@hasna/skills 0.9.10 → 0.9.11

package/dist/index.js

@@ -9657,7 +9657,7 @@ import { homedir as homedir5 } from "os";
 import {
   cpSync as cpSync2,
   existsSync as existsSync12,
-  lstatSync as lstatSync19,
+  lstatSync as lstatSync20,
   mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync2,
   readFileSync as readFileSync15,
@@ -9665,15 +9665,15 @@ import {
   renameSync as renameSync5,
   rmSync as rmSync3,
   statSync as statSync9,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename9, dirname as dirname16, join as join26 } from "path";
+import { basename as basename9, dirname as dirname17, join as join26 } from "path";
 
 // src/lib/agent-integration.ts
-import { createHash as createHash14, randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync11, lstatSync as lstatSync18, statSync as statSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync14, readdirSync as readdirSync10, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync5, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, chmodSync, openSync as openSync11, closeSync as closeSync11, fsyncSync as fsyncSync3, fstatSync as fstatSync11, readSync as readSync9, constants as constants10, linkSync as linkSync2 } from "fs";
-import { dirname as dirname15, join as join25, resolve as resolve15, relative as relative5, isAbsolute as isAbsolute15, sep as sep6 } from "path";
+import { createHash as createHash16, randomUUID as randomUUID3 } from "crypto";
+import { existsSync as existsSync11, lstatSync as lstatSync19, statSync as statSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync14, readdirSync as readdirSync10, opendirSync as opendirSync5, readlinkSync as readlinkSync2, realpathSync as realpathSync5, renameSync as renameSync4, rmdirSync as rmdirSync3, writeFileSync as writeFileSync6, unlinkSync as unlinkSync4, chmodSync, openSync as openSync12, closeSync as closeSync12, fsyncSync as fsyncSync4, fstatSync as fstatSync12, readSync as readSync10, constants as constants11, linkSync as linkSync2 } from "fs";
+import { dirname as dirname16, join as join25, resolve as resolve15, relative as relative5, isAbsolute as isAbsolute15, sep as sep6 } from "path";
 import { homedir as homedir3 } from "os";
 
 // src/lib/managed-policy.ts
@@ -10970,9 +10970,9 @@ function isOwnedCliBridge(path, expectedPaths) {
 }
 
 // src/lib/agent-discovery.ts
-import { createHash as createHash13 } from "crypto";
-import { lstatSync as lstatSync17, readFileSync as readFileSync13, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
-import { basename as basename8, dirname as dirname14, isAbsolute as isAbsolute14, join as join23, resolve as resolve14, sep as sep5 } from "path";
+import { createHash as createHash15 } from "crypto";
+import { lstatSync as lstatSync18, readFileSync as readFileSync13, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
+import { basename as basename8, dirname as dirname15, isAbsolute as isAbsolute14, join as join23, resolve as resolve14, sep as sep5 } from "path";
 
 // node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -11448,7 +11448,7 @@ import { isAbsolute as isAbsolute10, join as join20, resolve as resolve10 } from
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.9.10",
+  version: "0.9.11",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -15161,8 +15161,76 @@ function captureClaudeSettings(path, budget = { remaining: 256 * 1024 * 1024 })
   return { path, hashMode: "claude-settings-v1", sha256: settingsDigest(readSettings(path, budget)) };
 }
 
+// src/lib/codex-hook-discovery-recovery.ts
+import { createHash as createHash14 } from "crypto";
+
+// src/lib/codex-hook-trust-files.ts
+import { closeSync as closeSync11, constants as constants10, fstatSync as fstatSync11, fsyncSync as fsyncSync3, lstatSync as lstatSync17, openSync as openSync11, readSync as readSync9, writeFileSync as writeFileSync5 } from "fs";
+import { createHash as createHash13 } from "crypto";
+import { dirname as dirname14 } from "path";
+function need4(value, code) {
+  if (!value)
+    throw new Error(`CODEX_HOOK_TRUST_${code}`);
+}
+var sameStat = (a, b) => ["dev", "ino", "uid", "nlink", "mode", "size", "mtimeNs", "ctimeNs"].every((key) => a[key] === b[key]);
+function safeParents(file) {
+  for (let p = dirname14(file);; p = dirname14(p)) {
+    const s = lstatSync17(p);
+    need4(s.isDirectory() && !s.isSymbolicLink(), "UNSAFE_PARENT");
+    need4((s.mode & 18) === 0 || s.uid === 0 && (s.mode & 512) !== 0, "UNSAFE_PARENT");
+    if (dirname14(p) === p)
+      break;
+  }
+}
+function snapshot(file, privateFile = false, options = {}) {
+  const readOnlyPackage = options.readOnlyPackage === true && !privateFile;
+  safeParents(file);
+  const initial = lstatSync17(file, { bigint: true });
+  need4(initial.isFile() && initial.uid === BigInt(process.getuid()) && (initial.nlink === 1n || readOnlyPackage && initial.nlink > 1n) && (initial.mode & 0o022n) === 0n && (!privateFile || (initial.mode & 0o777n) === 0o600n), "UNSAFE_FILE");
+  need4(initial.size <= 8n * 1024n * 1024n, "FILE_BOUND");
+  const fd = openSync11(file, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  try {
+    const before = fstatSync11(fd, { bigint: true });
+    need4(sameStat(initial, before), "INPUT_CHANGED");
+    const bytes = Buffer.alloc(Number(before.size) + 1);
+    let length = 0;
+    while (length < bytes.length) {
+      const n2 = readSync9(fd, bytes, length, bytes.length - length, null);
+      if (!n2)
+        break;
+      length += n2;
+    }
+    need4(length === Number(before.size) && sameStat(before, fstatSync11(fd, { bigint: true })) && sameStat(before, lstatSync17(file, { bigint: true })), "INPUT_CHANGED");
+    const content = bytes.subarray(0, length), text2 = new TextDecoder("utf-8", { fatal: true }).decode(content);
+    return { file, privateFile, readOnlyPackage, text: text2, bytes: content, stat: before, sha256: createHash13("sha256").update(content).digest("hex") };
+  } finally {
+    closeSync11(fd);
+  }
+}
+function unchanged2(before) {
+  const after = snapshot(before.file, before.privateFile, before.readOnlyPackage ? { readOnlyPackage: true } : {});
+  need4(sameStat(before.stat, after.stat) && after.sha256 === before.sha256, "INPUT_CHANGED");
+}
+
+// src/lib/codex-hook-discovery-recovery.ts
+var sha = (text2) => createHash14("sha256").update(text2).digest("hex");
+var proofs = new WeakMap;
+function assertCodexHookDiscoveryRecovery(binding, witness) {
+  const proof = proofs.get(witness);
+  need4(!!proof && binding.agent === "codex" && witness.discoverySha256 === sha(JSON.stringify(binding)), "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  unchanged2(proof.before);
+  unchanged2(proof.current);
+}
+function verifiesCodexHookDiscoverySource(binding, source, currentDigest, witness) {
+  if (!witness || source.path !== witness.configPath || source.hashMode !== "bytes")
+    return false;
+  assertCodexHookDiscoveryRecovery(binding, witness);
+  need4(source.sha256 === witness.beforeSha256 && currentDigest === witness.currentSha256, "RECONCILE_DISCOVERY_RECOVERY_CHANGED");
+  return true;
+}
+
 // src/lib/agent-discovery.ts
-var digest = (text2) => createHash13("sha256").update(text2).digest("hex");
+var digest = (text2) => createHash15("sha256").update(text2).digest("hex");
 function parseConfig(text2, path, toml = false) {
   try {
     const value = toml ? Bun.TOML.parse(text2) : JSON.parse(text2);
@@ -15176,10 +15244,10 @@ function parseConfig(text2, path, toml = false) {
 function safe4(path) {
   if (!isAbsolute14(path) || path.includes("\x00"))
     throw new Error("Expected an absolute native discovery path");
-  for (let cursor = path;; cursor = dirname14(cursor)) {
-    if (lstatSync17(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+  for (let cursor = path;; cursor = dirname15(cursor)) {
+    if (lstatSync18(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink native discovery input: ${cursor}`);
-    if (dirname14(cursor) === cursor)
+    if (dirname15(cursor) === cursor)
       break;
   }
 }
@@ -15187,7 +15255,7 @@ function read(path, changes) {
   safe4(path);
   if (changes?.has(path))
     return changes.get(path);
-  const stat2 = lstatSync17(path, { throwIfNoEntry: false });
+  const stat2 = lstatSync18(path, { throwIfNoEntry: false });
   if (!stat2)
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
@@ -15237,7 +15305,9 @@ function projected(source, changes, budget = discoveryByteBudget()) {
     throw new Error("Expected native discovery configuration object");
   return digest(JSON.stringify(Object.fromEntries((source.fields ?? []).map((field2) => [field2, object4[field2] ?? null]))));
 }
-function verifyAgentDiscovery(binding) {
+function verifyAgentDiscovery(binding, codexRecovery) {
+  if (codexRecovery)
+    assertCodexHookDiscoveryRecovery(binding, codexRecovery);
   if (!binding || !Array.isArray(binding.sources) || !Array.isArray(binding.roots) || binding.sources.length > AGENT_POLICY_LIMITS.discoverySources || binding.roots.length > AGENT_POLICY_LIMITS.discoveryRoots)
     throw new Error("Invalid native discovery binding");
   if (binding.agent === "hermes" && !binding.directories?.length)
@@ -15253,7 +15323,8 @@ function verifyAgentDiscovery(binding) {
       throw new Error("Invalid native discovery projection");
     if (source.sha256 !== null && !/^[a-f0-9]{64}$/.test(source.sha256))
       throw new Error("Invalid native discovery digest");
-    if (projected(source, undefined, budget) !== source.sha256)
+    const current = projected(source, undefined, budget);
+    if (current !== source.sha256 && !verifiesCodexHookDiscoverySource(binding, source, current, codexRecovery))
       throw new Error(`Native discovery input changed; run skills hook install with a fresh discovery review: ${source.path}`);
   }
   for (const root2 of binding.roots)
@@ -15325,21 +15396,21 @@ function resolveAgentDiscovery(options) {
     const executable = Bun.which("gemini");
     if (executable) {
       let packageRoot;
-      for (let directory = dirname14(realpathSync4(executable)), depth = 0;depth < 8; directory = dirname14(directory), depth++) {
+      for (let directory = dirname15(realpathSync4(executable)), depth = 0;depth < 8; directory = dirname15(directory), depth++) {
         const path = join23(directory, "package.json"), raw = read(path);
         if (raw !== null && parseConfig(raw, path).name === "@google/gemini-cli") {
           packageRoot = directory;
           witness(path);
           break;
         }
-        if (dirname14(directory) === directory)
+        if (dirname15(directory) === directory)
           break;
       }
       if (!packageRoot)
         unresolved("installed Gemini package layout is not recognized");
       const builtinRoot = join23(packageRoot, "bundle/builtin");
       safe4(builtinRoot);
-      if (!lstatSync17(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
+      if (!lstatSync18(builtinRoot, { throwIfNoEntry: false })?.isDirectory())
         unresolved("installed Gemini builtin root is missing");
       for (const name of readdirSync9(builtinRoot).sort()) {
         const text2 = witness(join23(builtinRoot, name, "SKILL.md"));
@@ -15379,7 +15450,7 @@ function resolveAgentDiscovery(options) {
       unresolved("plugin hooks require a separate no-skill-injection review");
     const commands = join23(root2, "commands");
     safe4(commands);
-    if (agent === "claude" && (manifest.commands !== undefined || lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
+    if (agent === "claude" && (manifest.commands !== undefined || lstatSync18(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length))
       unresolved("legacy command discovery requires retirement or a dedicated format adapter");
     const rootSkill = witness(join23(root2, "SKILL.md"));
     if (rootSkill !== null)
@@ -15393,7 +15464,7 @@ function resolveAgentDiscovery(options) {
       const path = resolve14(root2, value);
       if (path !== root2 && !path.startsWith(root2 + sep5))
         unresolved("plugin skill path escapes its root");
-      roots.add(path.endsWith(`${sep5}SKILL.md`) ? dirname14(path) : path);
+      roots.add(path.endsWith(`${sep5}SKILL.md`) ? dirname15(path) : path);
     }
   }
   if (agent === "claude") {
@@ -15401,7 +15472,7 @@ function resolveAgentDiscovery(options) {
     const installed = registrations === null ? {} : parseConfig(registrations, join23(home, ".claude/plugins/installed_plugins.json")).plugins;
     const commands = canonical4(join23(home, ".claude/commands"));
     safe4(commands);
-    if (lstatSync17(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
+    if (lstatSync18(commands, { throwIfNoEntry: false })?.isDirectory() && readdirSync9(commands).length)
       unresolved("legacy home command discovery requires a dedicated format adapter");
     for (const [id, enabled] of Object.entries(config.enabledPlugins ?? {})) {
       if (enabled === false)
@@ -15443,12 +15514,12 @@ function resolveAgentDiscovery(options) {
     }
     const localPlugins = join23(home, ".config/opencode/plugins");
     safe4(localPlugins);
-    if (lstatSync17(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
+    if (lstatSync18(localPlugins, { throwIfNoEntry: false }) && readdirSync9(localPlugins).some((name) => name !== "skills-cli.js"))
       unresolved("additional local plugin hooks require review");
   } else if (agent === "hermes") {
     for (const directory of [join23(home, ".hermes/plugins"), join23(home, ".hermes/hermes-agent")]) {
       safe4(directory);
-      if (lstatSync17(directory, { throwIfNoEntry: false }))
+      if (lstatSync18(directory, { throwIfNoEntry: false }))
         unresolved("installed runtime/plugin discovery requires reviewed source bindings");
     }
     if (Bun.which("hermes") || Object.keys(config.plugins ?? {}).length)
@@ -15458,11 +15529,11 @@ function resolveAgentDiscovery(options) {
       unresolved("custom extension or skill paths");
     const directory = join23(home, ".gemini/extensions");
     safe4(directory);
-    if (lstatSync17(directory, { throwIfNoEntry: false }))
+    if (lstatSync18(directory, { throwIfNoEntry: false }))
       for (const name of readdirSync9(directory)) {
         const root2 = join23(directory, name);
         safe4(root2);
-        if (!lstatSync17(root2)?.isDirectory())
+        if (!lstatSync18(root2)?.isDirectory())
           continue;
         const raw = witness(join23(root2, "gemini-extension.json"));
         if (raw === null)
@@ -15617,7 +15688,7 @@ function disableCodexBundledSkills(text2) {
 }
 
 // src/lib/agent-integration.ts
-var sha = (data) => createHash14("sha256").update(data).digest("hex");
+var sha2 = (data) => createHash16("sha256").update(data).digest("hex");
 var ROOTS = [
   ["claude", ".claude/skills"],
   ["codex", ".codex/skills"],
@@ -15638,9 +15709,9 @@ var ROOTS = [
 function assertSafePath(path) {
   let cursor = resolve15(path);
   while (true) {
-    if (lstatSync18(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync19(cursor, { throwIfNoEntry: false })?.isSymbolicLink())
       throw new Error(`Refusing symlink path: ${cursor}`);
-    const parent = dirname15(cursor);
+    const parent = dirname16(cursor);
     if (parent === cursor)
       return;
     cursor = parent;
@@ -15649,12 +15720,12 @@ function assertSafePath(path) {
 function readRootAlias(home, agent) {
   assertSafePath(home);
   const realHome = realpathSync5(home), alias = join25(realHome, `.${agent}`);
-  const stat2 = lstatSync18(alias, { throwIfNoEntry: false, bigint: true });
+  const stat2 = lstatSync19(alias, { throwIfNoEntry: false, bigint: true });
   if (!stat2?.isSymbolicLink())
     throw new Error(`Agent root alias changed after planning: ${alias}`);
-  const link = readlinkSync2(alias), targetPath = resolve15(dirname15(alias), link);
+  const link = readlinkSync2(alias), targetPath = resolve15(dirname16(alias), link);
   assertSafePath(targetPath);
-  const targetStat = lstatSync18(targetPath, { throwIfNoEntry: false });
+  const targetStat = lstatSync19(targetPath, { throwIfNoEntry: false });
   if (!targetStat?.isDirectory())
     throw new Error(`Agent root alias must target an existing directory: ${alias}`);
   const target = realpathSync5(targetPath), inside = relative5(realHome, target);
@@ -15667,7 +15738,7 @@ function rootAliases(home, allowed = false) {
     return [];
   const result = [];
   for (const agent of ["claude", "codex"])
-    if (lstatSync18(join25(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
+    if (lstatSync19(join25(home, `.${agent}`), { throwIfNoEntry: false })?.isSymbolicLink())
       result.push(readRootAlias(home, agent));
   if (result.some((item, index) => result.slice(index + 1).some((other) => item.target === other.target || item.target.startsWith(other.target + sep6) || other.target.startsWith(item.target + sep6))))
     throw new Error("Agent root alias targets must not overlap");
@@ -15688,35 +15759,35 @@ function recheckRootAliases(aliases) {
 }
 function readNativeBytes(path, maximum = 64 * 1024 * 1024) {
   assertSafePath(path);
-  const before = lstatSync18(path);
+  const before = lstatSync19(path);
   if (!before.isFile() || before.size > maximum)
     throw new Error("Unsupported or oversized native skill file");
-  const descriptor = openSync11(path, constants10.O_RDONLY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  const descriptor = openSync12(path, constants11.O_RDONLY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
   try {
-    const opened = fstatSync11(descriptor);
+    const opened = fstatSync12(descriptor);
     if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino || opened.size !== before.size)
       throw new Error("Native skill file changed while reading");
     const bytes = Buffer.allocUnsafe(before.size + 1);
     let length = 0;
     while (length < bytes.length) {
-      const count = readSync9(descriptor, bytes, length, bytes.length - length, null);
+      const count = readSync10(descriptor, bytes, length, bytes.length - length, null);
       if (!count)
         break;
       length += count;
     }
-    const after = fstatSync11(descriptor);
+    const after = fstatSync12(descriptor);
     if (length !== before.size || after.size !== before.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs)
       throw new Error("Native skill file changed while reading");
     return bytes.subarray(0, length);
   } finally {
-    closeSync11(descriptor);
+    closeSync12(descriptor);
   }
 }
 function treeHash(root2) {
-  const hash2 = createHash14("sha256");
+  const hash2 = createHash16("sha256");
   let bytes = 0, files = 0;
   function visit2(path) {
-    const stat2 = lstatSync18(path);
+    const stat2 = lstatSync19(path);
     if (stat2.isSymbolicLink())
       throw new Error(`Refusing symlink in skill: ${path}`);
     const rel = relative5(root2, path);
@@ -15746,7 +15817,7 @@ function selectNativeMigrationTargets(inventory, manifest) {
   const selected = [];
   for (const target of manifest.targets) {
     const projectRoot = resolve15(target.projectRoot), normalized = relative5(projectRoot, resolve15(projectRoot, target.path));
-    if (!isAbsolute15(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync11(projectRoot) || !lstatSync18(projectRoot).isDirectory())
+    if (!isAbsolute15(target.projectRoot) || projectRoot !== target.projectRoot || !existsSync11(projectRoot) || !lstatSync19(projectRoot).isDirectory())
       throw new Error(`Native migration target project root must be an existing absolute directory: ${target.projectRoot}`);
     assertSafePath(projectRoot);
     if (isAbsolute15(target.path) || target.path.includes("\\") || target.path.includes("\x00") || !normalized || normalized === ".." || normalized.startsWith(`..${sep6}`) || normalized !== target.path || !/^[0-9a-f]{64}$/.test(target.treeSha256))
@@ -15775,7 +15846,7 @@ function projectAncestorDirectories(projects) {
       if (depth >= 100)
         throw new Error("NATIVE_SKILL_DRIFT: project ancestor discovery limit exceeded");
       directories.add(path);
-      const parent = dirname15(path);
+      const parent = dirname16(path);
       if (parent === path)
         break;
       path = parent;
@@ -15806,9 +15877,9 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
   }
   function emptySiblingCacheAlias(path, parent) {
     const link = readlinkSync2(path), target = resolve15(parent, link);
-    if (dirname15(target) !== parent || (isAbsolute15(link) ? link !== target : dirname15(link) !== "."))
+    if (dirname16(target) !== parent || (isAbsolute15(link) ? link !== target : dirname16(link) !== "."))
       return false;
-    if (!lstatSync18(target, { throwIfNoEntry: false })?.isDirectory())
+    if (!lstatSync19(target, { throwIfNoEntry: false })?.isDirectory())
       return false;
     const scan = cacheScans.get(target);
     return Boolean(scan?.complete && !scan.hasSkills && scan.entries <= maxAliasProofEntries);
@@ -15820,7 +15891,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
     assertSafePath(path);
     if (!existsSync11(path))
       return scan;
-    const stat2 = lstatSync18(path);
+    const stat2 = lstatSync19(path);
     if (stat2.isFile())
       return scan;
     if (!stat2.isDirectory())
@@ -15866,7 +15937,7 @@ function inventoryNativeSkills(home = homedir3(), options = {}) {
       if (isVendor && !options.includeVendor)
         continue;
       const child = join25(path, name);
-      if (isVendor && lstatSync18(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      if (isVendor && lstatSync19(child, { throwIfNoEntry: false })?.isSymbolicLink()) {
         const target = statSync8(child, { throwIfNoEntry: false });
         if (target?.isFile() || pluginCache && target?.isDirectory() && emptySiblingCacheAlias(child, path)) {
           scan.entries++;
@@ -16076,7 +16147,7 @@ function planAgentIntegration(options) {
         throw new Error("Refusing to overwrite an unrecognized Hermes supervisor");
       if (supervisorBefore !== supervisorAfter)
         changes.push({ path: supervisorPath, before: supervisorBefore, after: supervisorAfter });
-      const supervisor = { path: supervisorPath, runtime: process.execPath, sha256: sha(supervisorAfter) };
+      const supervisor = { path: supervisorPath, runtime: process.execPath, sha256: sha2(supervisorAfter) };
       const after2 = configureHermesHooks(before, supervisor, previous);
       if (before !== after2)
         changes.push({ path, before, after: after2 });
@@ -16123,7 +16194,7 @@ function planAgentIntegration(options) {
     agents: [...new Set([...priorAgents, ...options.agents])].sort(),
     home: resolve15(home),
     includeVendor: true,
-    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join25(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
+    ...options.agents.includes("hermes") ? { supervisors: { ...policy.bridge?.supervisors, hermes: { path: join25(dataDir2, "agent-hooks", "hermes.js"), runtime: process.execPath, sha256: sha2(renderHermesSupervisor(bindings.get("hermes").command, bindings.get("hermes").profileId)) } } } : {},
     commands: { ...policy.bridge?.commands, ...Object.fromEntries([...bindings].map(([agent, binding]) => [agent, binding.command])) },
     profiles: Object.fromEntries([...new Set([...priorAgents, ...options.agents])].sort().map((agent) => [agent, bindings.get(agent)?.profileId ?? policy.bridge?.profiles?.[agent] ?? policy.profileId])),
     disabledBuiltins: options.agents.includes("codex") ? nativeSkills.filter((entry) => entry.agent === "codex" && entry.vendor && entry.path.startsWith(canonicalAgentPath(join25(home, ".codex", "skills", ".system"), aliases) + sep6)).map((entry) => ({ path: entry.path, hash: entry.hash })) : policy.bridge?.disabledBuiltins ?? [],
@@ -16138,10 +16209,10 @@ function planAgentIntegration(options) {
 }
 function atomicWrite2(path, content) {
   assertSafePath(path);
-  mkdirSync7(dirname15(path), { recursive: true, mode: 448 });
+  mkdirSync7(dirname16(path), { recursive: true, mode: 448 });
   const temporary = `${path}.skills-${randomUUID3()}`;
   try {
-    writeFileSync5(temporary, content, { mode: 384, flag: "wx" });
+    writeFileSync6(temporary, content, { mode: 384, flag: "wx" });
     renameSync4(temporary, path);
   } finally {
     if (existsSync11(temporary))
@@ -16175,8 +16246,8 @@ function applyAgentIntegration(plan) {
   chmodSync(backupRoot, 448);
   for (const [index, change] of plan.changes.entries())
     if (change.before !== null) {
-      const backup = join25(backupRoot, `${index}-${sha(change.path).slice(0, 12)}.backup`);
-      writeFileSync5(backup, change.before, { mode: 384, flag: "wx" });
+      const backup = join25(backupRoot, `${index}-${sha2(change.path).slice(0, 12)}.backup`);
+      writeFileSync6(backup, change.before, { mode: 384, flag: "wx" });
       backups.push(backup);
     }
   try {
@@ -16184,7 +16255,7 @@ function applyAgentIntegration(plan) {
       recheckRootAliases(aliases);
       if (currentText(change.path) !== change.before)
         throw new Error(`Configuration changed after planning: ${change.path}`);
-      for (let directory = dirname15(change.path);!existsSync11(directory); directory = dirname15(directory))
+      for (let directory = dirname16(change.path);!existsSync11(directory); directory = dirname16(directory))
         createdDirectories.add(directory);
       const after = change.after;
       atomicWrite2(change.path, after);
@@ -16193,7 +16264,7 @@ function applyAgentIntegration(plan) {
     recheckRootAliases(aliases);
     for (const binding of plan.discoveryAfter ?? [])
       verifyAgentDiscovery(binding);
-    atomicWrite2(join25(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha(change.before), afterHash: sha(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
+    atomicWrite2(join25(backupRoot, "receipt.json"), JSON.stringify({ version: 1, changes: written.map((change) => ({ path: change.path, beforeHash: change.before === null ? null : sha2(change.before), afterHash: sha2(change.after) })), backups, ...aliases.length ? { rootAliases: aliases } : {} }) + `
 `);
   } catch (error) {
     for (const change of written.reverse()) {
@@ -16224,11 +16295,11 @@ function applyAgentIntegration(plan) {
 }
 function syncArchiveDirectory(path) {
   assertSafePath(path);
-  const descriptor = openSync11(path, constants10.O_RDONLY | constants10.O_DIRECTORY | constants10.O_NOFOLLOW | constants10.O_NONBLOCK);
+  const descriptor = openSync12(path, constants11.O_RDONLY | constants11.O_DIRECTORY | constants11.O_NOFOLLOW | constants11.O_NONBLOCK);
   try {
-    fsyncSync3(descriptor);
+    fsyncSync4(descriptor);
   } finally {
-    closeSync11(descriptor);
+    closeSync12(descriptor);
   }
 }
 function writeArchiveJournal(path, value) {
@@ -16236,18 +16307,18 @@ function writeArchiveJournal(path, value) {
   const temporary = `${path}.skills-${randomUUID3()}`;
   let descriptor;
   try {
-    descriptor = openSync11(temporary, constants10.O_WRONLY | constants10.O_CREAT | constants10.O_EXCL | constants10.O_NOFOLLOW, 384);
-    writeFileSync5(descriptor, `${JSON.stringify(value)}
+    descriptor = openSync12(temporary, constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
+    writeFileSync6(descriptor, `${JSON.stringify(value)}
 `);
-    fsyncSync3(descriptor);
-    closeSync11(descriptor);
+    fsyncSync4(descriptor);
+    closeSync12(descriptor);
     descriptor = undefined;
     renameSync4(temporary, path);
-    syncArchiveDirectory(dirname15(path));
+    syncArchiveDirectory(dirname16(path));
   } finally {
     if (descriptor !== undefined)
-      closeSync11(descriptor);
-    if (lstatSync18(temporary, { throwIfNoEntry: false }))
+      closeSync12(descriptor);
+    if (lstatSync19(temporary, { throwIfNoEntry: false }))
       unlinkSync4(temporary);
   }
 }
@@ -16272,8 +16343,8 @@ function archiveNativeSkills(inventory, options) {
   const operationId = randomUUID3(), archiveRoot = join25(options.dataDir ?? getDataDir(), "migration", operationId, "native"), receiptPath = join25(archiveRoot, "receipt.json");
   const entries = selected.map((entry, index) => ({
     source: entry.vendor ? join25(entry.path, "SKILL.md") : entry.path,
-    archive: join25(archiveRoot, `${index}-${sha(entry.path).slice(0, 12)}`),
-    hash: entry.vendor ? sha(readNativeBytes(join25(entry.path, "SKILL.md"))) : entry.hash,
+    archive: join25(archiveRoot, `${index}-${sha2(entry.path).slice(0, 12)}`),
+    hash: entry.vendor ? sha2(readNativeBytes(join25(entry.path, "SKILL.md"))) : entry.hash,
     ...entry.vendor ? { discoveryOnly: true } : {},
     status: "planned"
   }));
@@ -16281,22 +16352,22 @@ function archiveNativeSkills(inventory, options) {
   const moved = [];
   const verifyArchive = (entry) => {
     assertSafePath(entry.archive);
-    const stat2 = lstatSync18(entry.archive);
+    const stat2 = lstatSync19(entry.archive);
     if (entry.discoveryOnly ? !stat2.isFile() : !stat2.isDirectory())
       throw new Error("Archive type changed");
-    if ((entry.discoveryOnly ? sha(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
+    if ((entry.discoveryOnly ? sha2(readNativeBytes(entry.archive)) : treeHash(entry.archive)) !== entry.hash)
       throw new Error("Archive bytes changed");
   };
   assertSafePath(archiveRoot);
   const created = [];
-  for (let path = archiveRoot;!existsSync11(path); path = dirname15(path))
+  for (let path = archiveRoot;!existsSync11(path); path = dirname16(path))
     created.push(path);
   mkdirSync7(archiveRoot, { recursive: true, mode: 448 });
   try {
     for (const directory of created)
       syncArchiveDirectory(directory);
     if (created.length)
-      syncArchiveDirectory(dirname15(created.at(-1)));
+      syncArchiveDirectory(dirname16(created.at(-1)));
     writeArchiveJournal(receiptPath, journal);
     for (const [index, entry] of selected.entries()) {
       recheckRootAliases(aliases);
@@ -16308,7 +16379,7 @@ function archiveNativeSkills(inventory, options) {
       writeArchiveJournal(receiptPath, journal);
       renameSync4(move.source, move.archive);
       moved.push(move);
-      syncArchiveDirectory(dirname15(move.source));
+      syncArchiveDirectory(dirname16(move.source));
       syncArchiveDirectory(archiveRoot);
       verifyArchive(move);
       move.status = "archived";
@@ -16329,7 +16400,7 @@ function archiveNativeSkills(inventory, options) {
         recheckRootAliases(aliases);
         assertSafePath(entry.source);
         assertSafePath(entry.archive);
-        if (lstatSync18(entry.source, { throwIfNoEntry: false })) {
+        if (lstatSync19(entry.source, { throwIfNoEntry: false })) {
           entry.status = "recovery-required";
           entry.conflict = "source-occupied";
           continue;
@@ -16343,10 +16414,10 @@ function archiveNativeSkills(inventory, options) {
         }
         if (entry.discoveryOnly) {
           linkSync2(entry.archive, entry.source);
-          syncArchiveDirectory(dirname15(entry.source));
+          syncArchiveDirectory(dirname16(entry.source));
           unlinkSync4(entry.archive);
         } else {
-          if (lstatSync18(entry.source, { throwIfNoEntry: false })) {
+          if (lstatSync19(entry.source, { throwIfNoEntry: false })) {
             entry.status = "recovery-required";
             entry.conflict = "source-occupied";
             continue;
@@ -16354,7 +16425,7 @@ function archiveNativeSkills(inventory, options) {
           renameSync4(entry.archive, entry.source);
         }
         entry.status = "restored";
-        syncArchiveDirectory(dirname15(entry.source));
+        syncArchiveDirectory(dirname16(entry.source));
         syncArchiveDirectory(archiveRoot);
       } catch {
         entry.status = "recovery-required";
@@ -16393,7 +16464,7 @@ function isSkillsOwnershipMarker(marker) {
 function hasSkillsOwnershipMarker(dir) {
   const path = join26(dir, SYNC_MARKER_FILE);
   try {
-    if (!lstatSync19(path).isFile())
+    if (!lstatSync20(path).isFile())
       return false;
     const marker = JSON.parse(readFileSync15(path, "utf8"));
     return isSkillsOwnershipMarker(marker);
@@ -16619,7 +16690,7 @@ function writeManagedSkillDir(dir, skillMd, options) {
   const action = dirExists ? "update" : "create";
   if (options.dryRun)
     return { action, path: skillMdPath };
-  const parentDir = dirname16(dir);
+  const parentDir = dirname17(dir);
   mkdirSync8(parentDir, { recursive: true });
   const transactionDir = mkdtempSync2(join26(parentDir, `.hasna-skills-write-${basename9(dir)}-`));
   const candidateDir = join26(transactionDir, "candidate");
@@ -16641,10 +16712,10 @@ function writeManagedSkillDir(dir, skillMd, options) {
     } else {
       mkdirSync8(candidateDir, { recursive: true });
     }
-    writeFileSync6(candidateSkillMdPath, skillMd.endsWith(`
+    writeFileSync7(candidateSkillMdPath, skillMd.endsWith(`
 `) ? skillMd : `${skillMd}
 `);
-    writeFileSync6(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
+    writeFileSync7(candidateMarkerPath, `${JSON.stringify(marker, null, 2)}
 `);
     if (dirExists) {
       originalMoved = true;
@@ -16709,7 +16780,7 @@ function normalizeRequested(names) {
 }
 
 // src/lib/project-state.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync13, mkdirSync as mkdirSync9, readFileSync as readFileSync16, writeFileSync as writeFileSync8 } from "fs";
 import { join as join27 } from "path";
 var VALID_PIN_SOURCES = [
   "official",
@@ -16758,7 +16829,7 @@ function saveProjectConfig(config, targetDir = process.cwd()) {
   const dir = getProjectStateDir(targetDir);
   mkdirSync9(dir, { recursive: true });
   const normalized = normalizeProjectConfig({ ...config, updatedAt: new Date().toISOString() });
-  writeFileSync7(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
+  writeFileSync8(getProjectConfigPath(targetDir), JSON.stringify(normalized, null, 2) + `
 `);
 }
 function pinProjectSkill(name, details = {}, targetDir = process.cwd()) {
@@ -17110,8 +17181,8 @@ function loadProjectConfigCompat(targetDir) {
   return loadProjectConfig(targetDir);
 }
 // src/lib/run-state.ts
-import { createHash as createHash15, randomBytes } from "crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync18, readdirSync as readdirSync12, statSync as statSync10, writeFileSync as writeFileSync8 } from "fs";
+import { createHash as createHash17, randomBytes } from "crypto";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync18, readdirSync as readdirSync12, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
 import { extname, join as join29, relative as relative6 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
@@ -17176,15 +17247,15 @@ function updateSkillRun(context, patch) {
   return context.record;
 }
 function writeRunLogs(context, stdout = "", stderr = "") {
-  writeFileSync8(join29(context.logsDir, "stdout.log"), stdout);
-  writeFileSync8(join29(context.logsDir, "stderr.log"), stderr);
+  writeFileSync9(join29(context.logsDir, "stdout.log"), stdout);
+  writeFileSync9(join29(context.logsDir, "stderr.log"), stderr);
 }
 function appendRunEvent(context, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
   const path = join29(context.runDir, "events.ndjson");
   const previous = existsSync15(path) ? readFileSync18(path, "utf-8") : "";
-  writeFileSync8(path, previous + line);
+  writeFileSync9(path, previous + line);
 }
 function listSkillRuns(targetDir = process.cwd(), limit = 50) {
   const runsRoot = join29(getProjectStateDir(targetDir), "runs");
@@ -17220,11 +17291,11 @@ function getRunExportDir(runId, skill, targetDir = process.cwd()) {
   return join29(getProjectStateDir(targetDir), "exports", normalizeSkillName(skill), runId);
 }
 function writeRunRecord(context) {
-  writeFileSync8(join29(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
+  writeFileSync9(join29(context.runDir, "run.json"), JSON.stringify(context.record, null, 2) + `
 `);
 }
 function writeArtifactsManifest(context, artifacts) {
-  writeFileSync8(join29(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
+  writeFileSync9(join29(context.runDir, "artifacts.json"), JSON.stringify({ runId: context.record.id, artifacts }, null, 2) + `
 `);
 }
 function collectRunArtifacts(context) {
@@ -17237,7 +17308,7 @@ function collectRunArtifacts(context) {
     artifacts.push({
       path: toProjectRelative(context.targetDir, path),
       mime: mimeForPath(path),
-      sha256: createHash15("sha256").update(bytes).digest("hex"),
+      sha256: createHash17("sha256").update(bytes).digest("hex"),
       sizeBytes: stat2.size
     });
   }
@@ -36656,7 +36727,7 @@ function clone2(value) {
   return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
 }
 // src/lib/canonical-json.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 function canonicalJson2(value, maximumBytes = 2 * 1024 * 1024) {
   return canonicalJsonAtDepth(value, maximumBytes, 64);
 }
@@ -36700,7 +36771,7 @@ function canonicalJsonAtDepth(value, maximumBytes, maximumDepth) {
   return visit3(value, 0);
 }
 function canonicalJsonSha256(value, maximumBytes) {
-  return createHash16("sha256").update(canonicalJson2(value, maximumBytes)).digest("hex");
+  return createHash18("sha256").update(canonicalJson2(value, maximumBytes)).digest("hex");
 }
 
 // src/lib/remote-recurring-contract.ts
@@ -36843,8 +36914,8 @@ var inputs = {
 };
 function recurringInput(action, raw) {
   try {
-    const snapshot = JSON.parse(canonicalJson2(raw, action === "preview" ? 1048576 : 4096));
-    return inputs[action].parse(snapshot);
+    const snapshot2 = JSON.parse(canonicalJson2(raw, action === "preview" ? 1048576 : 4096));
+    return inputs[action].parse(snapshot2);
   } catch {
     throw new RecurringInputError;
   }
@@ -38750,7 +38821,7 @@ async function createRemoteSkillsClient(env = process.env) {
   return connection ? new RemoteSkillsClient(connection.apiKey, connection.apiOrigin) : null;
 }
 // src/lib/scheduler.ts
-import { existsSync as existsSync16, readFileSync as readFileSync19, writeFileSync as writeFileSync9, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync19, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "fs";
 import { join as join30 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join30(targetDir, ".skills", "schedules.json");
@@ -38769,7 +38840,7 @@ function saveSchedules(data, targetDir = process.cwd()) {
   const dir = join30(targetDir, ".skills");
   if (!existsSync16(dir))
     mkdirSync11(dir, { recursive: true });
-  writeFileSync9(path, JSON.stringify(data, null, 2));
+  writeFileSync10(path, JSON.stringify(data, null, 2));
 }
 function validateCronField(expr, min, max, label) {
   for (const part of expr.split(",")) {
@@ -38954,7 +39025,7 @@ function recordScheduleRun(id, status, targetDir) {
   saveSchedules(data, targetDir);
 }
 // src/lib/revision.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 var REVISION_ID_PATTERN = /^[0-9a-f]{64}$/;
 function revisionIdOf(content) {
   const canonicalContent = {
@@ -38976,14 +39047,14 @@ function revisionIdOf(content) {
     canonicalContent.replacementSlug = content.replacementSlug ?? null;
   }
   const canonical4 = JSON.stringify(canonicalContent);
-  return createHash17("sha256").update(canonical4).digest("hex");
+  return createHash19("sha256").update(canonical4).digest("hex");
 }
 function revisionIdOfRecord(record7) {
   return revisionIdOf(record7);
 }
 // src/lib/pull.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync20, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname17, join as join31 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync3, readFileSync as readFileSync20, renameSync as renameSync6, rmSync as rmSync5, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname18, join as join31 } from "path";
 
 // src/lib/skill-bundles.ts
 import { createHmac, timingSafeEqual } from "crypto";
@@ -39325,8 +39396,8 @@ function installBundleAtomically(name, entries, options = {}, marker = {}) {
   try {
     for (const entry of entries) {
       const destination = join31(staging, entry.path);
-      mkdirSync12(dirname17(destination), { recursive: true });
-      writeFileSync10(destination, entry.bytes, { mode: entry.mode });
+      mkdirSync12(dirname18(destination), { recursive: true });
+      writeFileSync11(destination, entry.bytes, { mode: entry.mode });
     }
     writePullMarker(staging, {
       skill: name,
@@ -39367,7 +39438,7 @@ function writePullMarker(dir, record7) {
     ...record7.revisionId ? { revisionId: record7.revisionId } : {},
     syncedAt: new Date().toISOString()
   };
-  writeFileSync10(join31(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
+  writeFileSync11(join31(dir, PULL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `);
 }
 async function safeMeta(client2, slug2) {
@@ -39517,7 +39588,7 @@ async function requestInvitationEmail(origin, action, input2) {
 }
 
 // src/lib/remote-private-publications.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 var PRIVATE_PUBLICATION_MAX_BYTES = 16 * 1024 * 1024;
 var failures2 = {
   INVALID_REQUEST: [400, "The publication request is invalid."],
@@ -39564,7 +39635,7 @@ var hash3 = (v) => typeof v === "string" && /^[a-f0-9]{64}$/.test(v);
 var record8 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var exact = (v, keys) => record8(v) && Object.keys(v).sort().join(",") === keys.sort().join(",");
 var date5 = (v) => typeof v === "string" && /^\d{4}-\d\d-\d\dT[0-9:.]+(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.test(v) && Number.isFinite(Date.parse(v));
-var publicationSha256 = (bytes) => createHash18("sha256").update(bytes).digest("hex");
+var publicationSha256 = (bytes) => createHash20("sha256").update(bytes).digest("hex");
 function checkedPublicationDeclaration(value) {
   if (!exact(value, ["idempotencyKey", "version", "expectedCurrentVersionId", "manifestText", "archiveSha256", "archiveByteSize"]) || !publicationUuid(value.idempotencyKey) || !(value.expectedCurrentVersionId === null || publicationUuid(value.expectedCurrentVersionId)) || typeof value.version !== "string" || !value.version || value.version.length > 128 || /[\p{Cc}\p{Cs}]/u.test(value.version) || typeof value.manifestText !== "string" || Buffer.byteLength(value.manifestText) > 16384 || !hash3(value.archiveSha256) || !Number.isSafeInteger(value.archiveByteSize) || Number(value.archiveByteSize) < 1 || Number(value.archiveByteSize) > PRIVATE_PUBLICATION_MAX_BYTES)
     return bad();
@@ -40048,7 +40119,7 @@ class RemoteSkillsAuthClient {
 
 // src/lib/recurring-recovery.ts
 var uuid12 = exports_external.string().regex(/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/);
-var sha2 = exports_external.string().regex(/^[a-f0-9]{64}$/);
+var sha3 = exports_external.string().regex(/^[a-f0-9]{64}$/);
 var common = exports_external.object({
   contractVersion: exports_external.literal(1),
   apiOrigin: exports_external.string().min(1).max(4096),
@@ -40061,7 +40132,7 @@ var intentSchema = exports_external.discriminatedUnion("operation", [
   common.extend({
     operation: exports_external.literal("activate"),
     draftId: uuid12,
-    termsSha256: sha2,
+    termsSha256: sha3,
     approvalDeadline: exports_external.string().datetime(),
     approval: recurringActivationSchema
   }).strict(),
@@ -40069,7 +40140,7 @@ var intentSchema = exports_external.discriminatedUnion("operation", [
 ]);
 var stateSchema = exports_external.object({
   contractVersion: exports_external.literal(1),
-  intentSha256: sha2,
+  intentSha256: sha3,
   phase: exports_external.enum(["prepared", "pending", "observed"]),
   consentId: uuid12.nullable()
 }).strict();
@@ -40228,8 +40299,8 @@ function findSkillsParityForMcpTool(tool) {
   return SKILLS_CLI_MCP_PARITY.find((entry) => entry.mcpTools.includes(tool));
 }
 // src/lib/registry-sync.ts
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname18, relative as relative7 } from "path";
+import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname19, relative as relative7 } from "path";
 function createRegistrySyncArtifact(options = {}) {
   const profile = options.profile ?? "all";
   const includeDocs = options.includeDocs ?? true;
@@ -40286,8 +40357,8 @@ function createRegistrySyncArtifact(options = {}) {
   };
 }
 function writeRegistrySyncArtifact(path, artifact) {
-  mkdirSync13(dirname18(path), { recursive: true });
-  writeFileSync11(path, `${JSON.stringify(artifact, null, 2)}
+  mkdirSync13(dirname19(path), { recursive: true });
+  writeFileSync12(path, `${JSON.stringify(artifact, null, 2)}
 `);
 }
 function buildDocs(name) {
@@ -41371,14 +41442,14 @@ function clone3(value) {
 }
 // src/lib/feedback.ts
 import { appendFileSync, existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
-import { dirname as dirname19, join as join32 } from "path";
+import { dirname as dirname20, join as join32 } from "path";
 import { Database } from "bun:sqlite";
 function getFeedbackDbPath() {
   return join32(getDataDir(), "skills.db");
 }
 function getFeedbackDb() {
   const dbPath = getFeedbackDbPath();
-  const dir = dirname19(dbPath);
+  const dir = dirname20(dbPath);
   if (!existsSync18(dir))
     mkdirSync14(dir, { recursive: true });
   const db = new Database(dbPath);
@@ -41407,7 +41478,7 @@ function saveFeedback(input2) {
   const category = input2.category ?? "general";
   if (isApiMode()) {
     const path = join32(getDataDir(), "feedback.jsonl");
-    const dir = dirname19(path);
+    const dir = dirname20(path);
     if (!existsSync18(dir))
       mkdirSync14(dir, { recursive: true });
     appendFileSync(path, JSON.stringify({ message, category, email: input2.email ?? null, agent: input2.agent ?? null, version: input2.version ?? null, createdAt: new Date().toISOString() }) + `
@@ -41430,16 +41501,16 @@ function isApiMode(env = process.env) {
   }
 }
 // src/lib/native-storage.ts
-import { createHash as createHash19, createHmac as createHmac2 } from "crypto";
+import { createHash as createHash21, createHmac as createHmac2 } from "crypto";
 import {
   existsSync as existsSync19,
   mkdirSync as mkdirSync15,
   readFileSync as readFileSync21,
   readdirSync as readdirSync13,
   statSync as statSync11,
-  writeFileSync as writeFileSync12
+  writeFileSync as writeFileSync13
 } from "fs";
-import { dirname as dirname20, join as join33, normalize as normalize3, relative as relative8, sep as sep7 } from "path";
+import { dirname as dirname21, join as join33, normalize as normalize3, relative as relative8, sep as sep7 } from "path";
 var SKILLS_STORAGE_TABLES = [
   "skills_sync_records",
   "skills_sync_cursors"
@@ -41606,7 +41677,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
       files.push({
         path: relativePath,
         sizeBytes: bytes.byteLength,
-        sha256: createHash19("sha256").update(bytes).digest("hex"),
+        sha256: createHash21("sha256").update(bytes).digest("hex"),
         ...options.includeFileContents ? { contentBase64: Buffer.from(bytes).toString("base64") } : {}
       });
     }
@@ -41617,10 +41688,10 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
     files: files.sort((a, b) => a.path.localeCompare(b.path))
   };
 }
-function importSkillsLocalSnapshot(snapshot, targetDir = process.cwd(), options = {}) {
+function importSkillsLocalSnapshot(snapshot2, targetDir = process.cwd(), options = {}) {
   let written = 0;
   let skipped = 0;
-  for (const file2 of snapshot.files) {
+  for (const file2 of snapshot2.files) {
     if (!file2.contentBase64) {
       skipped += 1;
       continue;
@@ -41631,12 +41702,12 @@ function importSkillsLocalSnapshot(snapshot, targetDir = process.cwd(), options
       continue;
     }
     const bytes = Buffer.from(file2.contentBase64, "base64");
-    const hash4 = createHash19("sha256").update(bytes).digest("hex");
+    const hash4 = createHash21("sha256").update(bytes).digest("hex");
     if (hash4 !== file2.sha256) {
       throw new Error(`Snapshot file checksum mismatch: ${file2.path}`);
     }
-    mkdirSync15(dirname20(absolutePath3), { recursive: true });
-    writeFileSync12(absolutePath3, bytes);
+    mkdirSync15(dirname21(absolutePath3), { recursive: true });
+    writeFileSync13(absolutePath3, bytes);
     written += 1;
   }
   return { written, skipped };
@@ -41733,14 +41804,14 @@ class SkillsPostgresSyncStore {
 function createSkillsPostgresSyncStore(client2) {
   return new SkillsPostgresSyncStore(client2);
 }
-function createSkillsSnapshotSyncRecord(snapshot, options = {}) {
+function createSkillsSnapshotSyncRecord(snapshot2, options = {}) {
   return {
     scope: options.scope ?? "default",
     kind: "local-snapshot",
     id: options.id ?? "project-state",
-    updatedAt: snapshot.exportedAt,
+    updatedAt: snapshot2.exportedAt,
     source: options.source ?? "skills",
-    payload: snapshot
+    payload: snapshot2
   };
 }
 
@@ -41824,18 +41895,18 @@ class SkillsS3ObjectStore {
 function createSkillsS3ObjectStore(options) {
   return new SkillsS3ObjectStore(options);
 }
-function planSkillsS3SnapshotUpload(snapshot, options = {}) {
+function planSkillsS3SnapshotUpload(snapshot2, options = {}) {
   const prefix = normalizeS3Prefix(options.prefix);
-  return snapshot.files.map((file2) => ({
+  return snapshot2.files.map((file2) => ({
     path: file2.path,
     key: [prefix, file2.path.replace(/^\.?\//, "")].filter(Boolean).join("/"),
     sizeBytes: file2.sizeBytes,
     sha256: file2.sha256
   }));
 }
-async function uploadSkillsSnapshotFilesToS3(snapshot, store) {
+async function uploadSkillsSnapshotFilesToS3(snapshot2, store) {
   const uploaded = [];
-  for (const file2 of snapshot.files) {
+  for (const file2 of snapshot2.files) {
     if (!file2.contentBase64)
       continue;
     uploaded.push(await store.putObject({
@@ -41963,7 +42034,7 @@ function toIsoString(value) {
   return Number.isNaN(date6.getTime()) ? value : date6.toISOString();
 }
 function sha256Hex2(value) {
-  return createHash19("sha256").update(value).digest("hex");
+  return createHash21("sha256").update(value).digest("hex");
 }
 function normalizeHeaders(headers) {
   const result = {};
@@ -42015,15 +42086,15 @@ function toArrayBuffer(bytes) {
   return buffer;
 }
 // src/lib/station-snapshot.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash22 } from "crypto";
 import {
   copyFileSync,
   mkdirSync as mkdirSync16,
   readFileSync as readFileSync23,
   statSync as statSync13,
-  writeFileSync as writeFileSync13
+  writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname21, isAbsolute as isAbsolute17, relative as relative9, resolve as resolve16, sep as sep9 } from "path";
+import { dirname as dirname22, isAbsolute as isAbsolute17, relative as relative9, resolve as resolve16, sep as sep9 } from "path";
 
 // src/lib/portable-snapshot-filter.ts
 import { readdirSync as readdirSync14, statSync as statSync12 } from "fs";
@@ -42190,7 +42261,7 @@ function validateStationId(stationId) {
   }
 }
 function sha256File(filePath) {
-  return createHash20("sha256").update(readFileSync23(filePath)).digest("hex");
+  return createHash22("sha256").update(readFileSync23(filePath)).digest("hex");
 }
 function scanHome(definition, homesRoot) {
   const homePath = homePathFor(definition, homesRoot);
@@ -42311,11 +42382,11 @@ function writeStationSnapshot(options) {
   let written = 0;
   for (const plan of untouched) {
     const destination = resolve16(repoRoot, plan.destination);
-    mkdirSync16(dirname21(destination), { recursive: true });
+    mkdirSync16(dirname22(destination), { recursive: true });
     copyFileSync(plan.source.fullPath, destination);
     written += 1;
   }
-  const unchanged2 = plans.length - untouched.length;
+  const unchanged3 = plans.length - untouched.length;
   const manifest = {
     schema: STATION_SYNC_MANIFEST_SCHEMA,
     stationId: options.stationId,
@@ -42323,34 +42394,34 @@ function writeStationSnapshot(options) {
     producer: STATION_SNAPSHOT_PRODUCER,
     stats: {
       written,
-      unchanged: unchanged2,
+      unchanged: unchanged3,
       files: plans.length,
       bytes: totalBytes
     },
     files: manifestFiles
   };
   const manifestPath = resolve16(repoRoot, "resources", options.stationId, "skills", "sync-manifest.json");
-  mkdirSync16(dirname21(manifestPath), { recursive: true });
-  writeFileSync13(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  mkdirSync16(dirname22(manifestPath), { recursive: true });
+  writeFileSync14(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return {
     ...base,
     mode: "populate",
-    stats: { files: plans.length, bytes: totalBytes, written, unchanged: unchanged2 },
+    stats: { files: plans.length, bytes: totalBytes, written, unchanged: unchanged3 },
     manifestPath
   };
 }
 // src/lib/station-hydrate.ts
-import { createHash as createHash21 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 import {
   copyFileSync as copyFileSync2,
   mkdirSync as mkdirSync17,
   readdirSync as readdirSync15,
   readFileSync as readFileSync25,
   statSync as statSync14,
-  writeFileSync as writeFileSync14
+  writeFileSync as writeFileSync15
 } from "fs";
-import { dirname as dirname22, join as join35, resolve as resolve17, sep as sep10 } from "path";
+import { dirname as dirname23, join as join35, resolve as resolve17, sep as sep10 } from "path";
 var STATION_HYDRATION_MANIFEST_SCHEMA = "hasna.fleet-resources.skills-hydration-manifest/v1";
 var STATION_HYDRATION_PRODUCER = { name: "@hasna/skills", version: package_default.version };
 var MANIFEST_HASH_KEY_SEP = String.fromCharCode(0);
@@ -42547,7 +42618,7 @@ function skillSha256(skill) {
     return sha256File(skill.files[0].winner.fullPath);
   }
   const joined = skill.files.map((file2) => sha256File(file2.winner.fullPath));
-  return createHash21("sha256").update(joined.sort().join(`
+  return createHash23("sha256").update(joined.sort().join(`
 `)).digest("hex");
 }
 function writeStationHydration(options) {
@@ -42606,11 +42677,11 @@ function writeStationHydration(options) {
   }
   let written = 0;
   for (const entry of toWrite) {
-    mkdirSync17(dirname22(entry.destination), { recursive: true });
+    mkdirSync17(dirname23(entry.destination), { recursive: true });
     copyFileSync2(entry.fullPath, entry.destination);
     written += 1;
   }
-  const unchanged2 = plan.totalFiles - written;
+  const unchanged3 = plan.totalFiles - written;
   const hydration = {
     schema: STATION_HYDRATION_MANIFEST_SCHEMA,
     stationId: options.stationId,
@@ -42621,26 +42692,26 @@ function writeStationHydration(options) {
     stats: {
       idents: plan.winners.length,
       written,
-      unchanged: unchanged2,
+      unchanged: unchanged3,
       files: plan.totalFiles,
       bytes: plan.totalBytes
     },
     skills: resultSkills
   };
-  const hydrationManifestPath = join35(dirname22(cacheRoot), `hydration-${options.stationId}.json`);
-  mkdirSync17(dirname22(hydrationManifestPath), { recursive: true });
-  writeFileSync14(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
+  const hydrationManifestPath = join35(dirname23(cacheRoot), `hydration-${options.stationId}.json`);
+  mkdirSync17(dirname23(hydrationManifestPath), { recursive: true });
+  writeFileSync15(hydrationManifestPath, `${JSON.stringify(hydration, null, 2)}
 `);
   return {
     ...base,
     mode: "apply",
-    stats: { ...base.stats, written, unchanged: unchanged2 },
+    stats: { ...base.stats, written, unchanged: unchanged3 },
     manifestPath: hydrationManifestPath
   };
 }
 // src/lib/private-publication-recovery.ts
-import { constants as constants11, closeSync as closeSync12, fsyncSync as fsyncSync4, fstatSync as fstatSync12, lstatSync as lstatSync20, mkdirSync as mkdirSync18, openSync as openSync12, readSync as readSync10, realpathSync as realpathSync6, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname23, isAbsolute as isAbsolute18, join as join36, resolve as resolve18 } from "path";
+import { constants as constants12, closeSync as closeSync13, fsyncSync as fsyncSync5, fstatSync as fstatSync13, lstatSync as lstatSync21, mkdirSync as mkdirSync18, openSync as openSync13, readSync as readSync11, realpathSync as realpathSync6, renameSync as renameSync7, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
+import { dirname as dirname24, isAbsolute as isAbsolute18, join as join36, resolve as resolve18 } from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 var fail2 = () => {
   throw new PrivatePublicationError("PUBLICATION_RECOVERY_INVALID", "The recovery directory is invalid or changed. Preserve it and inspect the existing intent; do not start a replacement automatically.");
@@ -42648,14 +42719,14 @@ var fail2 = () => {
 function safeDirectory(directory2) {
   if (!isAbsolute18(directory2) || directory2 !== resolve18(directory2) || realpathSync6(directory2) !== directory2)
     return fail2();
-  for (let path = directory2;; path = dirname23(path)) {
-    const stat2 = lstatSync20(path);
+  for (let path = directory2;; path = dirname24(path)) {
+    const stat2 = lstatSync21(path);
     if (!stat2.isDirectory() || stat2.isSymbolicLink())
       return fail2();
-    if (path === dirname23(path))
+    if (path === dirname24(path))
       break;
   }
-  const own2 = lstatSync20(directory2);
+  const own2 = lstatSync21(directory2);
   if ((own2.mode & 63) !== 0 || process.getuid && own2.uid !== process.getuid())
     return fail2();
   return { dev: own2.dev, ino: own2.ino };
@@ -42667,35 +42738,35 @@ function unchangedDirectory(directory2, identity3) {
 }
 function readOwned(directory2, name, max) {
   const identity3 = safeDirectory(directory2), file2 = join36(directory2, name);
-  const fd = openSync12(file2, constants11.O_RDONLY | constants11.O_NOFOLLOW);
+  const fd = openSync13(file2, constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
-    const stat2 = fstatSync12(fd);
+    const stat2 = fstatSync13(fd);
     if (!stat2.isFile() || stat2.nlink !== 1 || stat2.size > max || stat2.size < 1 || (stat2.mode & 63) !== 0 || process.getuid && stat2.uid !== process.getuid())
       return fail2();
     const buffer = Buffer.alloc(Math.min(max, stat2.size) + 1);
     let length = 0;
     while (length < buffer.length) {
-      const count = readSync10(fd, buffer, length, buffer.length - length, length);
+      const count = readSync11(fd, buffer, length, buffer.length - length, length);
       if (count === 0)
         break;
       length += count;
     }
-    const bytes = buffer.subarray(0, length), after = fstatSync12(fd);
+    const bytes = buffer.subarray(0, length), after = fstatSync13(fd);
     unchangedDirectory(directory2, identity3);
     if (bytes.length !== stat2.size || stat2.size !== after.size || stat2.mtimeMs !== after.mtimeMs || stat2.ctimeMs !== after.ctimeMs)
       return fail2();
     return bytes;
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
   }
 }
 function writeOwned(directory2, name, bytes) {
-  const fd = openSync12(join36(directory2, name), constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
+  const fd = openSync13(join36(directory2, name), constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
   try {
-    writeFileSync15(fd, bytes);
-    fsyncSync4(fd);
+    writeFileSync16(fd, bytes);
+    fsyncSync5(fd);
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
   }
 }
 function save(directory2, value) {
@@ -42704,11 +42775,11 @@ function save(directory2, value) {
 `);
   unchangedDirectory(directory2, identity3);
   renameSync7(join36(directory2, temporary), join36(directory2, "receipt.json"));
-  const fd = openSync12(directory2, constants11.O_RDONLY | constants11.O_NOFOLLOW);
+  const fd = openSync13(directory2, constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
-    fsyncSync4(fd);
+    fsyncSync5(fd);
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
   }
 }
 function bind(client2, receipt) {
@@ -42719,20 +42790,20 @@ async function locked(directory2, action) {
   const identity3 = safeDirectory(directory2), file2 = join36(directory2, "operation.lock");
   let fd;
   try {
-    fd = openSync12(file2, constants11.O_WRONLY | constants11.O_CREAT | constants11.O_EXCL | constants11.O_NOFOLLOW, 384);
+    fd = openSync13(file2, constants12.O_WRONLY | constants12.O_CREAT | constants12.O_EXCL | constants12.O_NOFOLLOW, 384);
   } catch {
     throw new PrivatePublicationError("PUBLICATION_RECOVERY_BUSY", "Another operation holds this recovery directory. If it crashed, confirm that process has stopped before explicitly removing operation.lock and resuming.");
   }
-  const lock = fstatSync12(fd);
+  const lock = fstatSync13(fd);
   try {
-    writeFileSync15(fd, JSON.stringify({ pid: process.pid }) + `
+    writeFileSync16(fd, JSON.stringify({ pid: process.pid }) + `
 `);
-    fsyncSync4(fd);
+    fsyncSync5(fd);
     return await action();
   } finally {
-    closeSync12(fd);
+    closeSync13(fd);
     unchangedDirectory(directory2, identity3);
-    const now = lstatSync20(file2);
+    const now = lstatSync21(file2);
     if (now.dev !== lock.dev || now.ino !== lock.ino || !now.isFile() || now.isSymbolicLink())
       fail2();
     unlinkSync5(file2);
@@ -42784,15 +42855,15 @@ async function preparePrivatePublication(client2, sourceDirectory, recoveryDirec
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute18(recoveryDirectory) || resolve18(recoveryDirectory) !== recoveryDirectory || realpathSync6(dirname23(recoveryDirectory)) !== dirname23(recoveryDirectory))
+  if (!isAbsolute18(recoveryDirectory) || resolve18(recoveryDirectory) !== recoveryDirectory || realpathSync6(dirname24(recoveryDirectory)) !== dirname24(recoveryDirectory))
     return fail2();
   mkdirSync18(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
-  const parent = openSync12(dirname23(recoveryDirectory), constants11.O_RDONLY | constants11.O_NOFOLLOW);
+  const parent = openSync13(dirname24(recoveryDirectory), constants12.O_RDONLY | constants12.O_NOFOLLOW);
   try {
-    fsyncSync4(parent);
+    fsyncSync5(parent);
   } finally {
-    closeSync12(parent);
+    closeSync13(parent);
   }
   writeOwned(recoveryDirectory, "bundle.tgz", packed.bytes);
   save(recoveryDirectory, receipt);
@@ -42875,7 +42946,7 @@ async function inspectLocked(client2, directory2, cancel) {
   return privatePublicationResult(directory2, receipt);
 }
 // src/lib/skill-context.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash24 } from "crypto";
 import { resolve as resolve19 } from "path";
 function words(value) {
   return new Set(value.toLowerCase().match(/[a-z0-9]+/g) ?? []);
@@ -42964,7 +43035,7 @@ ${content}`;
 `);
   const receipt = {
     schemaVersion: 1,
-    id: createHash22("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
+    id: createHash24("sha256").update(JSON.stringify({ profile: profile.profileRevision, sessionId, selections, omitted })).digest("hex"),
     profileId: profile.profileId,
     profileRevision: profile.profileRevision,
     authority: profile.authority,
@@ -42980,9 +43051,9 @@ ${content}`;
   return { context: context2, selections, omitted, receipt };
 }
 // src/lib/session-reconciliation.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash25 } from "crypto";
 var SESSION_RECONCILIATION_PLAN_TTL_MS = 5 * 60 * 1000;
-var digest3 = (value) => createHash23("sha256").update(JSON.stringify(value)).digest("hex");
+var digest3 = (value) => createHash25("sha256").update(JSON.stringify(value)).digest("hex");
 function exactTimestamp(value) {
   const parsed = value === undefined ? Number.NaN : Date.parse(value);
   if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value) {
@@ -43000,12 +43071,12 @@ function assertPlanWindow(issuedAt, expiresAt, now) {
   }
 }
 function inspectSkillSession(sessionId, options = {}) {
-  const snapshot = readSkillSessionSnapshot(sessionId, options), { receipt } = snapshot;
+  const snapshot2 = readSkillSessionSnapshot(sessionId, options), { receipt } = snapshot2;
   return {
     sessionId,
-    path: snapshot.path,
-    receiptSha256: snapshot.sha256,
-    generation: snapshot.generation,
+    path: snapshot2.path,
+    receiptSha256: snapshot2.sha256,
+    generation: snapshot2.generation,
     verifiedAt: receipt.verifiedAt,
     authority: receipt.profile.authority,
     workspaceId: receipt.profile.workspaceId,
@@ -43030,8 +43101,8 @@ async function reconcileSkillSession(input2, options = {}) {
   const expiresAt = input2.apply ? input2.planExpiresAt : new Date(now + SESSION_RECONCILIATION_PLAN_TTL_MS).toISOString();
   if (input2.apply)
     assertPlanWindow(issuedAt, expiresAt, now);
-  const snapshot = readSkillSessionSnapshot(input2.sessionId, options), old = snapshot.receipt;
-  if (snapshot.sha256 !== input2.receiptSha256 || old.profile.profileId !== input2.fromProfile || old.profile.profileRevision !== input2.fromRevision) {
+  const snapshot2 = readSkillSessionSnapshot(input2.sessionId, options), old = snapshot2.receipt;
+  if (snapshot2.sha256 !== input2.receiptSha256 || old.profile.profileId !== input2.fromProfile || old.profile.profileRevision !== input2.fromRevision) {
     throw new SkillSelectionError("SESSION_RECEIPT_CHANGED", "The current session receipt does not match the reviewed old bytes, profile and revision.");
   }
   const client2 = options.client ?? await createProfileClient();
@@ -43045,14 +43116,14 @@ async function reconcileSkillSession(input2, options = {}) {
   }
   const targetKeys = new Set(target.selections.map(selectionKey));
   const loaded = old.loaded.filter((key) => targetKeys.has(key));
-  const replacementGeneration = nextSkillSessionGeneration(snapshot.generation);
+  const replacementGeneration = nextSkillSessionGeneration(snapshot2.generation);
   const plan = {
     schemaVersion: 1,
     issuedAt,
     expiresAt,
     sessionId: input2.sessionId,
-    sessionPath: snapshot.path,
-    before: { receiptSha256: snapshot.sha256, generation: snapshot.generation, profileId: old.profile.profileId, profileRevision: old.profile.profileRevision, selectionCount: old.profile.selections.length },
+    sessionPath: snapshot2.path,
+    before: { receiptSha256: snapshot2.sha256, generation: snapshot2.generation, profileId: old.profile.profileId, profileRevision: old.profile.profileRevision, selectionCount: old.profile.selections.length },
     target: { authority: target.authority, workspaceId: target.workspaceId, profileId: target.profileId, profileRevision: target.profileRevision, profileSha256: digest3(target), selectionCount: target.selections.length },
     replacementGeneration,
     retainedLoadedCount: loaded.length,
@@ -43063,7 +43134,7 @@ async function reconcileSkillSession(input2, options = {}) {
   if (input2.planDigest !== undefined && input2.planDigest !== planDigest)
     throw new SkillSelectionError("SESSION_PLAN_CHANGED", "The session reconciliation plan differs from the reviewed plan.");
   if (!input2.apply)
-    return { applied: false, plan, planDigest, archivePath: undefined, receiptPath: undefined, beforeSha256: snapshot.sha256, afterSha256: undefined };
+    return { applied: false, plan, planDigest, archivePath: undefined, receiptPath: undefined, beforeSha256: snapshot2.sha256, afterSha256: undefined };
   assertPlanWindow(issuedAt, expiresAt, (options.now ?? Date.now)());
   const replacement = {
     ...old,
@@ -43072,7 +43143,7 @@ async function reconcileSkillSession(input2, options = {}) {
     profile: target,
     loaded
   };
-  const result = replaceSkillSession(skillSessionSnapshotBinding(snapshot), replacement, { ...plan, planDigest }, options, () => assertPlanWindow(issuedAt, expiresAt, (options.now ?? Date.now)()));
+  const result = replaceSkillSession(skillSessionSnapshotBinding(snapshot2), replacement, { ...plan, planDigest }, options, () => assertPlanWindow(issuedAt, expiresAt, (options.now ?? Date.now)()));
   return { applied: true, plan, planDigest, ...result };
 }
 export {