@hasna/skills 0.8.11 → 0.9.1

package/dist/index.js

@@ -8323,6 +8323,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
   const version = readDeclaredSkillVersion(skillPath) ?? PORTABLE_SKILL_DEFAULT_VERSION;
   const kind = parseSkillKind(stringField(jsonManifest, "kind") ?? frontmatter?.kind);
   const commands = parseManifestCommands(jsonManifest) ?? (kind === "instruction" ? [] : inferPackageCommands(pkg, name)) ?? [];
+  const runtime = parseManifestRuntime(jsonManifest) ?? inferRuntimeFromCommands(commands);
   return {
     $schema: stringField(jsonManifest, "$schema") ?? PORTABLE_SKILL_SCHEMA,
     standard: stringField(jsonManifest, "standard") ?? PORTABLE_SKILL_STANDARD,
@@ -8335,7 +8336,7 @@ function readManifest(skillPath, fallbackName, normalizeName) {
     ...kind ? { kind } : {},
     inputs: kind === "instruction" ? parseManifestInputs(jsonManifest) ?? [] : parseManifestInputs(jsonManifest) ?? DEFAULT_INPUTS,
     commands,
-    ...parseManifestRuntime(jsonManifest) ? { runtime: parseManifestRuntime(jsonManifest) } : {},
+    ...runtime ? { runtime } : {},
     ...parseManifestProvenance(jsonManifest) ? { provenance: parseManifestProvenance(jsonManifest) } : {}
   };
 }
@@ -8854,6 +8855,12 @@ function inferPackageCommands(pkg, fallbackName) {
   }
   return;
 }
+function inferRuntimeFromCommands(commands) {
+  const entrypoint = commands.find((command) => command.entry)?.entry;
+  if (!entrypoint || !entrypoint.toLowerCase().endsWith(".py"))
+    return;
+  return { ...defaultRuntimeContract(entrypoint), runtime: "python3" };
+}
 function readJsonObject(path) {
   const parsed = JSON.parse(readFileSync5(path, "utf-8"));
   if (!isRecord2(parsed))
@@ -9650,7 +9657,7 @@ import { homedir as homedir5 } from "os";
 import {
   cpSync as cpSync2,
   existsSync as existsSync12,
-  lstatSync as lstatSync18,
+  lstatSync as lstatSync19,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync15,
@@ -9661,12 +9668,12 @@ import {
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename7, dirname as dirname15, join as join26 } from "path";
+import { basename as basename9, dirname as dirname16, join as join26 } from "path";
 
 // src/lib/agent-integration.ts
-import { createHash as createHash13, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync11, lstatSync as lstatSync17, statSync as statSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync14, readdirSync as readdirSync10, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync5, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, chmodSync, openSync as openSync10, closeSync as closeSync10, fsyncSync as fsyncSync3, fstatSync as fstatSync10, readSync as readSync8, constants as constants9, linkSync as linkSync2 } from "fs";
-import { dirname as dirname14, join as join25, resolve as resolve14, relative as relative5, isAbsolute as isAbsolute14, sep as sep6 } from "path";
+import { createHash as createHash14, randomUUID as randomUUID3 } from "crypto";
+import { existsSync as existsSync11, lstatSync as lstatSync18, statSync as statSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync14, readdirSync as readdirSync10, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync5, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, chmodSync, openSync as openSync11, closeSync as closeSync11, fsyncSync as fsyncSync3, fstatSync as fstatSync11, readSync as readSync9, constants as constants10, linkSync as linkSync2 } from "fs";
+import { dirname as dirname15, join as join25, resolve as resolve15, relative as relative5, isAbsolute as isAbsolute15, sep as sep6 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/lib/managed-policy.ts
@@ -10807,7 +10814,9 @@ function assertAgentPolicyCollections(policy) {
       text(source.path);
       requireBound(source.sha256 === null || typeof source.sha256 === "string" && /^[a-f0-9]{64}$/.test(source.sha256));
       if (source.hashMode !== undefined)
-        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+        requireBound(["bytes", "path-bytes", "claude-plugin-registry", "claude-marketplace-registry", "claude-settings-v1"].includes(source.hashMode) && source.format === undefined && source.fields === undefined && (source.hashMode === "bytes" || source.sha256 !== null));
+      if (source.hashMode === "claude-settings-v1")
+        requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve4(source.path) === source.path && basename3(source.path) === "settings.json");
       if (source.hashMode === "claude-marketplace-registry")
         requireBound(agent === "claude" && value.agent === "claude" && value.method === "reviewed" && !/[\x00-\x1f\x7f]/.test(source.path) && isAbsolute3(source.path) && resolve4(source.path) === source.path && basename3(source.path) === "known_marketplaces.json");
       if (source.hashMode === "claude-plugin-registry") {
@@ -10961,9 +10970,9 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-discovery.ts
-import { createHash as createHash12 } from "crypto";
-import { lstatSync as lstatSync16, readFileSync as readFileSync13, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute13, join as join23, resolve as resolve13, sep as sep5 } from "path";
+import { createHash as createHash13 } from "crypto";
+import { lstatSync as lstatSync17, readFileSync as readFileSync13, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
+import { basename as basename8, dirname as dirname14, isAbsolute as isAbsolute14, join as join23, resolve as resolve14, sep as sep5 } from "path";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -11439,7 +11448,7 @@ import { isAbsolute as isAbsolute10, join as join20, resolve as resolve10 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.11",
+  version: "0.9.1",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -14931,8 +14940,228 @@ function captureClaudeMarketplaceRegistry(path, budget = { remaining: 256 * 1024
   return { path, hashMode: "claude-marketplace-registry", sha256: sha2562 };
 }
 
+// src/lib/claude-settings-witness.ts
+import { createHash as createHash12 } from "crypto";
+import { closeSync as closeSync10, constants as constants9, fstatSync as fstatSync10, lstatSync as lstatSync16, openSync as openSync10, readSync as readSync8 } from "fs";
+import { basename as basename7, dirname as dirname13, isAbsolute as isAbsolute13, resolve as resolve13 } from "path";
+var CLAUDE_SETTINGS_WITNESS_LIMITS = Object.freeze({ bytes: 1024 * 1024, rows: 1024, depth: 32, nodes: 65536, stringCharacters: 16384, pathCharacters: 4096 });
+function need3(value, reason) {
+  if (!value)
+    throw new Error(`Claude settings witness ${reason}`);
+}
+function absolutePath2(value) {
+  need3(typeof value === "string" && value.length > 0 && value.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.pathCharacters && !/[\x00-\x1f\x7f]/.test(value) && isAbsolute13(value) && resolve13(value) === value, "requires a normalized absolute path");
+}
+var sameFile2 = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.uid === b.uid && a.gid === b.gid && a.nlink === b.nlink && a.size === b.size && a.mtimeNs === b.mtimeNs && a.ctimeNs === b.ctimeNs;
+function parents2(path) {
+  const result = [];
+  for (let at = dirname13(path);; at = dirname13(at)) {
+    const stat2 = lstatSync16(at, { bigint: true });
+    need3(stat2.isDirectory() && !stat2.isSymbolicLink(), "path traverses a symlink or non-directory");
+    result.push([at, stat2]);
+    if (at === dirname13(at))
+      return result;
+  }
+}
+function readSettings(path, budget) {
+  absolutePath2(path);
+  need3(basename7(path) === "settings.json", "requires settings.json");
+  need3(Number.isSafeInteger(budget.remaining) && budget.remaining >= 0, "has an invalid byte budget");
+  const ancestors2 = parents2(path), initial = lstatSync16(path, { bigint: true });
+  need3(initial.isFile() && !initial.isSymbolicLink() && initial.size <= BigInt(CLAUDE_SETTINGS_WITNESS_LIMITS.bytes), "is not a bounded regular file");
+  need3(initial.size <= BigInt(budget.remaining), "exceeds its aggregate byte limit");
+  const fd = openSync10(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
+  try {
+    const opened = fstatSync10(fd, { bigint: true });
+    need3(opened.isFile() && sameFile2(initial, opened), "changed during open");
+    const bytes = Buffer.alloc(Number(opened.size) + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const count = readSync8(fd, bytes, length, bytes.length - length, null);
+      if (!count)
+        break;
+      length += count;
+    }
+    const after = fstatSync10(fd, { bigint: true }), current = lstatSync16(path, { bigint: true });
+    need3(current.isFile() && sameFile2(opened, after) && sameFile2(after, current) && BigInt(length) === opened.size, "changed during read");
+    for (const [ancestor, before] of ancestors2) {
+      const now = lstatSync16(ancestor, { bigint: true });
+      need3(now.isDirectory() && before.dev === now.dev && before.ino === now.ino && before.mode === now.mode, "parent changed during read");
+    }
+    budget.remaining -= length;
+    try {
+      return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes.subarray(0, length));
+    } catch {
+      throw new Error("Claude settings witness is not strict UTF-8");
+    }
+  } finally {
+    closeSync10(fd);
+  }
+}
+function parse6(text2) {
+  let at = 0, nodes = 0;
+  const numberPattern = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y;
+  const space = () => {
+    while (at < text2.length && /[\x20\t\r\n]/.test(text2[at]))
+      at++;
+  };
+  function string() {
+    need3(text2[at] === '"', "contains invalid JSON");
+    const start = at++;
+    while (at < text2.length) {
+      const character = text2[at++];
+      if (character === '"') {
+        let value2;
+        try {
+          value2 = JSON.parse(text2.slice(start, at));
+        } catch {
+          throw new Error("Claude settings witness contains invalid JSON string");
+        }
+        need3(value2.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.stringCharacters, "exceeds its string limit");
+        return value2;
+      }
+      if (character === "\\")
+        at++;
+    }
+    throw new Error("Claude settings witness contains an unterminated JSON string");
+  }
+  function value(depth) {
+    need3(depth <= CLAUDE_SETTINGS_WITNESS_LIMITS.depth && ++nodes <= CLAUDE_SETTINGS_WITNESS_LIMITS.nodes, "exceeds its nesting or node limit");
+    space();
+    const character = text2[at];
+    if (character === '"')
+      return { kind: "string", value: string() };
+    if (character === "{" || character === "[") {
+      at++;
+      space();
+      const object4 = character === "{", end = object4 ? "}" : "]", entries = [], items = [], keys = new Set;
+      if (text2[at] !== end)
+        while (true) {
+          if (object4) {
+            space();
+            const key = string();
+            need3(!keys.has(key), "contains a duplicate JSON key");
+            keys.add(key);
+            space();
+            need3(text2[at++] === ":", "contains invalid JSON");
+            entries.push([key, value(depth + 1)]);
+          } else
+            items.push(value(depth + 1));
+          space();
+          if (text2[at] === end)
+            break;
+          need3(text2[at++] === ",", "contains invalid JSON");
+        }
+      at++;
+      return object4 ? { kind: "object", entries } : { kind: "array", items };
+    }
+    for (const literal of ["true", "false", "null"])
+      if (text2.startsWith(literal, at)) {
+        at += literal.length;
+        return { kind: "literal", value: literal };
+      }
+    numberPattern.lastIndex = at;
+    const number = numberPattern.exec(text2);
+    need3(number, "contains invalid JSON");
+    at += number[0].length;
+    return { kind: "number", value: number[0] };
+  }
+  const root2 = value(0);
+  space();
+  need3(at === text2.length && root2.kind === "object", "requires a JSON object without trailing content");
+  need3(root2.entries.length <= CLAUDE_SETTINGS_WITNESS_LIMITS.rows, "exceeds its settings field limit");
+  return root2;
+}
+var BOOLEAN_PREFERENCES = new Set([
+  "autoScrollEnabled",
+  "axScreenReader",
+  "emojiCompletionEnabled",
+  "prefersReducedMotion",
+  "showTurnDuration",
+  "spinnerTipsEnabled",
+  "syntaxHighlightingDisabled",
+  "terminalProgressBarEnabled",
+  "terminalTitleFromRename",
+  "verbose",
+  "wheelScrollAccelerationEnabled"
+]);
+var ENUM_PREFERENCES = Object.freeze({
+  editorMode: ["normal", "vim"],
+  tui: ["default", "fullscreen"],
+  viewMode: ["default", "verbose", "focus"]
+});
+var BUILTIN_MODEL_SELECTIONS = new Set([
+  "default",
+  "best",
+  "fable",
+  "fable[1m]",
+  "sonnet",
+  "sonnet[1m]",
+  "opus",
+  "opus[1m]",
+  "haiku",
+  "opusplan",
+  "claude-fable-5-1",
+  "claude-fable-5",
+  "claude-fable-5[1m]",
+  "claude-opus-5",
+  "claude-sonnet-5",
+  "claude-haiku-4-5-20251001",
+  "claude-opus-4-6",
+  "claude-sonnet-4-5",
+  "claude-sonnet-4-5-20250929",
+  "claude-opus-4-8",
+  "claude-opus-4-8[1m]",
+  "claude-opus-4-7",
+  "claude-sonnet-4-6",
+  "claude-opus-4-5-20251101",
+  "claude-opus-4-5",
+  "claude-haiku-4-5",
+  "claude-fable-5-1[1m]",
+  "claude-opus-5[1m]",
+  "claude-opus-4-7[1m]",
+  "claude-opus-4-6[1m]",
+  "claude-sonnet-4-6[1m]"
+]);
+function canonical3(value) {
+  if (value.kind === "object")
+    return { kind: "object", entries: value.entries.map(([key, child]) => [key, canonical3(child)]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0) };
+  if (value.kind === "array")
+    return { kind: "array", items: value.items.map(canonical3) };
+  return value;
+}
+function settingsDigest(text2) {
+  const value = parse6(text2);
+  value.entries = value.entries.filter(([key, child]) => {
+    if (key === "model") {
+      need3(child.kind === "string", "contains an invalid model selection");
+      return !BUILTIN_MODEL_SELECTIONS.has(child.value);
+    }
+    if (BOOLEAN_PREFERENCES.has(key)) {
+      need3(child.kind === "literal" && (child.value === "true" || child.value === "false"), "contains an invalid display preference");
+      return false;
+    }
+    if (Object.hasOwn(ENUM_PREFERENCES, key)) {
+      need3(child.kind === "string" && ENUM_PREFERENCES[key].includes(child.value), "contains an invalid display preference");
+      return false;
+    }
+    return true;
+  });
+  return createHash12("sha256").update("hasna.skills.claude-settings.v1\x00").update(JSON.stringify(canonical3(value))).digest("hex");
+}
+function hashClaudeSettingsReplacement(text2, budget) {
+  need3(typeof text2 === "string", "requires settings text");
+  const bytes = Buffer.byteLength(text2);
+  need3(bytes <= CLAUDE_SETTINGS_WITNESS_LIMITS.bytes && Number.isSafeInteger(budget.remaining) && budget.remaining >= bytes, "exceeds its byte limit");
+  budget.remaining -= bytes;
+  return settingsDigest(text2);
+}
+function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 }) {
+  return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readSettings(path, budget)) };
+}
+
 // src/lib/agent-discovery.ts
-var digest = (text2) => createHash12("sha256").update(text2).digest("hex");
+var digest = (text2) => createHash13("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -14944,12 +15173,12 @@ function parseConfig(text2, path, toml = false) {
   }
 }
 function safe4(path) {
-  if (!isAbsolute13(path) || path.includes("\x00"))
+  if (!isAbsolute14(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname13(cursor)) {
-    if (lstatSync16(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname14(cursor)) {
+    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname13(cursor) === cursor)
+    if (dirname14(cursor) === cursor)
       break;
   }
 }
@@ -14957,7 +15186,7 @@ function read(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync16(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync17(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
@@ -14965,6 +15194,14 @@ function read(path, changes) {
   return readFileSync13(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
+  if (source.hashMode === "claude-settings-v1") {
+    if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256))
+      throw new Error("Claude settings witnesses require exact typed metadata");
+    const current = captureClaudeSettings(source.path, budget).sha256;
+    if (current !== source.sha256)
+      throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
+    return changes?.has(source.path) ? hashClaudeSettingsReplacement(changes.get(source.path), budget) : current;
+  }
   if (source.hashMode === "claude-marketplace-registry") {
     if (source.format !== undefined || source.fields !== undefined || source.managedPlugins !== undefined || typeof source.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(source.sha256) || changes?.has(source.path))
       throw new Error("Claude marketplace witnesses require an exact reviewed registry without synthetic changes");
@@ -15022,6 +15259,8 @@ function verifyAgentDiscovery(binding) {
     safe4(root2);
 }
 function assertMarketplaceBinding(binding, source) {
+  if (source.hashMode === "claude-settings-v1" && (binding.agent !== "claude" || binding.method !== "reviewed" || basename8(source.path) !== "settings.json"))
+    throw new Error("Claude settings witnesses require explicit reviewed Claude configuration");
   if (source.hashMode === "claude-marketplace-registry" && (binding.agent !== "claude" || binding.method !== "reviewed"))
     throw new Error("Claude marketplace witnesses require explicit reviewed Claude discovery");
 }
@@ -15045,10 +15284,10 @@ function captureDiscoveryPathSources(paths) {
   return paths.map((path) => ({ path, hashMode: "path-bytes", sha256: hashDiscoveryPathFile(path, budget) }));
 }
 function resolveAgentDiscovery(options) {
-  const canonical3 = options.canonical ?? resolve13, home = resolve13(options.home), agent = options.agent;
+  const canonical4 = options.canonical ?? resolve14, home = resolve14(options.home), agent = options.agent;
   const sources = [], roots = new Set, builtinNames = [];
   const witness = (path, format, fields) => {
-    const source = { path: canonical3(path), sha256: null, ...format ? { format, fields } : {} };
+    const source = { path: canonical4(path), sha256: null, ...format ? { format, fields } : {} };
     source.sha256 = projected(source);
     sources.push(source);
     return read(source.path);
@@ -15076,7 +15315,7 @@ function resolveAgentDiscovery(options) {
         continue;
       if (normalized.startsWith("~") && normalized !== "~" && !normalized.startsWith("~/"))
         unresolved("user-specific tilde expansion requires a separate discovery adapter");
-      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join23(home, normalized.slice(2)) : resolve13(home, ".hermes", normalized);
+      const path = normalized === "~" ? home : normalized.startsWith("~/") ? join23(home, normalized.slice(2)) : resolve14(home, ".hermes", normalized);
       safe4(path);
       roots.add(path);
     }
@@ -15085,21 +15324,21 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname13(realpathSync4(executable)), depth = 0;depth < 8; directory = dirname13(directory), depth++) {
+      for (let directory = dirname14(realpathSync4(executable)), depth = 0;depth < 8; directory = dirname14(directory), depth++) {
         const path = join23(directory, "package.json"), raw = read(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname13(directory) === directory)
+        if (dirname14(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
       const builtinRoot = join23(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync16(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync17(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync9(builtinRoot).sort()) {
         const text2 = witness(join23(builtinRoot, name, "SKILL.md"));
@@ -15120,12 +15359,14 @@ function resolveAgentDiscovery(options) {
     if (review.sources.some((source) => source.format !== undefined || source.fields !== undefined))
       throw new Error("Explicit discovery reviews require full source-file hashes");
     verifyAgentDiscovery(supplied);
-    if (!review.sources.some((source) => source.path === canonical3(configPath)))
+    if (review.sources.some((source) => source.hashMode === "claude-settings-v1" && source.path !== canonical4(configPath)))
+      throw new Error("Semantic settings witnesses must name the configured Claude configuration source");
+    if (!review.sources.some((source) => source.path === canonical4(configPath)))
       throw new Error("Discovery review must include the agent configuration source");
     return { ...supplied, roots: [...new Set([...roots, ...supplied.roots])].sort(), sources: [...sources, ...review.sources], ...agent === "gemini" ? { builtinNames } : {} };
   }
   function plugin(root2) {
-    root2 = canonical3(root2);
+    root2 = canonical4(root2);
     safe4(root2);
     const manifestPath = join23(root2, agent === "claude" ? ".claude-plugin/plugin.json" : ".codex-plugin/plugin.json");
     const raw = witness(manifestPath);
@@ -15137,7 +15378,7 @@ function resolveAgentDiscovery(options) {
       unresolved("plugin hooks require a separate no-skill-injection review");
     const commands = join23(root2, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync16(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
     const rootSkill = witness(join23(root2, "SKILL.md"));
     if (rootSkill !== null)
@@ -15148,18 +15389,18 @@ function resolveAgentDiscovery(options) {
     if (agent === "claude")
       roots.add(join23(root2, "skills"));
     for (const value of declared) {
-      const path = resolve13(root2, value);
+      const path = resolve14(root2, value);
       if (path !== root2 && !path.startsWith(root2 + sep5))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep5}SKILL.md`) ? dirname13(path) : path);
+      roots.add(path.endsWith(`${sep5}SKILL.md`) ? dirname14(path) : path);
     }
   }
   if (agent === "claude") {
     const registrations = witness(join23(home, ".claude/plugins/installed_plugins.json"));
     const installed = registrations === null ? {} : parseConfig(registrations, join23(home, ".claude/plugins/installed_plugins.json")).plugins;
-    const commands = canonical3(join23(home, ".claude/commands"));
+    const commands = canonical4(join23(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync16(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+    if (lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -15179,7 +15420,7 @@ function resolveAgentDiscovery(options) {
         unresolved("unsupported plugin enablement");
       const split = id.lastIndexOf("@"), name = id.slice(0, split), marketplace = id.slice(split + 1);
       const market = config.marketplaces?.[marketplace] ?? (marketplace === "personal" ? { source_type: "local", source: home } : undefined);
-      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute13(market.source))
+      if (split < 1 || market?.source_type !== "local" || typeof market.source !== "string" || !isAbsolute14(market.source))
         unresolved("enabled plugin marketplace is not an explicit local source");
       const catalogText = witness(join23(market.source, ".agents/plugins/marketplace.json"));
       if (catalogText === null)
@@ -15187,7 +15428,7 @@ function resolveAgentDiscovery(options) {
       const catalog = parseConfig(catalogText, join23(market.source, ".agents/plugins/marketplace.json")), matches = Array.isArray(catalog.plugins) ? catalog.plugins.filter((item) => item.name === name) : [];
       if (matches.length !== 1 || matches[0]?.source?.source !== "local" || typeof matches[0]?.source?.path !== "string")
         unresolved("plugin catalog source is missing or ambiguous");
-      plugin(resolve13(market.source, matches[0].source.path));
+      plugin(resolve14(market.source, matches[0].source.path));
     }
   } else if (agent === "opencode") {
     if (witness(join23(home, ".config/opencode/opencode.jsonc")) !== null || witness(join23(home, ".config/opencode/config.json")) !== null)
@@ -15195,18 +15436,18 @@ function resolveAgentDiscovery(options) {
     if ((config.plugin?.length ?? 0) > 0 || config.skills?.urls?.length)
       unresolved("external plugin or remote skill source");
     for (const path of config.skills?.paths ?? []) {
-      if (typeof path !== "string" || !isAbsolute13(path))
+      if (typeof path !== "string" || !isAbsolute14(path))
         unresolved("relative or malformed added skill root");
       roots.add(path);
     }
     const localPlugins = join23(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync16(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync17(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
     for (const directory of [join23(home, ".hermes/plugins"), join23(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync16(directory, { throwIfNoEntry: false }))
+      if (lstatSync17(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -15216,11 +15457,11 @@ function resolveAgentDiscovery(options) {
       unresolved("custom extension or skill paths");
     const directory = join23(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync16(directory, { throwIfNoEntry: false }))
+    if (lstatSync17(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync9(directory)) {
         const root2 = join23(directory, name);
         safe4(root2);
-        if (!lstatSync16(root2)?.isDirectory())
+        if (!lstatSync17(root2)?.isDirectory())
           continue;
         const raw = witness(join23(root2, "gemini-extension.json"));
         if (raw === null)
@@ -15231,7 +15472,7 @@ function resolveAgentDiscovery(options) {
         roots.add(join23(root2, "skills"));
       }
   }
-  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join23(home, ".hermes/plugins"), join23(home, ".hermes/hermes-agent")].map((path) => canonical3(path))) } : {} };
+  return { agent, roots: [...roots].sort(), sources, method: "automatic", ...agent === "gemini" ? { builtinNames } : {}, ...agent === "hermes" ? { directories: captureDiscoveryDirectories([join23(home, ".hermes/plugins"), join23(home, ".hermes/hermes-agent")].map((path) => canonical4(path))) } : {} };
 }
 
 // src/lib/agent-adapters.ts
@@ -15375,7 +15616,7 @@ function disableCodexBundledSkills(text2) {
 }
 
 // src/lib/agent-integration.ts
-var sha = (data) => createHash13("sha256").update(data).digest("hex");
+var sha = (data) => createHash14("sha256").update(data).digest("hex");
 var ROOTS = [
   ["claude", ".claude/skills"],
   ["codex", ".codex/skills"],
@@ -15394,11 +15635,11 @@ var ROOTS = [
   ["copilot", ".github/skills"]
 ];
 function assertSafePath(path) {
-  let cursor = resolve14(path);
+  let cursor = resolve15(path);
   while (true) {
-    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync18(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname14(cursor);
+    const parent = dirname15(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -15407,16 +15648,16 @@ function assertSafePath(path) {
 function readRootAlias(home, agent) {
   assertSafePath(home);
   const realHome = realpathSync5(home), alias = join25(realHome, `.${agent}`);
-  const stat2 = lstatSync17(alias, { throwIfNoEntry: false, bigint: true });
+  const stat2 = lstatSync18(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat2?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync2(alias), targetPath = resolve14(dirname14(alias), link);
+  const link = readlinkSync2(alias), targetPath = resolve15(dirname15(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync17(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync18(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync5(targetPath), inside = relative5(realHome, target);
-  if (!inside || inside === ".." || inside.startsWith(`..${sep6}`) || isAbsolute14(inside))
+  if (!inside || inside === ".." || inside.startsWith(`..${sep6}`) || isAbsolute15(inside))
     throw new Error(`Agent root alias target must be inside the real home: ${alias}`);
   return { agent, home: realHome, alias, target, link, aliasIdentity: `${stat2.dev}:${stat2.ino}:${stat2.ctimeNs}`, targetIdentity: `${targetStat.dev}:${targetStat.ino}` };
 }
@@ -15425,14 +15666,14 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync17(join25(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync18(join25(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep6) || other.target.startsWith(item.target + sep6))))
     throw new Error("Agent root alias targets must not overlap");
   return result;
 }
 function canonicalAgentPath(path, aliases) {
-  const absolute = resolve14(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep6));
+  const absolute = resolve15(path), binding = aliases.find((item) => absolute === item.alias || absolute.startsWith(item.alias + sep6));
   return binding ? join25(binding.target, relative5(binding.alias, absolute)) : absolute;
 }
 function recheckRootAliases(aliases) {
@@ -15446,35 +15687,35 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync17(path);
+  const before = lstatSync18(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync10(path, constants9.O_RDONLY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
+  const descriptor = openSync11(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
   try {
-    const opened = fstatSync10(descriptor);
+    const opened = fstatSync11(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync8(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync9(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync10(descriptor);
+    const after = fstatSync11(descriptor);
     if (length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync10(descriptor);
+    closeSync11(descriptor);
   }
 }
 function treeHash(root2) {
-  const hash2 = createHash13("sha256");
+  const hash2 = createHash14("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat2 = lstatSync17(path);
+    const stat2 = lstatSync18(path);
     if (stat2.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative5(root2, path);
@@ -15500,11 +15741,11 @@ function treeHash(root2) {
 function projectAncestorDirectories(projects) {
   const directories = new Set;
   for (const project of projects) {
-    for (let path = resolve14(project), depth = 0;; depth++) {
+    for (let path = resolve15(project), depth = 0;; depth++) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
-      const parent = dirname14(path);
+      const parent = dirname15(path);
       if (parent === path)
         break;
       path = parent;
@@ -15531,10 +15772,10 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       throw new Error("Native skill discovery metadata limit exceeded");
   }
   function emptySiblingCacheAlias(path, parent) {
-    const link = readlinkSync2(path), target = resolve14(parent, link);
-    if (dirname14(target) !== parent || (isAbsolute14(link) ? link !== target : dirname14(link) !== "."))
+    const link = readlinkSync2(path), target = resolve15(parent, link);
+    if (dirname15(target) !== parent || (isAbsolute15(link) ? link !== target : dirname15(link) !== "."))
       return false;
-    if (!lstatSync17(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync18(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
@@ -15546,7 +15787,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     assertSafePath(path);
     if (!existsSync11(path))
       return scan;
-    const stat2 = lstatSync17(path);
+    const stat2 = lstatSync18(path);
     if (stat2.isFile())
       return scan;
     if (!stat2.isDirectory())
@@ -15565,7 +15806,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       }
       const bridge = !vendor && isOwnedCliBridge(path, bridgePaths);
       const rootAlias = aliases.find((item) => path === item.target || path.startsWith(item.target + sep6));
-      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join25(home, ".codex", "skills", ".system"), aliases) + sep6) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve14(home) } : {}, ...rootAlias ? { rootAlias } : {} });
+      entries.push({ agent, path, hash: treeHash(path), managed, vendor, ...agent === "codex" && path.startsWith(canonicalAgentPath(join25(home, ".codex", "skills", ".system"), aliases) + sep6) ? { system: true } : {}, ...bridge ? { bridge: true, bridgeHome: resolve15(home) } : {}, ...rootAlias ? { rootAlias } : {} });
       return scan;
     }
     if (depth > (vendor ? 32 : 3))
@@ -15592,7 +15833,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       if (isVendor && !options.includeVendor)
         continue;
       const child = join25(path, name);
-      if (isVendor && lstatSync17(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      if (isVendor && lstatSync18(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync8(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
           scan.entries++;
@@ -15714,7 +15955,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
 function disableCodexSkills(text2, skills, aliases, bridgePath) {
   const bundled = disableCodexBundledSkills(text2);
   let result = bundled;
-  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve14(bridgePath), resolve14(join25(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
+  const bridgeSelector = (entry) => typeof entry.name === "string" && entry.name.trim() === CLI_BRIDGE_NAME || typeof entry.path === "string" && [resolve15(bridgePath), resolve15(join25(bridgePath, "SKILL.md"))].includes(canonicalAgentPath(entry.path, aliases));
   const previousConfig = Bun.TOML.parse(bundled).skills?.config;
   if (previousConfig !== undefined && (!Array.isArray(previousConfig) || previousConfig.some((entry) => !entry || typeof entry !== "object" || entry.path !== undefined && entry.name !== undefined)))
     throw new Error("Codex skill controls require one path or name selector per [[skills.config]] entry; review ambiguous entries before running skills hook install");
@@ -15726,7 +15967,7 @@ function disableCodexSkills(text2, skills, aliases, bridgePath) {
     result = result.replace(CODEX_SKILL_CONFIG_SECTIONS, (section) => {
       const parsed = Bun.TOML.parse(section);
       const declared = parsed.skills?.config?.[0];
-      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve14(path), resolve14(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
+      if (!declared || !(skill.enabled && bridgeSelector(declared)) && !(typeof declared.path === "string" && [resolve15(path), resolve15(skill.path)].includes(canonicalAgentPath(declared.path, aliases))))
         return section;
       found = true;
       return /^\s*enabled\s*=/m.test(section) ? section.replace(/^\s*enabled\s*=.*$/m, `enabled = ${skill.enabled}`) : `${section.trimEnd()}
@@ -15844,7 +16085,7 @@ function planAgentIntegration(options) {
     version: CLI_BRIDGE_VERSION,
     digest: CLI_BRIDGE_DIGEST,
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
-    home: resolve14(home),
+    home: resolve15(home),
     includeVendor: true,
     ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join25(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries([...bindings].map(([agent, binding]) => [agent, binding.command])) },
@@ -15861,7 +16102,7 @@ function planAgentIntegration(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync7(dirname14(path), { recursive: true, mode: 448 });
+  mkdirSync7(dirname15(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID3()}`;
   try {
     writeFileSync5(temporary, content, { mode: 384, flag: "wx" });
@@ -15874,10 +16115,10 @@ function atomicWrite2(path, content) {
 function applyAgentIntegration(plan) {
   const policyPath = join25(plan.dataDir, "agent-policy.json");
   assertSafePath(policyPath);
-  const currentText = (path) => resolve14(path) === resolve14(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
+  const currentText = (path) => resolve15(path) === resolve15(policyPath) ? readManagedSkillPolicySnapshot(plan.dataDir)?.text ?? null : readOptional(path);
   readManagedSkillPolicySnapshot(plan.dataDir);
   for (const change of plan.changes)
-    if (resolve14(change.path) === resolve14(policyPath))
+    if (resolve15(change.path) === resolve15(policyPath))
       parseManagedSkillPolicy(change.after);
   const aliases = plan.rootAliases ?? [];
   recheckRootAliases(aliases);
@@ -15907,7 +16148,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname14(change.path);!existsSync11(directory); directory = dirname14(directory))
+      for (let directory = dirname15(change.path);!existsSync11(directory); directory = dirname15(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -15947,11 +16188,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync10(path, constants9.O_RDONLY | constants9.O_DIRECTORY | constants9.O_NOFOLLOW | constants9.O_NONBLOCK);
+  const descriptor = openSync11(path, constants10.O_RDONLY | constants10.O_DIRECTORY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
   try {
     fsyncSync3(descriptor);
   } finally {
-    closeSync10(descriptor);
+    closeSync11(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -15959,18 +16200,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID3()}`;
   let descriptor;
   try {
-    descriptor = openSync10(temporary, constants9.O_WRONLY | constants9.O_CREAT | constants9.O_EXCL | constants9.O_NOFOLLOW, 384);
+    descriptor = openSync11(temporary, constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW, 384);
     writeFileSync5(descriptor, `${JSON.stringify(value)}
 `);
     fsyncSync3(descriptor);
-    closeSync10(descriptor);
+    closeSync11(descriptor);
     descriptor = undefined;
     renameSync4(temporary, path);
-    syncArchiveDirectory(dirname14(path));
+    syncArchiveDirectory(dirname15(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync10(descriptor);
-    if (lstatSync17(temporary, { throwIfNoEntry: false }))
+      closeSync11(descriptor);
+    if (lstatSync18(temporary, { throwIfNoEntry: false }))
       unlinkSync4(temporary);
   }
 }
@@ -16003,7 +16244,7 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat2 = lstatSync17(entry.archive);
+    const stat2 = lstatSync18(entry.archive);
     if (entry.discoveryOnly ? !stat2.isFile() : !stat2.isDirectory())
       throw new Error("Archive type changed");
     if ((entry.discoveryOnly ? sha(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
@@ -16011,14 +16252,14 @@ function archiveNativeSkills(inventory, options) {
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync11(path); path = dirname14(path))
+  for (let path = archiveRoot;!existsSync11(path); path = dirname15(path))
     created.push(path);
   mkdirSync7(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname14(created.at(-1)));
+      syncArchiveDirectory(dirname15(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -16030,7 +16271,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync4(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname14(move.source));
+      syncArchiveDirectory(dirname15(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -16051,7 +16292,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync18(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -16065,10 +16306,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync2(entry.archive, entry.source);
-          syncArchiveDirectory(dirname14(entry.source));
+          syncArchiveDirectory(dirname15(entry.source));
           unlinkSync4(entry.archive);
         } else {
-          if (lstatSync17(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync18(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -16076,7 +16317,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync4(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname14(entry.source));
+        syncArchiveDirectory(dirname15(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -16115,7 +16356,7 @@ function isSkillsOwnershipMarker(marker) {
 function hasSkillsOwnershipMarker(dir) {
   const path = join26(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync18(path).isFile())
+    if (!lstatSync19(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync15(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -16341,9 +16582,9 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname15(dir);
+  const parentDir = dirname16(dir);
   mkdirSync8(parentDir, { recursive: true });
-  const transactionDir = mkdtempSync2(join26(parentDir, `.hasna-skills-write-${basename7(dir)}-`));
+  const transactionDir = mkdtempSync2(join26(parentDir, `.hasna-skills-write-${basename9(dir)}-`));
   const candidateDir = join26(transactionDir, "candidate");
   const backupDir = join26(transactionDir, "backup");
   const candidateSkillMdPath = join26(candidateDir, "SKILL.md");
@@ -16832,7 +17073,7 @@ function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
 }
 // src/lib/run-state.ts
-import { createHash as createHash14, randomBytes } from "crypto";
+import { createHash as createHash15, randomBytes } from "crypto";
 import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync18, readdirSync as readdirSync12, statSync as statSync10, writeFileSync as writeFileSync8 } from "fs";
 import { extname, join as join29, relative as relative6 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
@@ -16959,7 +17200,7 @@ function collectRunArtifacts(context) {
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
-      sha256: createHash14("sha256").update(bytes).digest("hex"),
+      sha256: createHash15("sha256").update(bytes).digest("hex"),
       sizeBytes: stat2.size
     });
   }
@@ -17087,7 +17328,7 @@ __export(exports_external, {
   pipe: () => pipe,
   partialRecord: () => partialRecord,
   parseAsync: () => parseAsync2,
-  parse: () => parse8,
+  parse: () => parse9,
   overwrite: () => _overwrite,
   output: () => output,
   optional: () => optional,
@@ -17307,7 +17548,7 @@ __export(exports_core2, {
   prettifyError: () => prettifyError,
   parseURLObject: () => parseURLObject,
   parseAsync: () => parseAsync,
-  parse: () => parse6,
+  parse: () => parse7,
   meta: () => meta,
   mergeValues: () => mergeValues,
   memoizer: () => memoizer,
@@ -18761,7 +19002,7 @@ var _parse = (_Err) => {
   };
   return fn;
 };
-var parse6 = /* @__PURE__ */ _parse($ZodRealError);
+var parse7 = /* @__PURE__ */ _parse($ZodRealError);
 var _parseAsync = (_Err) => {
   const fn = async (schema, value, _ctx, params) => {
     const ctx = _ctx ? { ..._ctx, async: true } : { async: true };
@@ -18832,18 +19073,18 @@ var validateAsync = async (schema, value, _ctx) => {
   return result.issues.length === 0;
 };
 var _encode = (_Err) => {
-  const parse7 = _parse(_Err);
+  const parse8 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
     const ctx = _ctx ? { ..._ctx, direction: "backward" } : { direction: "backward" };
-    return parse7(schema, value, ctx, finalizeParams(fn, _params));
+    return parse8(schema, value, ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
 var encode = /* @__PURE__ */ _encode($ZodRealError);
 var _decode = (_Err) => {
-  const parse7 = _parse(_Err);
+  const parse8 = _parse(_Err);
   const fn = (schema, value, _ctx, _params) => {
-    return parse7(schema, value, _ctx, finalizeParams(fn, _params));
+    return parse8(schema, value, _ctx, finalizeParams(fn, _params));
   };
   return fn;
 };
@@ -21766,10 +22007,10 @@ var $ZodFunction = /* @__PURE__ */ $constructor("$ZodFunction", (inst, def) => {
       throw new Error("implement() must be called with a function");
     }
     return Object.defineProperty(function(...args) {
-      const parsedArgs = inst._def.input ? parse6(inst._def.input, args) : args;
+      const parsedArgs = inst._def.input ? parse7(inst._def.input, args) : args;
       const result = Reflect.apply(func, this, parsedArgs);
       if (inst._def.output) {
-        return parse6(inst._def.output, result);
+        return parse7(inst._def.output, result);
       }
       return result;
     }, "_zod", { value: inst._zod, enumerable: false });
@@ -33407,7 +33648,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, undefi
 });
 
 // node_modules/zod/v4/classic/parse.js
-var parse8 = /* @__PURE__ */ _parse(ZodRealError);
+var parse9 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
 var safeParseAsync2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
@@ -33543,7 +33784,7 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
     exports_util.own(this, "~standard", value);
   },
   parse: function _parse2(data, params) {
-    return parse8(this, data, params, { callee: _parse2 });
+    return parse9(this, data, params, { callee: _parse2 });
   },
   parseAsync: async function _parseAsync2(data, params) {
     return await parseAsync2(this, data, params, { callee: _parseAsync2 });
@@ -35720,6 +35961,8 @@ var remoteSkillSchema = exports_external.object({
   tags: exports_external.array(exports_external.string()).optional(),
   dependencies: exports_external.array(exports_external.string()).optional(),
   version: exports_external.string().optional(),
+  revisionId: exports_external.union([exports_external.string().regex(/^[\x21-\x7e]+$/), exports_external.null()]).optional(),
+  lifecycle: exports_external.enum(["active", "archived"]).optional(),
   availability: remoteAvailabilitySchema.optional()
 }).passthrough().refine((skill) => skill.name || skill.slug, {
   message: "Remote skill requires name or slug"
@@ -35782,6 +36025,8 @@ function normalizeRemoteSkill(skill) {
     tags: skill.tags || ["remote"],
     dependencies: skill.dependencies,
     ...skill.version ? { version: skill.version } : {},
+    ...skill.revisionId !== undefined ? { revisionId: skill.revisionId } : {},
+    ...skill.lifecycle ? { lifecycle: skill.lifecycle } : {},
     availability: normalizeRemoteAvailability(skill.availability),
     source: "remote"
   };
@@ -36374,7 +36619,7 @@ function clone2(value) {
   return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
 }
 // src/lib/canonical-json.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 function canonicalJson2(value, maximumBytes = 2 * 1024 * 1024) {
   return canonicalJsonAtDepth(value, maximumBytes, 64);
 }
@@ -36418,7 +36663,7 @@ function canonicalJsonAtDepth(value, maximumBytes, maximumDepth) {
   return visit3(value, 0);
 }
 function canonicalJsonSha256(value, maximumBytes) {
-  return createHash15("sha256").update(canonicalJson2(value, maximumBytes)).digest("hex");
+  return createHash16("sha256").update(canonicalJson2(value, maximumBytes)).digest("hex");
 }
 
 // src/lib/remote-recurring-contract.ts
@@ -37379,10 +37624,10 @@ async function readQuoteUnavailableCode(response) {
   let timer;
   let deadlineExceeded = false;
   const expired = Symbol("quote body deadline");
-  const deadline = new Promise((resolve15) => {
+  const deadline = new Promise((resolve16) => {
     timer = setTimeout(() => {
       deadlineExceeded = true;
-      resolve15(expired);
+      resolve16(expired);
       reader.cancel().catch(() => {});
     }, 1500);
   });
@@ -37498,6 +37743,18 @@ class RemoteRequestError extends Error {
     this.name = "RemoteRequestError";
   }
 }
+var KNOWN_SKILL_LIFECYCLE_CODES = new Set(["SKILL_ARCHIVE_PROFILE_CONFLICT", "LIFECYCLE_ROLE_REQUIRED"]);
+
+class RemoteSkillLifecycleError extends RemoteRequestError {
+  code;
+  constructor(path, status, code) {
+    super(path, status);
+    this.name = "RemoteSkillLifecycleError";
+    const safeCode = code !== undefined && KNOWN_SKILL_LIFECYCLE_CODES.has(code) ? code : undefined;
+    this.code = safeCode;
+    this.message = `Skill lifecycle update was refused (HTTP ${status}${safeCode ? `, code ${safeCode}` : ""})`;
+  }
+}
 
 class RemoteCreditCheckoutError extends RemoteRequestError {
   code;
@@ -37678,6 +37935,39 @@ class RemoteSkillsClient {
       })();
     return this.capabilities;
   }
+  async addSkillPublishScope(keyId, expectedScopes, expectedOrgId) {
+    if (!/^[A-Za-z0-9_-]+$/.test(keyId))
+      throw new Error("Invalid API key id");
+    if (!/^[A-Za-z0-9_-]{1,256}$/.test(expectedOrgId))
+      throw new Error("Invalid expected organization id");
+    if (!Array.isArray(expectedScopes) || expectedScopes.length > 32 || expectedScopes.some((scope) => typeof scope !== "string" || scope.length > 128 || !/^(?:\*|[a-z][a-z0-9_-]*:(?:\*|[a-z][a-z0-9_-]*))$/.test(scope)) || new Set(expectedScopes).size !== expectedScopes.length)
+      throw new Error("Invalid expected API key scopes");
+    const path = `/api/v1/admin/keys/${encodeURIComponent(keyId)}/scopes`;
+    const response = await this.request(path, { method: "PATCH", body: JSON.stringify({ expected_scopes: expectedScopes, add_scopes: ["skills:publish"] }) });
+    if (!response.ok)
+      throw new RemoteRequestError(path, response.status);
+    let value;
+    try {
+      value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, 64 * 1024)));
+    } catch {
+      throw new Error("Invalid API key scope update response");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new Error("Invalid API key scope update response");
+    const body = value;
+    const returnedId = body.keyId;
+    const orgId = body.orgId;
+    const scopes = body.scopes;
+    if (returnedId !== keyId || typeof orgId !== "string" || !orgId || expectedOrgId !== undefined && orgId !== expectedOrgId || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string") || body.updated !== true) {
+      throw new Error("Invalid API key scope update response");
+    }
+    const returnedScopes = scopes;
+    const expectedResult = expectedScopes.includes("skills:publish") ? expectedScopes : [...expectedScopes, "skills:publish"];
+    if (returnedScopes.length !== expectedResult.length || expectedResult.some((scope, index) => returnedScopes[index] !== scope)) {
+      throw new Error("API key scope update response did not preserve the expected scopes");
+    }
+    return { keyId, orgId, scopes: [...returnedScopes], updated: true };
+  }
   async submitQuotedRun(slug2, input2 = {}, args = [], approval = {}) {
     runQuoteReceipt(approval.quoteReceipt);
     ({ input: input2, args, approval } = JSON.parse(JSON.stringify({ input: input2, args, approval })));
@@ -38195,6 +38485,19 @@ class RemoteSkillsClient {
   async deleteSkill(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}`, { method: "DELETE" });
   }
+  async setSkillLifecycle(slug2, lifecycle, options) {
+    const path = `/api/v1/skills/${encodeURIComponent(slug2)}/lifecycle`;
+    const response = await this.request(path, {
+      method: "PATCH",
+      headers: { "If-Match": options.expectedRevisionId },
+      body: JSON.stringify({ lifecycle, ...options.reason ? { reason: options.reason } : {}, ...options.replacementSlug ? { replacementSlug: options.replacementSlug } : {} })
+    });
+    if (!response.ok) {
+      const code = await readResponseCode(response);
+      throw new RemoteSkillLifecycleError(path, response.status, code);
+    }
+    return response.json();
+  }
   async downloadSkillBundle(slug2) {
     return this.request(`/api/v1/skills/${encodeURIComponent(slug2)}/bundle`, { method: "GET" });
   }
@@ -38347,9 +38650,13 @@ function normalizeSkillSummaryList(payload) {
   return payload.map(normalizeSkillSummary);
 }
 async function responseBodyCarriesCode(response, codes) {
+  const code = await readResponseCode(response);
+  return code !== undefined && codes.includes(code);
+}
+async function readResponseCode(response) {
   const reader = response.body?.getReader();
   if (!reader)
-    return false;
+    return;
   const maximum = 8 * 1024;
   let deadline;
   const expired = new Promise((_, reject) => {
@@ -38364,7 +38671,7 @@ async function responseBodyCarriesCode(response, codes) {
         break;
       size += next.value.byteLength;
       if (size > maximum)
-        return false;
+        return;
       chunks.push(next.value);
     }
     const bytes = new Uint8Array(size);
@@ -38375,11 +38682,11 @@ async function responseBodyCarriesCode(response, codes) {
     }
     const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     if (!payload || typeof payload !== "object" || Array.isArray(payload) || !Object.hasOwn(payload, "code"))
-      return false;
+      return;
     const code = payload.code;
-    return typeof code === "string" && codes.includes(code);
+    return typeof code === "string" && /^[A-Z][A-Z0-9_:-]{0,127}$/.test(code) ? code : undefined;
   } catch {
-    return false;
+    return;
   } finally {
     clearTimeout(deadline);
     reader.cancel().catch(() => {});
@@ -38610,10 +38917,10 @@ function recordScheduleRun(id, status, targetDir) {
   saveSchedules(data, targetDir);
 }
 // src/lib/revision.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
-  const canonical3 = JSON.stringify({
+  const canonicalContent = {
     slug: content.slug,
     displayName: content.displayName,
     description: content.description,
@@ -38625,15 +38932,21 @@ function revisionIdOf(content) {
     skillMd: content.skillMd ?? null,
     bundleSha256: content.bundleSha256 ?? null,
     bundleByteSize: content.bundleByteSize ?? null
-  });
-  return createHash16("sha256").update(canonical3).digest("hex");
+  };
+  if (content.lifecycle === "archived" || content.archiveReason !== undefined || content.replacementSlug !== undefined) {
+    canonicalContent.lifecycle = content.lifecycle ?? "active";
+    canonicalContent.archiveReason = content.archiveReason ?? null;
+    canonicalContent.replacementSlug = content.replacementSlug ?? null;
+  }
+  const canonical4 = JSON.stringify(canonicalContent);
+  return createHash17("sha256").update(canonical4).digest("hex");
 }
 function revisionIdOfRecord(record7) {
   return revisionIdOf(record7);
 }
 // src/lib/pull.ts
 import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync20, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname16, join as join31 } from "path";
+import { dirname as dirname17, join as join31 } from "path";
 
 // src/lib/skill-bundles.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -38975,7 +39288,7 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   try {
     for (const entry of entries) {
       const destination = join31(staging, entry.path);
-      mkdirSync12(dirname16(destination), { recursive: true });
+      mkdirSync12(dirname17(destination), { recursive: true });
       writeFileSync10(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
@@ -39069,7 +39382,7 @@ function splitNameVersion(raw) {
   return version2 ? { name, version: version2 } : { name };
 }
 // src/lib/recurring-surface.ts
-import { isAbsolute as isAbsolute15 } from "path";
+import { isAbsolute as isAbsolute16 } from "path";
 
 // src/lib/remote-invitation-recovery.ts
 class InvitationEmailInputError extends Error {
@@ -39167,7 +39480,7 @@ async function requestInvitationEmail(origin, action, input2) {
 }
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
@@ -39214,7 +39527,7 @@ var hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
 var record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var exact = (v, keys) => record8(v) && Object.keys(v).sort().join(",") === keys.sort().join(",");
 var date5 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v));
-var publicationSha256 = (bytes) => createHash17("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash18("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -39459,12 +39772,12 @@ class RemotePrivatePublicationsClient {
       previous = view;
       if (!["queued", "verifying"].includes(view.state) || Date.now() >= until)
         return view;
-      await new Promise((resolve15) => {
+      await new Promise((resolve16) => {
         const timer = setTimeout(done, Math.min(1000, until - Date.now()));
         function done() {
           clearTimeout(timer);
           options.signal?.removeEventListener("abort", done);
-          resolve15();
+          resolve16();
         }
         options.signal?.addEventListener("abort", done, { once: true });
       });
@@ -39728,7 +40041,7 @@ var stateSchema = exports_external.object({
 var uuid13 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
 var context = { userId: uuid13.optional(), membershipId: uuid13.optional() };
 var page2 = { limit: exports_external.number().int().min(1).max(100).optional(), cursor: exports_external.string().min(1).max(2048).optional() };
-var directory = exports_external.string().max(4096).refine(isAbsolute15, "Use an absolute recovery directory");
+var directory = exports_external.string().max(4096).refine(isAbsolute16, "Use an absolute recovery directory");
 var email4 = exports_external.string().trim().toLowerCase().email().max(254);
 var code = exports_external.string().regex(/^\d{6}$/);
 var recurringSurfaceSchemas = {
@@ -39879,7 +40192,7 @@ function findSkillsParityForMcpTool(tool) {
 }
 // src/lib/registry-sync.ts
 import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname17, relative as relative7 } from "path";
+import { dirname as dirname18, relative as relative7 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -39936,7 +40249,7 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync13(dirname17(path), { recursive: true });
+  mkdirSync13(dirname18(path), { recursive: true });
   writeFileSync11(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
@@ -41021,14 +41334,14 @@ function clone3(value) {
 }
 // src/lib/feedback.ts
 import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
-import { dirname as dirname18, join as join32 } from "path";
+import { dirname as dirname19, join as join32 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
   return join32(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname18(dbPath);
+  const dir = dirname19(dbPath);
   if (!existsSync18(dir))
     mkdirSync14(dir, { recursive: true });
   const db = new Database(dbPath);
@@ -41057,7 +41370,7 @@ function saveFeedback(input2) {
   const category = input2.category ?? "general";
   if (isApiMode()) {
     const path = join32(getDataDir(), "feedback.jsonl");
-    const dir = dirname18(path);
+    const dir = dirname19(path);
     if (!existsSync18(dir))
       mkdirSync14(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input2.email ?? null, agent: input2.agent ?? null, version: input2.version ?? null, createdAt: new Date().toISOString() }) + `
@@ -41080,7 +41393,7 @@ function isApiMode(env = process.env) {
   }
 }
 // src/lib/native-storage.ts
-import { createHash as createHash18, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash19, createHmac as createHmac2 } from "crypto";
 import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync15,
@@ -41089,7 +41402,7 @@ import {
   statSync as statSync11,
   writeFileSync as writeFileSync12
 } from "fs";
-import { dirname as dirname19, join as join33, normalize as normalize3, relative as relative8, sep as sep7 } from "path";
+import { dirname as dirname20, join as join33, normalize as normalize3, relative as relative8, sep as sep7 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -41256,7 +41569,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
-        sha256: createHash18("sha256").update(bytes).digest("hex"),
+        sha256: createHash19("sha256").update(bytes).digest("hex"),
         ...options.includeFileContents ? { contentBase64: Buffer.from(bytes).toString("base64") } : {}
       });
     }
@@ -41275,18 +41588,18 @@ function importSkillsLocalSnapshot(snapshot, targetDir = process.cwd(), options
       skipped += 1;
       continue;
     }
-    const absolutePath2 = resolveSnapshotPath(targetDir, file2.path);
-    if (existsSync19(absolutePath2) && !options.overwrite) {
+    const absolutePath3 = resolveSnapshotPath(targetDir, file2.path);
+    if (existsSync19(absolutePath3) && !options.overwrite) {
       skipped += 1;
       continue;
     }
     const bytes = Buffer.from(file2.contentBase64, "base64");
-    const hash4 = createHash18("sha256").update(bytes).digest("hex");
+    const hash4 = createHash19("sha256").update(bytes).digest("hex");
     if (hash4 !== file2.sha256) {
       throw new Error(`Snapshot file checksum mismatch: ${file2.path}`);
     }
-    mkdirSync15(dirname19(absolutePath2), { recursive: true });
-    writeFileSync12(absolutePath2, bytes);
+    mkdirSync15(dirname20(absolutePath3), { recursive: true });
+    writeFileSync12(absolutePath3, bytes);
     written += 1;
   }
   return { written, skipped };
@@ -41613,7 +41926,7 @@ function toIsoString(value) {
   return Number.isNaN(date6.getTime()) ? value : date6.toISOString();
 }
 function sha256Hex2(value) {
-  return createHash18("sha256").update(value).digest("hex");
+  return createHash19("sha256").update(value).digest("hex");
 }
 function normalizeHeaders(headers) {
   const result = {};
@@ -41665,7 +41978,7 @@ function toArrayBuffer(bytes) {
   return buffer;
 }
 // src/lib/station-snapshot.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 import {
   copyFileSync,
   mkdirSync as mkdirSync16,
@@ -41673,7 +41986,7 @@ import {
   statSync as statSync13,
   writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname20, isAbsolute as isAbsolute16, relative as relative9, resolve as resolve15, sep as sep9 } from "path";
+import { dirname as dirname21, isAbsolute as isAbsolute17, relative as relative9, resolve as resolve16, sep as sep9 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync14, statSync as statSync12 } from "fs";
@@ -41840,7 +42153,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash19("sha256").update(readFileSync23(filePath)).digest("hex");
+  return createHash20("sha256").update(readFileSync23(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -41911,7 +42224,7 @@ function humanHomes(scanned) {
   }));
 }
 function writeStationSnapshot(options) {
-  const repoRoot = resolve15(options.repoRoot ?? process.cwd());
+  const repoRoot = resolve16(options.repoRoot ?? process.cwd());
   const { scanned, plans, totalBytes } = planStationSnapshot(options);
   const manifestFiles = plans.map((plan) => ({
     relativePath: plan.source.relativePath,
@@ -41937,9 +42250,9 @@ function writeStationSnapshot(options) {
   const conflicts = [];
   const untouched = [];
   for (const plan of plans) {
-    const destination = resolve15(repoRoot, plan.destination);
+    const destination = resolve16(repoRoot, plan.destination);
     const destinationRelative = relative9(repoRoot, destination);
-    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep9) || isAbsolute16(destinationRelative)) {
+    if (destinationRelative.startsWith("..") || destinationRelative.startsWith(sep9) || isAbsolute17(destinationRelative)) {
       throw new StationSnapshotError("DESTINATION_ESCAPE", `destination escapes repo root: ${plan.destination}`);
     }
     let existingDigest = null;
@@ -41960,8 +42273,8 @@ function writeStationSnapshot(options) {
   }
   let written = 0;
   for (const plan of untouched) {
-    const destination = resolve15(repoRoot, plan.destination);
-    mkdirSync16(dirname20(destination), { recursive: true });
+    const destination = resolve16(repoRoot, plan.destination);
+    mkdirSync16(dirname21(destination), { recursive: true });
     copyFileSync(plan.source.fullPath, destination);
     written += 1;
   }
@@ -41979,8 +42292,8 @@ function writeStationSnapshot(options) {
     },
     files: manifestFiles
   };
-  const manifestPath = resolve15(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync16(dirname20(manifestPath), { recursive: true });
+  const manifestPath = resolve16(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
+  mkdirSync16(dirname21(manifestPath), { recursive: true });
   writeFileSync13(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
@@ -41991,7 +42304,7 @@ function writeStationSnapshot(options) {
   };
 }
 // src/lib/station-hydrate.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync17,
@@ -42000,7 +42313,7 @@ import {
   statSync as statSync14,
   writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname21, join as join35, resolve as resolve16, sep as sep10 } from "path";
+import { dirname as dirname22, join as join35, resolve as resolve17, sep as sep10 } from "path";
 var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1";
 var STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
 var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
@@ -42197,12 +42510,12 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file2) => sha256File(file2.winner.fullPath));
-  return createHash20("sha256").update(joined.sort().join(`
+  return createHash21("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
-  const repoRoot = resolve16(options.repoRoot ?? process.cwd());
-  const cacheRoot = resolve16(options.cacheRoot ?? resolveCorpusRoot());
+  const repoRoot = resolve17(options.repoRoot ?? process.cwd());
+  const cacheRoot = resolve17(options.cacheRoot ?? resolveCorpusRoot());
   const plan = planStationHydration(options.stationId, repoRoot);
   const resultSkills = plan.winners.map((skill) => ({
     ident: skill.ident,
@@ -42256,7 +42569,7 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync17(dirname21(entry.destination), { recursive: true });
+    mkdirSync17(dirname22(entry.destination), { recursive: true });
     copyFileSync2(entry.fullPath, entry.destination);
     written += 1;
   }
@@ -42277,8 +42590,8 @@ function writeStationHydration(options) {
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join35(dirname21(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync17(dirname21(hydrationManifestPath), { recursive: true });
+  const hydrationManifestPath = join35(dirname22(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync17(dirname22(hydrationManifestPath), { recursive: true });
   writeFileSync14(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
@@ -42289,23 +42602,23 @@ function writeStationHydration(options) {
   };
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants10, closeSync as closeSync11, fsyncSync as fsyncSync4, fstatSync as fstatSync11, lstatSync as lstatSync19, mkdirSync as mkdirSync18, openSync as openSync11, readSync as readSync9, realpathSync as realpathSync6, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname22, isAbsolute as isAbsolute17, join as join36, resolve as resolve17 } from "path";
+import { constants as constants11, closeSync as closeSync12, fsyncSync as fsyncSync4, fstatSync as fstatSync12, lstatSync as lstatSync20, mkdirSync as mkdirSync18, openSync as openSync12, readSync as readSync10, realpathSync as realpathSync6, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname23, isAbsolute as isAbsolute18, join as join36, resolve as resolve18 } from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 var fail2 = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
 };
 function safeDirectory(directory2) {
-  if (!isAbsolute17(directory2) || directory2 !== resolve17(directory2) || realpathSync6(directory2) !== directory2)
+  if (!isAbsolute18(directory2) || directory2 !== resolve18(directory2) || realpathSync6(directory2) !== directory2)
     return fail2();
-  for (let path = directory2;; path = dirname22(path)) {
-    const stat2 = lstatSync19(path);
+  for (let path = directory2;; path = dirname23(path)) {
+    const stat2 = lstatSync20(path);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail2();
-    if (path === dirname22(path))
+    if (path === dirname23(path))
       break;
   }
-  const own2 = lstatSync19(directory2);
+  const own2 = lstatSync20(directory2);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail2();
   return { dev: own2.dev, ino: own2.ino };
@@ -42317,35 +42630,35 @@ function unchangedDirectory(directory2, identity3) {
 }
 function readOwned(directory2, name, max) {
   const identity3 = safeDirectory(directory2), file2 = join36(directory2, name);
-  const fd = openSync11(file2, constants10.O_RDONLY | constants10.O_NOFOLLOW);
+  const fd = openSync12(file2, constants11.O_RDONLY | constants11.O_NOFOLLOW);
   try {
-    const stat2 = fstatSync11(fd);
+    const stat2 = fstatSync12(fd);
     if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
       return fail2();
     const buffer = Buffer.alloc(Math.min(max, stat2.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync9(fd, buffer, length, buffer.length - length, length);
+      const count = readSync10(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync11(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync12(fd);
     unchangedDirectory(directory2, identity3);
     if (bytes.length !== stat2.size || stat2.size !== after.size || stat2.mtimeMs !== after.mtimeMs || stat2.ctimeMs !== after.ctimeMs)
       return fail2();
     return bytes;
   } finally {
-    closeSync11(fd);
+    closeSync12(fd);
   }
 }
 function writeOwned(directory2, name, bytes) {
-  const fd = openSync11(join36(directory2, name), constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW, 384);
+  const fd = openSync12(join36(directory2, name), constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
   try {
     writeFileSync15(fd, bytes);
     fsyncSync4(fd);
   } finally {
-    closeSync11(fd);
+    closeSync12(fd);
   }
 }
 function save(directory2, value) {
@@ -42354,11 +42667,11 @@ function save(directory2, value) {
 `);
   unchangedDirectory(directory2, identity3);
   renameSync7(join36(directory2, temporary), join36(directory2, "receipt.json"));
-  const fd = openSync11(directory2, constants10.O_RDONLY | constants10.O_NOFOLLOW);
+  const fd = openSync12(directory2, constants11.O_RDONLY | constants11.O_NOFOLLOW);
   try {
     fsyncSync4(fd);
   } finally {
-    closeSync11(fd);
+    closeSync12(fd);
   }
 }
 function bind(client2, receipt) {
@@ -42369,20 +42682,20 @@ async function locked(directory2, action) {
   const identity3 = safeDirectory(directory2), file2 = join36(directory2, "operation.lock");
   let fd;
   try {
-    fd = openSync11(file2, constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW, 384);
+    fd = openSync12(file2, constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync11(fd);
+  const lock = fstatSync12(fd);
   try {
     writeFileSync15(fd, JSON.stringify({ pid: process.pid }) + `
 `);
     fsyncSync4(fd);
     return await action();
   } finally {
-    closeSync11(fd);
+    closeSync12(fd);
     unchangedDirectory(directory2, identity3);
-    const now = lstatSync19(file2);
+    const now = lstatSync20(file2);
     if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
       fail2();
     unlinkSync5(file2);
@@ -42434,15 +42747,15 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute17(recoveryDirectory) || resolve17(recoveryDirectory) !== recoveryDirectory || realpathSync6(dirname22(recoveryDirectory)) !== dirname22(recoveryDirectory))
+  if (!isAbsolute18(recoveryDirectory) || resolve18(recoveryDirectory) !== recoveryDirectory || realpathSync6(dirname23(recoveryDirectory)) !== dirname23(recoveryDirectory))
     return fail2();
   mkdirSync18(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync11(dirname22(recoveryDirectory), constants10.O_RDONLY | constants10.O_NOFOLLOW);
+  const parent = openSync12(dirname23(recoveryDirectory), constants11.O_RDONLY | constants11.O_NOFOLLOW);
   try {
     fsyncSync4(parent);
   } finally {
-    closeSync11(parent);
+    closeSync12(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);
@@ -42525,8 +42838,8 @@ async function inspectLocked(client2, directory2, cancel) {
   return privatePublicationResult(directory2, receipt);
 }
 // src/lib/skill-context.ts
-import { createHash as createHash21 } from "crypto";
-import { resolve as resolve18 } from "path";
+import { createHash as createHash22 } from "crypto";
+import { resolve as resolve19 } from "path";
 function words(value) {
   return new Set(value.toLowerCase().match(/[a-z0-9]+/g) ?? []);
 }
@@ -42561,7 +42874,7 @@ async function buildSkillContext(input2, options = {}) {
   const promptWords = words(prompt);
   const promptNames = new Set(prompt.toLowerCase().match(/[a-z0-9]+(?:-[a-z0-9]+)*/g) ?? []);
   const loaded = new Set(resolved.session?.loaded ?? []);
-  const paths = [...input2.paths ?? [], ...input2.cwd ? [input2.cwd, resolve18(input2.cwd)] : []];
+  const paths = [...input2.paths ?? [], ...input2.cwd ? [input2.cwd, resolve19(input2.cwd)] : []];
   const candidates = profile.selections.map((selection) => {
     const key = selectionKey(selection);
     if (input2.restore && loaded.has(key))
@@ -42614,7 +42927,7 @@ ${content}`;
 `);
   const receipt = {
     schemaVersion: 1,
-    id: createHash21("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
+    id: createHash22("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
     profileId: profile.profileId,
     profileRevision: profile.profileRevision,
     authority: profile.authority,
@@ -42630,9 +42943,9 @@ ${content}`;
   return { context: context2, selections, omitted, receipt };
 }
 // src/lib/session-reconciliation.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 var SESSION_RECONCILIATION_PLAN_TTL_MS = 5 * 60 * 1000;
-var digest3 = (value) => createHash22("sha256").update(JSON.stringify(value)).digest("hex");
+var digest3 = (value) => createHash23("sha256").update(JSON.stringify(value)).digest("hex");
 function exactTimestamp(value) {
   const parsed = value === undefined ? Number.NaN : Date.parse(value);
   if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
@@ -42921,6 +43234,7 @@ export {
   captureDiscoveryPathSources,
   captureDiscoveryDirectories,
   captureDiscoveryByteSources,
+  captureClaudeSettings,
   captureClaudeMarketplaceRegistry,
   canonicalizeManifest,
   buildSkillsS3ObjectUrl,