@kitman-sh/cli 0.9.0 → 0.10.53

package/dist/chunk-7thnf14y.js

@@ -0,0 +1,936 @@
+// @bun
+import {
+  Reference,
+  TaggedError,
+  Scope,
+  provide,
+  forEach,
+  succeed6,
+  suspend3,
+  gen,
+  fail7,
+  flatMap3,
+  exit,
+  map8,
+  as,
+  catch_,
+  catchReason,
+  mapError2,
+  orDie,
+  orElseSucceed,
+  provideService,
+  scoped,
+  fnUntraced,
+  encodePrettyJsonString,
+  decodeJsonStringSync
+} from "./chunk-mbctzx7e.js";
+import {
+  isJsonObject,
+  isString
+} from "./chunk-arvwar2c.js";
+import {
+  FileSystem,
+  Path,
+  optionalEnv
+} from "./chunk-11p4wf6n.js";
+import {
+  AgentHarnessIds,
+  sha2562,
+  runCommand2
+} from "./chunk-wh1pa2aa.js";
+import {
+  NpmRegistry
+} from "./chunk-g5bs3f6z.js";
+
+// packages/agent-runtime/src/config-convergence.ts
+var writeAgentEnvironmentConfigFile2 = fnUntraced(function* (file, content, keep = {}) {
+  const fs = yield* FileSystem;
+  const paths = {
+    path: yield* Path,
+    home: yield* optionalEnv("HOME")
+  };
+  yield* fs.makeDirectory(paths.path.dirname(file), { recursive: true });
+  const existing = yield* readExistingText(file);
+  const merged = yield* gen(function* () {
+    if (file.endsWith("AGENTS.md"))
+      return mergeCodexAgents(existing, content);
+    if (file.endsWith("opencode.json")) {
+      const managed = yield* readManagedNamesForConfig(paths, file);
+      return mergeOpenCodeConfig(existing, content, managed.mcpNames, without(managed.packageNames, keep.packages));
+    }
+    if (file.endsWith(".codex/config.toml")) {
+      const managed = yield* readManagedNamesForConfig(paths, file);
+      return mergeCodexConfig(existing, content, managed.mcpNames, managed.skillPaths, keep.kitmanPlugins === true);
+    }
+    if (isPiConfigPath(paths.path, file, "settings.json")) {
+      const managed = yield* readManagedNamesForConfig(paths, file);
+      return mergePiSettingsConfig(existing, content, without(managed.packageNames, keep.packages));
+    }
+    if (isPiConfigPath(paths.path, file, "mcp.json")) {
+      const managed = yield* readManagedNamesForConfig(paths, file);
+      return mergePiMcpConfig(existing, content, managed.mcpNames);
+    }
+    return content;
+  });
+  yield* fs.writeFileString(file, merged);
+});
+var without = (names, kept = []) => new Set([...names].filter((name) => !kept.includes(name)));
+var KitmanAgentsStartMarker = "<!-- KITMAN_AGENT_ENVIRONMENT_START -->";
+var KitmanAgentsEndMarker = "<!-- KITMAN_AGENT_ENVIRONMENT_END -->";
+var KitmanGeneratedAgentsPrefix = "# Kitman AgentEnvironment\n\nThis file is generated by `kitman sync`";
+function mergeCodexAgents(existingText, generatedText) {
+  const block = `${KitmanAgentsStartMarker}
+${generatedText.trimEnd()}
+${KitmanAgentsEndMarker}`;
+  const trimmedExisting = existingText.trim();
+  if (trimmedExisting.length === 0 || existingText.startsWith(KitmanGeneratedAgentsPrefix))
+    return `${block}
+`;
+  const start = existingText.indexOf(KitmanAgentsStartMarker);
+  const end = existingText.indexOf(KitmanAgentsEndMarker);
+  if (start !== -1 && end !== -1 && end > start) {
+    return `${existingText.slice(0, start)}${block}${existingText.slice(end + KitmanAgentsEndMarker.length).replace(/^\n?/, `
+`)}`;
+  }
+  return `${existingText.trimEnd()}
+
+${block}
+`;
+}
+var readExistingText = (file) => flatMap3(FileSystem, (fs) => fs.readFileString(file).pipe(catchReason("PlatformError", "NotFound", () => succeed6(""))));
+var readManagedNamesForConfig = (paths, file) => gen(function* () {
+  const manifest = parseJsonObject(yield* readExistingText(yield* managedManifestPathForConfig(paths, file)));
+  const servers = Array.isArray(manifest.mcpServers) ? manifest.mcpServers : [];
+  const plugins = Array.isArray(manifest.plugins) ? manifest.plugins : [];
+  return {
+    mcpNames: new Set(servers.flatMap((entry) => {
+      const item = objectValue(objectValue(entry).item);
+      return isString(item.name) ? [item.name] : [];
+    })),
+    packageNames: new Set(plugins.flatMap((entry) => {
+      const { source: legacySource, sources } = objectValue(objectValue(entry).item);
+      return (Array.isArray(sources) ? sources : legacySource === undefined ? [] : [legacySource]).flatMap((source) => {
+        const { kind, packageName } = objectValue(source);
+        return kind === "package" && isString(packageName) ? [packageName] : [];
+      });
+    })),
+    skillPaths: manifestSkillPaths(manifest)
+  };
+});
+function manifestSkillPaths(manifest) {
+  const materializedSkills = Array.isArray(manifest.materializedSkills) ? manifest.materializedSkills : [];
+  return new Set(materializedSkills.flatMap((entry) => {
+    const item = objectValue(entry);
+    return isString(item.skillPath) ? [item.skillPath] : [];
+  }));
+}
+var readManifestSkillPaths2 = (manifestPath) => map8(readExistingText(manifestPath), (text) => manifestSkillPaths(parseJsonObject(text)));
+var managedManifestPathForConfig = (paths, file) => gen(function* () {
+  const fs = yield* FileSystem;
+  const manifestRoot = managedManifestRootPath(paths, file);
+  const manifestPath = paths.path.join(manifestRoot, ".kitman", manifestFileForHarness(managedHarnessForConfigPath(paths, file)));
+  const legacyPath = paths.path.join(manifestRoot, ".kitman/agent-environment.manifest.json");
+  if (yield* fs.exists(manifestPath))
+    return manifestPath;
+  return (yield* fs.exists(legacyPath)) ? legacyPath : manifestPath;
+});
+var HomeConfigFiles = [
+  [".config/opencode/opencode.json", "opencode"],
+  [".codex/AGENTS.md", "codex"],
+  [".codex/config.toml", "codex"],
+  [".claude/.mcp.json", "claude-code"],
+  [".pi/agent/settings.json", "pi"],
+  [".pi/agent/mcp.json", "pi"]
+];
+function homeConfigHarness({ path, home }, file) {
+  if (home === undefined)
+    return;
+  const resolved = path.resolve(file);
+  return HomeConfigFiles.find(([relative]) => path.resolve(home, relative) === resolved)?.[1];
+}
+function managedManifestRootPath(paths, file) {
+  const { path, home } = paths;
+  const resolved = path.resolve(file);
+  if (home !== undefined && homeConfigHarness(paths, file) !== undefined)
+    return home;
+  const harness = managedHarnessForConfigPath(paths, file);
+  const configDirectory = path.dirname(resolved);
+  const configFile = path.basename(resolved);
+  if (harness === "codex" && configFile === "config.toml" && path.basename(configDirectory) === ".codex")
+    return path.dirname(configDirectory);
+  if (harness === "pi" && (configFile === "settings.json" || configFile === "mcp.json") && path.basename(configDirectory) === ".pi")
+    return path.dirname(configDirectory);
+  return configDirectory;
+}
+function managedHarnessForConfigPath(paths, file) {
+  const homeHarness = homeConfigHarness(paths, file);
+  if (homeHarness !== undefined)
+    return homeHarness;
+  const { path } = paths;
+  const resolved = path.resolve(file);
+  const configFile = path.basename(resolved);
+  if (configFile === "opencode.json")
+    return "opencode";
+  if (configFile === ".mcp.json")
+    return "claude-code";
+  if ((configFile === "settings.json" || configFile === "mcp.json") && path.basename(path.dirname(resolved)) === ".pi")
+    return "pi";
+  if (configFile === "AGENTS.md" || configFile === "config.toml")
+    return "codex";
+  return;
+}
+function manifestFileForHarness(harness) {
+  if (harness === undefined)
+    return "agent-environment.manifest.json";
+  return `agent-environment.${harness}.manifest.json`;
+}
+function mergeOpenCodeConfig(existingText, generatedText, managedMcpNames, managedPackageNames) {
+  const existing = parseJsonObject(existingText);
+  const generated = parseJsonObject(generatedText);
+  const existingMcp = { ...objectValue(existing.mcp) };
+  for (const name of managedMcpNames)
+    delete existingMcp[name];
+  const existingPlugins = uniqueStrings(arrayValue(existing.plugin).filter((entry) => !isManagedPackageReference(entry, managedPackageNames)));
+  const merged = {
+    ...existing,
+    ...generated,
+    mcp: { ...existingMcp, ...objectValue(generated.mcp) },
+    plugin: uniqueStrings([...existingPlugins, ...arrayValue(generated.plugin)]),
+    skills: {
+      ...objectValue(existing.skills),
+      ...objectValue(generated.skills),
+      paths: uniqueStrings([
+        ...arrayValue(objectValue(existing.skills).paths),
+        ...arrayValue(objectValue(generated.skills).paths)
+      ])
+    }
+  };
+  return `${JSON.stringify(merged, null, 2)}
+`;
+}
+function isManagedPackageReference(entry, managedPackageNames, prefix = "") {
+  if (!isString(entry))
+    return false;
+  for (const name of managedPackageNames) {
+    if (entry === `${prefix}${name}` || entry.startsWith(`${prefix}${name}@`))
+      return true;
+  }
+  return false;
+}
+function mergePiSettingsConfig(existingText, generatedText, managedPackageNames) {
+  const existing = parseJsonObject(existingText);
+  const generated = parseJsonObject(generatedText);
+  const merged = {
+    ...existing,
+    ...generated,
+    packages: uniquePackageEntries([
+      ...packageEntries(existing.packages).filter((entry) => !isManagedPackageReference(entry, managedPackageNames, "npm:")),
+      ...packageEntries(generated.packages)
+    ])
+  };
+  return `${JSON.stringify(merged, null, 2)}
+`;
+}
+function mergePiMcpConfig(existingText, generatedText, managedMcpNames) {
+  const existing = parseJsonObject(existingText);
+  const generated = parseJsonObject(generatedText);
+  const existingMcp = { ...objectValue(existing.mcpServers) };
+  for (const name of managedMcpNames)
+    delete existingMcp[name];
+  const merged = {
+    ...existing,
+    ...generated,
+    mcpServers: { ...existingMcp, ...objectValue(generated.mcpServers) }
+  };
+  return `${JSON.stringify(merged, null, 2)}
+`;
+}
+function packageEntries(value) {
+  return Array.isArray(value) ? value : [];
+}
+function uniquePackageEntries(values) {
+  const seen = new Set;
+  const result = [];
+  for (const value of values) {
+    const key = isString(value) ? `string:${value}` : `json:${JSON.stringify(value)}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    result.push(value);
+  }
+  return result;
+}
+function isPiConfigPath(path, file, name) {
+  const parent = path.dirname(file);
+  return path.basename(file) === name && (path.basename(parent) === ".pi" || path.basename(parent) === "agent" && path.basename(path.dirname(parent)) === ".pi");
+}
+function mergeCodexConfig(existingText, generatedText, managedMcpNames, managedSkillPaths, keepKitmanPlugins) {
+  const preserved = stripTomlTables(existingText, new Set([...managedMcpNames, ...mcpServerNames(generatedText)]), new Set([...managedSkillPaths, ...codexSkillPaths(generatedText)]), keepKitmanPlugins ? undefined : kitmanPluginNames(generatedText)).trimEnd();
+  const generated = generatedText.trim();
+  if (preserved.length === 0)
+    return `${generated}
+`;
+  if (generated.length === 0)
+    return `${preserved}
+`;
+  return `${preserved}
+
+${generated}
+`;
+}
+function stripTomlTables(text, removeMcpServerNames, removeSkillPaths, keptKitmanPlugins) {
+  const lines = text.split(`
+`);
+  const staleHookState = (key) => {
+    const plugin = /^([^@]+)@kitman:/u.exec(key ?? "")?.[1];
+    return keptKitmanPlugins !== undefined && plugin !== undefined && !keptKitmanPlugins.has(plugin);
+  };
+  const kept = [];
+  for (let index = 0;index < lines.length; ) {
+    const line = lines[index] ?? "";
+    const table = tomlTableHeader2(line);
+    if (table === undefined) {
+      kept.push(line);
+      index += 1;
+      continue;
+    }
+    const block = [line];
+    index += 1;
+    while (index < lines.length && tomlTableHeader2(lines[index] ?? "") === undefined) {
+      block.push(lines[index] ?? "");
+      index += 1;
+    }
+    const skillPath = table === "skills.config" ? codexSkillPathFromBlock(block) : undefined;
+    const [first, second, hookKey, ...rest] = tomlKeyPath2(table);
+    const hookState = first === "hooks" && second === "state";
+    const drop = keptKitmanPlugins !== undefined && isKitmanPluginTable([first ?? "", second ?? ""]) || hookState && rest.length === 0 && staleHookState(hookKey) || codexMcpServerName(table, removeMcpServerNames) !== undefined || skillPath !== undefined && removeSkillPaths.has(skillPath);
+    if (drop)
+      continue;
+    if (hookState && hookKey === undefined)
+      kept.push(...block.filter((entry) => !staleHookState(tomlKeyPath2(/^([^=]+)=/u.exec(entry)?.[1] ?? "")[0])));
+    else
+      kept.push(...block);
+  }
+  return kept.join(`
+`);
+}
+function tomlTableHeader2(line) {
+  return /^\s*\[\[?((?:"(?:[^"\\]|\\.)*"|'[^']*'|[^"'[\]#])+)\]\]?\s*(?:#.*)?$/u.exec(line)?.[1];
+}
+function kitmanPluginNames(toml) {
+  return new Set(toml.split(`
+`).flatMap((line) => {
+    const [table, name] = tomlKeyPath2(tomlTableHeader2(line) ?? "");
+    return table === "plugins" && name?.endsWith("@kitman") === true ? [name.slice(0, -"@kitman".length)] : [];
+  }));
+}
+function isKitmanPluginTable([table, name]) {
+  return table === "marketplaces" && name === "kitman" || table === "plugins" && name?.endsWith("@kitman") === true;
+}
+function tomlKeyPath2(key) {
+  const part = /\s*(?:"((?:[^"\\]|\\.)*)"|'([^']*)'|([\w-]+))\s*(?:\.|$)/uy;
+  const parts = [];
+  while (part.lastIndex < key.length) {
+    const match = part.exec(key);
+    if (match === null)
+      return [];
+    parts.push(match[3] ?? match[2] ?? unescapeTomlString(match[1] ?? ""));
+  }
+  return parts;
+}
+function unescapeTomlString(text) {
+  const escapes = new Map([
+    ["b", "\b"],
+    ["t", "\t"],
+    ["n", `
+`],
+    ["f", "\f"],
+    ["r", "\r"],
+    ["e", "\x1B"]
+  ]);
+  return text.replace(/\\(?:u([\da-fA-F]{4})|U([\da-fA-F]{8})|(.))/gu, (_, short, long, char) => short !== undefined || long !== undefined ? String.fromCodePoint(Number.parseInt(short ?? long, 16)) : escapes.get(char) ?? char);
+}
+function mcpServerNames(toml) {
+  const names = new Set;
+  for (const line of toml.split(`
+`)) {
+    const table = tomlTableHeader2(line);
+    if (table === undefined)
+      continue;
+    const name = codexMcpServerTableName(table);
+    if (name !== undefined)
+      names.add(name);
+  }
+  return names;
+}
+function codexSkillPaths(toml) {
+  const paths = new Set;
+  const lines = toml.split(`
+`);
+  for (let index = 0;index < lines.length; ) {
+    const line = lines[index] ?? "";
+    if (!/^\s*\[\[\s*skills\.config\s*\]\]/u.test(line)) {
+      index += 1;
+      continue;
+    }
+    const block = [line];
+    index += 1;
+    while (index < lines.length && tomlTableHeader2(lines[index] ?? "") === undefined) {
+      block.push(lines[index] ?? "");
+      index += 1;
+    }
+    const path = codexSkillPathFromBlock(block);
+    if (path !== undefined)
+      paths.add(path);
+  }
+  return paths;
+}
+function codexSkillPathFromBlock(block) {
+  for (const line of block) {
+    const match = /^path\s*=\s*"((?:\\"|[^"])*)"/.exec(line.trim());
+    const value = match === null ? undefined : decodeJsonStringSync(`"${match[1]}"`);
+    if (isString(value))
+      return value;
+  }
+}
+function codexMcpServerName(table, names) {
+  const name = codexMcpServerTableName(table);
+  return name !== undefined && names.has(name) ? name : undefined;
+}
+function codexMcpServerTableName(table) {
+  const match = /^mcp_servers\.([^.]+)(?:\.|$)/.exec(table);
+  if (match === null)
+    return;
+  return match[1];
+}
+function parseJsonObject(text) {
+  return text.trim().length === 0 ? {} : objectValue(decodeJsonStringSync(text));
+}
+function objectValue(value) {
+  return isJsonObject(value) ? value : {};
+}
+function arrayValue(value) {
+  return Array.isArray(value) ? value.filter((item) => isString(item)) : [];
+}
+function uniqueStrings(values) {
+  return [...new Set(values)];
+}
+
+// packages/agent-runtime/src/source-resolver.ts
+import { tmpdir } from "os";
+class SourceResolutionFailed extends TaggedError("SourceResolutionFailed") {
+  get message() {
+    return this.reason;
+  }
+}
+var isCommitHash = (ref) => ref !== undefined && /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(ref);
+var gitCommit = (url, ref) => gen(function* () {
+  const patterns = ref === undefined ? ["HEAD"] : [ref, `${ref}^{}`];
+  const output = yield* runCommand2("git", ["ls-remote", "--", url, ...patterns], {
+    cwd: tmpdir(),
+    timeout: "1 minute"
+  }).pipe(mapError2((error) => new SourceResolutionFailed({ reason: error.message })));
+  const lines = output.split(`
+`).map((line) => line.split("\t"));
+  const names = ref === undefined ? ["HEAD"] : ref.startsWith("refs/") ? [ref] : [`refs/heads/${ref}`, `refs/tags/${ref}`];
+  const commit = (lines.find(([, name]) => names.some((candidate) => name === `${candidate}^{}`)) ?? lines.find(([, name]) => names.includes(name ?? "")))?.[0];
+  if (!isCommitHash(commit))
+    return yield* new SourceResolutionFailed({ reason: `${url} has no ${ref ?? "default branch"}` });
+  return commit;
+});
+var npmLatest = (packageName) => NpmRegistry.use((registry) => registry.latest(packageName)).pipe(mapError2((error) => new SourceResolutionFailed({ reason: error.message })));
+var SourceResolver = Reference("kitman/agent-runtime/SourceResolver", {
+  defaultValue: () => ({ gitCommit, npmLatest })
+});
+var withSourceResolutionCache2 = (effect) => gen(function* () {
+  const resolver = yield* SourceResolver;
+  const answers = new Map;
+  const once = (key, resolve) => suspend3(() => answers.get(key) ?? resolve.pipe(exit, flatMap3((exit) => {
+    answers.set(key, exit);
+    return exit;
+  })));
+  return yield* effect.pipe(provideService(SourceResolver, {
+    gitCommit: (url, ref) => once(`git:${url}#${ref ?? ""}`, resolver.gitCommit(url, ref)),
+    npmLatest: (packageName) => once(`npm:${packageName}`, resolver.npmLatest(packageName))
+  }));
+});
+
+// packages/agent-runtime/src/skill-materializer.ts
+var gitSourceKey = (source) => `${source.url}#${source.ref ?? ""}:${source.path ?? ""}`;
+var approvedCommits = (approved, source) => approved.flatMap((entry) => {
+  const [commit, path] = entry.startsWith(`${source.url}#`) ? entry.slice(source.url.length + 1).split(/:(.*)/su) : [];
+  return isCommitHash(commit) && path === (source.path ?? "") ? [commit] : [];
+});
+var resolveGitSource = (subject, source, input) => gen(function* () {
+  if (!source.url.startsWith("https://"))
+    return { problem: `${subject} must come from an https URL, not ${source.url}.` };
+  const resolver = yield* SourceResolver;
+  const latest = input.versions === "latest";
+  const ref = latest ? undefined : source.ref;
+  const resolved = (isCommitHash(ref) ? succeed6(ref) : resolver.gitCommit(source.url, ref)).pipe(map8((commit) => ({ commit })), catch_((error) => succeed6({
+    problem: `Kitman could not resolve ${subject} from ${source.url}${ref === undefined ? "" : ` at ${ref}`}: ${error.message}`
+  })));
+  if (input.requireReviewedSources !== true)
+    return yield* resolved;
+  const approved = approvedCommits(input.approvedSkillSources ?? [], source);
+  const wanted = isCommitHash(ref) ? { commit: ref } : undefined;
+  if (ref === undefined && !latest && approved.length > 0)
+    return { commit: approved.at(-1) ?? "" };
+  const candidate = wanted ?? (yield* resolved);
+  if ("problem" in candidate)
+    return { rejected: true, problem: `${candidate.problem} Under review Kitman keeps no copy it cannot check.` };
+  if (approved.includes(candidate.commit))
+    return candidate;
+  return {
+    rejected: true,
+    problem: `${subject} is not approved at ${candidate.commit}; approve it by adding ${source.url}#${candidate.commit}:${source.path ?? ""} to approvedSkillSources in your Kitman user config, or remove it from the Kit.`
+  };
+});
+
+class AgentEnvironmentMaterializationError2 extends TaggedError("AgentEnvironmentMaterializationError") {
+  get message() {
+    return `AgentEnvironment materialization failed: ${this.issues.map((issue) => issue.message).join("; ")}`;
+  }
+}
+
+class SkillMaterializationRefused2 extends TaggedError("SkillMaterializationRefused") {
+}
+var previewAgentEnvironmentMaterialization2 = fnUntraced(function* (input) {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const home = input.rootDir ?? (yield* optionalEnv("HOME")) ?? ".";
+  const harness = input.environment.harness;
+  const sourceRoot = input.cacheRoot ?? path.join(home, ".kitman", "agent-environment", "skills");
+  const targetRoot = skillBasePath(path, harness, input.scope, input.rootDir, home);
+  const operations = [];
+  const materializedSkills = [];
+  const materializedPlugins = [];
+  const skippedPlugins = [];
+  const warnings = [];
+  const unresolvedLinks = [];
+  for (const skill of input.environment.skills) {
+    const skillKey = skillIdentity2(skill.item);
+    const targetPath = path.join(targetRoot, `${skillSlug(skill.item.name)}-${hashSegment(skillKey)}`);
+    const source = skill.item.source;
+    const fromKit = skill.source.label === undefined ? "" : ` (from Kit ${skill.source.label})`;
+    const gitSkillPath = path.join(sourceRoot, "git", hashSegment(skillKey), skillSlug(skill.item.name));
+    const problem = source.kind === "kitman" ? source.contentMarkdown === undefined ? `Kitman skill ${skill.item.name} has no contentMarkdown to materialize.` : undefined : input.noInstall === true ? `Skipping materialization for ${skill.item.name} because sync was run with noInstall.` : source.kind !== "git" ? `Skill ${skill.item.name}${fromKit} comes from ${source.kind}, which Kitman cannot install yet; only Kitman and git skills are installed. Remove it from the Kit or make it recommended.` : undefined;
+    const resolution = problem === undefined && source.kind === "git" ? yield* resolveGitSource(`Git skill ${skill.item.name}${fromKit}`, source, input) : undefined;
+    const issueMessage = problem ?? (resolution !== undefined && "problem" in resolution ? resolution.problem : undefined);
+    if (issueMessage !== undefined) {
+      const issue = { message: issueMessage, skillName: skill.item.name, skillKey };
+      if (skill.item.policy === "required")
+        return yield* new AgentEnvironmentMaterializationError2({ issues: [issue] });
+      warnings.push(issue);
+      if (resolution !== undefined && "rejected" in resolution)
+        continue;
+      unresolvedLinks.push(targetPath);
+      if (source.kind === "git" && (yield* fs.exists(gitSkillPath).pipe(orElseSucceed(() => false))))
+        materializedSkills.push({
+          name: skill.item.name,
+          key: skillKey,
+          harness,
+          source,
+          skillPath: gitSkillPath,
+          managed: true
+        });
+      continue;
+    }
+    const commit = resolution !== undefined && "commit" in resolution ? resolution.commit : undefined;
+    const expose = (skillPath) => {
+      operations.push({
+        kind: "symlink_skill",
+        skillName: skill.item.name,
+        skillKey,
+        sourcePath: skillPath,
+        targetPath,
+        sourceRoot,
+        targetRoot
+      });
+      materializedSkills.push({
+        name: skill.item.name,
+        key: skillKey,
+        harness,
+        source,
+        skillPath,
+        managed: true,
+        ...commit === undefined ? undefined : { commit }
+      });
+    };
+    if (source.kind === "git" && commit !== undefined) {
+      operations.push({
+        kind: "fetch_git_skill",
+        skillName: skill.item.name,
+        skillKey,
+        url: source.url,
+        ref: commit,
+        ...source.path === undefined ? undefined : { repositoryPath: source.path },
+        path: gitSkillPath
+      });
+      expose(gitSkillPath);
+    } else if (source.kind === "kitman" && source.contentMarkdown !== undefined) {
+      const skillPath = path.join(sourceRoot, "kitman", hashSegment(source.skillId ?? source.name ?? skill.item.name), skillSlug(skill.item.name));
+      operations.push({
+        kind: "write_skill",
+        skillName: skill.item.name,
+        skillKey,
+        path: path.join(skillPath, "SKILL.md"),
+        content: skillMarkdown(skill.item.name, source.contentMarkdown)
+      });
+      expose(skillPath);
+    }
+  }
+  const codexMarketplace = harness === "codex" && input.scope === "user";
+  const marketplaceRoot = path.join(sourceRoot, "codex-marketplace");
+  const claudePluginsRoot = path.join(sourceRoot, "git-plugins");
+  for (const plugin of harness === "claude-code" || codexMarketplace ? input.environment.plugins : []) {
+    const source = plugin.item.sources.find((candidate) => candidate.kind === "git");
+    if (source === undefined)
+      continue;
+    const name = plugin.item.name;
+    const pluginKey = `plugin:git:${gitSourceKey(source)}:${name}`;
+    const fromKit = plugin.source.label === undefined ? "" : ` (from Kit ${plugin.source.label})`;
+    if (input.noInstall === true) {
+      skippedPlugins.push(name);
+      warnings.push({
+        message: `Skipping materialization for plugin ${name} because sync was run with noInstall.`,
+        skillName: name,
+        skillKey: pluginKey
+      });
+      continue;
+    }
+    const directoryName = `${skillSlug(name)}-${hashSegment(pluginKey)}`;
+    const [pluginPath, manifest] = harness === "codex" ? [path.join(marketplaceRoot, "plugins", directoryName), ".codex-plugin/plugin.json"] : [path.join(claudePluginsRoot, hashSegment(pluginKey), skillSlug(name)), ".claude-plugin/plugin.json"];
+    const resolution = yield* resolveGitSource(`Git plugin ${name}${fromKit}`, source, input);
+    if ("problem" in resolution) {
+      const issue = { message: resolution.problem, skillName: name, skillKey: pluginKey };
+      if (plugin.item.policy === "required")
+        return yield* new AgentEnvironmentMaterializationError2({ issues: [issue] });
+      warnings.push(issue);
+      if ("rejected" in resolution)
+        continue;
+      unresolvedLinks.push(path.join(targetRoot, directoryName));
+      if (yield* fs.exists(path.join(pluginPath, manifest)).pipe(orElseSucceed(() => false)))
+        materializedPlugins.push({
+          name,
+          key: pluginKey,
+          harness,
+          source,
+          pluginPath,
+          ...harness === "codex" ? { marketplaceRoot } : undefined
+        });
+      continue;
+    }
+    operations.push({
+      kind: "fetch_git_plugin",
+      pluginName: name,
+      pluginKey,
+      url: source.url,
+      ref: resolution.commit,
+      manifest,
+      path: pluginPath,
+      sourceRoot
+    });
+    if (harness === "codex") {
+      materializedPlugins.push({
+        name,
+        key: pluginKey,
+        harness,
+        source,
+        pluginPath,
+        marketplaceRoot,
+        commit: resolution.commit
+      });
+      continue;
+    }
+    operations.push({
+      kind: "symlink_skill",
+      skillName: name,
+      skillKey: pluginKey,
+      sourcePath: pluginPath,
+      targetPath: path.join(targetRoot, directoryName),
+      sourceRoot,
+      targetRoot
+    });
+    materializedPlugins.push({ name, key: pluginKey, harness, source, pluginPath, commit: resolution.commit });
+  }
+  if (input.noInstall !== true)
+    operations.push({
+      kind: "unlink_stale_links",
+      path: targetRoot,
+      sourceRoot,
+      keepPaths: [
+        ...operations.flatMap((operation) => operation.kind === "symlink_skill" ? [operation.targetPath] : []),
+        ...unresolvedLinks
+      ],
+      sharedWith: AgentHarnessIds.filter((other) => other !== harness && skillBasePath(path, other, input.scope, input.rootDir, home) === targetRoot).map((other) => ({
+        harness: other,
+        manifestPath: path.join(input.scope === "user" ? home : input.rootDir ?? ".", ".kitman", `agent-environment.${other}.manifest.json`)
+      }))
+    });
+  const marketplacePath = path.join(marketplaceRoot, ".agents", "plugins", "marketplace.json");
+  if (codexMarketplace && input.noInstall !== true)
+    operations.push({
+      kind: "write_codex_marketplace",
+      path: marketplacePath,
+      content: `${yield* encodePrettyJsonString({
+        name: "kitman",
+        interface: { displayName: "Kitman" },
+        plugins: materializedPlugins.map((plugin) => ({
+          name: plugin.name,
+          source: { source: "local", path: `./${path.relative(marketplaceRoot, plugin.pluginPath)}` },
+          policy: { installation: "INSTALLED_BY_DEFAULT", authentication: "ON_INSTALL" },
+          category: "Productivity"
+        }))
+      }).pipe(orDie)}
+`,
+      sourceRoot
+    });
+  return {
+    harness,
+    operations,
+    materializedSkills,
+    materializedPlugins,
+    skippedPlugins,
+    warnings,
+    ...codexMarketplace && materializedPlugins.length > 0 ? { codexHookTrust: { home, marketplacePath } } : undefined
+  };
+});
+var gitCheckouts2 = gen(function* () {
+  const scope = yield* Scope;
+  const trees = new Map;
+  const checkout = (url, ref) => gen(function* () {
+    const key = `${url}#${ref}`;
+    const known = trees.get(key);
+    if (known !== undefined)
+      return known;
+    const tree = yield* checkoutGitTree(url, ref).pipe(provide(scope));
+    trees.set(key, tree);
+    return tree;
+  });
+  return checkout;
+});
+var applyAgentEnvironmentMaterialization2 = (plan, checkout) => gen(function* () {
+  const checkoutTree = checkout ?? (yield* gitCheckouts2);
+  for (const operation of plan.operations) {
+    if (operation.kind === "write_skill")
+      yield* writeSkill(plan, operation);
+    else if (operation.kind === "fetch_git_skill")
+      yield* fetchGitSkill(plan, operation, checkoutTree);
+    else if (operation.kind === "fetch_git_plugin")
+      yield* fetchGitPlugin(operation, checkoutTree);
+    else if (operation.kind === "write_codex_marketplace")
+      yield* writeCodexMarketplace(operation);
+    else if (operation.kind === "unlink_stale_links")
+      yield* unlinkStaleLinks(operation);
+    else
+      yield* exposeSkill(operation);
+  }
+  return plan;
+}).pipe(scoped);
+var refuse = (message) => fail7(new SkillMaterializationRefused2({ message }));
+var managedSkillPath = (plan, skillKey, file) => gen(function* () {
+  const boundary = plan.operations.find((candidate) => candidate.kind === "symlink_skill" && candidate.skillKey === skillKey);
+  if (boundary === undefined)
+    return yield* refuse("SKILL_SYMLINK_BOUNDARY_MISSING");
+  return yield* managedPath(boundary.sourceRoot, file);
+});
+var managedPath = (sourceRoot, file) => gen(function* () {
+  const path = yield* Path;
+  const root = path.resolve(sourceRoot);
+  const target = path.resolve(file);
+  if (!isPathWithin2(path, root, target) || target === root)
+    return yield* refuse("SKILL_WRITE_OUTSIDE_ROOT");
+  yield* assertNoSymlinkComponents(path.dirname(target), "SKILL_WRITE_OUTSIDE_ROOT");
+  return target;
+});
+var writeSkill = (plan, operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedSkillPath(plan, operation.skillKey, operation.path);
+  if (yield* isSymbolicLink(target))
+    return yield* refuse("SKILL_WRITE_SYMLINK");
+  yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+  yield* fs.writeFileString(target, operation.content);
+});
+var checkoutGitTree = (url, ref) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const scratch = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-git-" });
+  const repository = path.join(scratch, "repository");
+  const tree = path.join(scratch, "tree");
+  const git = (...args) => runCommand2("git", ["--git-dir", repository, ...args]);
+  yield* fs.makeDirectory(tree);
+  yield* runCommand2("git", ["init", "--quiet", "--bare", repository]);
+  yield* git("fetch", "--quiet", "--depth", "1", "--", url, ref);
+  yield* git("--work-tree", tree, "checkout", "FETCH_HEAD", "--", ".");
+  return tree;
+});
+var replaceWithCopy = (directory, target) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const staged = `${target}.partial`;
+  yield* fs.remove(staged, { recursive: true, force: true });
+  yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+  yield* fs.copy(directory, staged);
+  yield* fs.remove(target, { recursive: true, force: true });
+  yield* fs.rename(staged, target);
+});
+var fetchGitSkill = (plan, operation, checkout) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedSkillPath(plan, operation.skillKey, operation.path);
+  const tree = yield* checkout(operation.url, operation.ref);
+  const skillDirectory = path.resolve(tree, operation.repositoryPath ?? ".");
+  if (!isPathWithin2(path, tree, skillDirectory))
+    return yield* refuse("SKILL_SOURCE_OUTSIDE_ROOT");
+  if (yield* containsSymbolicLink(tree, skillDirectory))
+    return yield* refuse(`Git skill ${operation.skillName} links to a file outside itself in ${operation.url}@${operation.ref}; Kitman does not install linked files.`);
+  if (!(yield* fs.exists(path.join(skillDirectory, "SKILL.md"))))
+    return yield* refuse(`Git skill ${operation.skillName} has no SKILL.md at ${operation.repositoryPath ?? "the repository root"} in ${operation.url}@${operation.ref}.`);
+  yield* replaceWithCopy(skillDirectory, target);
+});
+var writeCodexMarketplace = (operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedPath(operation.sourceRoot, operation.path);
+  if (yield* isSymbolicLink(target))
+    return yield* refuse("SKILL_WRITE_SYMLINK");
+  yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+  yield* fs.writeFileString(target, operation.content);
+});
+var fetchGitPlugin = (operation, checkout) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedPath(operation.sourceRoot, operation.path);
+  const tree = yield* checkout(operation.url, operation.ref);
+  if (yield* containsSymbolicLink(tree, tree))
+    return yield* refuse(`Git plugin ${operation.pluginName} links to a file in ${operation.url}@${operation.ref}; Kitman does not install linked files.`);
+  if (!(yield* fs.exists(path.join(tree, operation.manifest))))
+    return yield* refuse(`Git plugin ${operation.pluginName} has no ${operation.manifest} at the root of ${operation.url}@${operation.ref}.`);
+  yield* replaceWithCopy(tree, target);
+});
+var unlinkStaleLinks = (operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  if (!(yield* fs.exists(operation.path)))
+    return;
+  yield* assertNoSymlinkComponents(operation.path, "SKILL_TARGET_SYMLINK_PARENT");
+  const sharedSkillPaths = new Set((yield* forEach(operation.sharedWith, (shared) => readManifestSkillPaths2(shared.manifestPath))).flatMap((paths) => [...paths].map((skillPath) => path.resolve(skillPath))));
+  for (const entry of yield* fs.readDirectory(operation.path)) {
+    const link = path.join(operation.path, entry);
+    if (operation.keepPaths.includes(link) || !(yield* isSymbolicLink(link)))
+      continue;
+    const linkTarget = path.resolve(operation.path, yield* fs.readLink(link));
+    if (isPathWithin2(path, operation.sourceRoot, linkTarget) && !sharedSkillPaths.has(linkTarget))
+      yield* fs.remove(link);
+  }
+});
+var containsSymbolicLink = (root, directory) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  for (let current = directory;current !== root; current = path.dirname(current))
+    if (yield* isSymbolicLink(current))
+      return true;
+  if (!(yield* fs.exists(directory)))
+    return false;
+  for (const entry of yield* fs.readDirectory(directory, { recursive: true }))
+    if (yield* isSymbolicLink(path.join(directory, entry)))
+      return true;
+  return false;
+});
+var exposeSkill = (operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  if (operation.sourceRoot.length === 0 || operation.targetRoot.length === 0)
+    return yield* refuse("SKILL_SYMLINK_BOUNDARY_MISSING");
+  yield* assertNoSymlinkComponents(operation.sourceRoot, "SKILL_SOURCE_SYMLINK_PARENT");
+  const sourceRoot = yield* realPathOr(operation.sourceRoot, "SKILL_SOURCE_ROOT_UNAVAILABLE");
+  const sourcePath = yield* realPathOr(operation.sourcePath, "SKILL_SOURCE_UNAVAILABLE");
+  if (!isPathWithin2(path, sourceRoot, sourcePath))
+    return yield* refuse("SKILL_SOURCE_OUTSIDE_ROOT");
+  const skillDocument = path.join(sourcePath, "SKILL.md");
+  if ((yield* fs.exists(skillDocument)) && !isPathWithin2(path, sourcePath, yield* fs.realPath(skillDocument)))
+    return yield* refuse("SKILL_SOURCE_OUTSIDE_ROOT");
+  const targetRoot = path.resolve(operation.targetRoot);
+  const targetPath = path.resolve(operation.targetPath);
+  const targetParent = path.dirname(targetPath);
+  if (!isPathWithin2(path, targetRoot, targetPath) || !isPathWithin2(path, targetRoot, targetParent))
+    return yield* refuse("SKILL_TARGET_OUTSIDE_ROOT");
+  yield* assertNoSymlinkComponents(targetParent, "SKILL_TARGET_SYMLINK_PARENT");
+  yield* fs.makeDirectory(targetParent, { recursive: true });
+  if (yield* isSymbolicLink(targetPath)) {
+    const linkTarget = yield* fs.readLink(targetPath);
+    const resolvedLink = path.resolve(targetParent, linkTarget);
+    if ((yield* fs.exists(resolvedLink)) && (yield* fs.realPath(resolvedLink)) === sourcePath)
+      return;
+    if (!linkTarget.includes("/.kitman/agent-environment/skills/"))
+      return yield* refuse(`Refusing to replace non-Kitman skill symlink: ${targetPath}`);
+    yield* fs.remove(targetPath);
+  } else if (yield* fs.exists(targetPath)) {
+    return yield* refuse(`Refusing to replace user-owned skill path: ${targetPath}`);
+  }
+  yield* fs.symlink(path.resolve(operation.sourcePath), targetPath);
+});
+var isSymbolicLink = (file) => flatMap3(FileSystem, (fs) => fs.readLink(file).pipe(as(true), orElseSucceed(() => false)));
+var realPathOr = (file, reason) => flatMap3(FileSystem, (fs) => fs.realPath(file).pipe(mapError2(() => new SkillMaterializationRefused2({ message: reason }))));
+var assertNoSymlinkComponents = (file, reason) => gen(function* () {
+  const path = yield* Path;
+  for (let current = path.resolve(file);; current = path.dirname(current)) {
+    if (yield* isSymbolicLink(current))
+      return yield* refuse(reason);
+    if (path.dirname(current) === current)
+      return;
+  }
+});
+function isPathWithin2(path, root, candidate) {
+  const remainder = path.relative(path.resolve(root), path.resolve(candidate));
+  return remainder === "" || remainder !== ".." && !remainder.startsWith(`..${path.sep}`) && !path.isAbsolute(remainder);
+}
+function skillIdentity2(skill) {
+  const source = skill.source;
+  if (source.kind === "skills_sh")
+    return `skills_sh:${source.slug}${source.version === undefined ? "" : `@${source.version}`}:${skill.name}`;
+  if (source.kind === "kitman")
+    return `kitman:${source.skillId ?? source.name ?? skill.name}:${skill.name}`;
+  if (source.kind === "git")
+    return `git:${source.url}#${source.ref ?? ""}:${source.path ?? ""}:${skill.name}`;
+  if (source.kind === "package")
+    return `package:${source.packageName}@${source.version}:${source.path ?? ""}:${skill.name}`;
+  if (source.kind === "url")
+    return `url:${source.sha256}:${skill.name}`;
+  return `local_path:${source.path}:${skill.name}`;
+}
+var ProjectSkillDirectories = {
+  "claude-code": ".claude/skills",
+  codex: ".agents/skills",
+  opencode: ".agents/skills",
+  pi: ".pi/skills"
+};
+function skillBasePath(path, harness, scope, rootDir, home) {
+  if (scope !== "user")
+    return path.join(rootDir ?? ".", ProjectSkillDirectories[harness]);
+  return harness === "claude-code" ? path.join(home, ".claude", "skills") : path.join(home, ".agents", "skills");
+}
+function skillMarkdown(name, contentMarkdown) {
+  const content = contentMarkdown.trimEnd();
+  if (content.trimStart().startsWith("---"))
+    return `${content}
+`;
+  return `---
+name: ${skillSlug(name)}
+description: ${JSON.stringify(name)}
+---
+
+${content}
+`;
+}
+function skillSlug(name) {
+  const slug = name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  return slug.length === 0 ? "kitman-skill" : slug;
+}
+function hashSegment(value) {
+  return sha2562(value).slice(0, 16);
+}
+
+export { writeAgentEnvironmentConfigFile2, readManifestSkillPaths2, tomlTableHeader2, tomlKeyPath2, SourceResolver, withSourceResolutionCache2, AgentEnvironmentMaterializationError2, SkillMaterializationRefused2, previewAgentEnvironmentMaterialization2, gitCheckouts2, applyAgentEnvironmentMaterialization2, isPathWithin2, skillIdentity2 };