@mmerterden/multi-agent-pipeline 20.8.0 → 20.8.2

package/pipeline/scripts/pre-commit-check.sh

@@ -85,6 +85,13 @@ process.stdin.on("end", () => {
 });
 ' 2>/dev/null || true)"
     fi
+    # A command that never spells git, even with its quotes and backslashes
+    # removed (g'i't, "git", \git), cannot run it through any path the helper
+    # below would recognise, so it returns before paying for the parse.
+    if [ -n "$HOOK_COMMAND" ] \
+      && ! printf '%s' "$HOOK_COMMAND" | tr -d "\"'\\\\" | grep -qi 'git'; then
+      exit 0
+    fi
     if [ -n "$HOOK_COMMAND" ]; then
       # Commit detection is a tokenizer, not a regex: agent-guard.py shares its
       # shell parser through `--git-subcommand`, so an absolute git path, a
@@ -156,7 +163,7 @@ is_binary() {
 # a diff, or the whole file for something not yet tracked at all - every line
 # of a brand-new file is an addition).
 scan_file() {
-  local file="$1" content="$2"
+  local file="$1" content="$2" folded="${3:-}"
 
   # .env files
   if echo "$file" | grep -qE '\.env($|\.)'; then
@@ -174,17 +181,11 @@ scan_file() {
 
   [ -z "$content" ] && return 0
 
-  # A token written with an invisible character or a look-alike letter: scan a
-  # folded copy too. Only non-ASCII content pays for the node call.
-  if printf '%s' "$content" | LC_ALL=C grep -q '[^ -~[:space:]]' 2>/dev/null \
-     && command -v node >/dev/null 2>&1 \
-     && [ -f "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" ]; then
-    local folded
-    folded=$(printf '%s' "$content" | node "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" 2>/dev/null) || folded=""
-    if [ -n "$folded" ] && [ "$folded" != "$content" ]; then
-      content="$content
+  # A token written with an invisible character or a look-alike letter: the
+  # folded copy (see fold_and_scan) is scanned together with the raw text.
+  if [ -n "$folded" ] && [ "$folded" != "$content" ]; then
+    content="$content
 $folded"
-    fi
   fi
 
   # API keys / tokens (key = "long_string" pattern)
@@ -281,15 +282,50 @@ $folded"
     if [ -n "$candidates" ]; then
       entropy_hit=$(printf '%s\n' "$candidates" | awk '
         # Word-shaped identifier: letters and _ or - only, split into segments at
-        # separators and case boundaries (UIApplication -> UI, Application), where
-        # the segments read like words: average length 4+, none longer than 24,
-        # and at least 70 percent carrying a vowel. Random letters-only tokens
-        # flip case every one or two characters, so their segments average about
-        # two characters with few vowels; a long lowercase run is one oversized
-        # segment. Neither shape passes.
-        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, voweled, split_here) {
+        # separators and case boundaries (UIApplication -> UI, Application),
+        # where the segments average 4+ letters, none is longer than 24, and the
+        # letter pairs inside them read like English. PAIR scores every pair as
+        # log2 of how often it occurs across a 235k-word English word list
+        # relative to a uniform draw, rounded and clipped to -4..4 (stored +4,
+        # one row per first letter). Identifiers made of words average above
+        # +0.5 per pair even with an abbreviation or two (Qr, Ffp, Otp, Kg);
+        # uniformly random letters average below +0.1, so the mean must reach
+        # +0.25. Clipping keeps one unusual pair from outweighing the rest. An
+        # all-caps segment of up to five letters inside a token that also has
+        # lowercase letters is an acronym (URL, HTTP, JSON) and is not scored.
+        BEGIN {
+          rows = "06655352403757150767433232 52015000500600400421400010 " \
+            "60306006504400600515500040 50026021600313500420301030 " \
+            "63564442401657452876433420 40004300400400400302400020 " \
+            "50005033500423400510400030 60006000600322600403301050 " \
+            "64764551103657651577350105 20002000000000200000200000 " \
+            "30005001400201200010100010 71237220701622630024520060 " \
+            "64006000600032650010400040 62667462613324631357422031 " \
+            "44553352403667560766644321 60006006500501630644400030 " \
+            "00000000000000000000400000 73447233703354740445432050 " \
+            "51506105602453552067502040 61307106700421600624502050 " \
+            "44443230401657240665000000 40006000400000300000100000 " \
+            "40004002400102400100000000 20102000300000220002000020 " \
+            "31332020200433340343000000 30004000200000300000000011";
+          split(rows, row, " ");
+          alpha = "abcdefghijklmnopqrstuvwxyz";
+          for (r = 1; r <= 26; r++)
+            for (k = 1; k <= 26; k++)
+              PAIR[substr(alpha, r, 1) substr(alpha, k, 1)] = substr(row[r], k, 1) - 4;
+        }
+        function score_segment(seg, has_lower,    l, j) {
+          if (has_lower && seg ~ /^[A-Z]+$/ && length(seg) <= 5) return;
+          l = tolower(seg);
+          for (j = 2; j <= length(l); j++) {
+            pairs++;
+            pair_score += PAIR[substr(l, j - 1, 2)];
+          }
+        }
+        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, split_here, has_lower) {
           if (t !~ /^[A-Za-z_-]+$/) return 0;
-          n = length(t); seg = ""; nseg = 0; total = 0; maxlen = 0; voweled = 0;
+          has_lower = (t ~ /[a-z]/);
+          pairs = 0; pair_score = 0;
+          n = length(t); seg = ""; nseg = 0; total = 0; maxlen = 0;
           for (i = 1; i <= n + 1; i++) {
             c = (i <= n) ? substr(t, i, 1) : "_";
             split_here = 0;
@@ -302,13 +338,13 @@ $folded"
             if (split_here && seg != "") {
               nseg++; total += length(seg);
               if (length(seg) > maxlen) maxlen = length(seg);
-              if (tolower(seg) ~ /[aeiouy]/) voweled++;
+              score_segment(seg, has_lower);
               seg = "";
             }
             if (c != "_" && c != "-") seg = seg c;
           }
-          if (nseg == 0) return 0;
-          return (total / nseg >= 4 && maxlen <= 24 && voweled * 10 >= nseg * 7);
+          if (nseg == 0 || pairs == 0) return 0;
+          return (total / nseg >= 4 && maxlen <= 24 && pair_score * 4 >= pairs);
         }
         {
           s=$0;
@@ -357,9 +393,63 @@ $folded"
   fi
 }
 
+# Files are queued and scanned together so that the look-alike fold runs in
+# one node process for every non-ASCII file of the run rather than one per
+# file. ASCII content folds to itself and is not sent.
+Q_FILES=()
+Q_CONTENTS=()
+queue_file() {
+  Q_FILES+=("$1")
+  Q_CONTENTS+=("$2")
+}
+
+FOLD_WARNED=0
+fold_warn() {
+  [ "$FOLD_WARNED" = "1" ] && return 0
+  FOLD_WARNED=1
+  echo "pre-commit-check: $1 - non-ASCII content scanned without look-alike folding" >&2
+}
+
+fold_and_scan() {
+  local i n=${#Q_FILES[@]} lib="$PRE_COMMIT_DIR/../lib/normalize-text.mjs" out rec
+  local -a idx=() folded=()
+  for ((i = 0; i < n; i++)); do
+    folded[i]=""
+    if printf '%s' "${Q_CONTENTS[i]}" | LC_ALL=C grep -q '[^ -~[:space:]]' 2>/dev/null; then
+      idx+=("$i")
+    fi
+  done
+  if [ "${#idx[@]}" -gt 0 ]; then
+    if ! command -v node >/dev/null 2>&1 || [ ! -f "$lib" ]; then
+      fold_warn "node or lib/normalize-text.mjs unavailable"
+    else
+      out=$(mktemp "${TMPDIR:-/tmp}/pre-commit-fold.XXXXXX") || out=""
+      if [ -n "$out" ] && for i in "${idx[@]}"; do printf '%s\0' "${Q_CONTENTS[i]}"; done \
+        | node "$lib" --nul >"$out" 2>/dev/null; then
+        local -a recs=()
+        while IFS= read -r -d '' rec; do recs+=("$rec"); done <"$out"
+        if [ "${#recs[@]}" -eq "${#idx[@]}" ]; then
+          for ((i = 0; i < ${#idx[@]}; i++)); do folded[idx[i]]="${recs[i]}"; done
+        else
+          fold_warn "the look-alike fold returned ${#recs[@]} of ${#idx[@]} records"
+        fi
+      else
+        fold_warn "the look-alike fold (node lib/normalize-text.mjs) failed"
+      fi
+      [ -n "$out" ] && rm -f "$out"
+    fi
+  fi
+  for ((i = 0; i < n; i++)); do
+    scan_file "${Q_FILES[i]}" "${Q_CONTENTS[i]}" "${folded[i]}"
+  done
+  Q_FILES=()
+  Q_CONTENTS=()
+}
+
 if [ -n "$SCAN_FILE_TARGET" ]; then
   is_binary "$SCAN_FILE_TARGET" && exit 0
-  scan_file "$SCAN_FILE_TARGET" "$(cat "$SCAN_FILE_TARGET" 2>/dev/null)"
+  queue_file "$SCAN_FILE_TARGET" "$(cat "$SCAN_FILE_TARGET" 2>/dev/null)"
+  fold_and_scan
   if [ "$FOUND" -eq 1 ]; then
     echo "" >&2
     echo "Secret check failed on $SCAN_FILE_TARGET." >&2
@@ -402,10 +492,11 @@ if [ -n "$SCAN_RANGE" ]; then
         # blob at this commit so a NUL-laden file cannot hide a key.
         content=$(gitscan show --text --no-textconv "${commit}:${file}" 2>/dev/null || true)
       fi
-      scan_file "$file" "$content"
+      queue_file "$file" "$content"
     done < <(gitscan diff-tree --no-commit-id -r --root -m --first-parent \
       --name-only -z --diff-filter=d "$commit" 2>/dev/null)
   done
+  fold_and_scan
   if [ "$FOUND" -eq 1 ]; then
     echo "" >&2
     echo "Secret check failed on $SCAN_RANGE." >&2
@@ -424,7 +515,7 @@ while IFS= read -r -d '' file; do
   [ ! -f "$file" ] && continue
   is_binary "$file" && continue
   content=$(git diff --cached -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
-  scan_file "$file" "$content"
+  queue_file "$file" "$content"
 done < <(git diff --cached --name-only -z 2>/dev/null)
 
 if [ "$SCAN_UNSTAGED" = "1" ]; then
@@ -435,7 +526,7 @@ if [ "$SCAN_UNSTAGED" = "1" ]; then
     [ ! -f "$file" ] && continue
     is_binary "$file" && continue
     content=$(git diff HEAD -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
-    scan_file "$file" "$content"
+    queue_file "$file" "$content"
   done < <(git diff HEAD --name-only -z 2>/dev/null)
 
   # Untracked (brand-new) files - there is no diff to take yet, so every line
@@ -445,9 +536,10 @@ if [ "$SCAN_UNSTAGED" = "1" ]; then
     [ ! -f "$file" ] && continue
     is_binary "$file" && continue
     content=$(sed 's/^/+/' "$file" 2>/dev/null || true)
-    scan_file "$file" "$content"
+    queue_file "$file" "$content"
   done < <(git ls-files --others --exclude-standard -z 2>/dev/null)
 fi
+fold_and_scan
 
 if [ $FOUND -eq 1 ]; then
   echo "" >&2

package/pipeline/scripts/scan-agent-config.sh

@@ -123,16 +123,16 @@ for _event, entries in (t.get("hooks") or {}).items():
     for e in entries:
         for h in e.get("hooks", []):
             c = h.get("command", "")
-            # Allow only `bash $HOME/.claude/scripts/<name>` plus plain long
-            # flags. Flags had to be admitted because a hook that cannot take
-            # one cannot be correct: SessionEnd runs capture-flush with
-            # --if-stale, and without it every session end would re-flush a run
-            # that already finished. What stays banned is everything that could
-            # turn a flag into a second command - no spaces inside a token, no
-            # quotes, no metacharacters, and the eval/substitution check below
-            # still runs on the whole string.
+            # Allow only `bash "$HOME/.claude/scripts/<name>"` (the path quoted
+            # so a HOME with a space still runs it, or unquoted) plus plain long
+            # flags. SessionEnd needs one: capture-flush takes --if-stale so a
+            # session end does not re-flush a run that already finished. What
+            # stays banned is everything that could turn a flag into a second
+            # command - no spaces inside a token, no quotes beyond the pair
+            # around the path, no metacharacters, and the eval/substitution
+            # check below still runs on the whole string.
             if not re.fullmatch(
-                r'bash \$HOME/\.claude/scripts/[A-Za-z0-9._-]+(?: --[a-z0-9][a-z0-9-]*)*',
+                r'bash (?:"\$HOME/\.claude/scripts/[A-Za-z0-9._-]+"|\$HOME/\.claude/scripts/[A-Za-z0-9._-]+)(?: --[a-z0-9][a-z0-9-]*)*',
                 c.strip()):
                 bad.append(c)
             if re.search(r'\beval\b|\$\(|`|[;&|><]', c):

package/pipeline/scripts/unattended_policy.py

@@ -451,7 +451,14 @@ def structural_refusal(cmd):
     return None
 
 
+# shlex is quadratic in a token's length; a longer segment is split on
+# whitespace with quotes and backslashes removed (agent-guard.py coarse_tokens).
+SHLEX_MAX_CHARS = 16384
+
+
 def tokenize(text):
+    if len(text) > SHLEX_MAX_CHARS:
+        return [re.sub(r"[\"'\\]", "", t) for t in text.split()]
     try:
         return shlex.split(text)
     except ValueError:
@@ -2603,9 +2610,11 @@ TOOLKIT_PREFIX = "mcp__multi-agent-toolkit__"
 # Keys a toolkit tool uses for a filesystem destination it writes. Checked with
 # check_path so a toolkit call cannot write a screenshot, recording, build
 # output or export over a protected path. MCP tools run outside the OS sandbox,
-# so this is their only path boundary.
-TOOLKIT_PATH_KEYS = ("path", "filename", "out_dir", "output_path", "output_dir",
-                     "export_path", "derived_data_path", "result_bundle_path",
+# so this is their only path boundary. The toolkit's write parameters are
+# listed in test/fixtures/toolkit-path-params.json, generated from its tool
+# schemas, and the unattended-guard test checks each one against this list.
+TOOLKIT_PATH_KEYS = ("path", "filename", "out_dir", "output", "output_path", "output_dir",
+                     "output_graph", "export_path", "derived_data_path", "result_bundle_path",
                      "figma_path", "screenshot_path", "video_path", "file_path")
 
 

package/pipeline/scripts/uninstall.mjs

@@ -49,6 +49,7 @@ import {
   writeFileSync,
 } from "fs";
 import { execFileSync } from "child_process";
+import { createHash } from "crypto";
 import { join, dirname } from "path";
 import { homedir } from "os";
 import { pathToFileURL } from "url";
@@ -82,6 +83,22 @@ export const PIPELINE_AGENT_FILES = [
  */
 export const PIPELINE_CORE_SKILL_DIRS = ["apple-archive-compliance", "google-play-compliance"];
 
+/**
+ * Files the installer ships into ~/.claude/templates (install/templates/).
+ * Used only for an install that predates the install manifest; a unit test
+ * asserts it matches the source tree.
+ */
+export const PIPELINE_TEMPLATE_FILES = [
+  "claude-hooks.json",
+  "codex-instructions.md",
+  "copilot-instructions.md",
+  "multi-agent-autopilot-awake.plist.template",
+  "multi-agent-autopilot.plist.template",
+];
+
+/** Written by install/_common.mjs writeInstallManifest at the host dir root. */
+export const INSTALL_MANIFEST = ".pipeline-manifest.json";
+
 const flags = process.argv.slice(2).filter((a) => a !== "uninstall");
 
 const TOOL_FLAGS = [
@@ -238,6 +255,65 @@ function preservePrefsCredentialMapping(prefsPath) {
   );
 }
 
+function sha256Of(path) {
+  try {
+    return createHash("sha256").update(readFileSync(path)).digest("hex");
+  } catch {
+    return null;
+  }
+}
+
+function rmdirIfEmpty(dir) {
+  try {
+    if (readdirSync(dir).length > 0) return;
+  } catch {
+    return;
+  }
+  rmIfExists(dir);
+}
+
+/**
+ * Remove the co-owned files the install manifest records (top-level commands,
+ * lib/, templates/), each only while its hash is still the one installed. An
+ * edited file is the user's now and stays. Returns false when there is no
+ * manifest, so the caller falls back to the pre-manifest cleanup.
+ *
+ * @param {string} hostDir e.g. ~/.claude
+ * @param {string[]} keepInLib lib/ files kept on purpose
+ * @returns {boolean}
+ */
+function rmManifestFiles(hostDir, keepInLib) {
+  const manifestPath = join(hostDir, INSTALL_MANIFEST);
+  let files;
+  try {
+    files = JSON.parse(readFileSync(manifestPath, "utf-8"))?.files;
+  } catch {
+    return false;
+  }
+  if (!files || typeof files !== "object") return false;
+  const kept = [];
+  const dirs = new Set();
+  for (const [rel, hash] of Object.entries(files)) {
+    if (typeof rel !== "string" || rel.split("/").some((part) => part === ".." || part === "")) {
+      continue;
+    }
+    if (rel.startsWith("lib/") && keepInLib.includes(rel.slice(4))) continue;
+    const path = join(hostDir, rel);
+    if (!existsSync(path)) continue;
+    dirs.add(dirname(path));
+    if (sha256Of(path) === hash) rmIfExists(path);
+    else kept.push(rel);
+  }
+  for (const dir of [...dirs].sort((a, b) => b.length - a.length)) {
+    if (dir !== join(hostDir, "commands")) rmdirIfEmpty(dir);
+  }
+  if (kept.length > 0) {
+    console.log(`    kept ${kept.length} file(s) you changed since install: ${kept.join(", ")}`);
+  }
+  rmIfExists(manifestPath);
+  return true;
+}
+
 /**
  * Conditional rm  -  respects --dry-run.
  * @param {string} path
@@ -766,8 +842,19 @@ export async function main() {
     rmIfExists(join(CLAUDE, "scripts"));
     // Pipeline-managed trees the installer lays down alongside scripts/.
     rmIfExists(join(CLAUDE, "multi-agent-refs"));
+    rmIfExists(join(CLAUDE, ".pipeline-swap"));
     rmIfExists(join(CLAUDE, "schemas"));
-    rmDirExcept(join(CLAUDE, "lib"), KEEP_IN_LIB);
+    if (!rmManifestFiles(CLAUDE, KEEP_IN_LIB)) {
+      // An install that predates the manifest wiped lib/ and templates/ on
+      // every run, so their shipped names are the pipeline's. The top-level
+      // commands cannot be told from the user's own and stay.
+      rmDirExcept(join(CLAUDE, "lib"), KEEP_IN_LIB);
+      rmMatchingFiles(join(CLAUDE, "templates"), (name) => PIPELINE_TEMPLATE_FILES.includes(name));
+      rmdirIfEmpty(join(CLAUDE, "templates"));
+      console.log(
+        `    note: no ${INSTALL_MANIFEST}; top-level files in ${join(CLAUDE, "commands")} were left in place`,
+      );
+    }
     rmIfExists(join(CLAUDE, ".pipeline-version"));
     // NOTE: ~/.claude/rules/ is USER-OWNED. install lays baseline rules down
     // write-if-missing and NEVER overwrites them (install/claude.mjs

package/pipeline/scripts/usage-identity.mjs

@@ -200,7 +200,7 @@ function persist(prefsPath, patch, env) {
         j.global.usageLog = { ...(j.global.usageLog || {}), ...patch };
         return j;
       },
-      { mode: 0o600, timeoutMs: lockTimeoutFrom(env) },
+      { mode: 0o600, followSymlink: true, timeoutMs: lockTimeoutFrom(env) },
     );
     return written !== undefined;
   } catch {

package/pipeline/scripts/usage-register.mjs

@@ -230,7 +230,7 @@ export function persistPrefs(
         if (registeredAs) j.global.usageLog.registeredAs = registeredAs;
         return j;
       },
-      { mode: 0o600, timeoutMs: lockTimeoutFrom(process.env) },
+      { mode: 0o600, followSymlink: true, timeoutMs: lockTimeoutFrom(process.env) },
     );
     return written !== undefined;
   } catch {

package/pipeline/skills/.skill-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": "1.0.0",
-  "generatedAt": "2026-09-26T19:14:09Z",
+  "generatedAt": "2026-09-27T07:55:06Z",
   "skillCount": 218,
   "entries": [
     {
@@ -269,7 +269,7 @@
     },
     {
       "path": "shared/external/alarmkit/SKILL.md",
-      "sha256": "dad252df33be787eb9dc9cf0a1d4657b19f69b44c6b4d14010b0cf50117cf4b5"
+      "sha256": "ce285a6e95d03e3bc2f5c3150822e6ee2d07a4b629b81e8c0df81e6840161cb9"
     },
     {
       "path": "shared/external/android-architecture/SKILL.md",
@@ -325,15 +325,15 @@
     },
     {
       "path": "shared/external/app-store-optimization/SKILL.md",
-      "sha256": "3a933c14158a77a8124f74b7f4c145ec202d7ccb74c9b65af436dc236159648d"
+      "sha256": "6015dd7b4c8661e23b677c53c391a3e39116fee2ad6b2b031b3d310eef4a3e2b"
     },
     {
       "path": "shared/external/app-store-review/SKILL.md",
-      "sha256": "a2cd777753347aa66ea7d3094df4209a4a377a1214387283db7ba7247007e4a1"
+      "sha256": "0b77f648fd2d54e991f1c25540629f0a7d4fd2a1b30de7f8aaf07331b93963ea"
     },
     {
       "path": "shared/external/apple-on-device-ai/SKILL.md",
-      "sha256": "7c89227595db96798f9a4225d75ab314c4eab3115ab54a4648501c820e0f2f87"
+      "sha256": "a86a4032c158cdf5523009e332618c0e460a70fe695be99fed8c8767a69afff8"
     },
     {
       "path": "shared/external/architecture/SKILL.md",
@@ -341,7 +341,7 @@
     },
     {
       "path": "shared/external/authentication/SKILL.md",
-      "sha256": "5b8fe68bd207b8ac88874ea514dce7683f7e91de60748b4444df643540bf45c1"
+      "sha256": "4d3da49257432d30196b9970721f801524a7cdce4e6ddcaefc4fe31832a49157"
     },
     {
       "path": "shared/external/avkit/SKILL.md",
@@ -349,7 +349,7 @@
     },
     {
       "path": "shared/external/background-processing/SKILL.md",
-      "sha256": "a356a35289da428d977c85f6984fe204b50298955489752891f98332b891f971"
+      "sha256": "876516478a6019297b886f754e2ec59e96bc73419cfff753dc7bdc7a4336b6e9"
     },
     {
       "path": "shared/external/backlog/SKILL.md",
@@ -357,7 +357,7 @@
     },
     {
       "path": "shared/external/callkit-voip/SKILL.md",
-      "sha256": "0a7102e006a54e38011e24c274c50b0988f210cdd34fb6405ba5db922f23d3e7"
+      "sha256": "44646c2f192170a5468c18a0c78fb77ffcf135bb8d8cf2a7581ac2d1c0909eeb"
     },
     {
       "path": "shared/external/ci-cd-pipelines/SKILL.md",
@@ -369,7 +369,7 @@
     },
     {
       "path": "shared/external/cloudkit-sync/SKILL.md",
-      "sha256": "842889bc86a8be353871c6f2104a8f5f8e506cd81203e135ee25911cac050526"
+      "sha256": "9464e93c0435628f3628a6f1775b7478dea75514b0fb3aa3cc09c7cec83be48d"
     },
     {
       "path": "shared/external/compose-components/SKILL.md",
@@ -393,11 +393,11 @@
     },
     {
       "path": "shared/external/core-bluetooth/SKILL.md",
-      "sha256": "4911322b33fc791564b3ee6498a6df66626f1749e479f3a869ff7528a2597208"
+      "sha256": "3b7b41c7287cb86ee3c5bc477952c659fddbf050ceefbad95ab8a95ff15750be"
     },
     {
       "path": "shared/external/core-data/SKILL.md",
-      "sha256": "c0204397e9dabadad75d4ccbb0c06b4f55c47c97f61c65072a33e4480832ecf0"
+      "sha256": "c232488bc3de3542b25a8b40ba7da648a1c16b8fd467ade21dbde28620ab2c26"
     },
     {
       "path": "shared/external/core-motion/SKILL.md",
@@ -405,11 +405,11 @@
     },
     {
       "path": "shared/external/core-nfc/SKILL.md",
-      "sha256": "0f58b94d639b887588a472385791762181286ab30f015b423d868a1cef8fa5d7"
+      "sha256": "c838b7e38bb0c65f409674220ef9f6b668839ce2c0546609b75c69c1d7c18567"
     },
     {
       "path": "shared/external/coreml/SKILL.md",
-      "sha256": "b16e3b2f288a9f98dabce1d70e759ca2af9e9773830719a64bee57c8b18f5eec"
+      "sha256": "b5f3fdf161a2bd2ab839a52093f0cb99c2c3026211e48a7d13dbab712e11b255"
     },
     {
       "path": "shared/external/council/SKILL.md",
@@ -417,7 +417,7 @@
     },
     {
       "path": "shared/external/cryptokit/SKILL.md",
-      "sha256": "6c1999c0199c7937c063997383f64b353ac692715f579f585adc8d2075f414b2"
+      "sha256": "419f46a3058145f48e1f38e56741dc8074441132a1834812a6d9ad020e1c2c7e"
     },
     {
       "path": "shared/external/css-modern/SKILL.md",
@@ -437,7 +437,7 @@
     },
     {
       "path": "shared/external/device-integrity/SKILL.md",
-      "sha256": "9ac0956d2afb1afa48cc26514aa3ade9aa6ec57d5eb765d42ada61147360dfe2"
+      "sha256": "9d8c39c65f7b5918c25c7ef3dd438fe62901e61ecc6fa2d7ecbd7c9a0fcfa4c0"
     },
     {
       "path": "shared/external/docker-expert/SKILL.md",
@@ -569,7 +569,7 @@
     },
     {
       "path": "shared/external/localization-reuse-map/SKILL.md",
-      "sha256": "565fa80ffa729f49cb4a54fb8f1da98397de5aaf7fb308753d261b5dc9f51f46"
+      "sha256": "0a7429a2bbc2454b12ae4fb9af1eb09cc5a5d1ab96c05c693fc4827747bd8d15"
     },
     {
       "path": "shared/external/macos-menubar-tuist-app/SKILL.md",
@@ -581,7 +581,7 @@
     },
     {
       "path": "shared/external/mapkit-location/SKILL.md",
-      "sha256": "fa78d74db0a13cdcf215a5f62c6b0ed33c5e1a6757b795a9968d131f0a9030ee"
+      "sha256": "d6be293b79f2e0e3312db441c7c315779b7f345cea3c264508bfbf76f49e79ef"
     },
     {
       "path": "shared/external/metrickit-diagnostics/SKILL.md",
@@ -613,7 +613,7 @@
     },
     {
       "path": "shared/external/passkit-wallet/SKILL.md",
-      "sha256": "5780862b6f98b9a2b65975a79c690d2b200126f1004fac5055907b89f4bd8a0f"
+      "sha256": "972a26763ef557d6534e970c6a444526c0fc3eb0ac005f01ac1fee103e052e58"
     },
     {
       "path": "shared/external/pdfkit/SKILL.md",
@@ -621,11 +621,11 @@
     },
     {
       "path": "shared/external/pencilkit-drawing/SKILL.md",
-      "sha256": "080a07ed7fb2f2065030a9d0c543023035b11a180cdc069026be195464afb12e"
+      "sha256": "f18ccc4d5d985492758003aba555ccbfbede2e9c18c70932dc7c1198c4c2f624"
     },
     {
       "path": "shared/external/permissionkit/SKILL.md",
-      "sha256": "92167db142929bcfcb9458163d540bc4badc141dd5de5f7f98e7a5dc79b5b6db"
+      "sha256": "ea30c7a3bb9128a5f43064d5d2e46360d1fe08c732eb3ecedd63490d7d4420a5"
     },
     {
       "path": "shared/external/photos-camera-media/SKILL.md",
@@ -637,7 +637,7 @@
     },
     {
       "path": "shared/external/push-notifications/SKILL.md",
-      "sha256": "f962752d6e540cdd8e98e96f9b0790eccede1d0a88bf5bd22928891d26d172f3"
+      "sha256": "9f73964265e99c21aa0bab61b153a77ad3ac953f45766c852b1c8cfbef8498c3"
     },
     {
       "path": "shared/external/python-patterns/SKILL.md",
@@ -649,7 +649,7 @@
     },
     {
       "path": "shared/external/realitykit-ar/SKILL.md",
-      "sha256": "9c576081a515662c03d462fa0a15828f6e8ab02c8e14e1d4911fc0cfceef47fb"
+      "sha256": "66726df1164bb6ca96878cb941b4395ff3cff10ebc6743f91aa22b8ec795c246"
     },
     {
       "path": "shared/external/rest-api-design/SKILL.md",
@@ -721,7 +721,7 @@
     },
     {
       "path": "shared/external/swift-concurrency/SKILL.md",
-      "sha256": "b231d006488648ec679cac3fb9f6676c32594db3425e32b1e217a7caff73aec0"
+      "sha256": "428a7e31167e98ef300d0c000afda438bfdd7853793571ab4d1d05623e6d4383"
     },
     {
       "path": "shared/external/swift-formatstyle/SKILL.md",
@@ -733,7 +733,7 @@
     },
     {
       "path": "shared/external/swift-security/SKILL.md",
-      "sha256": "2dbc80cc138e70c0477f5340d372102e588a85970710add24d06dae19b5e58ff"
+      "sha256": "0358e6b23ec268c51bf34d9341a80150746d2cbe7f9e4159de5133442a1b0d2e"
     },
     {
       "path": "shared/external/swift-testing-pro/SKILL.md",
@@ -741,7 +741,7 @@
     },
     {
       "path": "shared/external/swift-testing/SKILL.md",
-      "sha256": "71bcab71b1d26f04220561c347ded36920784cdaec85fb3e303405359c99e2de"
+      "sha256": "bed2911b41450d88b77cc913648ea421d99d7c167fb49f4c8bcf54b580952c29"
     },
     {
       "path": "shared/external/swiftdata-pro/SKILL.md",
@@ -749,7 +749,7 @@
     },
     {
       "path": "shared/external/swiftdata/SKILL.md",
-      "sha256": "65518d8167b0ec9ed61608731aa9e7877124e21433cb64f230b9a8da792ceff8"
+      "sha256": "5fa27f7d9c0997acc5959ad811aa4b49ccbd34d62b5237556e1ffaa650447163"
     },
     {
       "path": "shared/external/swiftlint/SKILL.md",
@@ -777,7 +777,7 @@
     },
     {
       "path": "shared/external/swiftui-navigation/SKILL.md",
-      "sha256": "a40a53957bd01be79ff2f692f639fbf618c29da9b98d5f1150618bafd458825d"
+      "sha256": "422a6c0b680d422af731474a9b03d141ef04e1f16359ce25a3ba22780f2bf1c2"
     },
     {
       "path": "shared/external/swiftui-patterns/SKILL.md",
@@ -829,7 +829,7 @@
     },
     {
       "path": "shared/external/vision-framework/SKILL.md",
-      "sha256": "68ef66fc020e65885f47e26e665c88365bbbf52cb1fb8fb8de5c4cab7237c9e8"
+      "sha256": "370fdf6eaf71833dff0e8f2d3989a849b5c42ff3198605aa818c2fd0c12c7ef7"
     },
     {
       "path": "shared/external/vue-composition/SKILL.md",
@@ -837,7 +837,7 @@
     },
     {
       "path": "shared/external/weatherkit/SKILL.md",
-      "sha256": "cafc8e7c7ec3ee6107be992086d5ba3280ef524b5177e5069b8525914b272811"
+      "sha256": "db8a11fc9c572c6d9754c031ad97a868c5d0e6748855d90b72a2aeb44e2d4255"
     },
     {
       "path": "shared/external/web-accessibility/SKILL.md",
@@ -853,7 +853,7 @@
     },
     {
       "path": "shared/external/widgetkit/SKILL.md",
-      "sha256": "e00e47ad977c7775e6c83bcaee68546325cb1b7eb38d208d6fe01ca88090eb77"
+      "sha256": "d4bce1c362e57616b252304414cfd01354586c7ed0be6c22f61efcc0980e26b0"
     },
     {
       "path": "shared/external/xcode-build-benchmark/SKILL.md",