@iowarp/clio-coder 0.3.0 → 0.3.2

package/dist/{chunk-26BZQOAD.js → chunk-4BPJXDWC.js}

@@ -1,33 +1,51 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
-  ToolNames
-} from "./chunk-QV47YRF4.js";
+  readRootEntries,
+  splitYamlFrontmatter,
+  stringField
+} from "./chunk-2SFS6XQE.js";
 import {
   enabledExtensionResourceRoots
-} from "./chunk-CLJ5HLUD.js";
+} from "./chunk-ZWLZP4ZT.js";
 import {
-  fsyncDirectory
-} from "./chunk-VPAWTYLY.js";
+  ToolNames
+} from "./chunk-CGKSTWHD.js";
+import {
+  INTEROP_AGENT_KINDS,
+  interopSourceRank
+} from "./chunk-IHXBNWMM.js";
 import {
   clioConfigDir
-} from "./chunk-X3NE4WVW.js";
+} from "./chunk-BNAZZHFG.js";
+import {
+  fsyncDirectory
+} from "./chunk-WEPFGWHJ.js";
+import {
+  resolvePackageRoot
+} from "./chunk-IWHMRKLL.js";
+import {
+  init_esm_shims
+} from "./chunk-3R73A4XB.js";
 
 // src/domains/resources/skills/install.ts
+init_esm_shims();
 import { execFileSync } from "node:child_process";
 import {
   cpSync,
-  existsSync as existsSync4,
+  existsSync as existsSync3,
   mkdirSync,
   mkdtempSync,
   readFileSync as readFileSync3,
   renameSync,
   rmSync,
-  statSync as statSync2,
+  statSync,
   writeFileSync
 } from "node:fs";
 import { homedir as homedir2, tmpdir } from "node:os";
-import path4 from "node:path";
+import path3 from "node:path";
 
 // src/domains/resources/skills/content-hash.ts
+init_esm_shims();
 import { createHash } from "node:crypto";
 var PROVENANCE_KEYS = /* @__PURE__ */ new Set([
   "source-url",
@@ -39,7 +57,9 @@ var PROVENANCE_KEYS = /* @__PURE__ */ new Set([
   "updatedAt",
   "installed-hash",
   "installedHash",
-  "audit"
+  "audit",
+  "installed-by",
+  "installedBy"
 ]);
 function frontmatterRegion(rawText) {
   const opening = rawText.match(/^---\r?\n/);
@@ -94,99 +114,39 @@ function normalizedSkillHash(rawText) {
 }
 
 // src/domains/resources/skills/loader.ts
+init_esm_shims();
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync3, readdirSync as readdirSync3, readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import path3 from "node:path";
+import path2 from "node:path";
 
-// src/domains/resources/common-loader.ts
-import { existsSync, readdirSync, statSync } from "node:fs";
+// src/domains/resources/skills/marketplace.ts
+init_esm_shims();
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { parse as parseYaml } from "yaml";
-function defaultScopedResourceRoots(kind, cwd) {
-  return [
-    ...enabledExtensionResourceRoots(kind, cwd).map((root) => ({
-      path: root.path,
-      scope: "package",
-      source: root.source
-    })),
-    { path: path.join(clioConfigDir(), kind), scope: "user", source: "config" },
-    { path: path.join(cwd, ".clio-coder", kind), scope: "project", source: "project" }
-  ];
-}
-function sourceInfoForRoot(root, filePath) {
-  return {
-    path: filePath,
-    scope: root.scope,
-    ...root.source ? { source: root.source } : {}
-  };
-}
-function readRootEntries(root, label, diagnostics) {
-  if (!existsSync(root.path)) return [];
-  let stat;
-  try {
-    stat = statSync(root.path);
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    diagnostics.push({
-      type: "warning",
-      message: `${label} root could not be stat'ed: ${reason}`,
-      path: root.path
-    });
-    return [];
-  }
-  if (!stat.isDirectory()) {
-    diagnostics.push({ type: "warning", message: `${label} root is not a directory`, path: root.path });
-    return [];
-  }
+var MARKETPLACE_UNCONFIGURED = "no local skill marketplace catalog or index configured";
+function packageCatalogDir() {
   try {
-    return readdirSync(root.path, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    diagnostics.push({ type: "warning", message: `${label} root could not be read: ${reason}`, path: root.path });
-    return [];
+    return path.join(resolvePackageRoot(), "skills");
+  } catch {
+    return null;
   }
 }
-function splitYamlFrontmatter(raw) {
-  const opening = raw.match(/^---\r?\n/);
-  if (!opening) return { ok: false, reason: "missing", body: raw };
-  const closeRegex = /\r?\n---(?:\r?\n|$)/g;
-  closeRegex.lastIndex = opening[0].length;
-  const closing = closeRegex.exec(raw);
-  if (!closing) return { ok: false, reason: "missing closing delimiter", body: raw };
-  const body = raw.slice(closing.index + closing[0].length);
-  const frontmatterText = raw.slice(opening[0].length, closing.index);
-  let parsed;
+function packageIndexPath() {
   try {
-    parsed = parseYaml(frontmatterText);
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    return { ok: false, reason: `invalid YAML: ${reason}`, body };
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return { ok: false, reason: "must be a YAML object", body };
+    return path.join(resolvePackageRoot(), "skills", "skill-marketplace.json");
+  } catch {
+    return null;
   }
-  return {
-    ok: true,
-    frontmatter: parsed,
-    body
-  };
-}
-function stringField(frontmatter, key) {
-  const value = frontmatter[key];
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
-
-// src/domains/resources/skills/marketplace.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync } from "node:fs";
-import path2 from "node:path";
-var MARKETPLACE_UNCONFIGURED = "no local skill marketplace catalog or index configured";
 function defaultIndexPath() {
   try {
-    return path2.join(clioConfigDir(), "skill-marketplace.json");
+    const configured = path.join(clioConfigDir(), "skill-marketplace.json");
+    if (existsSync(configured)) return configured;
   } catch {
-    return null;
   }
+  const bundled = packageIndexPath();
+  return bundled && existsSync(bundled) ? bundled : null;
 }
 function isIndexSkill(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -224,15 +184,15 @@ function indexSkills(indexPath, diagnostics) {
   }
 }
 function looksLikeSkillCatalog(dir) {
-  if (!existsSync2(dir)) return false;
+  if (!existsSync(dir)) return false;
   try {
-    return readdirSync2(dir, { withFileTypes: true }).some((entry) => {
+    return readdirSync(dir, { withFileTypes: true }).some((entry) => {
       if (!entry.isDirectory()) return false;
-      const child = path2.join(dir, entry.name);
-      if (existsSync2(path2.join(child, "SKILL.md"))) return true;
+      const child = path.join(dir, entry.name);
+      if (existsSync(path.join(child, "SKILL.md"))) return true;
       try {
-        return readdirSync2(child, { withFileTypes: true }).some(
-          (inner) => inner.isDirectory() && existsSync2(path2.join(child, inner.name, "SKILL.md"))
+        return readdirSync(child, { withFileTypes: true }).some(
+          (inner) => inner.isDirectory() && existsSync(path.join(child, inner.name, "SKILL.md"))
         );
       } catch {
         return false;
@@ -244,15 +204,17 @@ function looksLikeSkillCatalog(dir) {
 }
 function resolveCatalogDir(options) {
   if (options.catalogDir === null) return null;
-  if (options.catalogDir) return path2.resolve(options.catalogDir);
+  if (options.catalogDir) return path.resolve(options.catalogDir);
   const fromEnv = process.env.CLIO_CODER_SKILL_CATALOG_DIR;
-  if (fromEnv && fromEnv.trim().length > 0) return path2.resolve(fromEnv.trim());
-  const repoCatalog = path2.join(options.cwd ?? process.cwd(), "skills");
-  return looksLikeSkillCatalog(repoCatalog) ? repoCatalog : null;
+  if (fromEnv && fromEnv.trim().length > 0) return path.resolve(fromEnv.trim());
+  const repoCatalog = path.join(options.cwd ?? process.cwd(), "skills");
+  if (looksLikeSkillCatalog(repoCatalog)) return repoCatalog;
+  const bundled = packageCatalogDir();
+  return bundled && looksLikeSkillCatalog(bundled) ? bundled : null;
 }
 function catalogCategory(catalogDir, baseDir) {
-  const rel = path2.relative(catalogDir, baseDir);
-  const category = path2.dirname(rel);
+  const rel = path.relative(catalogDir, baseDir);
+  const category = path.dirname(rel);
   if (rel.length === 0 || rel.startsWith("..") || category === "." || category.startsWith("..")) return void 0;
   return category;
 }
@@ -290,7 +252,7 @@ function discoverMarketplaceSkills(options = {}) {
   }
   const indexPath = options.indexPath === null ? null : options.indexPath ?? process.env.CLIO_CODER_SKILL_MARKETPLACE_INDEX ?? null;
   const resolvedIndexPath = indexPath ?? defaultIndexPath();
-  if (options.indexPath !== null && resolvedIndexPath && existsSync2(resolvedIndexPath)) {
+  if (options.indexPath !== null && resolvedIndexPath && existsSync(resolvedIndexPath)) {
     for (const skill of indexSkills(resolvedIndexPath, diagnostics)) {
       if (seen.has(skill.name)) continue;
       seen.add(skill.name);
@@ -308,7 +270,7 @@ function getMarketplaceSkills(options = {}) {
 function installSkill(input) {
   const source = input.source.trim();
   const spec = parseSkillSourceSpec(source);
-  if (spec?.kind === "local" && isSkillName(source) && !existsSync2(spec.path)) {
+  if (spec?.kind === "local" && isSkillName(source) && !existsSync(spec.path)) {
     const skill = getMarketplaceSkills({ ...input.cwd ? { cwd: input.cwd } : {} }).find(
       (entry) => entry.name === source
     );
@@ -355,15 +317,15 @@ function defaultPrecedenceForScope(scope) {
       return SKILL_PRECEDENCE.cli;
   }
 }
-function projectCompatTrusted(input) {
-  if (input.trustProjectCompatRoots === true) return true;
+function projectCompatTrusted(explicit) {
+  if (explicit === true) return true;
   return process.env.CLIO_CODER_TRUST_PROJECT_SKILLS === "1";
 }
 function defaultSkillRoots(input = {}) {
   const cwd = input.cwd ?? process.cwd();
   const home = input.home ?? homedir();
   const configDir = input.configDir ?? clioConfigDirSafe();
-  const trustProject = projectCompatTrusted(input);
+  const trustProject = projectCompatTrusted(input.trustProjectCompatRoots);
   const roots = [];
   for (const root of enabledExtensionResourceRoots("skills", cwd)) {
     roots.push({
@@ -375,54 +337,21 @@ function defaultSkillRoots(input = {}) {
       trusted: true
     });
   }
-  roots.push({
-    path: path3.join(home, ".agents", "skills"),
-    scope: "user",
-    source: "agents",
-    origin: "agents-user",
-    precedence: SKILL_PRECEDENCE.userCompat,
-    trusted: true,
-    containment: home
-  });
-  roots.push({
-    path: path3.join(home, ".claude", "skills"),
-    scope: "user",
-    source: "claude",
-    origin: "claude-user",
-    precedence: SKILL_PRECEDENCE.userCompat,
-    trusted: true,
-    containment: home
-  });
-  roots.push({
-    path: path3.join(home, ".codex", "skills"),
-    scope: "user",
-    source: "codex",
-    origin: "codex-user",
-    precedence: SKILL_PRECEDENCE.userCompat,
-    trusted: true,
-    containment: home
-  });
-  roots.push({
-    path: path3.join(home, ".config", "opencode", "skills"),
-    scope: "user",
-    source: "opencode",
-    origin: "opencode-user",
-    precedence: SKILL_PRECEDENCE.userCompat,
-    trusted: true,
-    containment: home
-  });
-  roots.push({
-    path: path3.join(home, ".copilot", "skills"),
-    scope: "user",
-    source: "copilot",
-    origin: "copilot-user",
-    precedence: SKILL_PRECEDENCE.userCompat,
-    trusted: true,
-    containment: home
-  });
+  for (const kind of INTEROP_AGENT_KINDS) {
+    if (kind.userSkillRoot === void 0 || kind.skillSource === void 0) continue;
+    roots.push({
+      path: path2.join(home, kind.userSkillRoot),
+      scope: "user",
+      source: kind.skillSource,
+      origin: `${kind.skillSource}-user`,
+      precedence: SKILL_PRECEDENCE.userCompat,
+      trusted: true,
+      containment: home
+    });
+  }
   if (configDir) {
     roots.push({
-      path: path3.join(configDir, "skills"),
+      path: path2.join(configDir, "skills"),
       scope: "user",
       source: "clio",
       origin: "config",
@@ -431,53 +360,20 @@ function defaultSkillRoots(input = {}) {
       containment: home
     });
   }
+  for (const kind of INTEROP_AGENT_KINDS) {
+    if (kind.projectSkillRoot === void 0 || kind.skillSource === void 0) continue;
+    roots.push({
+      path: path2.join(cwd, kind.projectSkillRoot),
+      scope: "project",
+      source: kind.skillSource,
+      origin: `${kind.skillSource}-project`,
+      precedence: SKILL_PRECEDENCE.projectCompat,
+      trusted: trustProject,
+      containment: cwd
+    });
+  }
   roots.push({
-    path: path3.join(cwd, ".agents", "skills"),
-    scope: "project",
-    source: "agents",
-    origin: "agents-project",
-    precedence: SKILL_PRECEDENCE.projectCompat,
-    trusted: trustProject,
-    containment: cwd
-  });
-  roots.push({
-    path: path3.join(cwd, ".claude", "skills"),
-    scope: "project",
-    source: "claude",
-    origin: "claude-project",
-    precedence: SKILL_PRECEDENCE.projectCompat,
-    trusted: trustProject,
-    containment: cwd
-  });
-  roots.push({
-    path: path3.join(cwd, ".codex", "skills"),
-    scope: "project",
-    source: "codex",
-    origin: "codex-project",
-    precedence: SKILL_PRECEDENCE.projectCompat,
-    trusted: trustProject,
-    containment: cwd
-  });
-  roots.push({
-    path: path3.join(cwd, ".opencode", "skills"),
-    scope: "project",
-    source: "opencode",
-    origin: "opencode-project",
-    precedence: SKILL_PRECEDENCE.projectCompat,
-    trusted: trustProject,
-    containment: cwd
-  });
-  roots.push({
-    path: path3.join(cwd, ".github", "skills"),
-    scope: "project",
-    source: "copilot",
-    origin: "copilot-project",
-    precedence: SKILL_PRECEDENCE.projectCompat,
-    trusted: trustProject,
-    containment: cwd
-  });
-  roots.push({
-    path: path3.join(cwd, ".clio-coder", "skills"),
+    path: path2.join(cwd, ".clio-coder", "skills"),
     scope: "project",
     source: "clio",
     origin: "project",
@@ -551,7 +447,7 @@ function declaredToolSurface(frontmatter, key, filePath, diagnostics) {
   return tools.length > 0 ? tools : void 0;
 }
 function validationSubject(filePath) {
-  return path3.basename(filePath) === "SKILL.md" ? path3.basename(path3.dirname(filePath)) : path3.basename(filePath, ".md");
+  return path2.basename(filePath) === "SKILL.md" ? path2.basename(path2.dirname(filePath)) : path2.basename(filePath, ".md");
 }
 function validateNameFormat(name) {
   const errors = [];
@@ -602,7 +498,9 @@ function extractProvenance(frontmatter) {
   const installedHash = field("installed-hash", "installedHash");
   const auditRaw = field("audit");
   const audit = auditRaw === "pass" || auditRaw === "warn" || auditRaw === "fail" || auditRaw === "unknown" ? auditRaw : void 0;
-  if (!installUrl && !registryId && !registryUrl && !installedAt && !updatedAt && !installedHash && !audit)
+  const installedByRaw = field("installed-by", "installedBy");
+  const installedBy = installedByRaw === "worker" ? installedByRaw : void 0;
+  if (!installUrl && !registryId && !registryUrl && !installedAt && !updatedAt && !installedHash && !audit && !installedBy)
     return void 0;
   return {
     ...installUrl ? { installUrl } : {},
@@ -611,18 +509,19 @@ function extractProvenance(frontmatter) {
     ...installedAt ? { installedAt } : {},
     ...updatedAt ? { updatedAt } : {},
     ...installedHash ? { installedHash } : {},
-    ...audit ? { audit } : {}
+    ...audit ? { audit } : {},
+    ...installedBy ? { installedBy } : {}
   };
 }
 function canonicalizePath(filePath) {
   try {
     return realpathSync.native(filePath);
   } catch {
-    return path3.resolve(filePath);
+    return path2.resolve(filePath);
   }
 }
 function pathIsInside(candidate, anchor) {
-  return candidate === anchor || candidate.startsWith(anchor + path3.sep);
+  return candidate === anchor || candidate.startsWith(anchor + path2.sep);
 }
 function containmentAnchor(root) {
   if (root.containment === void 0) return null;
@@ -706,7 +605,7 @@ function loadSkillFile(filePath, root) {
   }
   for (const message of validateNameFormat(name)) diagnostics.push({ type: "warning", message, path: filePath });
   if (!description) return { candidate: null, diagnostics };
-  const baseDir = path3.dirname(filePath);
+  const baseDir = path2.dirname(filePath);
   const scope = root.scope;
   const sourceInfo = {
     path: filePath,
@@ -743,11 +642,11 @@ function isSkillMarkdownFile(entryName) {
   return entryName === "SKILL.md" || entryName.endsWith(".md");
 }
 function collectSkills(root, dir, diagnostics, includeRootFiles, anchor = containmentAnchor(root)) {
-  if (!existsSync3(dir)) return [];
+  if (!existsSync2(dir)) return [];
   if (escapesContainment(dir, anchor, diagnostics)) return [];
   let entries;
   try {
-    entries = readdirSync3(dir, { withFileTypes: true });
+    entries = readdirSync2(dir, { withFileTypes: true });
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     diagnostics.push({ type: "warning", message: `skill root could not be read: ${reason}`, path: dir });
@@ -755,7 +654,7 @@ function collectSkills(root, dir, diagnostics, includeRootFiles, anchor = contai
   }
   const skillEntry = entries.find((entry) => entry.name === "SKILL.md" && entry.isFile());
   if (skillEntry) {
-    const skillPath = path3.join(dir, skillEntry.name);
+    const skillPath = path2.join(dir, skillEntry.name);
     if (escapesContainment(skillPath, anchor, diagnostics)) return [];
     const loaded = loadSkillFile(skillPath, root);
     diagnostics.push(...loaded.diagnostics);
@@ -764,8 +663,8 @@ function collectSkills(root, dir, diagnostics, includeRootFiles, anchor = contai
   const candidates = [];
   for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
     if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-    const fullPath = path3.join(dir, entry.name);
-    if (entry.isDirectory() || entry.isSymbolicLink() && existsSync3(path3.join(fullPath, "SKILL.md"))) {
+    const fullPath = path2.join(dir, entry.name);
+    if (entry.isDirectory() || entry.isSymbolicLink() && existsSync2(path2.join(fullPath, "SKILL.md"))) {
       candidates.push(...collectSkills(root, fullPath, diagnostics, false, anchor));
       continue;
     }
@@ -793,14 +692,14 @@ function explicitSkillRoot(filePath) {
   };
 }
 function loadExplicitSkillPath(inputPath, diagnostics) {
-  const resolved = path3.resolve(inputPath);
+  const resolved = path2.resolve(inputPath);
   const root = explicitSkillRoot(resolved);
-  if (!existsSync3(resolved)) {
+  if (!existsSync2(resolved)) {
     diagnostics.push({ type: "warning", message: `explicit skill path does not exist: ${resolved}`, path: resolved });
     return [];
   }
-  const skillFile = path3.basename(resolved) === "SKILL.md" || resolved.endsWith(".md") ? resolved : path3.join(resolved, "SKILL.md");
-  if (!existsSync3(skillFile)) {
+  const skillFile = path2.basename(resolved) === "SKILL.md" || resolved.endsWith(".md") ? resolved : path2.join(resolved, "SKILL.md");
+  if (!existsSync2(skillFile)) {
     const packages = collectSkills(root, resolved, diagnostics, false);
     if (packages.length > 0) return packages;
     diagnostics.push({
@@ -814,6 +713,13 @@ function loadExplicitSkillPath(inputPath, diagnostics) {
   diagnostics.push(...loaded.diagnostics);
   return loaded.candidate ? [loaded.candidate] : [];
 }
+function compareSkillCandidates(a, b) {
+  const precedence = a.precedence - b.precedence;
+  if (precedence !== 0) return precedence;
+  const rank = interopSourceRank(b.source) - interopSourceRank(a.source);
+  if (rank !== 0) return rank;
+  return a.filePath.localeCompare(b.filePath);
+}
 function dedupeCanonicalSkillPaths(candidates, diagnostics) {
   const byPath = /* @__PURE__ */ new Map();
   for (const candidate of candidates) {
@@ -828,18 +734,14 @@ function dedupeCanonicalSkillPaths(candidates, diagnostics) {
       if (only) winners.push(only);
       continue;
     }
-    const sorted = [...entries].sort((a, b) => {
-      const delta = a.skill.precedence - b.skill.precedence;
-      if (delta !== 0) return delta;
-      return a.skill.filePath.localeCompare(b.skill.filePath);
-    });
+    const sorted = [...entries].sort((a, b) => compareSkillCandidates(a.skill, b.skill));
     const winner = sorted[sorted.length - 1];
     if (!winner) continue;
     winners.push(winner);
     for (const loser of sorted.slice(0, -1)) {
       diagnostics.push({
         type: "warning",
-        message: `${loser.skill.name} at ${loser.skill.filePath} resolves to the same canonical skill file as ${winner.skill.filePath}; using the higher-precedence entry`,
+        message: `${loser.skill.name} at ${loser.skill.filePath} resolves to the same canonical skill file as ${winner.skill.filePath}, which is the entry in use`,
         path: loser.skill.filePath
       });
     }
@@ -858,11 +760,7 @@ function resolveSkillCollisions(candidates) {
   const winners = [];
   const diagnostics = [];
   for (const [name, entries] of byName.entries()) {
-    const sorted = [...entries].sort((a, b) => {
-      const delta = a.skill.precedence - b.skill.precedence;
-      if (delta !== 0) return delta;
-      return a.skill.filePath.localeCompare(b.skill.filePath);
-    });
+    const sorted = [...entries].sort((a, b) => compareSkillCandidates(a.skill, b.skill));
     const winner = sorted[sorted.length - 1];
     if (!winner) continue;
     winners.push(winner.skill);
@@ -922,9 +820,8 @@ function modelVisibleSkills(skills) {
 }
 function parseSkillCommand(input) {
   const trimmed = input.trim();
-  const prefix = trimmed.startsWith("/skill:") ? "/skill:" : trimmed.startsWith("/skills:") ? "/skills:" : trimmed.startsWith("/skill ") ? "/skill " : null;
-  if (!prefix) return null;
-  const rest = trimmed.slice(prefix.length).trim();
+  if (!trimmed.startsWith("/skill ")) return null;
+  const rest = trimmed.slice("/skill ".length).trim();
   const separator = rest.search(/\s/);
   const name = separator === -1 ? rest : rest.slice(0, separator);
   if (name.length === 0) return null;
@@ -1006,11 +903,11 @@ function isSkillName(value) {
   return value.length > 0 && value.length <= 64 && SKILL_NAME_PATTERN.test(value);
 }
 function repoRelativePath(filePath) {
-  if (path4.isAbsolute(filePath) || filePath.includes("\0")) return null;
+  if (path3.isAbsolute(filePath) || filePath.includes("\0")) return null;
   const segments = filePath.split("/");
   if (segments.some((segment) => segment === "..")) return null;
-  const normalized = path4.posix.normalize(filePath);
-  if (normalized.startsWith("..") || path4.posix.isAbsolute(normalized)) return null;
+  const normalized = path3.posix.normalize(filePath);
+  if (normalized.startsWith("..") || path3.posix.isAbsolute(normalized)) return null;
   return normalized;
 }
 function parseSkillSourceSpec(source) {
@@ -1041,8 +938,11 @@ function parseSkillSourceSpec(source) {
     };
   }
   if (trimmed.startsWith("http://") || trimmed.startsWith("https://")) return null;
-  const expanded = trimmed.startsWith("~/") ? path4.join(homedir2(), trimmed.slice(2)) : trimmed;
-  return { kind: "local", path: path4.resolve(expanded), original: trimmed };
+  const expanded = trimmed.startsWith("~/") ? path3.join(homedir2(), trimmed.slice(2)) : trimmed;
+  return { kind: "local", path: path3.resolve(expanded), original: trimmed };
+}
+function installingAsWorker() {
+  return process.env.CLIO_CODER_WORKER_RUN === "1";
 }
 function yamlQuote(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
@@ -1057,7 +957,8 @@ function injectProvenanceFrontmatter(rawText, fields) {
     ...fields.updatedAt ? [`updated-at: ${yamlQuote(fields.updatedAt)}`] : [],
     `installed-hash: ${yamlQuote(fields.installedHash)}`,
     // Audit is a human decision; installs always land unreviewed.
-    "audit: unknown"
+    "audit: unknown",
+    ...fields.installedBy ? [`installed-by: ${yamlQuote(fields.installedBy)}`] : []
   ];
   const clioIndex = kept.findIndex((line) => /^clio:/.test(line));
   if (clioIndex >= 0 && !/^clio:\s*$/.test(kept[clioIndex])) {
@@ -1076,13 +977,13 @@ function injectProvenanceFrontmatter(rawText, fields) {
   return `${region.head}${[...kept.slice(0, blockEnd), ...nested, ...kept.slice(blockEnd)].join("\n")}${region.tail}`;
 }
 function resolveSkillDir(target) {
-  if (!existsSync4(target)) throw new Error(`skill source path does not exist: ${target}`);
-  const stat = statSync2(target);
+  if (!existsSync3(target)) throw new Error(`skill source path does not exist: ${target}`);
+  const stat = statSync(target);
   if (stat.isFile()) {
     if (!target.endsWith(".md")) throw new Error(`skill source must be a SKILL.md file or directory: ${target}`);
-    return path4.dirname(target);
+    return path3.dirname(target);
   }
-  if (!existsSync4(path4.join(target, "SKILL.md"))) {
+  if (!existsSync3(path3.join(target, "SKILL.md"))) {
     throw new Error(`skill source directory has no SKILL.md: ${target}`);
   }
   return target;
@@ -1092,15 +993,15 @@ function fetchSource(spec) {
     return { skillDir: resolveSkillDir(spec.path), cleanup: () => {
     } };
   }
-  const tmp = mkdtempSync(path4.join(tmpdir(), "clio-skill-"));
+  const tmp = mkdtempSync(path3.join(tmpdir(), "clio-skill-"));
   const cleanup = () => rmSync(tmp, { recursive: true, force: true });
   try {
     execFileSync("git", ["clone", "--depth", "1", "--branch", spec.branch, spec.cloneUrl, tmp], {
       stdio: "pipe",
       timeout: CLONE_TIMEOUT_MS
     });
-    const target = path4.join(tmp, spec.filePath);
-    if (!existsSync4(target)) {
+    const target = path3.join(tmp, spec.filePath);
+    if (!existsSync3(target)) {
       throw new Error(
         `${spec.cloneUrl} (branch ${spec.branch}) has no ${spec.filePath}; the source-url may name a path that branch does not carry`
       );
@@ -1112,11 +1013,11 @@ function fetchSource(spec) {
   }
 }
 function copySkillDir(from, to) {
-  mkdirSync(path4.dirname(to), { recursive: true });
+  mkdirSync(path3.dirname(to), { recursive: true });
   cpSync(from, to, {
     recursive: true,
     filter: (source) => {
-      const base = path4.basename(source);
+      const base = path3.basename(source);
       return base !== ".git" && base !== "node_modules";
     }
   });
@@ -1133,7 +1034,7 @@ function swapSkillDir(stage, dest) {
     rmSync(staging, { recursive: true, force: true });
     throw err;
   }
-  const hadPrevious = existsSync4(dest);
+  const hadPrevious = existsSync3(dest);
   if (hadPrevious) renameSync(dest, backup);
   try {
     renameSync(staging, dest);
@@ -1143,10 +1044,10 @@ function swapSkillDir(stage, dest) {
     throw err;
   }
   if (hadPrevious) rmSync(backup, { recursive: true, force: true });
-  fsyncDirectory(path4.dirname(dest));
+  fsyncDirectory(path3.dirname(dest));
 }
 function destinationRoot(scope, cwd, configDir) {
-  return scope === "user" ? path4.join(configDir ?? clioConfigDir(), "skills") : path4.join(cwd, ".clio-coder", "skills");
+  return scope === "user" ? path3.join(configDir ?? clioConfigDir(), "skills") : path3.join(cwd, ".clio-coder", "skills");
 }
 function validateSourceSkill(skillDir) {
   const list = loadSkills({ disableDiscovery: true, explicitSkillPaths: [skillDir] });
@@ -1172,27 +1073,28 @@ function installSkillFromSource(input) {
     if (!isSkillName(name)) {
       throw new Error(`invalid skill name "${name}": use lowercase letters, numbers, and single hyphens`);
     }
-    const dest = path4.join(destinationRoot(scope, cwd, input.configDir), name);
-    if (existsSync4(dest) && input.force !== true) {
+    const dest = path3.join(destinationRoot(scope, cwd, input.configDir), name);
+    if (existsSync3(dest) && input.force !== true) {
       throw new Error(`skill already installed at ${dest} (use --force to overwrite)`);
     }
     const sourceRaw = readFileSync3(skill.filePath, "utf8");
     const installedHash = normalizedSkillHash(sourceRaw);
-    const destFile = path4.join(dest, "SKILL.md");
+    const destFile = path3.join(dest, "SKILL.md");
     swapSkillDir((staging) => {
       copySkillDir(fetched.skillDir, staging);
       writeFileSync(
-        path4.join(staging, "SKILL.md"),
+        path3.join(staging, "SKILL.md"),
         injectProvenanceFrontmatter(sourceRaw, {
           sourceUrl: spec.original,
           installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          installedHash
+          installedHash,
+          ...installingAsWorker() ? { installedBy: "worker" } : {}
         }),
         "utf8"
       );
     }, dest);
     const after = loadSkills({ cwd, ...scope === "user" && input.configDir ? { configDir: input.configDir } : {} });
-    const installWarnings = after.diagnostics.filter((diag) => diag.path && path4.resolve(diag.path).startsWith(dest)).map((diag) => diag.message);
+    const installWarnings = after.diagnostics.filter((diag) => diag.path && path3.resolve(diag.path).startsWith(dest)).map((diag) => diag.message);
     return {
       name,
       scope,
@@ -1217,7 +1119,7 @@ function updateOne(skill, force) {
   const fetched = fetchSource(spec);
   try {
     validateSourceSkill(fetched.skillDir);
-    const remoteFile = path4.join(fetched.skillDir, "SKILL.md");
+    const remoteFile = path3.join(fetched.skillDir, "SKILL.md");
     const remoteRaw = readFileSync3(remoteFile, "utf8");
     const remoteHash = normalizedSkillHash(remoteRaw);
     const localRaw = readFileSync3(skill.filePath, "utf8");
@@ -1231,12 +1133,15 @@ function updateOne(skill, force) {
     swapSkillDir((staging) => {
       copySkillDir(fetched.skillDir, staging);
       writeFileSync(
-        path4.join(staging, "SKILL.md"),
+        path3.join(staging, "SKILL.md"),
         injectProvenanceFrontmatter(remoteRaw, {
           sourceUrl,
           installedAt: skill.provenance?.installedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
           updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          installedHash: remoteHash
+          installedHash: remoteHash,
+          // Who installed a skill is set once; an update, worker- or
+          // operator-run, does not change who put it there originally.
+          ...skill.provenance?.installedBy ? { installedBy: skill.provenance.installedBy } : {}
         }),
         "utf8"
       );
@@ -1262,20 +1167,16 @@ function updateSkills(input = {}) {
 }
 
 export {
-  defaultScopedResourceRoots,
-  sourceInfoForRoot,
-  readRootEntries,
-  splitYamlFrontmatter,
-  stringField,
   updateSkills,
   MARKETPLACE_UNCONFIGURED,
   discoverMarketplaceSkills,
   getMarketplaceSkills,
   installSkill,
+  projectCompatTrusted,
   loadSkills,
   modelVisibleSkills,
   parseSkillCommand,
   expandSkillInvocationInput,
   parsePendingSkillRequests
 };
-//# sourceMappingURL=chunk-26BZQOAD.js.map
+//# sourceMappingURL=chunk-4BPJXDWC.js.map