(value).digest("hex");
+  return createHash12("sha256").update(value).digest("hex");
 }
 function normalizeHeaders(headers) {
   const result = {};
@@ -24146,7 +24339,7 @@ function toArrayBuffer(bytes) {
   return buffer;
 }
 // src/lib/station-snapshot.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync15,
@@ -24154,12 +24347,12 @@ import {
   statSync as statSync13,
   writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname14, isAbsolute as isAbsolute7, relative as relative8, resolve as resolve7, sep as sep7 } from "path";
+import { dirname as dirname16, isAbsolute as isAbsolute9, relative as relative8, resolve as resolve9, sep as sep7 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync15, statSync as statSync12 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join27, sep as sep6 } from "path";
+import { join as join28, sep as sep6 } from "path";
 var SYNC_HOMES = [
   { name: "skills", subClass: "skills", agent: null },
   { name: "custom", subClass: "custom", agent: null },
@@ -24252,16 +24445,16 @@ function isPortableWithinSkill(relativeParts) {
 function homePathFor(definition, homesRoot) {
   const home = homesRoot ?? homedir5();
   if (definition.subClass === "skills" || definition.subClass === "custom") {
-    return join27(skillsDataRootForHome(home), definition.name);
+    return join28(skillsDataRootForHome(home), definition.name);
   }
   if (definition.agent === "opencode") {
-    return join27(home, ".config", "opencode", "skills");
+    return join28(home, ".config", "opencode", "skills");
   }
-  return join27(home, `.${definition.agent}`, "skills");
+  return join28(home, `.${definition.agent}`, "skills");
 }
 function destinationFor(definition, stationId, relativePath) {
-  const category = definition.subClass === "agent-homes" ? join27("agent-homes", definition.agent ?? "") : definition.name;
-  return join27("resources", stationId, "skills", category, ...relativePath.split(sep6));
+  const category = definition.subClass === "agent-homes" ? join28("agent-homes", definition.agent ?? "") : definition.name;
+  return join28("resources", stationId, "skills", category, ...relativePath.split(sep6));
 }
 function walkEntries(absoluteRoot) {
   let entries;
@@ -24272,7 +24465,7 @@ function walkEntries(absoluteRoot) {
   }
   const output = [];
   for (const entry of entries) {
-    const childFull = join27(absoluteRoot, entry.name);
+    const childFull = join28(absoluteRoot, entry.name);
     if (entry.isSymbolicLink()) {
       output.push({ kind: "symlink", relativePath: entry.name, fullPath: childFull });
       continue;
@@ -24283,7 +24476,7 @@ function walkEntries(absoluteRoot) {
       }
       const nested = walkEntries(childFull);
       for (const item of nested) {
-        output.push({ ...item, relativePath: join27(entry.name, item.relativePath) });
+        output.push({ ...item, relativePath: join28(entry.name, item.relativePath) });
       }
       continue;
     }
@@ -24321,7 +24514,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash11("sha256").update(readFileSync22(filePath)).digest("hex");
+  return createHash13("sha256").update(readFileSync22(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -24392,7 +24585,7 @@ function humanHomes(scanned) {
   }));
 }
 function writeStationSnapshot(options) {
-  const repoRoot = resolve7(options.repoRoot ?? process.cwd());
+  const repoRoot = resolve9(options.repoRoot ?? process.cwd());
   const { scanned, plans, totalBytes } = planStationSnapshot(options);
   const manifestFiles = plans.map((plan) => ({
     relativePath: plan.source.relativePath,
@@ -24418,9 +24611,9 @@ function writeStationSnapshot(options) {
   const conflicts = [];
   const untouched = [];
   for (const plan of plans) {
-    const destination = resolve7(repoRoot, plan.destination);
+    const destination = resolve9(repoRoot, plan.destination);
     const destinationRelative = relative8(repoRoot, destination);
-    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep7) || isAbsolute7(destinationRelative)) {
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep7) || isAbsolute9(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
     let existingDigest = null;
@@ -24441,8 +24634,8 @@ function writeStationSnapshot(options) {
   }
   let written = 0;
   for (const plan of untouched) {
-    const destination = resolve7(repoRoot, plan.destination);
-    mkdirSync15(dirname14(destination), { recursive: true });
+    const destination = resolve9(repoRoot, plan.destination);
+    mkdirSync15(dirname16(destination), { recursive: true });
     copyFileSync2(plan.source.fullPath, destination);
     written += 1;
   }
@@ -24460,8 +24653,8 @@ function writeStationSnapshot(options) {
     },
     files: manifestFiles
   };
-  const manifestPath = resolve7(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync15(dirname14(manifestPath), { recursive: true });
+  const manifestPath = resolve9(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  mkdirSync15(dirname16(manifestPath), { recursive: true });
   writeFileSync13(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
@@ -24472,7 +24665,7 @@ function writeStationSnapshot(options) {
   };
 }
 // src/lib/station-hydrate.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import {
   copyFileSync as copyFileSync3,
   mkdirSync as mkdirSync16,
@@ -24481,7 +24674,7 @@ import {
   statSync as statSync14,
   writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname15, join as join28, resolve as resolve8, sep as sep8 } from "path";
+import { dirname as dirname17, join as join29, resolve as resolve10, sep as sep8 } from "path";
 var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1";
 var STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
 var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
@@ -24489,11 +24682,11 @@ function fail(code, message, detail = []) {
   throw new StationSnapshotError(code, message, detail);
 }
 function snapshotRootFor(repoRoot, stationId) {
-  return join28(repoRoot, "resources", stationId, "skills");
+  return join29(repoRoot, "resources", stationId, "skills");
 }
 function readSnapshotManifest(repoRoot, stationId) {
   const snapshotRoot = snapshotRootFor(repoRoot, stationId);
-  const manifestPath = join28(snapshotRoot, "sync-manifest.json");
+  const manifestPath = join29(snapshotRoot, "sync-manifest.json");
   let manifest;
   try {
     manifest = JSON.parse(readFileSync23(manifestPath, "utf8"));
@@ -24520,7 +24713,7 @@ function planStationHydration(stationId, repoRoot) {
   const hashMismatches = [];
   const skippedByRule = [];
   for (const agent of SYNC_AGENTS) {
-    const agentRoot = join28(snapshotRoot, "agent-homes", agent);
+    const agentRoot = join29(snapshotRoot, "agent-homes", agent);
     let identEntries;
     try {
       identEntries = readdirSync16(agentRoot, { withFileTypes: true });
@@ -24531,7 +24724,7 @@ function planStationHydration(stationId, repoRoot) {
       if (!identEntry.isDirectory() || identEntry.name.startsWith(".")) {
         continue;
       }
-      const identRoot = join28(agentRoot, identEntry.name);
+      const identRoot = join29(agentRoot, identEntry.name);
       const entries = walkEntries(identRoot);
       for (const entry of entries) {
         const relativeParts = [identEntry.name, ...entry.relativePath.split(sep8)];
@@ -24678,12 +24871,12 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file) => sha256File(file.winner.fullPath));
-  return createHash12("sha256").update(joined.sort().join(`
+  return createHash14("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
-  const repoRoot = resolve8(options.repoRoot ?? process.cwd());
-  const cacheRoot = resolve8(options.cacheRoot ?? resolveCorpusRoot());
+  const repoRoot = resolve10(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve10(options.cacheRoot ?? resolveCorpusRoot());
   const plan = planStationHydration(options.stationId, repoRoot);
   const resultSkills = plan.winners.map((skill) => ({
     ident: skill.ident,
@@ -24716,7 +24909,7 @@ function writeStationHydration(options) {
   const toWrite = [];
   for (const skill of plan.winners) {
     for (const file of skill.files) {
-      const destination = join28(cacheRoot, skill.ident, file.withinIdent);
+      const destination = join29(cacheRoot, skill.ident, file.withinIdent);
       const digest2 = sha256File(file.winner.fullPath);
       let existingDigest = null;
       try {
@@ -24737,7 +24930,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync16(dirname15(entry.destination), { recursive: true });
+    mkdirSync16(dirname17(entry.destination), { recursive: true });
     copyFileSync3(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -24758,8 +24951,8 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join28(dirname15(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync16(dirname15(hydrationManifestPath), { recursive: true });
+  const hydrationManifestPath = join29(dirname17(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync16(dirname17(hydrationManifestPath), { recursive: true });
   writeFileSync14(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
@@ -24865,7 +25058,7 @@ async function requestInvitationEmail(origin, action, input) {
 }
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
 var failures = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
@@ -24912,7 +25105,7 @@ var hash2 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
 var record6 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var exact = (v, keys) => record6(v) && Object.keys(v).sort().join(",") === keys.sort().join(",");
 var date = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v));
-var publicationSha256 = (bytes) => createHash13("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash15("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash2(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -25157,12 +25350,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve9) => {
+      await new Promise((resolve11) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve9();
+          resolve11();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -25394,23 +25587,23 @@ class RemoteSkillsAuthClient {
   }
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants6, closeSync as closeSync7, fsyncSync as fsyncSync2, fstatSync as fstatSync7, lstatSync as lstatSync12, mkdirSync as mkdirSync17, openSync as openSync7, readSync as readSync5, realpathSync as realpathSync5, renameSync as renameSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname16, isAbsolute as isAbsolute8, join as join29, resolve as resolve9 } from "path";
+import { constants as constants7, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, lstatSync as lstatSync14, mkdirSync as mkdirSync17, openSync as openSync8, readSync as readSync6, realpathSync as realpathSync5, renameSync as renameSync6, unlinkSync as unlinkSync4, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname18, isAbsolute as isAbsolute10, join as join30, resolve as resolve11 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 var fail2 = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory) {
-  if (!isAbsolute8(directory) || directory !== resolve9(directory) || realpathSync5(directory) !== directory)
+  if (!isAbsolute10(directory) || directory !== resolve11(directory) || realpathSync5(directory) !== directory)
     return fail2();
-  for (let path = directory;; path = dirname16(path)) {
-    const stat = lstatSync12(path);
+  for (let path = directory;; path = dirname18(path)) {
+    const stat = lstatSync14(path);
     if (!stat.isDirectory() || stat.isSymbolicLink())
       return fail2();
-    if (path === dirname16(path))
+    if (path === dirname18(path))
       break;
   }
-  const own = lstatSync12(directory);
+  const own = lstatSync14(directory);
   if ((own.mode & 63) !== 0 || process.getuid && own.uid !== process.getuid())
     return fail2();
   return { dev: own.dev, ino: own.ino };
@@ -25421,36 +25614,36 @@ function unchangedDirectory(directory, identity2) {
     return fail2();
 }
 function readOwned(directory, name, max) {
-  const identity2 = safeDirectory(directory), file = join29(directory, name);
-  const fd = openSync7(file, constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  const identity2 = safeDirectory(directory), file = join30(directory, name);
+  const fd = openSync8(file, constants7.O_RDONLY | constants7.O_NOFOLLOW);
   try {
-    const stat = fstatSync7(fd);
+    const stat = fstatSync8(fd);
     if (!stat.isFile() || stat.nlink !== 1 || stat.size > max || stat.size < 1 || (stat.mode & 63) !== 0 || process.getuid && stat.uid !== process.getuid())
       return fail2();
     const buffer = Buffer.alloc(Math.min(max, stat.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync5(fd, buffer, length, buffer.length - length, length);
+      const count = readSync6(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync7(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync8(fd);
     unchangedDirectory(directory, identity2);
     if (bytes.length !== stat.size || stat.size !== after.size || stat.mtimeMs !== after.mtimeMs || stat.ctimeMs !== after.ctimeMs)
       return fail2();
     return bytes;
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
 }
 function writeOwned(directory, name, bytes) {
-  const fd = openSync7(join29(directory, name), constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+  const fd = openSync8(join30(directory, name), constants7.O_WRONLY | constants7.O_CREAT | constants7.O_EXCL | constants7.O_NOFOLLOW, 384);
   try {
     writeFileSync15(fd, bytes);
     fsyncSync2(fd);
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
 }
 function save(directory, value) {
@@ -25458,12 +25651,12 @@ function save(directory, value) {
   writeOwned(directory, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory, identity2);
-  renameSync6(join29(directory, temporary), join29(directory, "receipt.json"));
-  const fd = openSync7(directory, constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  renameSync6(join30(directory, temporary), join30(directory, "receipt.json"));
+  const fd = openSync8(directory, constants7.O_RDONLY | constants7.O_NOFOLLOW);
   try {
     fsyncSync2(fd);
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
 }
 function bind(client, receipt) {
@@ -25471,23 +25664,23 @@ function bind(client, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory, action) {
-  const identity2 = safeDirectory(directory), file = join29(directory, "operation.lock");
+  const identity2 = safeDirectory(directory), file = join30(directory, "operation.lock");
   let fd;
   try {
-    fd = openSync7(file, constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+    fd = openSync8(file, constants7.O_WRONLY | constants7.O_CREAT | constants7.O_EXCL | constants7.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync7(fd);
+  const lock = fstatSync8(fd);
   try {
     writeFileSync15(fd, JSON.stringify({ pid: process.pid }) + `
 `);
     fsyncSync2(fd);
     return await action();
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
     unchangedDirectory(directory, identity2);
-    const now = lstatSync12(file);
+    const now = lstatSync14(file);
     if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
       fail2();
     unlinkSync4(file);
@@ -25539,15 +25732,15 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute8(recoveryDirectory) || resolve9(recoveryDirectory) !== recoveryDirectory || realpathSync5(dirname16(recoveryDirectory)) !== dirname16(recoveryDirectory))
+  if (!isAbsolute10(recoveryDirectory) || resolve11(recoveryDirectory) !== recoveryDirectory || realpathSync5(dirname18(recoveryDirectory)) !== dirname18(recoveryDirectory))
     return fail2();
   mkdirSync17(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync7(dirname16(recoveryDirectory), constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  const parent = openSync8(dirname18(recoveryDirectory), constants7.O_RDONLY | constants7.O_NOFOLLOW);
   try {
     fsyncSync2(parent);
   } finally {
-    closeSync7(parent);
+    closeSync8(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);
@@ -25757,8 +25950,8 @@ async function createProfileClient() {
   return new HttpProfileClient(connection.apiKey, connection.apiOrigin);
 }
 // src/lib/skill-context.ts
-import { createHash as createHash14 } from "crypto";
-import { resolve as resolve10 } from "path";
+import { createHash as createHash16 } from "crypto";
+import { resolve as resolve12 } from "path";
 
 // src/lib/selected-document.ts
 var DOCUMENT_PATHS = ["SKILL.md", "README.md", "CLAUDE.md"];
@@ -25905,7 +26098,7 @@ async function buildSkillContext(input, options = {}) {
   }
   const promptWords = words(prompt);
   const loaded = new Set(resolved.session?.loaded ?? []);
-  const paths = [...input.paths ?? [], ...input.cwd ? [input.cwd, resolve10(input.cwd)] : []];
+  const paths = [...input.paths ?? [], ...input.cwd ? [input.cwd, resolve12(input.cwd)] : []];
   const candidates = profile.selections.map((selection) => {
     const key = selectionKey(selection);
     if (input.restore && loaded.has(key))
@@ -25957,7 +26150,7 @@ ${content}`;
 `);
   const receipt = {
     schemaVersion: 1,
-    id: createHash14("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
+    id: createHash16("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
     profileId: profile.profileId,
     profileRevision: profile.profileRevision,
     authority: profile.authority,
@@ -26158,6 +26351,8 @@ export {
   computeContentHash,
   completeSkillRun,
   clearRegistryCache,
+  captureDiscoveryDirectories,
+  captureDiscoveryByteSources,
   canonicalizeManifest,
   buildSkillsS3ObjectUrl,
   buildSkillsApiUrl,