@modootoday/pmcp 0.13.0 → 0.14.0

package/dist/stdio.js

@@ -10,8 +10,8 @@ import { McpServer } from "@modelcontextprotocol/server";
 import { z } from "zod";
 
 // src/catalog.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync as readdirSync2 } from "fs";
-import { basename as basename2, dirname as dirname2, isAbsolute, join as join2, relative } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { basename as basename2, dirname as dirname2, isAbsolute as isAbsolute2, join as join3, relative as relative2 } from "path";
 
 // src/frontmatter.ts
 import { parse } from "yaml";
@@ -133,8 +133,122 @@ function specProblems(front, directory) {
 }
 
 // src/marketplace.ts
-import { existsSync, readFileSync, readdirSync } from "fs";
-import { basename, dirname, join, resolve } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync } from "fs";
+import { basename, dirname, join as join2, resolve as resolve2 } from "path";
+
+// src/marketplace/local.ts
+import { existsSync, readFileSync, realpathSync, statSync } from "fs";
+import { isAbsolute, join, relative, resolve, sep } from "path";
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function containedPath(root, path) {
+  const result = resolve(root, path);
+  const lexical = relative(resolve(root), result);
+  if (isAbsolute(lexical) || lexical === ".." || lexical.startsWith(`..${sep}`))
+    throw new Error("Path leaves the plugin root");
+  const physical = relative(realpathSync(root), realpathSync(result));
+  if (isAbsolute(physical) || physical === ".." || physical.startsWith(`..${sep}`))
+    throw new Error("Path leaves the plugin root through a symlink");
+  return result;
+}
+function pluginManifest(directory) {
+  for (const path of [
+    ".claude-plugin/plugin.json",
+    "plugin.json",
+    ".codex-plugin/plugin.json",
+    ".grok-plugin/plugin.json"
+  ]) {
+    if (!existsSync(join(directory, path))) continue;
+    const value = JSON.parse(
+      readFileSync(containedPath(directory, path), "utf8")
+    );
+    if (!object(value)) throw new Error("Plugin manifest must be an object");
+    return value;
+  }
+  return {};
+}
+function localSource(value) {
+  if (typeof value === "string") return value;
+  if (object(value) && value.source === "local" && typeof value.path === "string")
+    return value.path;
+  throw new Error(
+    "Only installed local plugin sources can be read; use the native installer for remote sources"
+  );
+}
+function readLocalMarketplace(directory, onReject) {
+  const filename = [
+    ".claude-plugin/marketplace.json",
+    ".agents/plugins/marketplace.json",
+    ".grok-plugin/marketplace.json"
+  ].find((path2) => existsSync(join(directory, path2)));
+  if (!filename) {
+    onReject?.({
+      path: directory,
+      reason: "No supported native marketplace.json found"
+    });
+    return null;
+  }
+  const path = join(directory, filename);
+  let manifest2;
+  try {
+    manifest2 = JSON.parse(
+      readFileSync(containedPath(directory, filename), "utf8")
+    );
+  } catch {
+    onReject?.({
+      path,
+      reason: "marketplace.json is not valid JSON or is outside its root"
+    });
+    return null;
+  }
+  if (!object(manifest2) || !Array.isArray(manifest2.plugins)) {
+    onReject?.({ path, reason: "marketplace.json requires a plugins array" });
+    return null;
+  }
+  const name = typeof manifest2.name === "string" ? manifest2.name : "marketplace";
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/u.test(name)) {
+    onReject?.({ path, reason: "Invalid marketplace name" });
+    return null;
+  }
+  const plugins = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of manifest2.plugins) {
+    try {
+      if (!object(item) || typeof item.name !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/u.test(item.name))
+        throw new Error("Invalid plugin name");
+      if (seen.has(item.name)) throw new Error("Duplicate plugin name");
+      const source = localSource(item.source);
+      if (!source.startsWith("./") || source.split(/[\\/]/u).includes(".."))
+        throw new Error("Local plugin source must be a contained ./ path");
+      const pluginDirectory = containedPath(directory, source);
+      if (!statSync(pluginDirectory).isDirectory())
+        throw new Error("Plugin source must be a directory");
+      const metadata2 = pluginManifest(pluginDirectory);
+      if (metadata2.name !== void 0 && metadata2.name !== item.name)
+        throw new Error("Plugin manifest name differs from marketplace entry");
+      seen.add(item.name);
+      plugins.push({
+        name: item.name,
+        directory: pluginDirectory,
+        manifest: metadata2
+      });
+    } catch (error) {
+      onReject?.({
+        path,
+        reason: error instanceof Error ? error.message : "Invalid plugin source"
+      });
+    }
+  }
+  const metadata = object(manifest2.metadata) ? manifest2.metadata : {};
+  return {
+    name,
+    plugins,
+    ...typeof metadata.tier === "string" ? { tier: metadata.tier } : {}
+  };
+}
+
+// src/marketplace.ts
 function readMetadata(source) {
   return metadataOf(frontmatterObject(source));
 }
@@ -147,16 +261,27 @@ var asList = (value) => {
   if (typeof value === "string") return [value];
   return Array.isArray(value) ? value : [];
 };
-function readJson(path) {
+function readJson(path, root) {
   try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    const parsed = JSON.parse(
+      readFileSync2(containedPath(root, path), "utf8")
+    );
     return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
   }
 }
 function markdownEntry(context, path, fallbackSlug, shape) {
-  const source = readFileSync(path, "utf8");
+  let source;
+  try {
+    source = readFileSync2(containedPath(context.pluginDir, path), "utf8");
+  } catch {
+    context.onReject?.({
+      path,
+      reason: "Asset is unreadable or outside the plugin root"
+    });
+    return null;
+  }
   const front = readFrontmatter(source);
   const description = front["description"] ?? "";
   if (description === "") {
@@ -188,25 +313,25 @@ function markdownEntry(context, path, fallbackSlug, shape) {
   };
 }
 function skillEntries(context) {
-  const dir = join(context.pluginDir, "skills");
-  if (!existsSync(dir)) return [];
+  const dir = join2(context.pluginDir, "skills");
+  if (!existsSync2(dir)) return [];
   const found = [];
   for (const child of readdirSync(dir, { withFileTypes: true })) {
     if (!child.isDirectory()) continue;
-    const path = join(dir, child.name, "SKILL.md");
-    if (!existsSync(path)) continue;
+    const path = join2(dir, child.name, "SKILL.md");
+    if (!existsSync2(path)) continue;
     const entry = markdownEntry(context, path, child.name, {});
     if (entry) found.push(entry);
   }
   return found;
 }
 function commandEntries(context) {
-  const dir = join(context.pluginDir, "commands");
-  if (!existsSync(dir)) return [];
+  const dir = join2(context.pluginDir, "commands");
+  if (!existsSync2(dir)) return [];
   const found = [];
   for (const child of readdirSync(dir, { withFileTypes: true })) {
     if (!child.isFile() || !child.name.endsWith(".md")) continue;
-    const path = join(dir, child.name);
+    const path = join2(dir, child.name);
     const entry = markdownEntry(context, path, basename(child.name, ".md"), {
       root: path
     });
@@ -215,22 +340,22 @@ function commandEntries(context) {
   return found;
 }
 function agentEntries(context) {
-  const dir = join(context.pluginDir, "agents");
-  if (!existsSync(dir)) return [];
+  const dir = join2(context.pluginDir, "agents");
+  if (!existsSync2(dir)) return [];
   const found = [];
   for (const child of readdirSync(dir, { withFileTypes: true })) {
     let entry = null;
     if (child.isFile() && child.name.endsWith(".md")) {
-      const path = join(dir, child.name);
+      const path = join2(dir, child.name);
       entry = markdownEntry(context, path, basename(child.name, ".md"), {
         kind: "agent",
         root: path,
         namespace: "agents"
       });
-    } else if (child.isDirectory() && existsSync(join(dir, child.name, "agent.md"))) {
+    } else if (child.isDirectory() && existsSync2(join2(dir, child.name, "agent.md"))) {
       entry = markdownEntry(
         context,
-        join(dir, child.name, "agent.md"),
+        join2(dir, child.name, "agent.md"),
         child.name,
         {
           kind: "agent",
@@ -244,9 +369,9 @@ function agentEntries(context) {
 }
 function hookEntries(context, manifest2) {
   const declared = typeof manifest2.hooks === "string" ? manifest2.hooks : void 0;
-  const path = resolve(context.pluginDir, declared ?? "hooks/hooks.json");
-  if (!existsSync(path)) return [];
-  const hooks = readJson(path);
+  const path = resolve2(context.pluginDir, declared ?? "hooks/hooks.json");
+  if (!existsSync2(path)) return [];
+  const hooks = readJson(path, context.pluginDir);
   if (hooks === null) {
     context.onReject?.({ path, reason: "hooks.json is not a JSON object" });
     return [];
@@ -272,9 +397,12 @@ function hookEntries(context, manifest2) {
   ];
 }
 function mcpEntries(context) {
-  const path = join(context.pluginDir, ".mcp.json");
-  if (!existsSync(path)) return [];
-  const config = readJson(path);
+  const filename = [".mcp.json", "mcp.json", "mcp_config.json"].find(
+    (name) => existsSync2(join2(context.pluginDir, name))
+  );
+  if (!filename) return [];
+  const path = join2(context.pluginDir, filename);
+  const config = readJson(path, context.pluginDir);
   const servers = config?.["mcpServers"];
   if (servers === null || typeof servers !== "object" || Array.isArray(servers)) {
     context.onReject?.({ path, reason: ".mcp.json has no mcpServers object" });
@@ -293,48 +421,24 @@ function mcpEntries(context) {
   }));
 }
 function readMarketplace(dir, onReject) {
-  const manifestPath = join(dir, ".claude-plugin", "marketplace.json");
-  if (!existsSync(manifestPath)) {
-    onReject?.({
-      path: dir,
-      reason: "no .claude-plugin/marketplace.json here"
-    });
-    return [];
-  }
-  let manifest2;
-  try {
-    manifest2 = JSON.parse(
-      readFileSync(manifestPath, "utf8")
-    );
-  } catch {
-    onReject?.({
-      path: manifestPath,
-      reason: "marketplace.json is not valid JSON"
-    });
-    return [];
-  }
-  const marketplace = manifest2.name ?? "marketplace";
+  const marketplace = readLocalMarketplace(dir, onReject);
+  if (!marketplace) return [];
   const found = [];
-  for (const plugin of manifest2.plugins ?? []) {
-    if (!plugin.name || !plugin.source) continue;
-    const pluginDir = resolve(dir, plugin.source);
-    if (!existsSync(pluginDir)) continue;
-    const pluginManifest = readJson(
-      join(pluginDir, ".claude-plugin", "plugin.json")
-    ) ?? {};
+  for (const plugin of marketplace.plugins) {
+    const pluginManifest2 = plugin.manifest;
     const context = {
-      marketplace,
+      marketplace: marketplace.name,
       plugin: plugin.name,
-      pluginDir,
-      pluginDescription: typeof pluginManifest.description === "string" ? pluginManifest.description : void 0,
-      tier: manifest2.metadata?.tier,
+      pluginDir: plugin.directory,
+      pluginDescription: typeof pluginManifest2.description === "string" ? pluginManifest2.description : void 0,
+      tier: marketplace.tier,
       onReject
     };
     found.push(
       ...skillEntries(context),
       ...commandEntries(context),
       ...agentEntries(context),
-      ...hookEntries(context, pluginManifest),
+      ...hookEntries(context, pluginManifest2),
       ...mcpEntries(context)
     );
   }
@@ -376,29 +480,29 @@ function skillFiles(packageDir) {
     }
     for (const entry of entries) {
       if (entry.isFile()) {
-        if (entry.name === "SKILL.md") found.push(join2(dir, entry.name));
+        if (entry.name === "SKILL.md") found.push(join3(dir, entry.name));
         continue;
       }
       if (!entry.isDirectory()) continue;
       if (SKIPPED_DIRS.has(entry.name)) continue;
       if (depth + 1 <= MAX_SKILL_DEPTH)
-        stack.push([join2(dir, entry.name), depth + 1]);
+        stack.push([join3(dir, entry.name), depth + 1]);
     }
   }
   return found.sort();
 }
 function packageDirs(root) {
-  if (!existsSync2(root)) return [];
+  if (!existsSync3(root)) return [];
   const found = [];
   for (const entry of readdirSync2(root, { withFileTypes: true })) {
     if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
     if (entry.name === ".bin" || entry.name === ".cache") continue;
-    const path = join2(root, entry.name);
+    const path = join3(root, entry.name);
     if (entry.name.startsWith("@")) {
-      if (!existsSync2(path)) continue;
+      if (!existsSync3(path)) continue;
       for (const scoped of readdirSync2(path, { withFileTypes: true })) {
         if (scoped.isDirectory() || scoped.isSymbolicLink()) {
-          found.push(join2(path, scoped.name));
+          found.push(join3(path, scoped.name));
         }
       }
       continue;
@@ -410,7 +514,7 @@ function packageDirs(root) {
 function readManifest(dir) {
   try {
     const parsed = JSON.parse(
-      readFileSync2(join2(dir, "package.json"), "utf8")
+      readFileSync3(join3(dir, "package.json"), "utf8")
     );
     return parsed !== null && typeof parsed === "object" ? parsed : null;
   } catch {
@@ -444,8 +548,8 @@ function globDirs(base, pattern) {
     }
     const segment = segments[index];
     if (!segment.includes("*")) {
-      const next = join2(dir, segment);
-      if (existsSync2(next)) walk(next, index + 1);
+      const next = join3(dir, segment);
+      if (existsSync3(next)) walk(next, index + 1);
       return;
     }
     let entries;
@@ -457,12 +561,12 @@ function globDirs(base, pattern) {
     const children = entries.filter((e) => e.isDirectory() || e.isSymbolicLink()).filter((e) => !SKIPPED_DIRS.has(e.name));
     if (segment === "**") {
       walk(dir, index + 1);
-      for (const child of children) walk(join2(dir, child.name), index);
+      for (const child of children) walk(join3(dir, child.name), index);
       return;
     }
     const matcher = segmentMatcher(segment);
     for (const child of children) {
-      if (matcher.test(child.name)) walk(join2(dir, child.name), index + 1);
+      if (matcher.test(child.name)) walk(join3(dir, child.name), index + 1);
     }
   };
   walk(base, 0);
@@ -487,7 +591,7 @@ function workspacePackageDirs(root) {
         }
       }
     }
-    const members = [...included].filter((m) => !excluded.has(m) && existsSync2(join2(m, "package.json"))).sort();
+    const members = [...included].filter((m) => !excluded.has(m) && existsSync3(join3(m, "package.json"))).sort();
     for (const member of members) expand(member);
     ordered.push(dir);
   };
@@ -504,9 +608,9 @@ function nameOf(dir, named) {
 }
 function expandRootGlob(dir) {
   if (!dir.includes("*")) return [dir];
-  const absolute = isAbsolute(dir);
+  const absolute = isAbsolute2(dir);
   const base = absolute ? "/" : ".";
-  return globDirs(base, dir).filter((d) => existsSync2(join2(d, "package.json"))).sort();
+  return globDirs(base, dir).filter((d) => existsSync3(join3(d, "package.json"))).sort();
 }
 function readCatalog(options) {
   const scopes = options.scopes ?? [];
@@ -530,7 +634,7 @@ function readCatalog(options) {
       seenPaths.add(path);
       let source;
       try {
-        source = readFileSync2(path, "utf8");
+        source = readFileSync3(path, "utf8");
       } catch {
         continue;
       }
@@ -574,7 +678,7 @@ function readCatalog(options) {
       }
       seen.add(entry.name);
       if (kindOf(entry) === "skill" && basename2(entry.path) === "SKILL.md") {
-        const parsed = frontmatterObject(readFileSync2(entry.path, "utf8"));
+        const parsed = frontmatterObject(readFileSync3(entry.path, "utf8"));
         for (const problem of specProblems(
           parsed,
           basename2(dirname2(entry.path))
@@ -641,7 +745,7 @@ function registerSkillPrompts(server, tools) {
 }
 
 // src/resources.ts
-import { statSync as statSync4 } from "fs";
+import { statSync as statSync5 } from "fs";
 import {
   ResourceNotFoundError,
   ResourceTemplate
@@ -649,8 +753,8 @@ import {
 
 // src/files/list.ts
 import { createHash } from "crypto";
-import { readFileSync as readFileSync3, readdirSync as readdirSync3, statSync } from "fs";
-import { basename as basename4, join as join3, relative as relative2, sep } from "path";
+import { readFileSync as readFileSync4, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
+import { basename as basename4, join as join4, relative as relative3, sep as sep2 } from "path";
 
 // src/files/redact.ts
 import { basename as basename3 } from "path";
@@ -687,11 +791,11 @@ function servedBytes(path, raw) {
 var FILE_LIST_LIMIT = 200;
 var sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function describe(path, full) {
-  const bytes = servedBytes(full, readFileSync3(full));
+  const bytes = servedBytes(full, readFileSync4(full));
   return { path, bytes: bytes.length, sha256: sha256(bytes) };
 }
 function listSkillFiles(root, limit = FILE_LIST_LIMIT) {
-  if (statSync(root).isFile()) {
+  if (statSync2(root).isFile()) {
     return { files: [describe(basename4(root), root)], truncated: false };
   }
   const files = [];
@@ -700,14 +804,14 @@ function listSkillFiles(root, limit = FILE_LIST_LIMIT) {
     const dir = stack.pop();
     for (const entry of readdirSync3(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git") continue;
-      const full = join3(dir, entry.name);
+      const full = join4(dir, entry.name);
       if (entry.isDirectory()) {
         stack.push(full);
         continue;
       }
       if (!entry.isFile()) continue;
       if (files.length >= limit) return { files, truncated: true };
-      files.push(describe(relative2(root, full).split(sep).join("/"), full));
+      files.push(describe(relative3(root, full).split(sep2).join("/"), full));
     }
   }
   files.sort((a, b) => a.path.localeCompare(b.path));
@@ -715,7 +819,7 @@ function listSkillFiles(root, limit = FILE_LIST_LIMIT) {
 }
 
 // src/files/read.ts
-import { readFileSync as readFileSync4, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync5, statSync as statSync4 } from "fs";
 
 // src/mime.ts
 var TYPES = {
@@ -821,31 +925,31 @@ function classify(path, bytes) {
 }
 
 // src/files/resolve.ts
-import { realpathSync, statSync as statSync2 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, relative as relative3, resolve as resolve2, sep as sep2 } from "path";
-var ownFile = (entry) => relative3(assetRoot(entry), entry.path).split(sep2).join("/");
+import { realpathSync as realpathSync2, statSync as statSync3 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute3, relative as relative4, resolve as resolve3, sep as sep3 } from "path";
+var ownFile = (entry) => relative4(assetRoot(entry), entry.path).split(sep3).join("/");
 function resolveSkillFile(entry, wanted = ownFile(entry)) {
-  if (isAbsolute2(wanted) || wanted.split(/[\\/]/u).includes("..")) {
+  if (isAbsolute3(wanted) || wanted.split(/[\\/]/u).includes("..")) {
     return { ok: false, error: "path_outside_skill", detail: wanted };
   }
-  const scope = realpathSync(assetRoot(entry));
-  const single = statSync2(scope).isFile();
+  const scope = realpathSync2(assetRoot(entry));
+  const single = statSync3(scope).isFile();
   const root = single ? dirname3(scope) : scope;
   let target;
   try {
-    target = realpathSync(
-      single && wanted === "" ? scope : resolve2(root, wanted)
+    target = realpathSync2(
+      single && wanted === "" ? scope : resolve3(root, wanted)
     );
   } catch {
     return { ok: false, error: "no_such_file", detail: wanted };
   }
-  const inside = single ? target === scope : target === root || target.startsWith(root + sep2);
+  const inside = single ? target === scope : target === root || target.startsWith(root + sep3);
   if (!inside)
     return { ok: false, error: "path_outside_skill", detail: wanted };
   return {
     ok: true,
     target,
-    path: relative3(root, target).split(sep2).join("/")
+    path: relative4(root, target).split(sep3).join("/")
   };
 }
 
@@ -854,7 +958,7 @@ var READ_BUDGET_BYTES = 256 * 1024;
 function readSkillFile(entry, wanted, budget = READ_BUDGET_BYTES) {
   const resolved = resolveSkillFile(entry, wanted);
   if (!resolved.ok) return resolved;
-  const size = statSync3(resolved.target).size;
+  const size = statSync4(resolved.target).size;
   if (size > budget) {
     return {
       ok: false,
@@ -862,7 +966,7 @@ function readSkillFile(entry, wanted, budget = READ_BUDGET_BYTES) {
       detail: `${size} bytes > ${budget}`
     };
   }
-  const bytes = servedBytes(resolved.target, readFileSync4(resolved.target));
+  const bytes = servedBytes(resolved.target, readFileSync5(resolved.target));
   const { kind: kind2, mimeType } = classify(resolved.path, bytes);
   return {
     ok: true,
@@ -902,7 +1006,7 @@ function listing(entries) {
     name: entry.name,
     description: entry.description,
     mimeType: "text/markdown",
-    size: statSync4(entry.path).size
+    size: statSync5(entry.path).size
   }));
 }
 function complete(value, entries) {
@@ -939,7 +1043,7 @@ function registerSkillResources(server, skills) {
 }
 
 // src/server.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 
 // src/find.ts
 import { createHash as createHash2 } from "crypto";
@@ -1035,11 +1139,11 @@ function rank(matches2, limit) {
 }
 
 // src/files/bundle.ts
-import { readFileSync as readFileSync5, statSync as statSync5 } from "fs";
-import { dirname as dirname4, join as join4 } from "path";
+import { readFileSync as readFileSync6, statSync as statSync6 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 function bundleSkill(entry) {
   const root = assetRoot(entry);
-  const base = statSync5(root).isFile() ? dirname4(root) : root;
+  const base = statSync6(root).isFile() ? dirname4(root) : root;
   const listing2 = listSkillFiles(root);
   return {
     name: entry.name,
@@ -1047,7 +1151,7 @@ function bundleSkill(entry) {
     files: listing2.files.map((file) => ({
       ...file,
       uri: skillFileUri(entry, file.path),
-      mimeType: classify(file.path, readFileSync5(join4(base, file.path))).mimeType
+      mimeType: classify(file.path, readFileSync6(join5(base, file.path))).mimeType
     }))
   };
 }
@@ -1251,7 +1355,7 @@ function createSkillTools(options) {
     describe(name) {
       const entry = byName(name);
       if (!entry) return null;
-      const source = readFileSync6(entry.path, "utf8");
+      const source = readFileSync7(entry.path, "utf8");
       const listing2 = listSkillFiles(assetRoot(entry));
       return {
         name: entry.name,
@@ -1288,7 +1392,7 @@ function createSkillTools(options) {
       return {
         name: entry.name,
         body: readBody(
-          servedBytes(entry.path, readFileSync6(entry.path)).toString("utf8")
+          servedBytes(entry.path, readFileSync7(entry.path)).toString("utf8")
         ),
         files: bundle.files.filter((file) => file.path !== own),
         filesTruncated: bundle.truncated
@@ -1308,17 +1412,17 @@ function createSkillTools(options) {
 
 // src/extension/entry.ts
 import { createHash as createHash3 } from "crypto";
-import { readFileSync as readFileSync7, readdirSync as readdirSync4, statSync as statSync6 } from "fs";
-import { basename as basename5, dirname as dirname5, join as join5, relative as relative4, sep as sep3 } from "path";
+import { readFileSync as readFileSync8, readdirSync as readdirSync4, statSync as statSync7 } from "fs";
+import { basename as basename5, dirname as dirname5, join as join6, relative as relative5, sep as sep4 } from "path";
 var MAX_RESOURCES = 512;
 var MAX_SKILL_BYTES = 16 * 1024 * 1024;
 var digests = /* @__PURE__ */ new Map();
 function facts(path) {
-  const stat = statSync6(path);
+  const stat = statSync7(path);
   const key = `${stat.mtimeMs}:${stat.size}`;
   const cached = digests.get(path);
   if (cached?.key === key) return cached;
-  const bytes = servedBytes(path, readFileSync7(path));
+  const bytes = servedBytes(path, readFileSync8(path));
   const digest = `sha256:${createHash3("sha256").update(bytes).digest("hex")}`;
   const fresh = { key, digest, size: bytes.length };
   digests.set(path, fresh);
@@ -1331,7 +1435,7 @@ function filesUnder(root) {
     const dir = stack.pop();
     for (const entry of readdirSync4(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git") continue;
-      const full = join5(dir, entry.name);
+      const full = join6(dir, entry.name);
       if (entry.isDirectory()) stack.push(full);
       else if (entry.isFile()) found.push(full);
       if (found.length > MAX_RESOURCES) return null;
@@ -1342,7 +1446,7 @@ function filesUnder(root) {
 function extensionEntry(entry) {
   if (kindOf(entry) !== "skill" || basename5(entry.path) !== "SKILL.md")
     return null;
-  const frontmatter = frontmatterObject(readFileSync7(entry.path, "utf8"));
+  const frontmatter = frontmatterObject(readFileSync8(entry.path, "utf8"));
   const root = dirname5(entry.path);
   if (specProblems(frontmatter, basename5(root)).length > 0) return null;
   if (frontmatter?.["name"] !== entry.slug) return null;
@@ -1352,7 +1456,7 @@ function extensionEntry(entry) {
   const resources = files.map((path) => {
     const fact = facts(path);
     total += fact.size;
-    const file = relative4(root, path).split(sep3).join("/");
+    const file = relative5(root, path).split(sep4).join("/");
     return {
       uri: skillFileUri(entry, file),
       digest: fact.digest,
@@ -1837,7 +1941,7 @@ function registerMailboxTools(server, service) {
 
 // src/mcp.ts
 var SERVER_NAME = "pmcp";
-var SERVER_VERSION = "0.13.0";
+var SERVER_VERSION = "0.14.0";
 function registerSkillTools(server, tools) {
   registerCatalogTool(server, tools);
   registerFindTool(server, tools);
@@ -1862,22 +1966,22 @@ import { randomUUID } from "crypto";
 import {
   closeSync,
   constants,
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   fstatSync,
   mkdirSync,
   openSync,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   renameSync,
   rmSync,
   writeFileSync
 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname7, join as join7, resolve as resolve4 } from "path";
+import { dirname as dirname7, join as join8, resolve as resolve5 } from "path";
 import { z as z12 } from "zod";
 
 // src/config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname6, join as join6, resolve as resolve3 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname6, join as join7, resolve as resolve4 } from "path";
 import { parse as parse2 } from "smol-toml";
 
 // src/encoder.ts
@@ -1885,7 +1989,11 @@ import { createHash as createHash4 } from "crypto";
 
 // src/config.ts
 var PATH_KEYS = ["roots", "workspaces", "packages", "marketplaces"];
-var CATALOG_KEYS = /* @__PURE__ */ new Set([...PATH_KEYS, "scopes"]);
+var CATALOG_KEYS = /* @__PURE__ */ new Set([
+  ...PATH_KEYS,
+  "scopes",
+  "builtin"
+]);
 
 // src/mailbox/types.ts
 var MailboxError = class extends Error {
@@ -1942,7 +2050,7 @@ function readPrivateJson(file) {
         "Credential file must belong to the current user"
       );
     }
-    return JSON.parse(readFileSync9(descriptor, "utf8"));
+    return JSON.parse(readFileSync10(descriptor, "utf8"));
   } finally {
     closeSync(descriptor);
   }
@@ -1954,7 +2062,7 @@ function readBinding(file) {
   return bindingSchema.parse(readPrivateJson(file));
 }
 function writePrivateJson(file, value) {
-  mkdirSync(dirname7(resolve4(file)), { recursive: true, mode: 448 });
+  mkdirSync(dirname7(resolve5(file)), { recursive: true, mode: 448 });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}
 `, {
     flag: "wx",
@@ -1962,7 +2070,7 @@ function writePrivateJson(file, value) {
   });
 }
 function writeBindingFile(file, binding) {
-  if (existsSync4(file)) {
+  if (existsSync5(file)) {
     const previous = readBinding(file);
     if (previous.projectId !== binding.projectId || previous.actorId !== binding.actorId) {
       throw new MailboxError(
@@ -1989,7 +2097,7 @@ import {
   chmodSync as chmodSync2,
   copyFileSync,
   constants as constants2,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   unlinkSync
 } from "fs";
 
@@ -2626,7 +2734,7 @@ var MailboxStore = class _MailboxStore {
         "Mailbox storage is closed"
       );
     }
-    if (existsSync5(destination)) {
+    if (existsSync6(destination)) {
       throw new MailboxError(
         "destination_exists",
         "Backup destination already exists"