@hasna/skills 0.8.6 → 0.8.8

package/README.md

@@ -70,6 +70,22 @@ skills hook install --agent all --selection-profile default --json
 skills hook install --agent all --selection-profile default --apply --json
 ```
 
+Native migration includes the current directory, every ancestor, and the global
+agent directories. Use `--project /path/to/project` to include another project
+and its ancestors. This matches the prompt hook's project discovery, including
+skills inherited from a parent workspace. Preview the JSON inventory before
+applying it; archived copies retain recovery receipts. A drift refusal reports
+the affected paths without printing their skill documents.
+
+Claude hook installation sets `syncClaudeAiSkills: false` in user settings to
+stop [account skill synchronization](https://code.claude.com/docs/en/skills#skills-synced-from-claudeai)
+from recreating native copies. The prompt hook checks that setting. Vendor
+migration also inventories `~/.claude/plugins/synced/` and archives its skill
+documents while preserving other plugin files. Whole-plugin synchronization
+remains unchanged because synced plugins can also provide hooks, MCP servers,
+and language servers. A later plugin download that restores a skill document
+will trigger another drift refusal and require review.
+
 Native hook invocations must use their installed adapter's selection profile.
 An old client command or environment override naming another profile refuses
 before synchronization or context loading. Review the hook installation and

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.6",
+    version: "0.8.8",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -38212,6 +38212,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add2(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join8(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync(current);
+    } catch {
+      add2(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add2(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add2(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add2(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -38447,10 +38476,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join8(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join8(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync8(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add2(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync8(srcDir)) {
         add2(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync8(srcDir)) {
       add2(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync8(join8(srcDir, "index.ts")) && !existsSync8(join8(srcDir, "index.js"))) {
@@ -40028,7 +40069,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))
@@ -51183,11 +51228,26 @@ function treeHash(root) {
   visit2(root);
   return hash2.digest("hex");
 }
+function projectAncestorDirectories(projects) {
+  const directories = new Set;
+  for (const project of projects) {
+    for (let path = resolve10(project), depth = 0;; depth++) {
+      if (depth >= 100)
+        throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
+      directories.add(path);
+      const parent = dirname10(path);
+      if (parent === path)
+        break;
+      path = parent;
+    }
+  }
+  return [...directories];
+}
 function inventoryNativeSkills(home = homedir3(), options = {}) {
   const aliases = rootAliases(home, options.allowRootAliases);
   const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join21(home, path), aliases)]);
   const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join21(home, adapter.root, CLI_BRIDGE_NAME), aliases));
-  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve10(path)))) {
+  for (const project of projectAncestorDirectories([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []])) {
     for (const [agent, path] of ROOTS)
       roots.push([agent, canonicalAgentPath(join21(project, path), aliases)]);
   }
@@ -51290,6 +51350,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"])
       scanRoot(agent, canonicalAgentPath(join21(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+    scanRoot("claude", canonicalAgentPath(join21(home, ".claude", "plugins", "synced"), aliases), true);
     scanRoot("gemini", join21(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
@@ -51354,6 +51415,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
     config.permissions.deny = nativeReady ? denied.filter((rule) => rule !== "Skill") : [...new Set([...denied, "Skill"])];
     config.permissions.allow = nativeReady ? [...new Set([...allowed, `Skill(${CLI_BRIDGE_NAME})`])] : allowed;
     config.disableBundledSkills = true;
+    config.syncClaudeAiSkills = false;
   }
   if (agent === "gemini") {
     config.skills ??= {};
@@ -51766,18 +51828,7 @@ function assertManagedAgentBridge(agent, options = {}) {
   const expected = canonicalAgentPath(join21(home, AGENT_ADAPTERS[agent].root, CLI_BRIDGE_NAME), aliases);
   if (!isOwnedCliBridge(expected, [expected]))
     throw new Error("NATIVE_SKILL_DRIFT: the native Skills bridge is missing or modified; repair it before continuing");
-  const roots = new Set;
-  for (const project of [options.projectDir ?? process.cwd(), ...options.projectDirs ?? [], ...agent === "hermes" && process.env.TERMINAL_CWD ? [process.cwd()] : []]) {
-    for (let path = resolve10(project), depth = 0;; depth++) {
-      if (depth >= 100)
-        throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
-      roots.add(path);
-      const parent = dirname10(path);
-      if (parent === path)
-        break;
-      path = parent;
-    }
-  }
+  const roots = projectAncestorDirectories([options.projectDir ?? process.cwd(), ...options.projectDirs ?? [], ...agent === "hermes" && process.env.TERMINAL_CWD ? [process.cwd()] : []]);
   const visible = (entry) => entry.agent === agent || ["codex", "gemini", "opencode", "hermes"].includes(agent) && entry.path.includes(`${sep5}.agents${sep5}skills${sep5}`) || agent === "opencode" && entry.agent === "claude";
   assertProjectDiscovery(agent, [...roots], home, (path) => canonicalAgentPath(path, aliases));
   const configPath = canonicalAgentPath(join21(home, AGENT_ADAPTERS[agent].config), aliases), config = agent === "hermes" ? parseHermesConfig(readOptional(configPath)) : jsonObject(readOptional(configPath), configPath);
@@ -51804,6 +51855,8 @@ function assertManagedAgentBridge(agent, options = {}) {
       }
     if (agent === "claude" && (config.disableBundledSkills !== true || config.disableAllHooks === true || !config.permissions?.allow?.includes(`Skill(${CLI_BRIDGE_NAME})`) || config.permissions?.deny?.includes("Skill")))
       throw new Error("NATIVE_SKILL_DRIFT: Claude bridge or bundled-skill protection changed; retire copies and run skills hook install");
+    if (agent === "claude" && config.syncClaudeAiSkills !== false)
+      throw new Error("NATIVE_SKILL_DRIFT: Claude account skill synchronization is not disabled (syncClaudeAiSkills); run skills hook install to prevent native copies from returning");
     if (agent === "gemini" && (config.hooksConfig?.enabled === false || config.skills?.enabled !== true || !["antigravity-support", "skill-creator"].every((name) => config.skills?.disabled?.includes(name)) || config.skills?.disabled?.includes(CLI_BRIDGE_NAME)))
       throw new Error("NATIVE_SKILL_DRIFT: Gemini bridge or bundled-skill protection changed; run skills hook install");
   }
@@ -51835,8 +51888,15 @@ function assertManagedAgentBridge(agent, options = {}) {
     throw new Error(`NATIVE_SKILL_DRIFT: ${error.message}`);
   }
   const inventory = inventoryNativeSkills(home, { includeVendor: true, guardHermes: agent === "hermes", projectDirs: [...roots], agentRoots: discovery.roots.map((path) => ({ agent, path })), allowRootAliases: aliases.length > 0 });
-  if (inventory.some((entry) => visible(entry) && !entry.bridge && !disabledBuiltin(entry)))
-    throw new Error("NATIVE_SKILL_DRIFT: unexpected native skill copies were found; review skills migrate native --include-unmanaged --include-vendor before continuing");
+  const unexpected = inventory.filter((entry) => visible(entry) && !entry.bridge && !disabledBuiltin(entry));
+  if (unexpected.length) {
+    const paths = unexpected.slice(0, 3).map((entry) => {
+      const escaped = JSON.stringify(entry.path).replace(/[\u007f-\u009f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+      return escaped.length > 768 ? `${escaped.slice(0, 384)}...${escaped.slice(-381)}` : escaped;
+    });
+    const remaining = unexpected.length - paths.length;
+    throw new Error(`NATIVE_SKILL_DRIFT: ${unexpected.length} unexpected native skill copies were found: ${paths.join(", ")}${remaining ? `; ${remaining} more` : ""}. Review skills migrate native --project <working-directory> --include-unmanaged --include-vendor --json before continuing; it inventories that directory and its ancestors. Use --apply after reviewing the archive plan.`);
+  }
   recheckRootAliases(aliases);
 }
 function normalizeAgentHookPrompt(agent, event, prompt) {
@@ -105564,10 +105624,10 @@ function registerAgentIntegration(parent) {
     }
   });
   const migrate = parent.command("migrate").description("Preserve and retire native agent skill copies");
-  migrate.command("native").option("--project <directory>", "Also inventory native skills in a project directory").option("--include-unmanaged", "Archive user-authored skills as well as Skills-managed copies", false).option("--include-vendor", "Retire vendor SKILL.md discovery files while preserving plugin scripts and assets", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Move selected skills to private archives outside agent discovery roots", false).option("--json", "Output inventory and archive receipt as JSON", false).description("Inventory native skill copies; preserve complete directories before retiring them").action(async (options) => {
+  migrate.command("native").option("--project <directory>", "Also inventory a project and its ancestors (the current directory and its ancestors are always included)").option("--include-unmanaged", "Archive user-authored skills as well as Skills-managed copies", false).option("--include-vendor", "Retire vendor SKILL.md discovery files while preserving plugin scripts and assets", false).option("--discovery-inputs <file>", "Advanced reviewed active plugin roots and source hashes").option("--allow-root-aliases", "Allow home .claude/.codex aliases to existing directories within this home", false).option("--apply", "Move selected skills to private archives outside agent discovery roots", false).option("--json", "Output inventory and archive receipt as JSON", false).description("Inventory native skill copies; preserve complete directories before retiring them").action(async (options) => {
     try {
       const discoveryInputs = options.discoveryInputs ? JSON.parse(readFileSync37(options.discoveryInputs, "utf8")) : undefined;
-      const inventory = inventoryNativeSkills(undefined, { projectDir: options.project, includeVendor: options.includeVendor, configured: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases });
+      const inventory = inventoryNativeSkills(undefined, { projectDirs: [process.cwd(), ...options.project ? [options.project] : []], includeVendor: options.includeVendor, configured: options.includeVendor, discoveryInputs, allowRootAliases: options.allowRootAliases });
       const result2 = options.apply ? archiveNativeSkills(inventory, { includeUnmanaged: options.includeUnmanaged, includeVendor: options.includeVendor, allowRootAliases: options.allowRootAliases }) : { entries: [] };
       if (options.json)
         await writeCliOutput(JSON.stringify({ applied: options.apply, inventory, ...result2 }));

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.6",
+    version: "0.8.8",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36478,6 +36478,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join7(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync3(current);
+    } catch {
+      add(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -36713,10 +36742,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join7(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join7(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync4(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync4(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync4(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync4(join7(srcDir, "index.ts")) && !existsSync4(join7(srcDir, "index.js"))) {
@@ -38176,7 +38217,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -83749,7 +83749,7 @@ var require_protocols9 = __commonJS((exports) => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -76168,7 +76168,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -7376,6 +7376,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join4(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync(current);
+    } catch {
+      add(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -7611,10 +7640,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join4(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join4(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync4(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync4(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync4(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync4(join4(srcDir, "index.ts")) && !existsSync4(join4(srcDir, "index.js"))) {
@@ -9146,7 +9187,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))
@@ -11648,11 +11693,26 @@ function treeHash(root) {
   visit2(root);
   return hash2.digest("hex");
 }
+function projectAncestorDirectories(projects) {
+  const directories = new Set;
+  for (const project of projects) {
+    for (let path = resolve9(project), depth = 0;; depth++) {
+      if (depth >= 100)
+        throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
+      directories.add(path);
+      const parent = dirname10(path);
+      if (parent === path)
+        break;
+      path = parent;
+    }
+  }
+  return [...directories];
+}
 function inventoryNativeSkills(home = homedir2(), options = {}) {
   const aliases = rootAliases(home, options.allowRootAliases);
   const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join17(home, path), aliases)]);
   const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join17(home, adapter.root, CLI_BRIDGE_NAME), aliases));
-  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve9(path)))) {
+  for (const project of projectAncestorDirectories([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []])) {
     for (const [agent, path] of ROOTS)
       roots.push([agent, canonicalAgentPath(join17(project, path), aliases)]);
   }
@@ -11755,6 +11815,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"])
       scanRoot(agent, canonicalAgentPath(join17(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+    scanRoot("claude", canonicalAgentPath(join17(home, ".claude", "plugins", "synced"), aliases), true);
     scanRoot("gemini", join17(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
@@ -11819,6 +11880,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
     config.permissions.deny = nativeReady ? denied.filter((rule) => rule !== "Skill") : [...new Set([...denied, "Skill"])];
     config.permissions.allow = nativeReady ? [...new Set([...allowed, `Skill(${CLI_BRIDGE_NAME})`])] : allowed;
     config.disableBundledSkills = true;
+    config.syncClaudeAiSkills = false;
   }
   if (agent === "gemini") {
     config.skills ??= {};
@@ -37660,7 +37722,7 @@ import { dirname as dirname14, relative as relative7 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/sdk/index.js

@@ -96141,7 +96141,7 @@ async function resolveExecutionGrant(input) {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.8",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -97782,11 +97782,26 @@ function treeHash(root) {
   visit2(root);
   return hash2.digest("hex");
 }
+function projectAncestorDirectories(projects) {
+  const directories = new Set;
+  for (const project of projects) {
+    for (let path = resolve8(project), depth = 0;; depth++) {
+      if (depth >= 100)
+        throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
+      directories.add(path);
+      const parent = dirname9(path);
+      if (parent === path)
+        break;
+      path = parent;
+    }
+  }
+  return [...directories];
+}
 function inventoryNativeSkills(home = homedir2(), options = {}) {
   const aliases = rootAliases(home, options.allowRootAliases);
   const roots = ROOTS.map(([agent, path]) => [agent, canonicalAgentPath(join16(home, path), aliases)]);
   const bridgePaths = Object.values(AGENT_ADAPTERS).map((adapter) => canonicalAgentPath(join16(home, adapter.root, CLI_BRIDGE_NAME), aliases));
-  for (const project of new Set([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []].map((path) => resolve8(path)))) {
+  for (const project of projectAncestorDirectories([...options.projectDirs ?? [], ...options.projectDir ? [options.projectDir] : []])) {
     for (const [agent, path] of ROOTS)
       roots.push([agent, canonicalAgentPath(join16(project, path), aliases)]);
   }
@@ -97889,6 +97904,7 @@ function inventoryNativeSkills(home = homedir2(), options = {}) {
   if (options.includeVendor) {
     for (const agent of ["codex", "claude"])
       scanRoot(agent, canonicalAgentPath(join16(home, `.${agent}`, "plugins", "cache"), aliases), true, true);
+    scanRoot("claude", canonicalAgentPath(join16(home, ".claude", "plugins", "synced"), aliases), true);
     scanRoot("gemini", join16(home, ".gemini", "extensions"), true);
   }
   const configured = options.configured ? INTEGRATION_AGENTS.flatMap((agent) => resolveAgentDiscovery({ home, agent, reviewed: options.discoveryInputs, canonical: (path) => canonicalAgentPath(path, aliases) }).roots.map((path) => ({ agent, path }))) : [];
@@ -97953,6 +97969,7 @@ function configureHooks(config, agent, command, profileId, nativeReady) {
     config.permissions.deny = nativeReady ? denied.filter((rule) => rule !== "Skill") : [...new Set([...denied, "Skill"])];
     config.permissions.allow = nativeReady ? [...new Set([...allowed, `Skill(${CLI_BRIDGE_NAME})`])] : allowed;
     config.disableBundledSkills = true;
+    config.syncClaudeAiSkills = false;
   }
   if (agent === "gemini") {
     config.skills ??= {};
@@ -98480,6 +98497,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join18(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync13(current);
+    } catch {
+      add(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -98715,10 +98761,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join18(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join18(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync6(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync6(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync6(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync6(join18(srcDir, "index.ts")) && !existsSync6(join18(srcDir, "index.js"))) {
@@ -100216,7 +100274,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.8.6",
+  "version": "0.8.8",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {