@hasna/skills 0.7.1 → 0.7.2

package/dist/sdk/index.js

@@ -30042,10 +30042,10 @@ var require_public_api = __commonJS((exports) => {
 import { chmod, mkdir, readFile, rename, writeFile as writeFile2 } from "fs/promises";
 import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync22 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 import { existsSync as existsSync18 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join28, resolve as resolve8 } from "path";
+import { join as join29, resolve as resolve10 } from "path";
 import { homedir as pathsResolverHomedir2 } from "os";
 import { join as pathsResolverJoin2 } from "path";
 import { createHmac as createHmac4, timingSafeEqual as timingSafeEqual3 } from "crypto";
@@ -30207,7 +30207,7 @@ function effectiveHome2() {
   return process.env["HOME"] || process.env["USERPROFILE"] || homedir6();
 }
 function legacyHomeDir() {
-  return join28(effectiveHome2(), ".hasna", "events");
+  return join29(effectiveHome2(), ".hasna", "events");
 }
 function resolverHome() {
   return dataDir2({ app: "events", home: effectiveHome2() || undefined });
@@ -30216,7 +30216,7 @@ function adoptResolverHome(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync18(join28(resolved, EVENTS_STORE_SENTINEL_FILE));
+  return existsSync18(join29(resolved, EVENTS_STORE_SENTINEL_FILE));
 }
 function exactEventsHome() {
   const dir = process.env[HASNA_EVENTS_DIR_ENV];
@@ -30230,9 +30230,9 @@ function exactEventsHome() {
 function getEventsHome() {
   const exact = exactEventsHome();
   if (exact)
-    return resolve8(exact);
+    return resolve10(exact);
   const resolved = resolverHome();
-  return adoptResolverHome(resolved) ? resolve8(resolved) : resolve8(legacyHomeDir());
+  return adoptResolverHome(resolved) ? resolve10(resolved) : resolve10(legacyHomeDir());
 }
 function getEventsDataDir(override) {
   return override || getEventsHome();
@@ -30247,9 +30247,9 @@ class JsonEventsStore {
   constructor(dataDir22 = getEventsDataDir()) {
     this.dataDir = dataDir22;
     this.runtime = localJsonRuntime(dataDir22);
-    this.channelsPath = join27(dataDir22, "channels.json");
-    this.eventsPath = join27(dataDir22, "events.json");
-    this.deliveriesPath = join27(dataDir22, "deliveries.json");
+    this.channelsPath = join28(dataDir22, "channels.json");
+    this.eventsPath = join28(dataDir22, "events.json");
+    this.deliveriesPath = join28(dataDir22, "deliveries.json");
   }
   async init() {
     await mkdir(this.dataDir, { recursive: true, mode: 448 });
@@ -31368,7 +31368,7 @@ var init_event_sink = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.7.1",
+  version: "0.7.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -45190,7 +45190,7 @@ import { existsSync as existsSync17 } from "fs";
 
 // src/lib/installer.ts
 import { existsSync as existsSync14, readFileSync as readFileSync17, rmSync as rmSync3 } from "fs";
-import { dirname as dirname13, join as join23 } from "path";
+import { dirname as dirname15, join as join24 } from "path";
 import { homedir as homedir5 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -45198,7 +45198,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 import {
   cpSync as cpSync3,
   existsSync as existsSync11,
-  lstatSync as lstatSync10,
+  lstatSync as lstatSync12,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync14,
@@ -45209,12 +45209,12 @@ import {
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename3, dirname as dirname12, join as join20 } from "path";
+import { basename as basename3, dirname as dirname14, join as join21 } from "path";
 
 // src/lib/agent-integration.ts
-import { createHash as createHash10, randomUUID as randomUUID6 } from "crypto";
-import { existsSync as existsSync5, lstatSync as lstatSync7, statSync as statSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync9, readdirSync as readdirSync6, readlinkSync, realpathSync as realpathSync2, renameSync as renameSync2, rmdirSync, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2, chmodSync, openSync as openSync5, closeSync as closeSync5, fsyncSync, fstatSync as fstatSync5, readSync as readSync4, constants as constants4, linkSync } from "fs";
-import { dirname as dirname9, join as join14, resolve as resolve5, relative as relative2, isAbsolute as isAbsolute5, sep as sep2 } from "path";
+import { createHash as createHash12, randomUUID as randomUUID6 } from "crypto";
+import { existsSync as existsSync5, lstatSync as lstatSync9, statSync as statSync3, mkdirSync as mkdirSync5, readFileSync as readFileSync9, readdirSync as readdirSync6, opendirSync as opendirSync3, readlinkSync, realpathSync as realpathSync2, renameSync as renameSync2, rmdirSync, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2, chmodSync, openSync as openSync6, closeSync as closeSync6, fsyncSync, fstatSync as fstatSync6, readSync as readSync5, constants as constants5, linkSync } from "fs";
+import { dirname as dirname11, join as join15, resolve as resolve7, relative as relative2, isAbsolute as isAbsolute7, sep as sep2 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/lib/managed-policy.ts
@@ -45484,7 +45484,7 @@ function readSkillSession(sessionId, options = {}) {
 }
 
 // src/lib/agent-policy-limits.ts
-var AGENT_POLICY_LIMITS = Object.freeze({ bytes: 1024 * 1024, agents: 16, discoverySources: 2048, discoveryRoots: 512, builtinNames: 2048, rootAliases: 2, fields: 64, pathCharacters: 4096 });
+var AGENT_POLICY_LIMITS = Object.freeze({ bytes: 1024 * 1024, agents: 16, discoverySources: 2048, discoveryRawSourceBytes: 64 * 1024 * 1024, discoveryRawTotalBytes: 256 * 1024 * 1024, discoveryRoots: 512, discoveryDirectories: 64, discoveryDirectoryEntries: 20000, discoveryDirectoryBytes: 8 * 1024 * 1024, builtinNames: 2048, rootAliases: 2, fields: 64, pathCharacters: 4096 });
 function object2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -45548,12 +45548,20 @@ function assertAgentPolicyCollections(policy) {
       requireBound(object2(source));
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
+      if (source.hashMode !== undefined)
+        requireBound(source.hashMode === "bytes" && source.format === undefined && source.fields === undefined);
       if (source.format !== undefined)
         requireBound(["json", "toml", "yaml"].includes(source.format));
       if (source.fields !== undefined)
         for (const field of array(source.fields, AGENT_POLICY_LIMITS.fields))
           text(field, 256);
     }
+    if (value.directories !== undefined)
+      for (const directory of array(value.directories, AGENT_POLICY_LIMITS.discoveryDirectories)) {
+        requireBound(object2(directory));
+        text(directory.path);
+        requireBound(directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256));
+      }
     if (value.builtinNames !== undefined)
       for (const name of array(value.builtinNames, AGENT_POLICY_LIMITS.builtinNames))
         text(name, 128);
@@ -45682,9 +45690,9 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-discovery.ts
-import { createHash as createHash9 } from "crypto";
-import { lstatSync as lstatSync6, readFileSync as readFileSync8, readdirSync as readdirSync5, realpathSync } from "fs";
-import { dirname as dirname8, isAbsolute as isAbsolute4, join as join13, resolve as resolve4, sep } from "path";
+import { createHash as createHash11 } from "crypto";
+import { lstatSync as lstatSync8, readFileSync as readFileSync8, readdirSync as readdirSync5, realpathSync } from "fs";
+import { dirname as dirname10, isAbsolute as isAbsolute6, join as join14, resolve as resolve6, sep } from "path";
 
 // ../../node_modules/.bun/yaml@2.9.0/node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -45802,6 +45810,10 @@ function configureHermesHooks(text2, supervisor, previous) {
 function assertHermesEnvironment(home) {
   if (process.env.TERMINAL_CWD)
     throw new Error("NATIVE_SKILL_DRIFT: Hermes TERMINAL_CWD requires a separately reviewed effective project; unset it before using this adapter");
+  for (const variable of ["HERMES_BUNDLED_PLUGINS", "HERMES_BUNDLED_SKILLS"]) {
+    if (process.env[variable])
+      throw new Error(`NATIVE_SKILL_DRIFT: Hermes ${variable} requires a dedicated discovery adapter; unset it before using this adapter`);
+  }
   const selected = process.env.HERMES_HOME?.trim();
   if (selected && (!isAbsolute3(selected) || resolve3(selected) !== join12(resolve3(home), ".hermes")))
     throw new Error("NATIVE_SKILL_DRIFT: custom Hermes homes/profiles require their own reviewed bridge");
@@ -45893,8 +45905,147 @@ if (failed) process.exitCode = 2;
 `;
 }
 
+// src/lib/agent-discovery-directories.ts
+import { createHash as createHash9 } from "crypto";
+import { lstatSync as lstatSync6, opendirSync as opendirSync2 } from "fs";
+import { dirname as dirname8, isAbsolute as isAbsolute4, join as join13, resolve as resolve4 } from "path";
+function need(value, message) {
+  if (!value)
+    throw new Error(message);
+}
+function safe(path) {
+  need(typeof path === "string" && path.length <= AGENT_POLICY_LIMITS.pathCharacters && isAbsolute4(path) && resolve4(path) === path && !path.includes("\x00"), "Expected a canonical absolute discovery directory path");
+  for (let cursor = path;; cursor = dirname8(cursor)) {
+    need(!lstatSync6(cursor, { throwIfNoEntry: false })?.isSymbolicLink(), "Refusing symlink native discovery directory");
+    if (dirname8(cursor) === cursor)
+      break;
+  }
+}
+function same(before, after) {
+  return Boolean(after && after.isDirectory() && before.dev === after.dev && before.ino === after.ino && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs);
+}
+function capture(path, budget) {
+  safe(path);
+  const root3 = lstatSync6(path, { throwIfNoEntry: false });
+  if (!root3)
+    return { path, sha256: null };
+  need(root3.isDirectory(), "Unsupported native discovery directory input");
+  const hash2 = createHash9("sha256");
+  function walk2(current, relative2, before, depth) {
+    need(depth <= 64, "Native discovery directory depth limit exceeded");
+    const names = [], directory = opendirSync2(current);
+    try {
+      for (let entry = directory.readSync();entry; entry = directory.readSync()) {
+        need(++budget.entries <= AGENT_POLICY_LIMITS.discoveryDirectoryEntries, "Native discovery directory entry limit exceeded");
+        names.push(entry.name);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    need(new Set(names).size === names.length, "Ambiguous native discovery directory names");
+    for (const name of names.sort()) {
+      const child = join13(current, name), childRelative = relative2 ? `${relative2}/${name}` : name;
+      need(child.length <= AGENT_POLICY_LIMITS.pathCharacters, "Native discovery directory path limit exceeded");
+      const stat = lstatSync6(child);
+      need(stat.isFile() || stat.isDirectory(), "Refusing symlink or special native discovery directory member");
+      const row = JSON.stringify([childRelative, stat.isDirectory() ? "directory" : "file"]) + `
+`;
+      budget.bytes += Buffer.byteLength(row);
+      need(budget.bytes <= AGENT_POLICY_LIMITS.discoveryDirectoryBytes, "Native discovery directory metadata limit exceeded");
+      hash2.update(row);
+      if (stat.isDirectory())
+        walk2(child, childRelative, stat, depth + 1);
+    }
+    need(same(before, lstatSync6(current, { throwIfNoEntry: false })), "Native discovery directory changed while reading");
+  }
+  walk2(path, "", root3, 0);
+  safe(path);
+  return { path, sha256: hash2.digest("hex") };
+}
+function captureDiscoveryDirectories(paths) {
+  need(Array.isArray(paths) && paths.length <= AGENT_POLICY_LIMITS.discoveryDirectories && new Set(paths).size === paths.length, "Invalid native discovery directory collection");
+  const budget = { entries: 0, bytes: 0 };
+  return paths.map((path) => capture(path, budget));
+}
+function verifyDiscoveryDirectories(directories) {
+  need(Array.isArray(directories) && directories.length <= AGENT_POLICY_LIMITS.discoveryDirectories, "Invalid native discovery directory collection");
+  for (const directory of directories)
+    need(directory && typeof directory === "object" && (directory.sha256 === null || typeof directory.sha256 === "string" && /^[a-f0-9]{64}$/.test(directory.sha256)), "Invalid native discovery directory digest");
+  const current = captureDiscoveryDirectories(directories.map((directory) => directory.path));
+  for (let i3 = 0;i3 < directories.length; i3++)
+    need(current[i3].sha256 === directories[i3].sha256, `Native discovery directory membership changed; run skills hook install with a fresh discovery review: ${directories[i3].path}`);
+}
+
+// src/lib/agent-discovery-bytes.ts
+import { createHash as createHash10 } from "crypto";
+import { closeSync as closeSync5, constants as constants4, fstatSync as fstatSync5, lstatSync as lstatSync7, openSync as openSync5, readSync as readSync4 } from "fs";
+import { dirname as dirname9, isAbsolute as isAbsolute5, resolve as resolve5 } from "path";
+function discoveryByteBudget() {
+  return { remaining: AGENT_POLICY_LIMITS.discoveryRawTotalBytes };
+}
+function safe2(path) {
+  if (typeof path !== "string" || !isAbsolute5(path) || path !== resolve5(path) || path.length > AGENT_POLICY_LIMITS.pathCharacters || path.includes("\x00"))
+    throw new Error("Expected a canonical absolute raw discovery path");
+  for (let cursor = path;; cursor = dirname9(cursor)) {
+    if (lstatSync7(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+      throw new Error("Refusing symlink raw discovery input");
+    if (dirname9(cursor) === cursor)
+      break;
+  }
+}
+function same2(left, right) {
+  return left.dev === right.dev && left.ino === right.ino && left.size === right.size && left.mtimeMs === right.mtimeMs && left.ctimeMs === right.ctimeMs;
+}
+function consume(budget, bytes) {
+  if (bytes > budget.remaining)
+    throw new Error("Raw discovery aggregate byte limit exceeded");
+  budget.remaining -= bytes;
+}
+function hashRawDiscoveryFile(path, budget, changes) {
+  safe2(path);
+  if (changes?.has(path)) {
+    const text2 = changes.get(path), bytes = Buffer.byteLength(text2);
+    if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+      throw new Error("Raw discovery file byte limit exceeded");
+    consume(budget, bytes);
+    return createHash10("sha256").update(text2).digest("hex");
+  }
+  const initial = lstatSync7(path, { throwIfNoEntry: false });
+  if (!initial)
+    return null;
+  if (!initial.isFile() || initial.size > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+    throw new Error("Unsupported or oversized raw discovery input");
+  if (initial.size > budget.remaining)
+    throw new Error("Raw discovery aggregate byte limit exceeded");
+  const fd = openSync5(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  try {
+    const opened = fstatSync5(fd);
+    if (!opened.isFile() || !same2(initial, opened))
+      throw new Error("Raw discovery input changed during open");
+    const hash2 = createHash10("sha256"), buffer = Buffer.alloc(64 * 1024);
+    let bytes = 0;
+    while (true) {
+      const count = readSync4(fd, buffer, 0, Math.min(buffer.length, AGENT_POLICY_LIMITS.discoveryRawSourceBytes - bytes + 1), null);
+      if (!count)
+        break;
+      bytes += count;
+      if (bytes > AGENT_POLICY_LIMITS.discoveryRawSourceBytes)
+        throw new Error("Raw discovery file byte limit exceeded");
+      consume(budget, count);
+      hash2.update(buffer.subarray(0, count));
+    }
+    const final = fstatSync5(fd), current = lstatSync7(path, { throwIfNoEntry: false });
+    safe2(path);
+    if (!current?.isFile() || !same2(opened, final) || !same2(final, current) || bytes !== final.size)
+      throw new Error("Raw discovery input changed during read");
+    return hash2.digest("hex");
+  } finally {
+    closeSync5(fd);
+  }
+}
+
 // src/lib/agent-discovery.ts
-var digest2 = (text2) => createHash9("sha256").update(text2).digest("hex");
+var digest2 = (text2) => createHash11("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -45905,28 +46056,35 @@ function parseConfig(text2, path, toml = false) {
     throw new Error(`Invalid native discovery configuration: ${path}`);
   }
 }
-function safe(path) {
-  if (!isAbsolute4(path) || path.includes("\x00"))
+function safe3(path) {
+  if (!isAbsolute6(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname8(cursor)) {
-    if (lstatSync6(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname10(cursor)) {
+    if (lstatSync8(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname8(cursor) === cursor)
+    if (dirname10(cursor) === cursor)
       break;
   }
 }
 function read(path, changes) {
-  safe(path);
+  safe3(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat = lstatSync6(path, { throwIfNoEntry: false });
+  const stat = lstatSync8(path, { throwIfNoEntry: false });
   if (!stat)
     return null;
   if (!stat.isFile() || stat.size > 16 * 1024 * 1024)
     throw new Error(`Unsupported or oversized native discovery input: ${path}`);
   return readFileSync8(path, "utf8");
 }
-function projected(source, changes) {
+function projected(source, changes, budget = discoveryByteBudget()) {
+  if (source.hashMode !== undefined) {
+    if (source.hashMode !== "bytes")
+      throw new Error("Invalid native discovery hash mode");
+    if (source.format !== undefined || source.fields !== undefined)
+      throw new Error("Raw discovery witnesses cannot project configuration fields");
+    return hashRawDiscoveryFile(source.path, budget, changes);
+  }
   const text2 = read(source.path, changes);
   if (text2 === null)
     return null;
@@ -45940,22 +46098,34 @@ function projected(source, changes) {
 function verifyAgentDiscovery(binding) {
   if (!binding || !Array.isArray(binding.sources) || !Array.isArray(binding.roots) || binding.sources.length > AGENT_POLICY_LIMITS.discoverySources || binding.roots.length > AGENT_POLICY_LIMITS.discoveryRoots)
     throw new Error("Invalid native discovery binding");
+  if (binding.agent === "hermes" && !binding.directories?.length)
+    throw new Error("Hermes discovery requires directory membership coverage; run skills hook install with a fresh discovery review");
+  if (binding.directories !== undefined)
+    verifyDiscoveryDirectories(binding.directories);
+  const budget = discoveryByteBudget();
   for (const source of binding.sources) {
     if (source.format !== undefined && (!["json", "toml", "yaml"].includes(source.format) || !Array.isArray(source.fields) || !source.fields.length || source.fields.length > 64 || source.fields.some((field) => typeof field !== "string" || !field)))
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
-    if (projected(source) !== source.sha256)
+    if (projected(source, undefined, budget) !== source.sha256)
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
   }
   for (const root3 of binding.roots)
-    safe(root3);
+    safe3(root3);
 }
 function rebindAgentDiscovery(binding, changes) {
-  return { ...binding, sources: binding.sources.map((source) => ({ ...source, sha256: projected(source, changes) })) };
+  const budget = discoveryByteBudget();
+  return { ...binding, sources: binding.sources.map((source) => ({ ...source, sha256: projected(source, changes, budget) })) };
+}
+function captureDiscoveryByteSources(paths) {
+  if (!Array.isArray(paths) || paths.length > AGENT_POLICY_LIMITS.discoverySources || new Set(paths).size !== paths.length)
+    throw new Error("Invalid raw discovery source collection");
+  const budget = discoveryByteBudget();
+  return paths.map((path) => ({ path, hashMode: "bytes", sha256: hashRawDiscoveryFile(path, budget) }));
 }
 function resolveAgentDiscovery(options) {
-  const canonical = options.canonical ?? resolve4, home = resolve4(options.home), agent = options.agent;
+  const canonical = options.canonical ?? resolve6, home = resolve6(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields) => {
     const source = { path: canonical(path), sha256: null, ...format ? { format, fields } : {} };
@@ -45965,14 +46135,14 @@ function resolveAgentDiscovery(options) {
   };
   if (agent === "hermes")
     assertHermesEnvironment(home);
-  const configPath = join13(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
+  const configPath = join14(home, agent === "hermes" ? ".hermes/config.yaml" : agent === "opencode" ? ".config/opencode/opencode.json" : `.${agent}/${agent === "codex" ? "config.toml" : agent === "cursor" ? "hooks.json" : "settings.json"}`);
   const configText = witness(configPath, agent === "hermes" ? "yaml" : agent === "codex" ? "toml" : "json", agent === "hermes" ? ["skills", "plugins", "hooks"] : agent === "claude" ? ["enabledPlugins", "extraKnownMarketplaces"] : agent === "codex" ? ["plugins", "marketplaces", "skills"] : agent === "gemini" ? ["skills", "extensions", "security"] : agent === "opencode" ? ["plugin", "skills"] : ["version"]);
   const config = configText === null ? {} : agent === "hermes" ? parseHermesConfig(configText) : parseConfig(configText, configPath, agent === "codex");
   const unresolved = (detail) => {
     throw new Error(`Native discovery is unresolved (${agent}: ${detail}); provide a reviewed --discovery-inputs file`);
   };
   if (agent === "hermes") {
-    const profile2 = witness(join13(home, ".hermes/active_profile"));
+    const profile2 = witness(join14(home, ".hermes/active_profile"));
     if (profile2?.trim() && profile2.trim() !== "default")
       unresolved("a non-default profile is active");
     const declared = config.skills?.external_dirs ?? [], paths = typeof declared === "string" ? [declared] : declared;
@@ -45986,8 +46156,8 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join13(home, normalized.slice(2)) : resolve4(home, ".hermes", normalized);
-      safe(path);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join14(home, normalized.slice(2)) : resolve6(home, ".hermes", normalized);
+      safe3(path);
       roots.add(path);
     }
   }
@@ -45995,24 +46165,24 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname8(realpathSync(executable)), depth = 0;depth < 8; directory = dirname8(directory), depth++) {
-        const path = join13(directory, "package.json"), raw = read(path);
+      for (let directory = dirname10(realpathSync(executable)), depth = 0;depth < 8; directory = dirname10(directory), depth++) {
+        const path = join14(directory, "package.json"), raw = read(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname8(directory) === directory)
+        if (dirname10(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
-      const builtinRoot = join13(packageRoot, "bundle/builtin");
-      safe(builtinRoot);
-      if (!lstatSync6(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      const builtinRoot = join14(packageRoot, "bundle/builtin");
+      safe3(builtinRoot);
+      if (!lstatSync8(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync5(builtinRoot).sort()) {
-        const text2 = witness(join13(builtinRoot, name, "SKILL.md"));
+        const text2 = witness(join14(builtinRoot, name, "SKILL.md"));
         const match = text2?.match(/^---\r?\n[\s\S]*?^name:\s*([a-z0-9][a-z0-9-]*)\s*$/m);
         if (!match?.[1] || builtinNames.includes(match[1]))
           unresolved("installed Gemini builtin name is missing or ambiguous");
@@ -46026,7 +46196,7 @@ function resolveAgentDiscovery(options) {
   if (review) {
     if (review.pluginHooks !== "reviewed-no-skill-injection" || !Array.isArray(review.sources) || !review.sources.length || !Array.isArray(review.roots))
       throw new Error("Discovery review must bind sources and confirm plugin hooks do not inject retired skills");
-    const supplied = { agent, roots: review.roots, sources: review.sources, method: "reviewed" };
+    const supplied = { agent, roots: review.roots, sources: review.sources, ...review.directories !== undefined ? { directories: review.directories } : {}, method: "reviewed" };
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
@@ -46036,40 +46206,40 @@ function resolveAgentDiscovery(options) {
   }
   function plugin(root3) {
     root3 = canonical(root3);
-    safe(root3);
-    const manifestPath = join13(root3, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
+    safe3(root3);
+    const manifestPath = join14(root3, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
     if (raw === null)
       unresolved("plugin manifest missing");
     const manifest = parseConfig(raw, manifestPath);
-    const hooks = witness(join13(root3, "hooks/hooks.json"));
+    const hooks = witness(join14(root3, "hooks/hooks.json"));
     if (manifest.hooks !== undefined || hooks !== null)
       unresolved("plugin hooks require a separate no-skill-injection review");
-    const commands2 = join13(root3, "commands");
-    safe(commands2);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync6(commands2, { throwIfNoEntry: false })?.isDirectory() && readdirSync5(commands2).length))
+    const commands2 = join14(root3, "commands");
+    safe3(commands2);
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync8(commands2, { throwIfNoEntry: false })?.isDirectory() && readdirSync5(commands2).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
-    const rootSkill = witness(join13(root3, "SKILL.md"));
+    const rootSkill = witness(join14(root3, "SKILL.md"));
     if (rootSkill !== null)
       roots.add(root3);
     const declared = manifest.skills === undefined ? ["./skills"] : typeof manifest.skills === "string" ? [manifest.skills] : manifest.skills;
     if (!Array.isArray(declared) || declared.some((path) => typeof path !== "string"))
       unresolved("unsupported plugin skill paths");
     if (agent === "claude")
-      roots.add(join13(root3, "skills"));
+      roots.add(join14(root3, "skills"));
     for (const value of declared) {
-      const path = resolve4(root3, value);
+      const path = resolve6(root3, value);
       if (path !== root3 && !path.startsWith(root3 + sep))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep}SKILL.md`) ? dirname8(path) : path);
+      roots.add(path.endsWith(`${sep}SKILL.md`) ? dirname10(path) : path);
     }
   }
   if (agent === "claude") {
-    const registrations = witness(join13(home, ".claude/plugins/installed_plugins.json"));
-    const installed = registrations === null ? {} : parseConfig(registrations, join13(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands2 = canonical(join13(home, ".claude/commands"));
-    safe(commands2);
-    if (lstatSync6(commands2, { throwIfNoEntry: false })?.isDirectory() && readdirSync5(commands2).length)
+    const registrations = witness(join14(home, ".claude/plugins/installed_plugins.json"));
+    const installed = registrations === null ? {} : parseConfig(registrations, join14(home, ".claude/plugins/installed_plugins.json")).plugins;
+    const commands2 = canonical(join14(home, ".claude/commands"));
+    safe3(commands2);
+    if (lstatSync8(commands2, { throwIfNoEntry: false })?.isDirectory() && readdirSync5(commands2).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -46089,34 +46259,34 @@ function resolveAgentDiscovery(options) {
         unresolved("unsupported plugin enablement");
       const split = id.lastIndexOf("@"), name = id.slice(0, split), marketplace = id.slice(split + 1);
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
-      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute4(market.source))
+      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute6(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
-      const catalogText = witness(join13(market.source, ".agents/plugins/marketplace.json"));
+      const catalogText = witness(join14(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
         unresolved("marketplace catalog missing");
-      const catalog = parseConfig(catalogText, join13(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
+      const catalog = parseConfig(catalogText, join14(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve4(market.source, matches[0].source.path));
+      plugin(resolve6(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
-    if (witness(join13(home, ".config/opencode/opencode.jsonc")) !== null || witness(join13(home, ".config/opencode/config.json")) !== null)
+    if (witness(join14(home, ".config/opencode/opencode.jsonc")) !== null || witness(join14(home, ".config/opencode/config.json")) !== null)
       unresolved("additional config layers require review");
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
     for (const path of config.skills?.paths ?? []) {
-      if (typeof path !== "string" || !isAbsolute4(path))
+      if (typeof path !== "string" || !isAbsolute6(path))
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
-    const localPlugins = join13(home, ".config/opencode/plugins");
-    safe(localPlugins);
-    if (lstatSync6(localPlugins, { throwIfNoEntry: false }) && readdirSync5(localPlugins).some((name) => name !== "skills-cli.js"))
+    const localPlugins = join14(home, ".config/opencode/plugins");
+    safe3(localPlugins);
+    if (lstatSync8(localPlugins, { throwIfNoEntry: false }) && readdirSync5(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
-    for (const directory of [join13(home, ".hermes/plugins"), join13(home, ".hermes/hermes-agent")]) {
-      safe(directory);
-      if (lstatSync6(directory, { throwIfNoEntry: false }))
+    for (const directory of [join14(home, ".hermes/plugins"), join14(home, ".hermes/hermes-agent")]) {
+      safe3(directory);
+      if (lstatSync8(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -46124,24 +46294,24 @@ function resolveAgentDiscovery(options) {
   } else if (agent === "gemini") {
     if (Object.keys(config.extensions ?? {}).length || config.skills?.paths?.length)
       unresolved("custom extension or skill paths");
-    const directory = join13(home, ".gemini/extensions");
-    safe(directory);
-    if (lstatSync6(directory, { throwIfNoEntry: false }))
+    const directory = join14(home, ".gemini/extensions");
+    safe3(directory);
+    if (lstatSync8(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync5(directory)) {
-        const root3 = join13(directory, name);
-        safe(root3);
-        if (!lstatSync6(root3)?.isDirectory())
+        const root3 = join14(directory, name);
+        safe3(root3);
+        if (!lstatSync8(root3)?.isDirectory())
           continue;
-        const raw = witness(join13(root3, "gemini-extension.json"));
+        const raw = witness(join14(root3, "gemini-extension.json"));
         if (raw === null)
           unresolved("extension registration missing");
-        const manifest = parseConfig(raw, join13(root3, "gemini-extension.json"));
-        if (manifest.hooks !== undefined || witness(join13(root3, "hooks/hooks.json")) !== null || witness(join13(root3, ".gemini-extension-install.json")) !== null)
+        const manifest = parseConfig(raw, join14(root3, "gemini-extension.json"));
+        if (manifest.hooks !== undefined || witness(join14(root3, "hooks/hooks.json")) !== null || witness(join14(root3, ".gemini-extension-install.json")) !== null)
           unresolved("extension hooks or linked registration require review");
-        roots.add(join13(root3, "skills"));
+        roots.add(join14(root3, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join14(home, ".hermes/plugins"), join14(home, ".hermes/hermes-agent")].map((path) => canonical(path))) } : {} };
 }
 
 // src/lib/agent-adapters.ts
@@ -46206,7 +46376,7 @@ export default async ({ directory }) => {
 }
 
 // src/lib/agent-integration.ts
-var sha = (data) => createHash10("sha256").update(data).digest("hex");
+var sha = (data) => createHash12("sha256").update(data).digest("hex");
 var ROOTS = [
   ["claude", ".claude/skills"],
   ["codex", ".codex/skills"],
@@ -46225,11 +46395,11 @@ var ROOTS = [
   ["copilot", ".github/skills"]
 ];
 function assertSafePath(path) {
-  let cursor = resolve5(path);
+  let cursor = resolve7(path);
   while (true) {
-    if (lstatSync7(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync9(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname9(cursor);
+    const parent = dirname11(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -46237,17 +46407,17 @@ function assertSafePath(path) {
 }
 function readRootAlias(home, agent) {
   assertSafePath(home);
-  const realHome = realpathSync2(home), alias = join14(realHome, `.${agent}`);
-  const stat = lstatSync7(alias, { throwIfNoEntry: false, bigint: true });
+  const realHome = realpathSync2(home), alias = join15(realHome, `.${agent}`);
+  const stat = lstatSync9(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync(alias), targetPath = resolve5(dirname9(alias), link);
+  const link = readlinkSync(alias), targetPath = resolve7(dirname11(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync7(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync9(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync2(targetPath), inside = relative2(realHome, target);
-  if (!inside || inside === ".." || inside.startsWith(`..${sep2}`) || isAbsolute5(inside))
+  if (!inside || inside === ".." || inside.startsWith(`..${sep2}`) || isAbsolute7(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link, aliasIdentity: `${stat.dev}:${stat.ino}:${stat.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
 }
@@ -46256,19 +46426,19 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync7(join14(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync9(join15(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep2) || other.target.startsWith(item.target + sep2))))
     throw new Error("Agent root alias targets must not overlap");
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve5(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep2));
-  return binding ? join14(binding.target, relative2(binding.alias, absolute)) : absolute;
+  const absolute = resolve7(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep2));
+  return binding ? join15(binding.target, relative2(binding.alias, absolute)) : absolute;
 }
 function recheckRootAliases(aliases) {
   for (const binding of aliases) {
-    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join14(binding.home, `.${binding.agent}`))
+    if (!["claude", "codex"].includes(binding.agent) || binding.alias !== join15(binding.home, `.${binding.agent}`))
       throw new Error("Invalid agent root alias binding");
     const current = readRootAlias(binding.home, binding.agent);
     if (JSON.stringify(current) !== JSON.stringify(binding))
@@ -46277,42 +46447,42 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync7(path);
+  const before = lstatSync9(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync5(path, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  const descriptor = openSync6(path, constants5.O_RDONLY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
   try {
-    const opened = fstatSync5(descriptor);
+    const opened = fstatSync6(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync4(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync5(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync5(descriptor);
+    const after = fstatSync6(descriptor);
     if (length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync5(descriptor);
+    closeSync6(descriptor);
   }
 }
 function treeHash(root3) {
-  const hash2 = createHash10("sha256");
+  const hash2 = createHash12("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat = lstatSync7(path);
+    const stat = lstatSync9(path);
     if (stat.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative2(root3, path);
     if (stat.isDirectory()) {
       hash2.update(`d\x00${rel}\x00`);
       for (const name of readdirSync6(path).sort())
-        visit2(join14(path, name));
+        visit2(join15(path, name));
       return;
     }
     if (!stat.isFile())
@@ -46330,37 +46500,50 @@ function treeHash(root3) {
 }
 function inventoryNativeSkills(home = homedir3(), options = {}) {
   const aliases = rootAliases(home, options.allowRootAliases);
-  const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join14(home, path), aliases)]);
-  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join14(home, adapter.root, CLI_BRIDGE_NAME), aliases));
-  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve5(path)))) {
+  const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join15(home, path), aliases)]);
+  const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join15(home, adapter.root, CLI_BRIDGE_NAME), aliases));
+  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve7(path)))) {
     for (const [agent, path] of ROOTS)
-      roots.push([agent, canonicalAgentPath(join14(project, path), aliases)]);
+      roots.push([agent, canonicalAgentPath(join15(project, path), aliases)]);
   }
   const entries = [], seen = new Set;
   const cacheScans = new Map, maxAliasProofEntries = 1e4;
+  let discoveryEntries = 0, discoveryPathBytes = 0;
+  function admit(path) {
+    if (++discoveryEntries > 20000)
+      throw new Error("Native skill discovery entry limit exceeded");
+    discoveryPathBytes += Buffer.byteLength(path, "utf8");
+    if (discoveryPathBytes > 4 * 1024 * 1024)
+      throw new Error("Native skill discovery metadata limit exceeded");
+  }
   function emptySiblingCacheAlias(path, parent) {
-    const link = readlinkSync(path), target = resolve5(parent, link);
-    if (dirname9(target) !== parent || (isAbsolute5(link) ? link !== target : dirname9(link) !== "."))
+    const link = readlinkSync(path), target = resolve7(parent, link);
+    if (dirname11(target) !== parent || (isAbsolute7(link) ? link !== target : dirname11(link) !== "."))
       return false;
-    if (!lstatSync7(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync9(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
   }
-  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false) {
+  function visit2(agent, path, vendor = false, depth = 0, pluginCache = false, admitted = false) {
+    if (!admitted)
+      admit(path);
     const scan = { complete: true, hasSkills: false, entries: 1 };
     assertSafePath(path);
     if (!existsSync5(path))
       return scan;
-    if (!lstatSync7(path).isDirectory())
+    const stat = lstatSync9(path);
+    if (stat.isFile())
       return scan;
-    if (existsSync5(join14(path, "SKILL.md"))) {
+    if (!stat.isDirectory())
+      throw new Error(`Unsupported native discovery entry: ${path}`);
+    if (existsSync5(join15(path, "SKILL.md"))) {
       scan.hasSkills = true;
       if (seen.has(path))
         return scan;
       seen.add(path);
       let managed = false;
-      const marker = join14(path, ".hasna-skills.json");
+      const marker = join15(path, ".hasna-skills.json");
       if (existsSync5(marker)) {
         try {
           managed = JSON.parse(readFileSync9(marker, "utf8")).managedBy === "@hasna/skills";
@@ -46368,12 +46551,22 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       }
       const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
       const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep2));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join14(home, ".codex", "skills", ".system"), aliases) + sep2) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve5(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join15(home, ".codex", "skills", ".system"), aliases) + sep2) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve7(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
-    if (depth > (vendor ? 8 : 3))
+    if (depth > (vendor ? 32 : 3))
       return { ...scan, complete: false };
-    const children = readdirSync6(path, { withFileTypes: true }).sort((a3, b3) => a3.name < b3.name ? -1 : a3.name > b3.name ? 1 : 0);
+    const children = [], directory = opendirSync3(path);
+    try {
+      let child;
+      while ((child = directory.readSync()) !== null) {
+        admit(join15(path, child.name));
+        children.push(child);
+      }
+    } finally {
+      directory.closeSync();
+    }
+    children.sort((a3, b3) => a3.name < b3.name ? -1 : a3.name > b3.name ? 1 : 0);
     if (pluginCache)
       children.sort((a3, b3) => Number(a3.isSymbolicLink()) - Number(b3.isSymbolicLink()));
     for (const { name } of children) {
@@ -46384,15 +46577,15 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       const isVendor = vendor || name === ".system";
       if (isVendor && !options.includeVendor)
         continue;
-      const child = join14(path, name);
-      if (isVendor && lstatSync7(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      const child = join15(path, name);
+      if (isVendor && lstatSync9(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync3(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
           scan.entries++;
           continue;
         }
       }
-      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache);
+      const childScan = visit2(agent, child, isVendor, depth + 1, pluginCache, true);
       scan.complete &&= childScan.complete;
       scan.hasSkills ||= childScan.hasSkills;
       scan.entries += childScan.entries;
@@ -46411,8 +46604,8 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     scanRoot(agent, path);
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"])
-      scanRoot(agent, canonicalAgentPath(join14(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
-    scanRoot("gemini", join14(home, ".gemini", "extensions"), true);
+      scanRoot(agent, canonicalAgentPath(join15(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+    scanRoot("gemini", join15(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
   for (const root3 of [...options.agentRoots ?? [], ...configured])
@@ -46510,12 +46703,12 @@ function disableCodexSkills(text2, skills, aliases, bridgePath) {
   let result = text2;
   const selections2 = [...skills.filter((entry) => entry.agent === "codex" && !entry.bridge).map((skill) => ({ path: skill.path, enabled: false })), { path: bridgePath, enabled: true }];
   for (const skill of selections2) {
-    const path = join14(skill.path, "SKILL.md");
+    const path = join15(skill.path, "SKILL.md");
     let found = false;
     result = result.replace(/^\[\[skills\.config\]\][^\n]*(?:\n(?!\s*\[)[^\n]*)*/gm, (section) => {
       const parsed = Bun.TOML.parse(section);
       const declared = parsed.skills?.config?.[0]?.path;
-      if (!declared || ![resolve5(path), resolve5(skill.path)].includes(canonicalAgentPath(declared, aliases)))
+      if (!declared || ![resolve7(path), resolve7(skill.path)].includes(canonicalAgentPath(declared, aliases)))
         return section;
       found = true;
       return /^\s*enabled\s*=/m.test(section) ? section.replace(/^\s*enabled\s*=.*$/m, `enabled = ${skill.enabled}`) : `${section.trimEnd()}
@@ -46539,7 +46732,7 @@ function planAgentIntegration(options) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(profileId) || profileId.includes(".."))
     throw new Error("Invalid selection profile id");
   const aliases = rootAliases(home, options.allowRootAliases);
-  const policyPath = join14(dataDir2, "agent-policy.json");
+  const policyPath = join15(dataDir2, "agent-policy.json");
   assertSafePath(policyPath);
   const priorSnapshot = readManagedSkillPolicySnapshot(dataDir2), previousPolicy = priorSnapshot?.text ?? null, policy = priorSnapshot?.value ?? {};
   if (policy.bridge !== undefined && (!policy.bridge || typeof policy.bridge !== "object" || Array.isArray(policy.bridge)))
@@ -46556,19 +46749,19 @@ function planAgentIntegration(options) {
     if (!INTEGRATION_AGENTS.includes(agent))
       throw new Error(`Unsupported agent: ${agent}`);
     const adapter = AGENT_ADAPTERS[agent];
-    const bridgePath = canonicalAgentPath(join14(home, adapter.root, CLI_BRIDGE_NAME), aliases);
+    const bridgePath = canonicalAgentPath(join15(home, adapter.root, CLI_BRIDGE_NAME), aliases);
     assertSafePath(bridgePath);
     if (existsSync5(bridgePath) && !isOwnedCliBridge(bridgePath, [bridgePath]))
       throw new Error(`Refusing to overwrite an unrecognized or modified Skills bridge: ${bridgePath}`);
     for (const [name, after2] of Object.entries(CLI_BRIDGE_FILES)) {
-      const path2 = join14(bridgePath, name), before2 = readOptional(path2);
+      const path2 = join15(bridgePath, name), before2 = readOptional(path2);
       if (before2 !== after2)
         changes.push({ path: path2, before: before2, after: after2 });
     }
-    const path = canonicalAgentPath(join14(home, adapter.config), aliases);
+    const path = canonicalAgentPath(join15(home, adapter.config), aliases);
     const before = readOptional(path);
     if (agent === "hermes") {
-      const supervisorPath = join14(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(options.command ?? "skills", profileId);
+      const supervisorPath = join15(dataDir2, "agent-hooks", "hermes.js"), supervisorBefore = readOptional(supervisorPath), supervisorAfter = renderHermesSupervisor(options.command ?? "skills", profileId);
       const priorCommand = policy.bridge?.commands?.hermes, priorProfile = policy.bridge?.profiles?.hermes ?? policy.profileId;
       const previous = policy.bridge?.supervisors?.hermes;
       if (supervisorBefore !== null && supervisorBefore !== supervisorAfter && !(previous?.path === supervisorPath && typeof priorCommand === "string" && typeof priorProfile === "string" && supervisorBefore === renderHermesSupervisor(priorCommand, priorProfile)))
@@ -46579,7 +46772,7 @@ function planAgentIntegration(options) {
       const after2 = configureHermesHooks(before, supervisor, previous);
       if (before !== after2)
         changes.push({ path, before, after: after2 });
-      const optOut = join14(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
+      const optOut = join15(home, ".hermes", HERMES_OPT_OUT), optOutBefore = readOptional(optOut);
       if (optOutBefore === null)
         changes.push({ path: optOut, before: null, after: `Managed by @hasna/skills: bundled native skill reseeding is disabled.
 ` });
@@ -46591,7 +46784,7 @@ function planAgentIntegration(options) {
       if (!permission || typeof permission !== "object" || Array.isArray(permission))
         throw new Error("Expected OpenCode permission object");
       config.permission = { ...permission, skill: { "*": "deny", [CLI_BRIDGE_NAME]: "allow" } };
-      const pluginPath = join14(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
+      const pluginPath = join15(home, ".config", "opencode", "plugins", "skills-cli.js"), pluginBefore = readOptional(pluginPath);
       const pluginAfter = renderOpenCodePlugin(options.command ?? "skills", profileId);
       const priorCommand = policy.bridge?.commands?.opencode;
       const ownedPrevious = typeof priorCommand === "string" && typeof policy.profileId === "string" && pluginBefore === renderOpenCodePlugin(priorCommand, policy.bridge?.profiles?.opencode ?? policy.profileId);
@@ -46608,7 +46801,7 @@ function planAgentIntegration(options) {
     if (before !== after)
       changes.push({ path, before, after });
     if (agent === "codex") {
-      const configPath = canonicalAgentPath(join14(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
+      const configPath = canonicalAgentPath(join15(home, ".codex", "config.toml"), aliases), previous = readOptional(configPath);
       const next = disableCodexSkills(previous ?? "", nativeSkills, aliases, bridgePath);
       if (next !== (previous ?? ""))
         changes.push({ path: configPath, before: previous, after: next });
@@ -46621,12 +46814,12 @@ function planAgentIntegration(options) {
     version: CLI_BRIDGE_VERSION,
     digest: CLI_BRIDGE_DIGEST,
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
-    home: resolve5(home),
+    home: resolve7(home),
     includeVendor: true,
-    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join14(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(options.command ?? "skills", profileId)) } } } : {},
+    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join15(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(options.command ?? "skills", profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries(options.agents.map((agent) => [agent, options.command ?? "skills"])) },
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, options.agents.includes(agent) ? profileId : policy.bridge?.profiles?.[agent] ?? policy.profileId])),
-    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join14(home, ".codex", "skills", ".system"), aliases) + sep2)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
+    disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join15(home, ".codex", "skills", ".system"), aliases) + sep2)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
     rootAliases: aliases,
     discovery: { ...policy.bridge?.discovery, ...Object.fromEntries(discoveryAfter.map((binding) => [binding.agent, binding])) }
   } };
@@ -46638,7 +46831,7 @@ function planAgentIntegration(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync5(dirname9(path), { recursive: true, mode: 448 });
+  mkdirSync5(dirname11(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID6()}`;
   try {
     writeFileSync3(temporary, content, { mode: 384, flag: "wx" });
@@ -46649,12 +46842,12 @@ function atomicWrite2(path, content) {
   }
 }
 function applyAgentIntegration(plan) {
-  const policyPath = join14(plan.dataDir, "agent-policy.json");
+  const policyPath = join15(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve5(path) === resolve5(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve7(path) === resolve7(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve5(change.path) === resolve5(policyPath))
+    if (resolve7(change.path) === resolve7(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
@@ -46665,7 +46858,7 @@ function applyAgentIntegration(plan) {
   for (const change of plan.changes)
     if (currentText(change.path) !== change.before)
       throw new Error(`Configuration changed after planning: ${change.path}`);
-  const backupRoot = join14(plan.dataDir, "migration", randomUUID6()), backups = [], written = [], createdDirectories = new Set;
+  const backupRoot = join15(plan.dataDir, "migration", randomUUID6()), backups = [], written = [], createdDirectories = new Set;
   if (!plan.changes.length) {
     recheckRootAliases(aliases);
     return { changed: [], backups, ...aliases.length ? { rootAliases: aliases } : {} };
@@ -46675,7 +46868,7 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join14(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
+      const backup = join15(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
       writeFileSync3(backup, change.before, { mode: 384, flag: "wx" });
       backups.push(backup);
     }
@@ -46684,7 +46877,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname9(change.path);!existsSync5(directory); directory = dirname9(directory))
+      for (let directory = dirname11(change.path);!existsSync5(directory); directory = dirname11(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -46693,7 +46886,7 @@ function applyAgentIntegration(plan) {
     recheckRootAliases(aliases);
     for (const binding of plan.discoveryAfter ?? [])
       verifyAgentDiscovery(binding);
-    atomicWrite2(join14(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join15(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -46724,11 +46917,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync5(path, constants4.O_RDONLY | constants4.O_DIRECTORY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+  const descriptor = openSync6(path, constants5.O_RDONLY | constants5.O_DIRECTORY | constants5.O_NOFOLLOW | constants5.O_NONBLOCK);
   try {
     fsyncSync(descriptor);
   } finally {
-    closeSync5(descriptor);
+    closeSync6(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -46736,18 +46929,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID6()}`;
   let descriptor;
   try {
-    descriptor = openSync5(temporary, constants4.O_WRONLY | constants4.O_CREAT | constants4.O_EXCL | constants4.O_NOFOLLOW, 384);
+    descriptor = openSync6(temporary, constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW, 384);
     writeFileSync3(descriptor, `${JSON.stringify(value)}
 `);
     fsyncSync(descriptor);
-    closeSync5(descriptor);
+    closeSync6(descriptor);
     descriptor = undefined;
     renameSync2(temporary, path);
-    syncArchiveDirectory(dirname9(path));
+    syncArchiveDirectory(dirname11(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync5(descriptor);
-    if (lstatSync7(temporary, { throwIfNoEntry: false }))
+      closeSync6(descriptor);
+    if (lstatSync9(temporary, { throwIfNoEntry: false }))
       unlinkSync2(temporary);
   }
 }
@@ -46758,7 +46951,7 @@ function archiveNativeSkills(inventory, options) {
   recheckRootAliases(aliases);
   for (const entry of inventory.filter((entry2) => entry2.bridge)) {
     const adapter = AGENT_ADAPTERS[entry.agent];
-    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join14(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
+    const expected = adapter && entry.bridgeHome ? canonicalAgentPath(join15(entry.bridgeHome, adapter.root, CLI_BRIDGE_NAME), aliases) : undefined;
     if (!expected || treeHash(entry.path) !== entry.hash || !isOwnedCliBridge(entry.path, [expected]))
       throw new Error(`Skills bridge changed after planning: ${entry.path}`);
   }
@@ -46768,11 +46961,11 @@ function archiveNativeSkills(inventory, options) {
       throw new Error(`Native skill changed after planning: ${entry.path}`);
   if (!selected.length)
     return { entries: [], ...aliases.length ? { rootAliases: aliases } : {} };
-  const operationId = randomUUID6(), archiveRoot = join14(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join14(archiveRoot, "receipt.json");
+  const operationId = randomUUID6(), archiveRoot = join15(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join15(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
-    source: entry.vendor ? join14(entry.path, "SKILL.md") : entry.path,
-    archive: join14(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
-    hash: entry.vendor ? sha(readNativeBytes(join14(entry.path, "SKILL.md"))) : entry.hash,
+    source: entry.vendor ? join15(entry.path, "SKILL.md") : entry.path,
+    archive: join15(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
+    hash: entry.vendor ? sha(readNativeBytes(join15(entry.path, "SKILL.md"))) : entry.hash,
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
@@ -46780,7 +46973,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat = lstatSync7(entry.archive);
+    const stat = lstatSync9(entry.archive);
     if (entry.discoveryOnly ? !stat.isFile() : !stat.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -46788,14 +46981,14 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync5(path); path = dirname9(path))
+  for (let path = archiveRoot;!existsSync5(path); path = dirname11(path))
     created.push(path);
   mkdirSync5(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname9(created.at(-1)));
+      syncArchiveDirectory(dirname11(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -46807,7 +47000,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync2(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname9(move.source));
+      syncArchiveDirectory(dirname11(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -46828,7 +47021,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync7(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync9(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -46842,10 +47035,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync(entry.archive, entry.source);
-          syncArchiveDirectory(dirname9(entry.source));
+          syncArchiveDirectory(dirname11(entry.source));
           unlinkSync2(entry.archive);
         } else {
-          if (lstatSync7(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync9(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -46853,7 +47046,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync2(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname9(entry.source));
+        syncArchiveDirectory(dirname11(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -46890,7 +47083,7 @@ import {
   statSync as statSync8,
   writeFileSync as writeFileSync5
 } from "fs";
-import { basename as basename2, dirname as dirname11, isAbsolute as isAbsolute7, join as join19, normalize as normalize2, relative as relative4, resolve as resolve6, sep as sep4 } from "path";
+import { basename as basename2, dirname as dirname13, isAbsolute as isAbsolute9, join as join20, normalize as normalize2, relative as relative4, resolve as resolve8, sep as sep4 } from "path";
 
 // src/lib/registry-data/development-tools.ts
 var DEVELOPMENT_TOOLS_SKILLS = [
@@ -47603,7 +47796,7 @@ var SKILLS = [
 
 // src/lib/hosted-skill-set.ts
 import { existsSync as existsSync6, readFileSync as readFileSync10, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var HOSTED_RUNTIMES = new Set(["hosted"]);
 var HOSTED_SOURCES = new Set(["remote", "private-hosted"]);
 function normalizeMarker(value) {
@@ -47616,7 +47809,7 @@ function isHostedMetadataPackage(pkg) {
   return HOSTED_RUNTIMES.has(normalizeMarker(skills.runtime)) || HOSTED_SOURCES.has(normalizeMarker(skills.source));
 }
 function isHostedMetadataSkillDir(skillDir) {
-  const pkgPath = join15(skillDir, "package.json");
+  const pkgPath = join16(skillDir, "package.json");
   if (!existsSync6(pkgPath))
     return false;
   try {
@@ -47641,8 +47834,8 @@ var BRACE_SOURCE_EXCLUSION = new RegExp(`^!skills/\\{(${SLUG}(?:,${SLUG})+)\\}/s
 var SINGLE_SOURCE_EXCLUSION = new RegExp(`^!skills/(${SLUG})/src$`);
 
 // src/lib/skill-validation.ts
-import { existsSync as existsSync7, lstatSync as lstatSync8, readFileSync as readFileSync11, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute6, join as join16, normalize } from "path";
+import { existsSync as existsSync7, lstatSync as lstatSync10, readFileSync as readFileSync11, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
+import { isAbsolute as isAbsolute8, join as join17, normalize } from "path";
 var VALID_SKILL_KINDS = ["executable", "instruction"];
 var DOC_FILES = ["SKILL.md", "README.md", "CLAUDE.md"];
 var RESERVED_SKILL_ENTRIES = new Set([
@@ -47705,7 +47898,7 @@ function sortMessages(messages) {
   return [...messages].sort((a3, b3) => a3.code.localeCompare(b3.code) || a3.message.localeCompare(b3.message));
 }
 function isSafeRelativePath(value) {
-  if (!value.trim() || isAbsolute6(value))
+  if (!value.trim() || isAbsolute8(value))
     return false;
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
@@ -47805,11 +47998,11 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     add(issues, "skill.name_invalid", `Skill name '${bareName}' must use lowercase letters, numbers, dots, underscores, or hyphens`);
   }
   for (const entry of readdirSync8(skillPath).sort()) {
-    const entryPath = join16(skillPath, entry);
+    const entryPath = join17(skillPath, entry);
     if (RESERVED_SKILL_ENTRIES.has(entry)) {
       add(issues, "skill.reserved_file", `Reserved file '${entry}' is not allowed in skill packages`);
     }
-    if (lstatSync8(entryPath).isSymbolicLink()) {
+    if (lstatSync10(entryPath).isSymbolicLink()) {
       add(issues, "skill.symlink_forbidden", `Symlink '${entry}' is not allowed in skill packages`);
     }
     if (!KNOWN_TOP_LEVEL_ENTRIES.has(entry)) {
@@ -47817,13 +48010,13 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     }
   }
   for (const docFile of DOC_FILES) {
-    if (existsSync7(join16(skillPath, docFile)))
+    if (existsSync7(join17(skillPath, docFile)))
       metadata.docFiles.push(docFile);
   }
   if (metadata.docFiles.length === 0) {
     add(issues, "skill.docs_missing", "Missing documentation file: expected SKILL.md, README.md, or CLAUDE.md");
   }
-  const skillMdPath = join16(skillPath, "SKILL.md");
+  const skillMdPath = join17(skillPath, "SKILL.md");
   if (existsSync7(skillMdPath)) {
     const frontmatter = parseSkillFrontmatter(readFileSync11(skillMdPath, "utf-8"));
     if (!frontmatter) {
@@ -47867,7 +48060,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   }
   metadata.kind = resolvedKind;
   const isInstruction = resolvedKind === "instruction";
-  const pkgPath = join16(skillPath, "package.json");
+  const pkgPath = join17(skillPath, "package.json");
   if (!existsSync7(pkgPath)) {
     if (!isInstruction)
       add(issues, "package.missing", "Missing package.json");
@@ -47926,7 +48119,7 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
               add(issues, "package.bin_target_unsafe", `package.json bin '${command3}' target '${target}' must stay inside the skill directory`);
               continue;
             }
-            const targetPath = join16(skillPath, target);
+            const targetPath = join17(skillPath, target);
             if (!existsSync7(targetPath)) {
               add(warnings, "package.bin_target_missing", `package.json bin '${command3}' target '${target}' is not present before build`);
             } else if (statSync5(targetPath).isDirectory()) {
@@ -47944,17 +48137,17 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
     metadata.runtime = "none";
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
-    const srcDir = join16(skillPath, "src");
+    const srcDir = join17(skillPath, "src");
     if (hostedMetadata) {
       if (existsSync7(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
     } else if (!existsSync7(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
-    } else if (!existsSync7(join16(srcDir, "index.ts")) && !existsSync7(join16(srcDir, "index.js"))) {
+    } else if (!existsSync7(join17(srcDir, "index.ts")) && !existsSync7(join17(srcDir, "index.js"))) {
       add(issues, "skill.src_index_missing", "Missing src/index.ts or src/index.js");
     } else {
-      const indexPath = existsSync7(join16(srcDir, "index.ts")) ? join16(srcDir, "index.ts") : join16(srcDir, "index.js");
+      const indexPath = existsSync7(join17(srcDir, "index.ts")) ? join17(srcDir, "index.ts") : join17(srcDir, "index.js");
       const size = statSync5(indexPath).size;
       if (size < 50)
         add(warnings, "skill.src_index_minimal", `Source entry point is very small (${size}B)`);
@@ -47979,7 +48172,7 @@ function validateRegistryConsistency(registry, skillsDir) {
     return false;
   })));
   const skillDirs = existsSync7(skillsDir) ? readdirSync8(skillsDir).filter((entry) => {
-    const fullPath = join16(skillsDir, entry);
+    const fullPath = join17(skillsDir, entry);
     return !entry.startsWith(".") && entry !== "_common" && statSync5(fullPath).isDirectory();
   }) : [];
   const directoryNames = new Set(skillDirs);
@@ -47995,9 +48188,9 @@ function validateRegistryConsistency(registry, skillsDir) {
 }
 
 // src/lib/skill-hash.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { existsSync as existsSync8, readdirSync as readdirSync9, readFileSync as readFileSync12, statSync as statSync6 } from "fs";
-import { join as join17, sep as sep3 } from "path";
+import { join as join18, sep as sep3 } from "path";
 var CONTENT_HASH_ALGORITHM = "sha256";
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
 function excludedHashEntry(name, directory) {
@@ -48059,7 +48252,7 @@ function collectBundleFiles(skillPath) {
     if (seen.has(entry))
       continue;
     seen.add(entry);
-    const absolute = join17(skillPath, entry);
+    const absolute = join18(skillPath, entry);
     if (!existsSync8(absolute))
       continue;
     if (statSync6(absolute).isDirectory())
@@ -48073,7 +48266,7 @@ function collectDirectory(files, dir, rel) {
   for (const entry of readdirSync9(dir).sort()) {
     if (entry.startsWith("."))
       continue;
-    const absolute = join17(dir, entry);
+    const absolute = join18(dir, entry);
     const childRel = `${rel}/${entry}`;
     let stats;
     try {
@@ -48119,13 +48312,13 @@ function* bundleHashParts(files) {
   yield new TextEncoder().encode("\x00");
 }
 function hashBundleFiles(files) {
-  const hash2 = createHash11(CONTENT_HASH_ALGORITHM);
+  const hash2 = createHash13(CONTENT_HASH_ALGORITHM);
   for (const part of bundleHashParts(files))
     hash2.update(part);
   return hash2.digest("hex");
 }
 async function hashBundleFilesCooperatively(files, check) {
-  const hash2 = createHash11(CONTENT_HASH_ALGORITHM);
+  const hash2 = createHash13(CONTENT_HASH_ALGORITHM);
   let bytesSinceYield = 0;
   for (const part of bundleHashParts(files)) {
     for (let offset = 0;offset < part.byteLength; offset += 64 * 1024) {
@@ -48134,7 +48327,7 @@ async function hashBundleFilesCooperatively(files, check) {
       hash2.update(chunk);
       bytesSinceYield += chunk.byteLength;
       if (bytesSinceYield >= 256 * 1024) {
-        await new Promise((resolve6) => setImmediate(resolve6));
+        await new Promise((resolve8) => setImmediate(resolve8));
         bytesSinceYield = 0;
       }
     }
@@ -48287,7 +48480,7 @@ async function hashContentEntries(entries, options) {
     const normalized = [];
     let normalizedBytes = 0;
     let manifest;
-    await new Promise((resolve6) => setImmediate(resolve6));
+    await new Promise((resolve8) => setImmediate(resolve8));
     for (const entry of snapshot) {
       check();
       if (!coveredContentPath(entry.path))
@@ -48300,7 +48493,7 @@ async function hashContentEntries(entries, options) {
         contentLimit("Content hash normalized byte limit exceeded");
       normalizedBytes += file.content.byteLength;
       normalized.push(file);
-      await new Promise((resolve6) => setImmediate(resolve6));
+      await new Promise((resolve8) => setImmediate(resolve8));
     }
     normalized.sort((a3, b3) => a3.rel < b3.rel ? -1 : a3.rel > b3.rel ? 1 : 0);
     check();
@@ -48508,13 +48701,13 @@ function validateRuntimeContract(manifest, issues, strict) {
 import {
   cpSync,
   existsSync as existsSync9,
-  lstatSync as lstatSync9,
+  lstatSync as lstatSync11,
   mkdirSync as mkdirSync6,
   readFileSync as readFileSync13,
   realpathSync as realpathSync3,
   writeFileSync as writeFileSync4
 } from "fs";
-import { basename, dirname as dirname10, join as join18, relative as relative3 } from "path";
+import { basename, dirname as dirname12, join as join19, relative as relative3 } from "path";
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([
   ".git",
   ".DS_Store",
@@ -48571,9 +48764,9 @@ function readPortableSkillManifestForImport(skillPath) {
   return readManifest(skillPath, basename(skillPath), normalizeNewPortableSkillName);
 }
 function readManifest(skillPath, fallbackName, normalizeName) {
-  const skillJsonPath = join18(skillPath, "skill.json");
-  const skillMdPath = join18(skillPath, "SKILL.md");
-  const pkgPath = join18(skillPath, "package.json");
+  const skillJsonPath = join19(skillPath, "skill.json");
+  const skillMdPath = join19(skillPath, "SKILL.md");
+  const pkgPath = join19(skillPath, "package.json");
   const jsonManifest = existsSync9(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
   const frontmatter = existsSync9(skillMdPath) ? parseSkillFrontmatter(readFileSync13(skillMdPath, "utf-8")) ?? undefined : undefined;
   const pkg = existsSync9(pkgPath) ? readJsonObject(pkgPath) : undefined;
@@ -48604,9 +48797,9 @@ function parseSkillKind(value) {
   return;
 }
 function readDeclaredSkillVersion(skillPath) {
-  const skillJsonPath = join18(skillPath, "skill.json");
-  const skillMdPath = join18(skillPath, "SKILL.md");
-  const pkgPath = join18(skillPath, "package.json");
+  const skillJsonPath = join19(skillPath, "skill.json");
+  const skillMdPath = join19(skillPath, "SKILL.md");
+  const pkgPath = join19(skillPath, "package.json");
   const jsonManifest = existsSync9(skillJsonPath) ? readJsonObject(skillJsonPath) : undefined;
   const frontmatter = existsSync9(skillMdPath) ? parseSkillFrontmatter(readFileSync13(skillMdPath, "utf-8")) ?? undefined : undefined;
   const pkg = existsSync9(pkgPath) ? readJsonObject(pkgPath) : undefined;
@@ -48631,7 +48824,7 @@ function createInstructionManifest(name, options) {
 }
 function writeInstructionSkillTemplate(skillPath, manifest) {
   mkdirSync6(skillPath, { recursive: true });
-  writeFileSync4(join18(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
+  writeFileSync4(join19(skillPath, "SKILL.md"), renderInstructionSkillMd(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function renderInstructionSkillMd(manifest) {
@@ -48681,12 +48874,12 @@ function createPortableManifest(name, options) {
   };
 }
 function writePortableSkillTemplate(skillPath, manifest) {
-  mkdirSync6(join18(skillPath, "src"), { recursive: true });
-  writeFileSync4(join18(skillPath, "SKILL.md"), renderSkillMd(manifest));
-  writeFileSync4(join18(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
-  writeFileSync4(join18(skillPath, "package.json"), renderPackageJson(manifest));
-  writeFileSync4(join18(skillPath, "tsconfig.json"), renderTsconfig());
-  writeFileSync4(join18(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
+  mkdirSync6(join19(skillPath, "src"), { recursive: true });
+  writeFileSync4(join19(skillPath, "SKILL.md"), renderSkillMd(manifest));
+  writeFileSync4(join19(skillPath, "AGENTS.md"), renderAgentsMd(manifest));
+  writeFileSync4(join19(skillPath, "package.json"), renderPackageJson(manifest));
+  writeFileSync4(join19(skillPath, "tsconfig.json"), renderTsconfig());
+  writeFileSync4(join19(skillPath, "src", "index.ts"), renderEntrypoint(manifest));
   writeSkillJsonWithHash(skillPath, manifest);
 }
 function fillContractDefaults(manifest, entrypoint) {
@@ -48711,7 +48904,7 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: undefined
     }
   };
-  writeFileSync4(join18(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
+  writeFileSync4(join19(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withoutHash) }, null, 2)}
 `);
   const hash2 = computeContentHash(skillPath);
   const withHash = {
@@ -48721,12 +48914,12 @@ function writeSkillJsonWithHash(skillPath, manifest) {
       content_hash: hash2
     }
   };
-  writeFileSync4(join18(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
+  writeFileSync4(join19(skillPath, "skill.json"), `${JSON.stringify({ ...existing, ...renderSkillJsonObject(withHash) }, null, 2)}
 `);
   return withHash;
 }
 function readExistingSkillJson(skillPath) {
-  const path = join18(skillPath, "skill.json");
+  const path = join19(skillPath, "skill.json");
   if (!existsSync9(path))
     return {};
   try {
@@ -48760,24 +48953,24 @@ function ensurePortableSkillFiles(skillPath, manifest) {
     tags: next.tags?.length ? next.tags : ["custom", next.name]
   };
   const entry = next.commands[0]?.entry ?? "src/index.ts";
-  if (entry && !existsSync9(join18(skillPath, entry))) {
-    mkdirSync6(dirname10(join18(skillPath, entry)), { recursive: true });
-    writeFileSync4(join18(skillPath, entry), renderEntrypoint(next));
+  if (entry && !existsSync9(join19(skillPath, entry))) {
+    mkdirSync6(dirname12(join19(skillPath, entry)), { recursive: true });
+    writeFileSync4(join19(skillPath, entry), renderEntrypoint(next));
   }
-  if (!existsSync9(join18(skillPath, "SKILL.md")))
-    writeFileSync4(join18(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync9(join19(skillPath, "SKILL.md")))
+    writeFileSync4(join19(skillPath, "SKILL.md"), renderSkillMd(next));
   else
-    writeFileSync4(join18(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync13(join18(skillPath, "SKILL.md"), "utf-8"), next));
-  if (!existsSync9(join18(skillPath, "AGENTS.md")))
-    writeFileSync4(join18(skillPath, "AGENTS.md"), renderAgentsMd(next));
+    writeFileSync4(join19(skillPath, "SKILL.md"), ensureSkillMdFrontmatter(readFileSync13(join19(skillPath, "SKILL.md"), "utf-8"), next));
+  if (!existsSync9(join19(skillPath, "AGENTS.md")))
+    writeFileSync4(join19(skillPath, "AGENTS.md"), renderAgentsMd(next));
   ensurePackageJson(skillPath, next);
-  if (!existsSync9(join18(skillPath, "tsconfig.json")))
-    writeFileSync4(join18(skillPath, "tsconfig.json"), renderTsconfig());
+  if (!existsSync9(join19(skillPath, "tsconfig.json")))
+    writeFileSync4(join19(skillPath, "tsconfig.json"), renderTsconfig());
   writeSkillJsonWithHash(skillPath, next);
   return readPortableSkillManifest(skillPath, next.name);
 }
 function ensurePackageJson(skillPath, manifest) {
-  const pkgPath = join18(skillPath, "package.json");
+  const pkgPath = join19(skillPath, "package.json");
   const first = manifest.commands[0] ?? { name: manifest.name, entry: "src/index.ts" };
   const commandName = normalizePortableSkillName(first.name || manifest.name);
   const entry = (first.entry ?? "src/index.ts").replace(/^\.\//, "");
@@ -48824,17 +49017,17 @@ function ensureInstructionSkillFiles(skillPath, manifest) {
     inputs: [],
     commands: []
   };
-  if (!existsSync9(join18(skillPath, "SKILL.md"))) {
-    writeFileSync4(join18(skillPath, "SKILL.md"), renderSkillMd(next));
+  if (!existsSync9(join19(skillPath, "SKILL.md"))) {
+    writeFileSync4(join19(skillPath, "SKILL.md"), renderSkillMd(next));
   } else {
-    const path = join18(skillPath, "SKILL.md");
+    const path = join19(skillPath, "SKILL.md");
     const content = readFileSync13(path, "utf8");
     const declaredName = parseSkillFrontmatter(content)?.name;
     if (declaredName && declaredName !== next.name) {
       writeFileSync4(path, renameInstructionFrontmatter(content, next.name));
     }
   }
-  const packagePath = join18(skillPath, "package.json");
+  const packagePath = join19(skillPath, "package.json");
   if (existsSync9(packagePath)) {
     const pkg = readJsonObject(packagePath);
     if (typeof pkg.name === "string" && pkg.name !== next.name) {
@@ -48866,7 +49059,7 @@ function renameInstructionFrontmatter(content, name) {
   return renamed + content.slice(frontmatter[0].length);
 }
 function copySkillDirectory(source, destination) {
-  const resolvedSource = lstatSync9(source).isSymbolicLink() ? realpathSync3(source) : source;
+  const resolvedSource = lstatSync11(source).isSymbolicLink() ? realpathSync3(source) : source;
   mkdirSync6(destination, { recursive: true });
   cpSync(resolvedSource, destination, {
     recursive: true,
@@ -48879,7 +49072,7 @@ function copySkillDirectory(source, destination) {
         if (isExcludedCopyEntry(segments[i3], i3 === 0))
           return false;
       }
-      if (lstatSync9(src).isSymbolicLink())
+      if (lstatSync11(src).isSymbolicLink())
         return false;
       return true;
     }
@@ -49158,11 +49351,11 @@ function getPortableSkillsRoot(options = {}) {
 function resolvePortableSkillsRoot(options, migrate) {
   if (options.rootDir)
     return options.rootDir;
-  const appDir = options.homeDir ? join19(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
-  const cache3 = join19(appDir, SKILLS_CACHE_DIRNAME);
+  const appDir = options.homeDir ? join20(options.homeDir, ".hasna", "skills") : migrate ? getDataDir() : getDataDirReadOnly();
+  const cache3 = join20(appDir, SKILLS_CACHE_DIRNAME);
   if (isOwnerLayoutMigrated(appDir) && safeIsDirectory(cache3))
     return cache3;
-  const installed = join19(appDir, INSTALLED_SKILLS_DIRNAME);
+  const installed = join20(appDir, INSTALLED_SKILLS_DIRNAME);
   if (migrate)
     migrateLegacySkillLayout(appDir, installed);
   return installed;
@@ -49170,7 +49363,7 @@ function resolvePortableSkillsRoot(options, migrate) {
 function looksLikeSkillDirectory(path) {
   if (!safeIsDirectory(path))
     return false;
-  return existsSync10(join19(path, "SKILL.md")) || existsSync10(join19(path, "skill.json")) || existsSync10(join19(path, "package.json"));
+  return existsSync10(join20(path, "SKILL.md")) || existsSync10(join20(path, "skill.json")) || existsSync10(join20(path, "package.json"));
 }
 function migrateLegacySkillLayout(appDir, installed) {
   if (!safeIsDirectory(appDir))
@@ -49180,7 +49373,7 @@ function migrateLegacySkillLayout(appDir, installed) {
     for (const entry of readdirSync10(appDir)) {
       if (entry.startsWith(".") || entry === INSTALLED_SKILLS_DIRNAME)
         continue;
-      const path = join19(appDir, entry);
+      const path = join20(appDir, entry);
       if (entry === LEGACY_CUSTOM_DIRNAME) {
         if (!safeIsDirectory(path))
           continue;
@@ -49188,7 +49381,7 @@ function migrateLegacySkillLayout(appDir, installed) {
           for (const nested of readdirSync10(path)) {
             if (nested.startsWith("."))
               continue;
-            const nestedPath = join19(path, nested);
+            const nestedPath = join20(path, nested);
             if (looksLikeSkillDirectory(nestedPath))
               candidates.push({ from: nestedPath, name: nested });
           }
@@ -49202,10 +49395,10 @@ function migrateLegacySkillLayout(appDir, installed) {
     return;
   }
   for (const { from, name } of candidates) {
-    const target = join19(installed, name);
+    const target = join20(installed, name);
     if (existsSync10(target))
       continue;
-    const staging = join19(installed, `.migrating-${name}-${process.pid}`);
+    const staging = join20(installed, `.migrating-${name}-${process.pid}`);
     try {
       rmSync(staging, { recursive: true, force: true });
       cpSync2(from, staging, { recursive: true, errorOnExist: false });
@@ -49218,7 +49411,7 @@ function migrateLegacySkillLayout(appDir, installed) {
   }
 }
 function getPortableSkillPath(name, options = {}) {
-  return join19(getPortableSkillsRoot(options), normalizePortableSkillName(name));
+  return join20(getPortableSkillsRoot(options), normalizePortableSkillName(name));
 }
 function findPortableSkill(name, options = {}) {
   let normalized;
@@ -49244,7 +49437,7 @@ function listPortableSkills(options = {}) {
   for (const entry of readdirSync10(root3).sort()) {
     if (entry.startsWith("."))
       continue;
-    const path = join19(root3, entry);
+    const path = join20(root3, entry);
     if (!safeIsDirectory(path))
       continue;
     try {
@@ -49278,7 +49471,7 @@ function isOfficialSkillName(name) {
 function scaffoldPortableSkill(name, options = {}) {
   const skillName = normalizeNewPortableSkillName(name);
   const root3 = getPortableSkillsRoot(options);
-  const skillPath = join19(root3, skillName);
+  const skillPath = join20(root3, skillName);
   if (existsSync10(skillPath)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${skillPath}`);
@@ -49310,7 +49503,7 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   const skipped = [];
   const entries = readdirSync10(absoluteSource, { withFileTypes: true }).map((entry) => entry.name).filter((entryName) => !entryName.startsWith(".")).sort();
   for (const entryName of entries) {
-    const childPath = join19(absoluteSource, entryName);
+    const childPath = join20(absoluteSource, entryName);
     if (!safeIsDirectory(childPath))
       continue;
     if (!isSkillCandidate(childPath)) {
@@ -49339,23 +49532,23 @@ function portPortableSkillDirectory(sourceDir, options = {}) {
   };
 }
 function isSkillCandidate(dir) {
-  return existsSync10(join19(dir, "SKILL.md")) || existsSync10(join19(dir, "skill.json")) || existsSync10(join19(dir, "package.json"));
+  return existsSync10(join20(dir, "SKILL.md")) || existsSync10(join20(dir, "skill.json")) || existsSync10(join20(dir, "package.json"));
 }
 function physicalImportPath(path) {
-  let ancestor = resolve6(path);
+  let ancestor = resolve8(path);
   const suffix = [];
   while (!existsSync10(ancestor)) {
     suffix.unshift(basename2(ancestor));
-    ancestor = dirname11(ancestor);
+    ancestor = dirname13(ancestor);
   }
-  return join19(realpathSync4(ancestor), ...suffix);
+  return join20(realpathSync4(ancestor), ...suffix);
 }
 function assertDisjointImportPaths(source, destination) {
   const sourcePath = realpathSync4(source);
   const destinationPath = physicalImportPath(destination);
   const contains = (parent, child) => {
     const path = relative4(parent, child);
-    return path === "" || !isAbsolute7(path) && path !== ".." && !path.startsWith(`..${sep4}`);
+    return path === "" || !isAbsolute9(path) && path !== ".." && !path.startsWith(`..${sep4}`);
   };
   if (contains(sourcePath, destinationPath) || contains(destinationPath, sourcePath)) {
     throw new Error("Source and destination skill directories must not overlap");
@@ -49374,16 +49567,16 @@ function portPortableSkill(sourcePath, options = {}) {
     const via = explicitName ? `Name '${skillName}' matches a bundled official skill.` : `Inferred name '${skillName}'${sourceSlug && sourceSlug !== skillName ? ` (from source folder '${basename2(absoluteSource)}')` : ""} matches a bundled official skill.`;
     throw new Error(`${via} Importing it would shadow the official '${skillName}'. ` + `Pass --name to choose a different name, or --allow-shadow to override deliberately.`);
   }
-  assertDisjointImportPaths(absoluteSource, join19(resolvePortableSkillsRoot(options, false), skillName));
+  assertDisjointImportPaths(absoluteSource, join20(resolvePortableSkillsRoot(options, false), skillName));
   const root3 = getPortableSkillsRoot(options);
-  const destination = join19(root3, skillName);
+  const destination = join20(root3, skillName);
   assertDisjointImportPaths(absoluteSource, destination);
   if (existsSync10(destination)) {
     if (!options.overwrite)
       throw new Error(`Skill '${skillName}' already exists at ${destination}`);
     rmSync(destination, { recursive: true, force: true });
   }
-  mkdirSync7(dirname11(destination), { recursive: true });
+  mkdirSync7(dirname13(destination), { recursive: true });
   copySkillDirectory(absoluteSource, destination);
   const base = {
     ...inferred,
@@ -49420,10 +49613,10 @@ function buildCorpusManifest(input, name) {
 function writeCorpusSkill(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const root3 = getPortableSkillsRoot(options);
-  const skillPath = join19(root3, name);
+  const skillPath = join20(root3, name);
   const created = !existsSync10(skillPath);
   mkdirSync7(skillPath, { recursive: true });
-  writeFileSync5(join19(skillPath, "SKILL.md"), input.skillMd);
+  writeFileSync5(join20(skillPath, "SKILL.md"), input.skillMd);
   const manifest = buildCorpusManifest(input, name);
   writeSkillJsonWithHash(skillPath, manifest);
   return { name, path: skillPath, manifest, created };
@@ -49431,19 +49624,19 @@ function writeCorpusSkill(input, options = {}) {
 function installCorpusSkillAtomically(input, options = {}) {
   const name = normalizePortableSkillName(input.name);
   const root3 = getPortableSkillsRoot(options);
-  const target = join19(root3, name);
+  const target = join20(root3, name);
   const created = !existsSync10(target);
   mkdirSync7(root3, { recursive: true });
-  const staging = mkdtempSync(join19(root3, `.pull-${name}-`));
+  const staging = mkdtempSync(join20(root3, `.pull-${name}-`));
   let moved = false;
   let backup = null;
   try {
-    writeFileSync5(join19(staging, "SKILL.md"), input.skillMd);
+    writeFileSync5(join20(staging, "SKILL.md"), input.skillMd);
     const manifest = buildCorpusManifest(input, name);
     writeSkillJsonWithHash(staging, manifest);
     if (existsSync10(target)) {
-      backup = mkdtempSync(join19(root3, `.pull-backup-${name}-`));
-      renameSync3(target, join19(backup, name));
+      backup = mkdtempSync(join20(root3, `.pull-backup-${name}-`));
+      renameSync3(target, join20(backup, name));
       moved = true;
     }
     renameSync3(staging, target);
@@ -49452,9 +49645,9 @@ function installCorpusSkillAtomically(input, options = {}) {
     return { name, path: target, manifest, created };
   } catch (error) {
     rmSync(staging, { recursive: true, force: true });
-    if (moved && backup && existsSync10(join19(backup, name))) {
+    if (moved && backup && existsSync10(join20(backup, name))) {
       try {
-        renameSync3(join19(backup, name), target);
+        renameSync3(join20(backup, name), target);
       } catch {}
     }
     throw error;
@@ -49467,8 +49660,8 @@ function validatePortableSkillDirectory(name, skillPath) {
   const warnings = [...base.warnings];
   let manifest;
   if (existsSync10(skillPath)) {
-    const skillJsonPath = join19(skillPath, "skill.json");
-    const skillMdPath = join19(skillPath, "SKILL.md");
+    const skillJsonPath = join20(skillPath, "skill.json");
+    const skillMdPath = join20(skillPath, "SKILL.md");
     if (!existsSync10(skillJsonPath) && !existsSync10(skillMdPath)) {
       add3(issues, "portable.manifest_missing", "Missing portable manifest: expected SKILL.md frontmatter and/or skill.json");
     }
@@ -49488,7 +49681,7 @@ function validatePortableSkillDirectory(name, skillPath) {
         add3(issues, "portable.version_missing", "Portable manifest missing version");
       }
       const contractIssues = validatePortableManifestContract(manifest, {
-        strict: existsSync10(join19(skillPath, "skill.json")),
+        strict: existsSync10(join20(skillPath, "skill.json")),
         skillPath
       });
       for (const issue of contractIssues)
@@ -49524,7 +49717,7 @@ function validatePortableSkillDirectory(name, skillPath) {
               add3(issues, "portable.command_entry_unsafe", `Command '${command3.name}' entry '${command3.entry}' must stay inside the skill directory`);
               continue;
             }
-            const entryPath = join19(skillPath, command3.entry);
+            const entryPath = join20(skillPath, command3.entry);
             if (!existsSync10(entryPath))
               add3(issues, "portable.command_entry_missing", `Command '${command3.name}' entry '${command3.entry}' is missing`);
             else if (statSync8(entryPath).isDirectory())
@@ -49535,7 +49728,7 @@ function validatePortableSkillDirectory(name, skillPath) {
     } catch (error) {
       add3(issues, "portable.manifest_invalid", error.message);
     }
-    if (manifest?.kind !== "instruction" && !existsSync10(join19(skillPath, "AGENTS.md"))) {
+    if (manifest?.kind !== "instruction" && !existsSync10(join20(skillPath, "AGENTS.md"))) {
       add3(issues, "portable.agents_missing", "Missing AGENTS.md with build-out instructions for coding agents");
     }
   }
@@ -49571,12 +49764,12 @@ async function runPortableSkill(name, args, options = {}) {
   if (!isSafeRelativePath2(command3.entry)) {
     return { exitCode: 1, error: `Portable skill '${name}' command entry is unsafe` };
   }
-  const entryPath = join19(skill.path, command3.entry);
+  const entryPath = join20(skill.path, command3.entry);
   if (!existsSync10(entryPath)) {
     return { exitCode: 1, error: `Entry point '${command3.entry}' not found in portable skill '${name}'` };
   }
-  const pkgPath = join19(skill.path, "package.json");
-  const nodeModules = join19(skill.path, "node_modules");
+  const pkgPath = join20(skill.path, "package.json");
+  const nodeModules = join20(skill.path, "node_modules");
   if (existsSync10(pkgPath) && !existsSync10(nodeModules) && hasPackageDependencies(pkgPath)) {
     const install = Bun.spawn(["bun", "install", "--no-save"], {
       cwd: skill.path,
@@ -49623,7 +49816,7 @@ function safeIsDirectory(path) {
   }
 }
 function isSafeRelativePath2(value) {
-  if (!value.trim() || isAbsolute7(value))
+  if (!value.trim() || isAbsolute9(value))
     return false;
   const normalized = normalize2(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
@@ -49648,9 +49841,9 @@ function isSkillsOwnershipMarker(marker) {
   return typeof marker === "object" && marker !== null && Object.hasOwn(marker, "managedBy") && marker.managedBy === SYNC_MARKER_MANAGED_BY;
 }
 function hasSkillsOwnershipMarker(dir) {
-  const path = join20(dir, SYNC_MARKER_FILE);
+  const path = join21(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync10(path).isFile())
+    if (!lstatSync12(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync14(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -49672,9 +49865,9 @@ function resolveSyncAgents(arg) {
 function agentGlobalSkillsDir(agent, homeDir2 = homedir4()) {
   switch (agent) {
     case "opencode":
-      return join20(homeDir2, ".config", "opencode", "skills");
+      return join21(homeDir2, ".config", "opencode", "skills");
     default:
-      return join20(homeDir2, `.${agent}`, "skills");
+      return join21(homeDir2, `.${agent}`, "skills");
   }
 }
 function adaptSkillMdForAgent(skillMd, agent) {
@@ -49733,7 +49926,7 @@ function resolveSyncCorpus(options = {}) {
 function packageSourceRoots(source) {
   const roots = [];
   for (const sub of ["skills"]) {
-    const candidate = join20(source, sub);
+    const candidate = join21(source, sub);
     if (existsSync11(candidate) && isDirectory(candidate))
       roots.push(candidate);
   }
@@ -49749,10 +49942,10 @@ function containsSkillDirectories(path) {
     return false;
   }
   return entries.some((entry) => {
-    const candidate = join20(path, entry);
+    const candidate = join21(path, entry);
     if (!isDirectory(candidate))
       return false;
-    return existsSync11(join20(candidate, "SKILL.md")) || existsSync11(join20(candidate, "skill.json")) || existsSync11(join20(candidate, "package.json"));
+    return existsSync11(join21(candidate, "SKILL.md")) || existsSync11(join21(candidate, "skill.json")) || existsSync11(join21(candidate, "package.json"));
   });
 }
 function isDirectory(path) {
@@ -49792,7 +49985,7 @@ function syncSkillsToAgents(options = {}) {
         actions.push({
           skill: name,
           agent,
-          path: join20(agentGlobalSkillsDir(agent, homeDir2), name, "SKILL.md"),
+          path: join21(agentGlobalSkillsDir(agent, homeDir2), name, "SKILL.md"),
           action: "skip",
           reason: "not found in this machine's corpus"
         });
@@ -49822,7 +50015,7 @@ function syncSkillsToAgents(options = {}) {
 }
 function writeManagedAgentSkill(params) {
   const homeDir2 = params.homeDir ?? homedir4();
-  const dir = join20(agentGlobalSkillsDir(params.agent, homeDir2), params.skill);
+  const dir = join21(agentGlobalSkillsDir(params.agent, homeDir2), params.skill);
   const result = writeManagedSkillDir(dir, params.skillMd, {
     skill: params.skill,
     source: params.source,
@@ -49839,8 +50032,8 @@ function writeManagedAgentSkill(params) {
   };
 }
 function writeManagedSkillDir(dir, skillMd, options) {
-  const skillMdPath = join20(dir, "SKILL.md");
-  const markerPath = join20(dir, SYNC_MARKER_FILE);
+  const skillMdPath = join21(dir, "SKILL.md");
+  const markerPath = join21(dir, SYNC_MARKER_FILE);
   const dirExists = existsSync11(dir);
   const managed = hasSkillsOwnershipMarker(dir);
   const hasSkillMd = existsSync11(skillMdPath);
@@ -49876,13 +50069,13 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname12(dir);
+  const parentDir = dirname14(dir);
   mkdirSync8(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join20(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
-  const candidateDir = join20(transactionDir, "candidate");
-  const backupDir = join20(transactionDir, "backup");
-  const candidateSkillMdPath = join20(candidateDir, "SKILL.md");
-  const candidateMarkerPath = join20(candidateDir, SYNC_MARKER_FILE);
+  const transactionDir = mkdtempSync2(join21(parentDir, `.hasna-skills-write-${basename3(dir)}-`));
+  const candidateDir = join21(transactionDir, "candidate");
+  const backupDir = join21(transactionDir, "backup");
+  const candidateSkillMdPath = join21(candidateDir, "SKILL.md");
+  const candidateMarkerPath = join21(candidateDir, SYNC_MARKER_FILE);
   const marker = {
     managedBy: SYNC_MARKER_MANAGED_BY,
     skill: options.skill,
@@ -49931,7 +50124,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   return { action, path: skillMdPath };
 }
 function removeManagedAgentSkill(skill, agent, homeDir2 = homedir4()) {
-  const dir = join20(agentGlobalSkillsDir(agent, homeDir2), skill);
+  const dir = join21(agentGlobalSkillsDir(agent, homeDir2), skill);
   if (!hasSkillsOwnershipMarker(dir))
     return false;
   rmSync2(dir, { recursive: true, force: true });
@@ -49939,7 +50132,7 @@ function removeManagedAgentSkill(skill, agent, homeDir2 = homedir4()) {
 }
 function sourceSkillMd(skillPath, name, description, kind, preferBundledDocs = false) {
   if (kind === undefined || kind === "instruction" || preferBundledDocs) {
-    const skillMdPath = join20(skillPath, "SKILL.md");
+    const skillMdPath = join21(skillPath, "SKILL.md");
     if (existsSync11(skillMdPath))
       return readFileSync14(skillMdPath, "utf-8");
   }
@@ -49972,7 +50165,7 @@ function normalizeSkillName(name) {
 
 // src/lib/registry.ts
 import { existsSync as existsSync12, readFileSync as readFileSync15, readdirSync as readdirSync12 } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 
 // src/lib/registry-merge.ts
 var SKILL_SOURCE_PRECEDENCE = {
@@ -50193,7 +50386,7 @@ function discoverSkillsInDir(dir, source = "custom") {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillMdPath = join21(dir, entry.name, "SKILL.md");
+      const skillMdPath = join22(dir, entry.name, "SKILL.md");
       if (!existsSync12(skillMdPath))
         continue;
       let content;
@@ -50213,7 +50406,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         category: fm.category || "Development Tools",
         tags: fm.tags || [],
         ...fm.kind ? { kind: fm.kind } : {},
-        ...isHostedMetadataSkillDir(join21(dir, entry.name)) ? { serverOwned: true } : {},
+        ...isHostedMetadataSkillDir(join22(dir, entry.name)) ? { serverOwned: true } : {},
         source
       });
     }
@@ -50229,8 +50422,8 @@ function findExtensionSkillPath(name) {
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join21(config.extensionsDir, entry.name);
-      const skillMdPath = join21(skillDir, "SKILL.md");
+      const skillDir = join22(config.extensionsDir, entry.name);
+      const skillMdPath = join22(skillDir, "SKILL.md");
       if (!existsSync12(skillMdPath))
         continue;
       let content;
@@ -50268,7 +50461,7 @@ function loadRegistry(cwd) {
   const official = SKILLS.map((s2) => ({ ...s2, source: "official" }));
   const extensions = config.extensionsDir ? discoverSkillsInDir(config.extensionsDir, "extension") : [];
   const portableCustom = listPortableSkillMetas();
-  const legacyCustom = discoverSkillsInDir(join21(dataDir2, "custom"));
+  const legacyCustom = discoverSkillsInDir(join22(dataDir2, "custom"));
   const globalCustom = mergeCustomSkills([...legacyCustom, ...portableCustom]);
   registryCache = mergeSkillRegistryLists(official, extensions, globalCustom);
   registryCacheTime = now;
@@ -50317,7 +50510,7 @@ function getAllTags() {
 
 // src/lib/project-state.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
   "custom",
@@ -50332,10 +50525,10 @@ var SKILLS_PROJECT_DIR = ".skills";
 var PROJECT_CONFIG_FILE = "project.json";
 var DEFAULT_EXPORT_DIR = ".skills/exports";
 function getProjectStateDir(targetDir = process.cwd()) {
-  return join22(targetDir, SKILLS_PROJECT_DIR);
+  return join23(targetDir, SKILLS_PROJECT_DIR);
 }
 function getProjectConfigPath(targetDir = process.cwd()) {
-  return join22(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
+  return join23(getProjectStateDir(targetDir), PROJECT_CONFIG_FILE);
 }
 function loadProjectConfig(targetDir = process.cwd()) {
   const path = getProjectConfigPath(targetDir);
@@ -50456,16 +50649,16 @@ function isPinSource(value) {
 }
 
 // src/lib/installer.ts
-var __dirname2 = dirname13(fileURLToPath2(import.meta.url));
+var __dirname2 = dirname15(fileURLToPath2(import.meta.url));
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i3 = 0;i3 < 5; i3++) {
-    const candidate = join23(dir, "skills");
+    const candidate = join24(dir, "skills");
     if (existsSync14(candidate) && !dir.includes(".skills"))
       return candidate;
-    dir = dirname13(dir);
+    dir = dirname15(dir);
   }
-  return join23(__dirname2, "..", "skills");
+  return join24(__dirname2, "..", "skills");
 }
 var SKILLS_DIR = findSkillsDir();
 function getSkillPath(name) {
@@ -50473,13 +50666,13 @@ function getSkillPath(name) {
   const portable = findPortableSkill(skillName);
   if (portable)
     return portable.path;
-  const legacyCustomPath = join23(getDataDir(), "custom", skillName);
+  const legacyCustomPath = join24(getDataDir(), "custom", skillName);
   if (existsSync14(legacyCustomPath))
     return legacyCustomPath;
   const extensionPath = findExtensionSkillPath(skillName);
   if (extensionPath)
     return extensionPath;
-  return join23(SKILLS_DIR, skillName);
+  return join24(SKILLS_DIR, skillName);
 }
 function getCanonicalSkillName(name) {
   return getSkill(name)?.name ?? resolveSkillAlias(normalizeSkillSlug(name));
@@ -50542,7 +50735,7 @@ function createLocalSkillManifest(name, generateSkillMd) {
   if (!existsSync14(sourcePath))
     return null;
   let skillMd = "";
-  const skillMdPath = join23(sourcePath, "SKILL.md");
+  const skillMdPath = join24(sourcePath, "SKILL.md");
   if (existsSync14(skillMdPath)) {
     skillMd = readFileSync17(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
@@ -50616,16 +50809,16 @@ function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const base = projectDir || process.cwd();
   switch (agent) {
     case "pi":
-      return scope === "project" ? join23(base, ".pi", "skills") : join23(homedir5(), ".pi", "agent", "skills");
+      return scope === "project" ? join24(base, ".pi", "skills") : join24(homedir5(), ".pi", "agent", "skills");
     case "opencode":
-      return scope === "project" ? join23(base, ".opencode", "skills") : join23(homedir5(), ".config", "opencode", "skills");
+      return scope === "project" ? join24(base, ".opencode", "skills") : join24(homedir5(), ".config", "opencode", "skills");
     default:
-      return scope === "project" ? join23(base, `.${agent}`, "skills") : join23(homedir5(), `.${agent}`, "skills");
+      return scope === "project" ? join24(base, `.${agent}`, "skills") : join24(homedir5(), `.${agent}`, "skills");
   }
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(getCanonicalSkillName(name));
-  return join23(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join24(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   assertNativeExportAllowed();
@@ -50661,7 +50854,7 @@ function removeSkillForAgent(name, options) {
 }
 function resolveAgentSkillMd(name, generateSkillMd) {
   const sourcePath = getSkillPath(name);
-  const skillMdPath = join23(sourcePath, "SKILL.md");
+  const skillMdPath = join24(sourcePath, "SKILL.md");
   if (existsSync14(skillMdPath))
     return readFileSync17(skillMdPath, "utf-8");
   if (generateSkillMd)
@@ -50696,7 +50889,7 @@ function generateMinimalSkillMd(name) {
     "---",
     ""
   ].filter(Boolean);
-  const fallbackDoc = readFileIfExists(join23(sourcePath, "README.md")) || readFileIfExists(join23(sourcePath, "CLAUDE.md"));
+  const fallbackDoc = readFileIfExists(join24(sourcePath, "README.md")) || readFileIfExists(join24(sourcePath, "CLAUDE.md"));
   if (fallbackDoc)
     return `${frontmatter.join(`
 `)}${fallbackDoc.trim()}
@@ -50715,7 +50908,7 @@ skills run ${canonicalName}
 `;
 }
 function readBundledSkillVersion(name) {
-  const pkgPath = join23(getSkillPath(name), "package.json");
+  const pkgPath = join24(getSkillPath(name), "package.json");
   if (!existsSync14(pkgPath))
     return "unknown";
   try {
@@ -50734,15 +50927,15 @@ function loadProjectConfigCompat(targetDir) {
 
 // src/server/seed-bundled.ts
 import { readFileSync as readFileSync21 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // src/server/registry.ts
 import { existsSync as existsSync16, readFileSync as readFileSync20 } from "fs";
-import { resolve as resolve7, sep as sep5 } from "path";
+import { resolve as resolve9, sep as sep5 } from "path";
 
 // src/lib/dependency-preparation.ts
-import { constants as constants5, closeSync as closeSync6, fstatSync as fstatSync6, lstatSync as lstatSync11, mkdirSync as mkdirSync10, openSync as openSync6, readFileSync as readFileSync18, readdirSync as readdirSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3, ftruncateSync, writeSync } from "fs";
-import { join as join24 } from "path";
+import { constants as constants6, closeSync as closeSync7, fstatSync as fstatSync7, lstatSync as lstatSync13, mkdirSync as mkdirSync10, openSync as openSync7, readFileSync as readFileSync18, readdirSync as readdirSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3, ftruncateSync, writeSync } from "fs";
+import { join as join25 } from "path";
 
 // src/lib/preparation-process.ts
 function capturePreparationProcess(child, platform = process.platform, signalGroup = (pid, signal) => process.kill(pid, signal)) {
@@ -50789,15 +50982,15 @@ var DEPENDENCY_PREPARATION_MARKER = ".skills-dependency-preparation";
 var RECOVERY = "Skill dependency preparation is incomplete. Confirm no installer is running, successfully run bun install --no-save in the skill directory, then remove only .skills-dependency-preparation. See docs/skill-standard.md#recovering-interrupted-dependency-preparation.";
 function hasDependencyPreparationMarker(skillPath) {
   try {
-    lstatSync11(join24(skillPath, DEPENDENCY_PREPARATION_MARKER));
+    lstatSync13(join25(skillPath, DEPENDENCY_PREPARATION_MARKER));
     return true;
   } catch (error) {
     return error.code !== "ENOENT";
   }
 }
 function claimPreparation(skillPath) {
-  const marker = join24(skillPath, DEPENDENCY_PREPARATION_MARKER);
-  const state2 = join24(marker, "state.json"), active = join24(marker, "active");
+  const marker = join25(skillPath, DEPENDENCY_PREPARATION_MARKER);
+  const state2 = join25(marker, "state.json"), active = join25(marker, "active");
   let created = false;
   try {
     mkdirSync10(marker, { mode: 448 });
@@ -50808,21 +51001,21 @@ function claimPreparation(skillPath) {
   }
   let fd;
   try {
-    if (!lstatSync11(marker).isDirectory() || lstatSync11(marker).isSymbolicLink())
+    if (!lstatSync13(marker).isDirectory() || lstatSync13(marker).isSymbolicLink())
       return;
     if (!created) {
       if (readdirSync13(marker).some((name) => name !== "state.json"))
         return;
-      if (!lstatSync11(state2).isFile() || lstatSync11(state2).isSymbolicLink() || lstatSync11(state2).size > 1024)
+      if (!lstatSync13(state2).isFile() || lstatSync13(state2).isSymbolicLink() || lstatSync13(state2).size > 1024)
         return;
       const previous = JSON.parse(readFileSync18(state2, "utf8"));
       if (previous.version !== 1 || previous.status !== "failed" || Object.keys(previous).length !== 2)
         return;
     }
     mkdirSync10(active, { mode: 448 });
-    fd = openSync6(state2, constants5.O_RDWR | constants5.O_NOFOLLOW | (created ? constants5.O_CREAT | constants5.O_EXCL : 0), 384);
-    if (!fstatSync6(fd).isFile()) {
-      closeSync6(fd);
+    fd = openSync7(state2, constants6.O_RDWR | constants6.O_NOFOLLOW | (created ? constants6.O_CREAT | constants6.O_EXCL : 0), 384);
+    if (!fstatSync7(fd).isFile()) {
+      closeSync7(fd);
       return;
     }
     const descriptor = fd;
@@ -50834,7 +51027,7 @@ function claimPreparation(skillPath) {
     record2("pending");
     return { abandon() {
       try {
-        closeSync6(descriptor);
+        closeSync7(descriptor);
       } catch {}
     }, finish(success) {
       try {
@@ -50842,7 +51035,7 @@ function claimPreparation(skillPath) {
           unlinkSync3(state2);
         else
           record2("failed");
-        closeSync6(descriptor);
+        closeSync7(descriptor);
         fd = undefined;
         rmdirSync2(active);
         if (success)
@@ -50850,7 +51043,7 @@ function claimPreparation(skillPath) {
         return true;
       } catch {
         try {
-          closeSync6(descriptor);
+          closeSync7(descriptor);
         } catch {}
         return false;
       }
@@ -50858,7 +51051,7 @@ function claimPreparation(skillPath) {
   } catch {
     if (fd !== undefined)
       try {
-        closeSync6(fd);
+        closeSync7(fd);
       } catch {}
     return;
   }
@@ -50949,11 +51142,11 @@ async function prepareSkillDependencies(skillPath, env, timeoutMs = DEFAULT_PREP
 
 // src/lib/skillinfo.ts
 import { existsSync as existsSync15, readFileSync as readFileSync19 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function isInstructionSkillDir(skillPath, meta) {
   if (meta?.kind === "instruction")
     return true;
-  const skillMdPath = join25(skillPath, "SKILL.md");
+  const skillMdPath = join26(skillPath, "SKILL.md");
   if (!existsSync15(skillMdPath))
     return false;
   try {
@@ -50983,9 +51176,9 @@ function getSkillDocs(name) {
   if (!existsSync15(skillPath))
     return null;
   return {
-    skillMd: readIfExists(join25(skillPath, "SKILL.md")),
-    readme: readIfExists(join25(skillPath, "README.md")),
-    claudeMd: readIfExists(join25(skillPath, "CLAUDE.md"))
+    skillMd: readIfExists(join26(skillPath, "SKILL.md")),
+    readme: readIfExists(join26(skillPath, "README.md")),
+    claudeMd: readIfExists(join26(skillPath, "CLAUDE.md"))
   };
 }
 function getSkillBestDoc(name) {
@@ -51000,14 +51193,14 @@ function getSkillRequirements(name) {
     return null;
   const texts = [];
   for (const file of ["SKILL.md", "README.md", "CLAUDE.md", ".env.example", ".env.local.example"]) {
-    const content = readIfExists(join25(skillPath, file));
+    const content = readIfExists(join26(skillPath, file));
     if (content)
       texts.push(content);
   }
   const meta = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync19(join25(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync19(join26(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta);
 }
@@ -51069,7 +51262,7 @@ async function runSkill(name, args, options = {}) {
       error: `Skill '${name}' is an instruction skill (kind: instruction) and is not runnable. Instruction skills are consumed by coding agents via SKILL.md, not executed with 'skills run'.`
     };
   }
-  const pkgPath = join25(skillPath, "package.json");
+  const pkgPath = join26(skillPath, "package.json");
   if (!existsSync15(pkgPath)) {
     return { exitCode: 1, error: `No package.json in skill '${name}'` };
   }
@@ -51089,12 +51282,12 @@ async function runSkill(name, args, options = {}) {
   } catch {
     return { exitCode: 1, error: `Failed to parse package.json for skill '${name}'` };
   }
-  const entryPath = join25(skillPath, entryPoint);
+  const entryPath = join26(skillPath, entryPoint);
   if (!existsSync15(entryPath)) {
     return { exitCode: 1, error: `Entry point '${entryPoint}' not found in skill '${name}'` };
   }
   const env = { ...process.env, ...options.env };
-  if (!existsSync15(join25(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
+  if (!existsSync15(join26(skillPath, "node_modules")) || hasDependencyPreparationMarker(skillPath)) {
     const failure = await prepareSkillDependencies(skillPath, env, options.preparationTimeoutMs);
     if (failure)
       return failure;
@@ -51172,10 +51365,10 @@ function generateSkillMd(name) {
     "---"
   ].join(`
 `);
-  const readme = readIfExists(join25(skillPath, "README.md"));
-  const claudeMd = readIfExists(join25(skillPath, "CLAUDE.md"));
+  const readme = readIfExists(join26(skillPath, "README.md"));
+  const claudeMd = readIfExists(join26(skillPath, "CLAUDE.md"));
   let cliCommand = null;
-  const pkgPath = join25(skillPath, "package.json");
+  const pkgPath = join26(skillPath, "package.json");
   if (existsSync15(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync19(pkgPath, "utf-8"));
@@ -51291,15 +51484,15 @@ function getServerSkillMd(slug) {
   const docs = getSkillDocs(name);
   if (docs?.skillMd)
     return docs.skillMd;
-  const skillsDir = resolve7(process.cwd(), "skills");
-  const path = resolve7(skillsDir, name, "SKILL.md");
+  const skillsDir = resolve9(process.cwd(), "skills");
+  const path = resolve9(skillsDir, name, "SKILL.md");
   if (!isInsideDir(skillsDir, path))
     return null;
   return existsSync16(path) ? readFileSync20(path, "utf8") : null;
 }
 
 // src/server/skills-api.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
 var SHA256_HEX2 = /^[0-9a-f]{64}$/;
 var MAX_SLUG_LENGTH = 128;
@@ -51511,7 +51704,7 @@ async function parsePublishRequest(request, config) {
     if (bundleBytes.byteLength === 0) {
       throw new SkillRequestError(400, "BUNDLE_EMPTY", "the uploaded bundle is empty");
     }
-    const sha2562 = createHash12("sha256").update(bundleBytes).digest("hex");
+    const sha2562 = createHash14("sha256").update(bundleBytes).digest("hex");
     const claimed = optionalString(manifest.bundleSha256);
     if (claimed)
       assertSha2562(claimed);
@@ -51626,7 +51819,7 @@ async function readPublishedBundle(store, artifactStorage, principal, slug) {
   if (!bytes) {
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
   }
-  const actual = createHash12("sha256").update(bytes).digest("hex");
+  const actual = createHash14("sha256").update(bytes).digest("hex");
   if (actual !== record2.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}' hashes to ${actual} but was published as ${record2.bundleSha256}`);
   }
@@ -51774,7 +51967,7 @@ async function readSkillVersionBundle(store, artifactStorage, principal, slug, v
   const bytes = await artifactStorage.readBundle(bundle);
   if (!bytes)
     throw new SkillRequestError(503, "BUNDLE_BACKEND_UNAVAILABLE", "bundle storage backend unavailable");
-  const actual = createHash12("sha256").update(bytes).digest("hex");
+  const actual = createHash14("sha256").update(bytes).digest("hex");
   if (actual !== found.bundleSha256) {
     throw new SkillRequestError(500, "BUNDLE_DIGEST_DRIFT", `stored bundle for '${slug}@${version2}' hashes to ${actual} but was published as ${found.bundleSha256}`);
   }
@@ -51818,7 +52011,7 @@ async function seedBundledCorpus(options) {
       }
       const manifest = readPortableSkillManifest(dir, slug);
       const packed = packSkillBundle(dir, { maxUnpackedBytes: 50000000 });
-      const skillMdPath = join26(dir, "SKILL.md");
+      const skillMdPath = join27(dir, "SKILL.md");
       const skillMd = existsSync17(skillMdPath) ? readFileSync21(skillMdPath, "utf-8") : undefined;
       const content = {
         slug,
@@ -52086,7 +52279,7 @@ async function handleProfileApi(store, principal, request, parts, config) {
 // src/server/runtime-store.ts
 import { Database as Database3 } from "bun:sqlite";
 import { mkdirSync as mkdirSync11 } from "fs";
-import { dirname as dirname14 } from "path";
+import { dirname as dirname16 } from "path";
 
 // src/sdk/execution/types.ts
 var EXECUTION_PROTOCOL_VERSION = REMOTE_SKILL_RUN_CONTRACT_VERSION;
@@ -52142,7 +52335,7 @@ class RuntimeExecutionStore {
     }
     const path = target.kind === "sqlite" ? target.path : ":memory:";
     if (path !== ":memory:")
-      mkdirSync11(dirname14(path), { recursive: true });
+      mkdirSync11(dirname16(path), { recursive: true });
     const db = new Database3(path);
     db.run("PRAGMA busy_timeout=5000");
     db.run("PRAGMA journal_mode=WAL");
@@ -52382,7 +52575,7 @@ class RuntimeExecutionStore {
 }
 
 // src/sdk/execution/admission.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 
 // src/sdk/execution/image-profile.ts
 class ImageProfileResolutionError extends Error {
@@ -52980,11 +53173,11 @@ function ownedAdmission(admission) {
   };
 }
 function digestInput(input) {
-  return createHash14("sha256").update(canonicalJson(input)).digest("hex");
+  return createHash16("sha256").update(canonicalJson(input)).digest("hex");
 }
 
 // src/sdk/execution/dispatchers/ecs.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 
 // src/sdk/execution/state-machine.ts
 var LEGAL_TRANSITIONS = {
@@ -56383,13 +56576,13 @@ function observedTask(states, taskArn) {
   return state2.lastStatus === "STOPPED" || LIVE_TASK_STATUSES.has(state2.lastStatus) ? state2 : undefined;
 }
 function clientTokenFor(runId2, attemptId) {
-  return createHash15("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
+  return createHash17("sha256").update(`${runId2}\x00${attemptId}`).digest("hex").slice(0, CLIENT_TOKEN_BYTES * 2);
 }
 function startedByFor(runId2, attemptNumber) {
   return `skills-exec/${runId2}/a${attemptNumber}`;
 }
 function requestDigestFor(admission, attemptId) {
-  return createHash15("sha256").update(canonicalJson({ admission, attemptId })).digest("hex");
+  return createHash17("sha256").update(canonicalJson({ admission, attemptId })).digest("hex");
 }
 
 class EcsDispatcher {
@@ -56685,7 +56878,7 @@ function validText(value) {
 }
 
 // src/server/runtime-policy.ts
-import { createHash as createHash16, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHash as createHash18, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var RUNTIME_MAX_INPUT_BYTES = 1e5;
 var RUNTIME_MAX_BUNDLE_BYTES = 1e6;
 var RUNTIME_MAX_ARTIFACT_BYTES = 2000000;
@@ -56757,7 +56950,7 @@ function verifyRuntimeToken(token, key, admission, attempt, now = Date.now()) {
   const actual = Buffer.from(token);
   return actual.length === expected.length && timingSafeEqual2(actual, expected);
 }
-var hashBytes = (bytes) => createHash16("sha256").update(bytes).digest("hex");
+var hashBytes = (bytes) => createHash18("sha256").update(bytes).digest("hex");
 
 // src/server/runtime-api.ts
 async function createRuntimeService(options) {
@@ -57206,7 +57399,7 @@ function normalizePrefix(value) {
 }
 
 // src/server/handlers.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 
 // src/server/store.ts
 import { randomUUID as randomUUID7 } from "crypto";
@@ -58238,7 +58431,7 @@ function textArtifact(run, relativePath, bodyText, contentType = relativePath.en
       relativePath,
       contentType,
       byteSize: bytes.byteLength,
-      sha256: createHash17("sha256").update(bytes).digest("hex"),
+      sha256: createHash19("sha256").update(bytes).digest("hex"),
       visibility: "private"
     },
     body: { relativePath, bodyText, contentType }
@@ -62836,7 +63029,7 @@ var localRunExecutor = {
 // src/sdk/storage.ts
 var artifactStorageSeam = ArtifactStorage;
 // src/sdk/outputs.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 class DatabaseOnlyObjectStore {
   usesS3 = false;
   async materialize(run, artifact, body3) {
@@ -62883,7 +63076,7 @@ function createGovernedArtifactWriter(options) {
       const stamped = {
         ...meta,
         byteSize: outputBytes,
-        sha256: createHash18("sha256").update(persistedBytes).digest("hex"),
+        sha256: createHash20("sha256").update(persistedBytes).digest("hex"),
         visibility: options.visibility ?? config.defaultVisibility,
         ...config.artifactTtlSeconds !== undefined ? { expiresAt: expiresAtFor(createdAt, config.artifactTtlSeconds) } : {}
       };
@@ -63621,10 +63814,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve9) => {
+  const deadline = new Promise((resolve11) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve9(expired);
+      resolve11(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -64533,7 +64726,7 @@ async function requestInvitationEmail(origin, action, input) {
 }
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
 var failures = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
@@ -64580,7 +64773,7 @@ var hash2 = (v2) => typeof v2 === "string" && /^[a-f0-9]{64}$/.test(v2);
 var record6 = (v2) => !!v2 && typeof v2 === "object" && !Array.isArray(v2);
 var exact = (v2, keys) => record6(v2) && Object.keys(v2).sort().join(",") === keys.sort().join(",");
 var date = (v2) => typeof v2 === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v2) && Number.isFinite(Date.parse(v2));
-var publicationSha256 = (bytes) => createHash19("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash21("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash2(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -64825,12 +65018,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve9) => {
+      await new Promise((resolve11) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve9();
+          resolve11();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -65062,23 +65255,23 @@ class RemoteSkillsAuthClient {
   }
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants6, closeSync as closeSync7, fsyncSync as fsyncSync2, fstatSync as fstatSync7, lstatSync as lstatSync12, mkdirSync as mkdirSync12, openSync as openSync7, readSync as readSync5, realpathSync as realpathSync5, renameSync as renameSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname15, isAbsolute as isAbsolute8, join as join30, resolve as resolve9 } from "path";
+import { constants as constants7, closeSync as closeSync8, fsyncSync as fsyncSync2, fstatSync as fstatSync8, lstatSync as lstatSync14, mkdirSync as mkdirSync12, openSync as openSync8, readSync as readSync6, realpathSync as realpathSync5, renameSync as renameSync5, unlinkSync as unlinkSync4, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname17, isAbsolute as isAbsolute10, join as join31, resolve as resolve11 } from "path";
 import { randomUUID as randomUUID9 } from "crypto";
 var fail = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory) {
-  if (!isAbsolute8(directory) || directory !== resolve9(directory) || realpathSync5(directory) !== directory)
+  if (!isAbsolute10(directory) || directory !== resolve11(directory) || realpathSync5(directory) !== directory)
     return fail();
-  for (let path2 = directory;; path2 = dirname15(path2)) {
-    const stat = lstatSync12(path2);
+  for (let path2 = directory;; path2 = dirname17(path2)) {
+    const stat = lstatSync14(path2);
     if (!stat.isDirectory() || stat.isSymbolicLink())
       return fail();
-    if (path2 === dirname15(path2))
+    if (path2 === dirname17(path2))
       break;
   }
-  const own = lstatSync12(directory);
+  const own = lstatSync14(directory);
   if ((own.mode & 63) !== 0 || process.getuid && own.uid !== process.getuid())
     return fail();
   return { dev: own.dev, ino: own.ino };
@@ -65089,36 +65282,36 @@ function unchangedDirectory(directory, identity2) {
     return fail();
 }
 function readOwned(directory, name, max) {
-  const identity2 = safeDirectory(directory), file = join30(directory, name);
-  const fd = openSync7(file, constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  const identity2 = safeDirectory(directory), file = join31(directory, name);
+  const fd = openSync8(file, constants7.O_RDONLY | constants7.O_NOFOLLOW);
   try {
-    const stat = fstatSync7(fd);
+    const stat = fstatSync8(fd);
     if (!stat.isFile() || stat.nlink !== 1 || stat.size > max || stat.size < 1 || (stat.mode & 63) !== 0 || process.getuid && stat.uid !== process.getuid())
       return fail();
     const buffer = Buffer.alloc(Math.min(max, stat.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync5(fd, buffer, length, buffer.length - length, length);
+      const count = readSync6(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync7(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync8(fd);
     unchangedDirectory(directory, identity2);
     if (bytes.length !== stat.size || stat.size !== after.size || stat.mtimeMs !== after.mtimeMs || stat.ctimeMs !== after.ctimeMs)
       return fail();
     return bytes;
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
 }
 function writeOwned(directory, name, bytes) {
-  const fd = openSync7(join30(directory, name), constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+  const fd = openSync8(join31(directory, name), constants7.O_WRONLY | constants7.O_CREAT | constants7.O_EXCL | constants7.O_NOFOLLOW, 384);
   try {
     writeFileSync8(fd, bytes);
     fsyncSync2(fd);
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
 }
 function save(directory, value) {
@@ -65126,12 +65319,12 @@ function save(directory, value) {
   writeOwned(directory, temporary, JSON.stringify(value) + `
 `);
   unchangedDirectory(directory, identity2);
-  renameSync5(join30(directory, temporary), join30(directory, "receipt.json"));
-  const fd = openSync7(directory, constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  renameSync5(join31(directory, temporary), join31(directory, "receipt.json"));
+  const fd = openSync8(directory, constants7.O_RDONLY | constants7.O_NOFOLLOW);
   try {
     fsyncSync2(fd);
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
 }
 function bind(client, receipt) {
@@ -65139,23 +65332,23 @@ function bind(client, receipt) {
     throw new PrivatePublicationError("PUBLICATION_IDENTITY_CHANGED", "The fresh session does not match the recovery directory's server, account and membership.");
 }
 async function locked(directory, action) {
-  const identity2 = safeDirectory(directory), file = join30(directory, "operation.lock");
+  const identity2 = safeDirectory(directory), file = join31(directory, "operation.lock");
   let fd;
   try {
-    fd = openSync7(file, constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 384);
+    fd = openSync8(file, constants7.O_WRONLY | constants7.O_CREAT | constants7.O_EXCL | constants7.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync7(fd);
+  const lock = fstatSync8(fd);
   try {
     writeFileSync8(fd, JSON.stringify({ pid: process.pid }) + `
 `);
     fsyncSync2(fd);
     return await action();
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
     unchangedDirectory(directory, identity2);
-    const now2 = lstatSync12(file);
+    const now2 = lstatSync14(file);
     if (now2.dev !== lock.dev || now2.ino !== lock.ino || !now2.isFile() || now2.isSymbolicLink())
       fail();
     unlinkSync4(file);
@@ -65207,15 +65400,15 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute8(recoveryDirectory) || resolve9(recoveryDirectory) !== recoveryDirectory || realpathSync5(dirname15(recoveryDirectory)) !== dirname15(recoveryDirectory))
+  if (!isAbsolute10(recoveryDirectory) || resolve11(recoveryDirectory) !== recoveryDirectory || realpathSync5(dirname17(recoveryDirectory)) !== dirname17(recoveryDirectory))
     return fail();
   mkdirSync12(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync7(dirname15(recoveryDirectory), constants6.O_RDONLY | constants6.O_NOFOLLOW);
+  const parent = openSync8(dirname17(recoveryDirectory), constants7.O_RDONLY | constants7.O_NOFOLLOW);
   try {
     fsyncSync2(parent);
   } finally {
-    closeSync7(parent);
+    closeSync8(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);