@mudssky/trellis 0.6.16-mudssky.5

package/dist/utils/integration.js

@@ -0,0 +1,1549 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AI_TOOLS } from "../types/ai-tools.js";
+import { PLATFORM_IDS, collectPlatformTemplates, getConfiguredPlatforms, } from "../configurators/index.js";
+import { agentsMdContent } from "../templates/markdown/index.js";
+import { TRELLIS_BLOCK_END, TRELLIS_BLOCK_START } from "./managed-paths.js";
+import { assertSafeManagedPath, lstatIfPresent, validateManagedRelativePath, } from "./managed-removal.js";
+import { fingerprintPath, fingerprintsEqual, withAblationProjectLock, } from "./ablation-store.js";
+import { writeFileAtomic } from "./atomic-write.js";
+import { loadHashes } from "./template-hash.js";
+const SUPPORTED_PLATFORMS = new Set([
+    "pi",
+    "omp",
+    "codex",
+    "claude-code",
+    "zcode",
+]);
+const STATE_DIR = ".trellis/.integration";
+const STATE_PATH = `${STATE_DIR}/state.json`;
+const PARKED_ROOT = `${STATE_DIR}/parked`;
+const MANIFEST_PATH = ".trellis/.template-hashes.json";
+function integrationPath(projectRoot, relativePath, allowLeafSymlink = false) {
+    const absolute = assertSafeManagedPath(projectRoot, relativePath);
+    const segments = relativePath.split("/");
+    let current = projectRoot;
+    for (const [index, segment] of segments.entries()) {
+        current = path.join(current, segment);
+        if (allowLeafSymlink && index === segments.length - 1)
+            break;
+        if (lstatIfPresent(current)?.isSymbolicLink()) {
+            throw new Error(`Integration paths must not traverse symlinks: ${relativePath}`);
+        }
+    }
+    return absolute;
+}
+function ownedTemplates(projectRoot, id) {
+    integrationPath(projectRoot, MANIFEST_PATH);
+    const hashes = loadHashes(projectRoot);
+    return new Map([...(collectPlatformTemplates(id) ?? new Map())].filter(([relativePath]) => Object.hasOwn(hashes, relativePath)));
+}
+function sha256(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+function defaultConfig() {
+    return { enabled: true, skills: true, hooks: true, platforms: {} };
+}
+function cloneConfig(config) {
+    return {
+        enabled: config.enabled,
+        skills: config.skills,
+        hooks: config.hooks,
+        platforms: Object.fromEntries(Object.entries(config.platforms).map(([id, value]) => [id, { ...value }])),
+    };
+}
+function parseBoolean(raw, key) {
+    const value = raw
+        .trim()
+        .replace(/\s+#.*$/, "")
+        .trim();
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    throw new Error(`Invalid integration boolean for ${key}: ${JSON.stringify(value)}`);
+}
+function indentation(line) {
+    return line.length - line.trimStart().length;
+}
+function parseIntegrationConfig(content) {
+    const config = defaultConfig();
+    const lines = content.split(/\r?\n/);
+    let integrationIndent = null;
+    let childIndent = null;
+    let platformsIndent = null;
+    let platformIndent = null;
+    let platform = null;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0 || trimmed.startsWith("#"))
+            continue;
+        const indent = indentation(line);
+        if (integrationIndent === null) {
+            if (/^integration:\s*(?:#.*)?$/.test(trimmed)) {
+                integrationIndent = indent;
+            }
+            else if (/^integration\s*:/.test(trimmed)) {
+                throw new Error(`Unsupported integration mapping syntax: ${trimmed}`);
+            }
+            continue;
+        }
+        if (indent <= integrationIndent)
+            break;
+        childIndent ??= indent;
+        if (indent === childIndent) {
+            platform = null;
+            platformIndent = null;
+            if (/^platforms:\s*(?:#.*)?$/.test(trimmed)) {
+                platformsIndent = indent;
+                continue;
+            }
+            platformsIndent = null;
+            const match = trimmed.match(/^(enabled|skills|hooks):\s*(.*)$/);
+            if (!match)
+                throw new Error(`Invalid integration entry: ${trimmed}`);
+            const key = match[1];
+            config[key] = parseBoolean(match[2] ?? "", `integration.${key}`);
+            continue;
+        }
+        if (platformsIndent === null || indent <= platformsIndent)
+            continue;
+        if (platformIndent === null || indent === platformIndent) {
+            const match = trimmed.match(/^([^:#][^:]*):\s*(?:#.*)?$/);
+            if (!match) {
+                throw new Error(`Invalid integration platform entry: ${trimmed}`);
+            }
+            platformIndent = indent;
+            platform = match[1]?.trim() ?? null;
+            if (!platform || platform.includes("/") || platform.includes("\\")) {
+                throw new Error(`Invalid integration platform id: ${JSON.stringify(platform)}`);
+            }
+            config.platforms[platform] = {};
+            continue;
+        }
+        if (platform && indent > platformIndent) {
+            const match = trimmed.match(/^(enabled|skills|hooks):\s*(.*)$/);
+            if (!match) {
+                throw new Error(`Invalid integration platform setting: ${trimmed}`);
+            }
+            const key = match[1];
+            const current = config.platforms[platform] ?? {};
+            current[key] = parseBoolean(match[2] ?? "", `integration.platforms.${platform}.${key}`);
+            config.platforms[platform] = current;
+        }
+    }
+    return config;
+}
+function renderIntegrationSection(config) {
+    const lines = [
+        "integration:",
+        `  enabled: ${config.enabled}`,
+        `  skills: ${config.skills}`,
+        `  hooks: ${config.hooks}`,
+    ];
+    const platforms = Object.entries(config.platforms).filter(([, value]) => Object.keys(value).length > 0);
+    if (platforms.length > 0) {
+        lines.push("  platforms:");
+        for (const [id, value] of platforms.sort(([a], [b]) => a.localeCompare(b))) {
+            lines.push(`    ${id}:`);
+            if (value.enabled !== undefined)
+                lines.push(`      enabled: ${value.enabled}`);
+            if (value.skills !== undefined)
+                lines.push(`      skills: ${value.skills}`);
+            if (value.hooks !== undefined)
+                lines.push(`      hooks: ${value.hooks}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+function replaceIntegrationSection(content, config) {
+    const lines = content.split(/\r?\n/);
+    const start = lines.findIndex((line) => /^\s*integration:\s*(?:#.*)?$/.test(line));
+    const rendered = renderIntegrationSection(config).trimEnd().split("\n");
+    if (start === -1) {
+        return `${content.trimEnd()}\n\n${rendered.join("\n")}\n`;
+    }
+    const sourceLine = lines[start] ?? "";
+    const baseIndent = indentation(sourceLine);
+    const prefix = sourceLine.slice(0, baseIndent);
+    const indentedRendered = rendered.map((line) => `${prefix}${line}`);
+    let end = start + 1;
+    while (end < lines.length) {
+        const line = lines[end] ?? "";
+        if (line.trim().length > 0 && indentation(line) <= baseIndent)
+            break;
+        end += 1;
+    }
+    return [...lines.slice(0, start), ...indentedRendered, ...lines.slice(end)]
+        .join("\n")
+        .replace(/\n*$/, "\n");
+}
+function resolveConfigPath(projectRoot) {
+    return integrationPath(projectRoot, ".trellis/config.yaml");
+}
+function readConfig(projectRoot) {
+    const configPath = resolveConfigPath(projectRoot);
+    if (!fs.existsSync(configPath))
+        return defaultConfig();
+    return parseIntegrationConfig(fs.readFileSync(configPath, "utf-8"));
+}
+function emptyState() {
+    return {
+        schemaVersion: 1,
+        configuredPlatforms: [],
+        parked: [],
+        jsonRestores: [],
+    };
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateState(projectRoot, raw) {
+    if (!isObject(raw) || raw.schemaVersion !== 1) {
+        throw new Error("Invalid Trellis integration state.");
+    }
+    if (!Array.isArray(raw.configuredPlatforms) ||
+        !raw.configuredPlatforms.every((id) => typeof id === "string") ||
+        !Array.isArray(raw.parked) ||
+        !Array.isArray(raw.jsonRestores)) {
+        throw new Error("Malformed Trellis integration state.");
+    }
+    if (Object.keys(raw).some((key) => ![
+        "schemaVersion",
+        "configuredPlatforms",
+        "parked",
+        "jsonRestores",
+        "markdownRestore",
+    ].includes(key)) ||
+        !raw.configuredPlatforms.every((id) => PLATFORM_IDS.includes(String(id)))) {
+        throw new Error("Unknown integration recovery state fields or platforms.");
+    }
+    const validFingerprint = (value) => {
+        if (!isObject(value) || typeof value.kind !== "string")
+            return false;
+        if (value.kind === "absent")
+            return false;
+        if (value.kind === "file") {
+            return (typeof value.sha256 === "string" &&
+                /^[a-f0-9]{64}$/.test(value.sha256) &&
+                typeof value.size === "number" &&
+                Number.isSafeInteger(value.size) &&
+                value.size >= 0 &&
+                typeof value.mode === "number" &&
+                Number.isInteger(value.mode) &&
+                value.mode >= 0 &&
+                value.mode <= 0o7777 &&
+                Object.keys(value).every((key) => ["kind", "sha256", "size", "mode"].includes(key)));
+        }
+        if (value.kind === "symlink") {
+            return (typeof value.target === "string" &&
+                typeof value.mode === "number" &&
+                Number.isInteger(value.mode) &&
+                value.mode >= 0 &&
+                value.mode <= 0o7777 &&
+                Object.keys(value).every((key) => ["kind", "target", "mode"].includes(key)));
+        }
+        return false;
+    };
+    const state = raw;
+    const ownedByPlatform = new Map();
+    const sharedPaths = new Set();
+    if (state.parked.length > 0) {
+        for (const id of SUPPORTED_PLATFORMS) {
+            const templates = ownedTemplates(projectRoot, id);
+            ownedByPlatform.set(id, templates);
+            for (const relativePath of templates.keys()) {
+                if (/^\.agents\/skills\/[^/]+\/SKILL\.md$/.test(relativePath))
+                    sharedPaths.add(relativePath);
+            }
+        }
+    }
+    const parkedKeys = new Set();
+    for (const entry of state.parked) {
+        if (!isObject(entry) ||
+            typeof entry.path !== "string" ||
+            typeof entry.parkedPath !== "string" ||
+            typeof entry.platform !== "string" ||
+            !["skill", "command", "agent"].includes(String(entry.category)) ||
+            !validFingerprint(entry.fingerprint) ||
+            (entry.templateHash !== undefined &&
+                typeof entry.templateHash !== "string")) {
+            throw new Error("Malformed parked integration entry.");
+        }
+        if (Object.keys(entry).some((key) => ![
+            "path",
+            "parkedPath",
+            "platform",
+            "category",
+            "fingerprint",
+            "templateHash",
+        ].includes(key))) {
+            throw new Error("Unknown parked integration entry fields.");
+        }
+        validateManagedRelativePath(entry.path);
+        validateManagedRelativePath(entry.parkedPath);
+        const expectedPath = entry.platform === "shared"
+            ? `${path.posix.dirname(entry.path)}/.trellis-disabled.md`
+            : parkedPathFor(entry.platform, entry.path);
+        const owned = entry.platform === "shared"
+            ? sharedPaths.has(entry.path)
+            : ownedByPlatform.get(entry.platform)?.has(entry.path) ===
+                true;
+        if (!owned ||
+            entry.category !== categoryForPath(entry.path) ||
+            entry.parkedPath !== expectedPath) {
+            throw new Error(`Invalid parked integration ownership: ${entry.path}`);
+        }
+        const key = `${entry.platform}:${entry.path}`;
+        if (parkedKeys.has(key))
+            throw new Error(`Duplicate parked integration entry: ${key}`);
+        parkedKeys.add(key);
+        integrationPath(projectRoot, entry.path, true);
+        integrationPath(projectRoot, entry.parkedPath, true);
+    }
+    const restoreKeys = new Set();
+    for (const record of state.jsonRestores) {
+        if (!isObject(record) ||
+            typeof record.path !== "string" ||
+            typeof record.platform !== "string" ||
+            !["hooks", "pi-skills", "omp-skills", "claude-skills"].includes(String(record.kind)) ||
+            !("data" in record)) {
+            throw new Error("Malformed integration restore record.");
+        }
+        if (Object.keys(record).some((key) => !["path", "platform", "kind", "data"].includes(key))) {
+            throw new Error("Unknown integration restore record fields.");
+        }
+        validateRestoreRecord(projectRoot, record);
+        const key = `${record.platform}:${record.kind}`;
+        if (restoreKeys.has(key))
+            throw new Error(`Duplicate integration restore record: ${key}`);
+        restoreKeys.add(key);
+        integrationPath(projectRoot, record.path);
+    }
+    if (state.markdownRestore) {
+        if (!isObject(state.markdownRestore) ||
+            typeof state.markdownRestore.path !== "string" ||
+            typeof state.markdownRestore.block !== "string" ||
+            (state.markdownRestore.templateHash !== undefined &&
+                typeof state.markdownRestore.templateHash !== "string")) {
+            throw new Error("Malformed integration markdown restore record.");
+        }
+        if (Object.keys(state.markdownRestore).some((key) => !["path", "block", "templateHash"].includes(key))) {
+            throw new Error("Unknown integration markdown restore fields.");
+        }
+        if (state.markdownRestore.path !== "AGENTS.md" ||
+            extractManagedBlock(state.markdownRestore.block) !==
+                state.markdownRestore.block) {
+            throw new Error("Invalid integration markdown ownership.");
+        }
+        integrationPath(projectRoot, state.markdownRestore.path);
+    }
+    return state;
+}
+function loadState(projectRoot) {
+    const stateFile = integrationPath(projectRoot, STATE_PATH);
+    if (!lstatIfPresent(stateFile))
+        return emptyState();
+    const stat = fs.lstatSync(stateFile);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error("Trellis integration state must be a regular file.");
+    }
+    try {
+        return validateState(projectRoot, JSON.parse(fs.readFileSync(stateFile, "utf-8")));
+    }
+    catch (error) {
+        if (error instanceof SyntaxError) {
+            throw new Error(`Malformed Trellis integration state: ${error.message}`);
+        }
+        throw error;
+    }
+}
+function effective(config, id) {
+    const override = config.platforms[id] ?? {};
+    const enabled = config.enabled && (override.enabled ?? true);
+    return {
+        enabled,
+        skills: enabled && (override.skills ?? config.skills),
+        hooks: enabled && (override.hooks ?? config.hooks),
+    };
+}
+function installedPlatforms(projectRoot, state) {
+    const installed = new Set(getConfiguredPlatforms(projectRoot));
+    for (const id of state.configuredPlatforms) {
+        if (PLATFORM_IDS.includes(id))
+            installed.add(id);
+    }
+    return installed;
+}
+function categoryForPath(relativePath) {
+    if (relativePath.includes("/commands/") || relativePath.includes("/prompts/"))
+        return "command";
+    if (relativePath.includes("/agents/"))
+        return "agent";
+    if (relativePath.includes("/skills/"))
+        return "skill";
+    return null;
+}
+function shouldParkPath(id, relativePath, config) {
+    const category = categoryForPath(relativePath);
+    if (!category)
+        return null;
+    const state = effective(config, id);
+    if (!state.enabled && (category === "command" || category === "agent"))
+        return category;
+    if (!state.skills && category === "skill") {
+        if (relativePath.startsWith(".agents/skills/"))
+            return null;
+        if (id !== "zcode")
+            return null;
+        return category;
+    }
+    return null;
+}
+function parkedPathFor(id, relativePath) {
+    validateManagedRelativePath(relativePath);
+    return `${PARKED_ROOT}/${id}/${relativePath}`;
+}
+function cloneState(state) {
+    return JSON.parse(JSON.stringify(state));
+}
+function addOperation(plan, operation, action) {
+    plan.operations.push(operation);
+    const relativePath = operation.kind === "move"
+        ? `${operation.from} -> ${operation.to}`
+        : operation.relativePath;
+    plan.changes.push({ path: relativePath, action });
+}
+function plannedWrite(plan, relativePath) {
+    return plan.operations.find((operation) => operation.kind === "write" && operation.relativePath === relativePath);
+}
+function planWrite(plan, relativePath, content, action, mode) {
+    const pending = plannedWrite(plan, relativePath);
+    if (pending) {
+        pending.content = content;
+        pending.mode = mode ?? pending.mode;
+        const change = plan.changes.find((item) => item.path === relativePath && item.action === action);
+        if (!change)
+            plan.changes.push({ path: relativePath, action });
+        return;
+    }
+    const absPath = integrationPath(plan.projectRoot, relativePath);
+    const before = fingerprintPath(absPath);
+    if (before.kind !== "file" && before.kind !== "absent")
+        throw new Error(`Expected regular integration file: ${relativePath}`);
+    mode ??= before.kind === "file" ? before.mode : 0o600;
+    if (before.kind === "file" && fs.readFileSync(absPath, "utf-8") === content) {
+        return;
+    }
+    addOperation(plan, { kind: "write", relativePath, before, content, mode }, action);
+}
+function planMove(plan, from, to, action) {
+    const fromAbs = integrationPath(plan.projectRoot, from, true);
+    const toAbs = integrationPath(plan.projectRoot, to, true);
+    const fromBefore = fingerprintPath(fromAbs);
+    const toBefore = fingerprintPath(toAbs);
+    if (fromBefore.kind === "absent")
+        return;
+    if (toBefore.kind !== "absent") {
+        throw new Error(`Integration target already exists: ${to}`);
+    }
+    addOperation(plan, { kind: "move", from, to, fromBefore, toBefore }, action);
+}
+function planDelete(plan, relativePath, action) {
+    const absPath = integrationPath(plan.projectRoot, relativePath);
+    const before = fingerprintPath(absPath);
+    if (before.kind === "absent")
+        return;
+    addOperation(plan, { kind: "delete", relativePath, before }, action);
+}
+function parseJsonFile(plan, relativePath) {
+    const pending = plannedWrite(plan, relativePath);
+    if (pending) {
+        const parsed = JSON.parse(pending.content);
+        if (!isObject(parsed))
+            throw new Error(`Expected JSON object: ${relativePath}`);
+        return parsed;
+    }
+    const absPath = integrationPath(plan.projectRoot, relativePath);
+    const stat = lstatIfPresent(absPath);
+    if (!stat)
+        return {};
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error(`Expected regular JSON file: ${relativePath}`);
+    }
+    const parsed = JSON.parse(fs.readFileSync(absPath, "utf-8"));
+    if (!isObject(parsed))
+        throw new Error(`Expected JSON object: ${relativePath}`);
+    return parsed;
+}
+function jsonText(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function isTrellisHookHandler(value) {
+    if (!isObject(value) || typeof value.command !== "string")
+        return false;
+    return /(?:\.claude|\.codex|\.zcode)\/hooks\/(?:session-start|inject-workflow-state|inject-subagent-context|inject-shell-session-context)\.py/.test(value.command);
+}
+function removeTrellisHooks(settings) {
+    const copy = structuredClone(settings);
+    const rootHooks = copy.hooks;
+    if (!isObject(rootHooks))
+        return copy;
+    const hooks = isObject(rootHooks.events) ? rootHooks.events : rootHooks;
+    for (const [event, registrations] of Object.entries(hooks)) {
+        if (!Array.isArray(registrations))
+            continue;
+        const kept = registrations.flatMap((registration) => {
+            if (!isObject(registration) || !Array.isArray(registration.hooks)) {
+                return [registration];
+            }
+            const handlers = registration.hooks.filter((handler) => !isTrellisHookHandler(handler));
+            return handlers.length > 0 ? [{ ...registration, hooks: handlers }] : [];
+        });
+        if (kept.length === 0)
+            Reflect.deleteProperty(hooks, event);
+        else
+            hooks[event] = kept;
+    }
+    if (hooks === rootHooks && Object.keys(hooks).length === 0)
+        delete copy.hooks;
+    return copy;
+}
+function collectTrellisHooks(settings) {
+    const result = {};
+    const rootHooks = settings.hooks;
+    if (!isObject(rootHooks))
+        return result;
+    const hooks = isObject(rootHooks.events) ? rootHooks.events : rootHooks;
+    for (const [event, registrations] of Object.entries(hooks)) {
+        if (!Array.isArray(registrations))
+            continue;
+        const managed = registrations.flatMap((registration) => {
+            if (!isObject(registration) || !Array.isArray(registration.hooks))
+                return [];
+            const handlers = registration.hooks.filter(isTrellisHookHandler);
+            return handlers.length > 0 ? [{ ...registration, hooks: handlers }] : [];
+        });
+        if (managed.length > 0)
+            result[event] = managed;
+    }
+    return result;
+}
+function mergeTrellisHooks(settings, restored, nestedEvents) {
+    const existingManaged = collectTrellisHooks(settings);
+    if (Object.keys(existingManaged).length > 0) {
+        if (JSON.stringify(existingManaged) === JSON.stringify(restored)) {
+            return structuredClone(settings);
+        }
+        throw new Error("Trellis hook registrations changed while disabled; resolve the conflicting handlers before restoring.");
+    }
+    const copy = structuredClone(settings);
+    if (copy.hooks !== undefined && !isObject(copy.hooks)) {
+        throw new Error("Cannot restore Trellis hooks over a non-object hooks configuration.");
+    }
+    const rootHooks = isObject(copy.hooks)
+        ? copy.hooks
+        : {};
+    copy.hooks = rootHooks;
+    let events = rootHooks;
+    if (nestedEvents) {
+        if (rootHooks.events !== undefined && !isObject(rootHooks.events)) {
+            throw new Error("Cannot restore Trellis hooks over a non-object hooks.events configuration.");
+        }
+        events = isObject(rootHooks.events) ? rootHooks.events : {};
+        rootHooks.events = events;
+    }
+    const metadataKey = (registration) => JSON.stringify(Object.keys(registration)
+        .filter((key) => key !== "hooks")
+        .sort()
+        .map((key) => [key, registration[key]]));
+    for (const [event, registrations] of Object.entries(restored)) {
+        const current = events[event];
+        if (current !== undefined && !Array.isArray(current)) {
+            throw new Error(`Cannot restore Trellis hooks over a non-array ${event} configuration.`);
+        }
+        const merged = Array.isArray(current) ? current : [];
+        for (const registration of registrations) {
+            if (!isObject(registration) || !Array.isArray(registration.hooks)) {
+                throw new Error(`Invalid Trellis hook recovery registration for ${event}.`);
+            }
+            const matching = merged.find((entry) => isObject(entry) && metadataKey(entry) === metadataKey(registration));
+            if (isObject(matching) && Array.isArray(matching.hooks)) {
+                matching.hooks.push(...structuredClone(registration.hooks));
+            }
+            else {
+                merged.push(structuredClone(registration));
+            }
+        }
+        events[event] = merged;
+    }
+    return copy;
+}
+function templateJson(id, relativePath) {
+    const content = collectPlatformTemplates(id)?.get(relativePath);
+    if (!content)
+        return null;
+    const parsed = JSON.parse(content);
+    return isObject(parsed) ? parsed : null;
+}
+function findRestore(state, platform, kind) {
+    return state.jsonRestores.find((record) => record.platform === platform && record.kind === kind);
+}
+function putRestore(state, record) {
+    const index = state.jsonRestores.findIndex((item) => item.platform === record.platform && item.kind === record.kind);
+    if (index === -1)
+        state.jsonRestores.push(record);
+    else
+        state.jsonRestores[index] = record;
+}
+function dropRestore(state, platform, kind) {
+    state.jsonRestores = state.jsonRestores.filter((record) => !(record.platform === platform && record.kind === kind));
+}
+function reconcileHooks(plan, id, relativePath) {
+    const desired = effective(plan.desired, id).hooks;
+    const restore = findRestore(plan.nextState, id, "hooks");
+    if (!ownedTemplates(plan.projectRoot, id).has(relativePath) && !restore)
+        return;
+    const current = parseJsonFile(plan, relativePath);
+    if (!desired && restore) {
+        const managed = collectTrellisHooks(current);
+        if (Object.keys(managed).length > 0) {
+            const template = templateJson(id, relativePath);
+            const data = isObject(restore.data) ? restore.data : {};
+            if (JSON.stringify(managed) !== JSON.stringify(data.hooks) &&
+                JSON.stringify(managed) !==
+                    JSON.stringify(template ? collectTrellisHooks(template) : {})) {
+                throw new Error(`Disabled ${id} hook registrations changed; resolve the conflict before applying.`);
+            }
+            planWrite(plan, relativePath, jsonText(removeTrellisHooks(current)), `disable regenerated ${id} hooks`);
+        }
+        return;
+    }
+    if (!desired && !restore) {
+        const managed = collectTrellisHooks(current);
+        if (Object.keys(managed).length === 0)
+            return;
+        const template = templateJson(id, relativePath);
+        putRestore(plan.nextState, {
+            path: relativePath,
+            platform: id,
+            kind: "hooks",
+            data: {
+                hooks: managed,
+                useTemplate: template !== null &&
+                    JSON.stringify(managed) ===
+                        JSON.stringify(collectTrellisHooks(template)),
+            },
+        });
+        planWrite(plan, relativePath, jsonText(removeTrellisHooks(current)), `disable ${id} hooks`);
+        return;
+    }
+    if (desired && restore) {
+        const data = isObject(restore.data) ? restore.data : {};
+        const storedHooks = isObject(data.hooks) ? data.hooks : {};
+        const template = data.useTemplate === true ? templateJson(id, relativePath) : null;
+        const hooks = template
+            ? collectTrellisHooks(template)
+            : storedHooks;
+        const restored = mergeTrellisHooks(current, hooks, id === "zcode");
+        planWrite(plan, relativePath, jsonText(restored), `restore ${id} hooks`);
+        dropRestore(plan.nextState, id, "hooks");
+    }
+}
+function piSkillExclusions(projectRoot) {
+    const templates = ownedTemplates(projectRoot, "pi");
+    const exclusions = new Set();
+    for (const relativePath of templates.keys()) {
+        const match = relativePath.match(/^\.agents\/skills\/([^/]+)\/SKILL\.md$/);
+        if (match?.[1])
+            exclusions.add(`-skills/${match[1]}/SKILL.md`);
+    }
+    return [...exclusions].sort();
+}
+function piHiddenSkillAliases(projectRoot) {
+    return sharedSkillEntryPaths(projectRoot).map((relativePath) => `../${path.posix.dirname(relativePath)}/.trellis-disabled.md`);
+}
+function reconcilePiSkills(plan, hiddenSharedSkills) {
+    const id = "pi";
+    const relativePath = ".pi/settings.json";
+    const enabled = effective(plan.desired, id).skills;
+    const desiredEntries = enabled
+        ? hiddenSharedSkills
+            ? piHiddenSkillAliases(plan.projectRoot)
+            : []
+        : piSkillExclusions(plan.projectRoot);
+    const restore = findRestore(plan.nextState, id, "pi-skills");
+    const current = parseJsonFile(plan, relativePath);
+    if (current.skills !== undefined &&
+        (!Array.isArray(current.skills) ||
+            !current.skills.every((value) => typeof value === "string"))) {
+        throw new Error("Expected a string array for Pi skills.");
+    }
+    const skills = Array.isArray(current.skills)
+        ? current.skills.filter((value) => typeof value === "string")
+        : [];
+    if (desiredEntries.length > 0) {
+        if (restore && !Array.isArray(restore.data)) {
+            throw new Error("Malformed Pi skill restore state.");
+        }
+        const owned = new Set(Array.isArray(restore?.data)
+            ? restore.data.filter((value) => typeof value === "string")
+            : []);
+        const next = skills.filter((entry) => !owned.has(entry));
+        owned.clear();
+        for (const entry of desiredEntries) {
+            if (!next.includes(entry)) {
+                next.push(entry);
+                owned.add(entry);
+            }
+        }
+        if (!restore && owned.size > 0) {
+            putRestore(plan.nextState, {
+                path: relativePath,
+                platform: id,
+                kind: "pi-skills",
+                data: [...owned],
+            });
+        }
+        else if (restore) {
+            restore.data = [...owned];
+        }
+        if (JSON.stringify(next) !== JSON.stringify(skills)) {
+            current.skills = next;
+            planWrite(plan, relativePath, jsonText(current), enabled ? "load hidden Trellis skills in pi" : "disable pi skills");
+        }
+    }
+    else if (restore) {
+        if (!Array.isArray(restore.data)) {
+            throw new Error("Malformed Pi skill restore state.");
+        }
+        const owned = new Set(restore.data.filter((value) => typeof value === "string"));
+        if ([...owned].some((entry) => !skills.includes(entry))) {
+            throw new Error("Cannot restore Pi skills: managed loading entry changed.");
+        }
+        const next = skills.filter((value) => !owned.has(value));
+        if (next.length === 0)
+            delete current.skills;
+        else
+            current.skills = next;
+        planWrite(plan, relativePath, jsonText(current), "restore pi skills");
+        dropRestore(plan.nextState, id, "pi-skills");
+    }
+}
+function ompSkillNames(projectRoot) {
+    return [...ownedTemplates(projectRoot, "omp").keys()]
+        .flatMap((relativePath) => {
+        const match = relativePath.match(/^\.omp\/skills\/([^/]+)\/SKILL\.md$/);
+        return match?.[1] ? [match[1]] : [];
+    })
+        .sort();
+}
+function yamlSectionEnd(lines, start) {
+    const indent = indentation(lines[start] ?? "");
+    let end = start + 1;
+    while (end < lines.length) {
+        const line = lines[end] ?? "";
+        if (line.trim() &&
+            !line.trimStart().startsWith("#") &&
+            indentation(line) <= indent)
+            break;
+        end += 1;
+    }
+    return end;
+}
+function ompSkillSections(lines) {
+    const roots = lines.flatMap((line, index) => /^skills\s*:/.test(line) ? [index] : []);
+    if (roots.length > 1)
+        throw new Error("Duplicate OMP skills mappings.");
+    const skills = roots[0] ?? -1;
+    if (skills === -1)
+        return { skills, ignored: -1 };
+    if (!/^skills:\s*(?:#.*)?$/.test(lines[skills] ?? ""))
+        throw new Error("Unsupported OMP skills mapping syntax.");
+    const end = yamlSectionEnd(lines, skills);
+    const children = lines.flatMap((line, index) => index > skills && index < end && /^\s+ignoredSkills\s*:/.test(line)
+        ? [index]
+        : []);
+    if (children.length > 1)
+        throw new Error("Duplicate OMP ignoredSkills mappings.");
+    const ignored = children[0] ?? -1;
+    if (ignored !== -1 &&
+        !/^ {2}ignoredSkills:\s*(?:#.*)?$/.test(lines[ignored] ?? "")) {
+        throw new Error("Unsupported OMP ignoredSkills syntax; use a two-space block list.");
+    }
+    if (ignored !== -1) {
+        for (const line of lines.slice(ignored + 1, yamlSectionEnd(lines, ignored))) {
+            if (line.trim() &&
+                !line.trimStart().startsWith("#") &&
+                !/^ {4}-\s+/.test(line)) {
+                throw new Error("Unsupported OMP ignoredSkills list syntax.");
+            }
+        }
+    }
+    return { skills, ignored };
+}
+function reconcileOmpSkills(plan) {
+    const id = "omp";
+    const relativePath = ".omp/config.yml";
+    const desired = effective(plan.desired, id).skills;
+    const restore = findRestore(plan.nextState, id, "omp-skills");
+    if (desired && !restore)
+        return;
+    const absPath = integrationPath(plan.projectRoot, relativePath);
+    const content = lstatIfPresent(absPath)
+        ? fs.readFileSync(absPath, "utf-8")
+        : "";
+    const lines = content.split(/\r?\n/);
+    const data = restore
+        ? restore.data
+        : { entries: [], createdSkills: false, createdIgnoredSkills: false };
+    let { skills, ignored } = ompSkillSections(lines);
+    if (!desired) {
+        const names = ompSkillNames(plan.projectRoot);
+        if (names.length === 0)
+            return;
+        if (skills === -1) {
+            skills = lines.length;
+            lines.push("skills:");
+            data.createdSkills = true;
+        }
+        if (ignored === -1) {
+            ignored = skills + 1;
+            lines.splice(ignored, 0, "  ignoredSkills:");
+            data.createdIgnoredSkills = true;
+        }
+        for (const name of names) {
+            const end = yamlSectionEnd(lines, ignored);
+            if (!lines
+                .slice(ignored + 1, end)
+                .some((line) => line.trim() === `- ${name}` ||
+                line.trim() === `- "${name}"` ||
+                line.trim() === `- '${name}'`)) {
+                lines.splice(end, 0, `    - ${name}`);
+                if (!data.entries.includes(name))
+                    data.entries.push(name);
+            }
+        }
+        if (data.entries.length > 0)
+            putRestore(plan.nextState, {
+                path: relativePath,
+                platform: id,
+                kind: "omp-skills",
+                data,
+            });
+    }
+    else {
+        if (ignored === -1)
+            throw new Error("Cannot restore OMP skills: managed ignoredSkills entry changed.");
+        for (const name of data.entries) {
+            const end = yamlSectionEnd(lines, ignored);
+            const index = lines.findIndex((line, index) => index > ignored && index < end && line.trim() === `- ${name}`);
+            if (index === -1)
+                throw new Error("Cannot restore OMP skills: managed ignoredSkills entry changed.");
+            lines.splice(index, 1);
+        }
+        const hasChildren = (start) => lines
+            .slice(start + 1, yamlSectionEnd(lines, start))
+            .some((line) => line.trim().length > 0);
+        if (data.createdIgnoredSkills && !hasChildren(ignored))
+            lines.splice(ignored, 1);
+        if (data.createdSkills && !hasChildren(skills))
+            lines.splice(skills, 1);
+        dropRestore(plan.nextState, id, "omp-skills");
+    }
+    const next = `${lines.join("\n").replace(/\n*$/, "")}\n`;
+    if (next !== content)
+        planWrite(plan, relativePath, next, desired ? "restore omp skills" : "disable omp skills");
+}
+function validateRestoreRecord(projectRoot, record) {
+    const fail = () => {
+        throw new Error(`Invalid integration restore ownership: ${record.platform}/${record.kind}`);
+    };
+    const data = record.data;
+    const stringEntries = (value, allowed) => Array.isArray(value) &&
+        value.every((entry) => typeof entry === "string" && allowed.includes(entry)) &&
+        new Set(value).size === value.length;
+    if (record.kind === "pi-skills") {
+        if (record.platform !== "pi" ||
+            record.path !== ".pi/settings.json" ||
+            !stringEntries(data, [
+                ...piSkillExclusions(projectRoot),
+                ...piHiddenSkillAliases(projectRoot),
+            ]))
+            fail();
+        return;
+    }
+    if (record.kind === "omp-skills") {
+        if (record.platform !== "omp" ||
+            record.path !== ".omp/config.yml" ||
+            !isObject(data) ||
+            !stringEntries(data.entries, ompSkillNames(projectRoot)) ||
+            typeof data.createdSkills !== "boolean" ||
+            typeof data.createdIgnoredSkills !== "boolean" ||
+            Object.keys(data).some((key) => !["entries", "createdSkills", "createdIgnoredSkills"].includes(key)))
+            fail();
+        return;
+    }
+    if (record.kind === "claude-skills") {
+        if (record.platform !== "claude-code" ||
+            record.path !== ".claude/settings.json" ||
+            !isObject(data))
+            fail();
+        const names = claudeSkillNames(projectRoot);
+        if (!isObject(data) ||
+            Object.entries(data).some(([name, value]) => !names.includes(name) ||
+                (value !== null && !["on", "off", "auto"].includes(String(value)))))
+            fail();
+        return;
+    }
+    const hookPaths = {
+        "claude-code": ".claude/settings.json",
+        codex: ".codex/hooks.json",
+        zcode: ".zcode/config.json",
+    };
+    if (record.path !== hookPaths[record.platform] ||
+        !isObject(data) ||
+        !isObject(data.hooks) ||
+        typeof data.useTemplate !== "boolean" ||
+        Object.keys(data).some((key) => !["hooks", "useTemplate"].includes(key)))
+        fail();
+    if (!isObject(data) || !isObject(data.hooks))
+        return;
+    const templates = ownedTemplates(projectRoot, record.platform);
+    if (!templates.has(record.path))
+        fail();
+    for (const registrations of Object.values(data.hooks)) {
+        if (!Array.isArray(registrations))
+            fail();
+        for (const registration of registrations) {
+            if (!isObject(registration) ||
+                !Array.isArray(registration.hooks) ||
+                (registration.matcher !== undefined &&
+                    typeof registration.matcher !== "string") ||
+                Object.keys(registration).some((key) => !["matcher", "hooks"].includes(key)))
+                fail();
+            if (!isObject(registration) || !Array.isArray(registration.hooks))
+                continue;
+            for (const handler of registration.hooks) {
+                if (!isTrellisHookHandler(handler) ||
+                    !isObject(handler) ||
+                    typeof handler.command !== "string" ||
+                    handler.type !== "command" ||
+                    (handler.timeout !== undefined &&
+                        typeof handler.timeout !== "number") ||
+                    (handler.async !== undefined && typeof handler.async !== "boolean") ||
+                    (handler.once !== undefined && typeof handler.once !== "boolean") ||
+                    (handler.statusMessage !== undefined &&
+                        typeof handler.statusMessage !== "string") ||
+                    Object.keys(handler).some((key) => ![
+                        "type",
+                        "command",
+                        "timeout",
+                        "async",
+                        "statusMessage",
+                        "once",
+                    ].includes(key)))
+                    fail();
+                if (!isObject(handler) || typeof handler.command !== "string")
+                    continue;
+                const match = handler.command.match(/(?:\.claude|\.codex|\.zcode)\/hooks\/[\w-]+\.py/);
+                if (!match?.[0] || !templates.has(match[0]))
+                    fail();
+            }
+        }
+    }
+}
+function claudeSkillNames(projectRoot) {
+    const files = ownedTemplates(projectRoot, "claude-code");
+    const names = new Set();
+    for (const relativePath of files.keys()) {
+        const match = relativePath.match(/^\.claude\/skills\/([^/]+)\/SKILL\.md$/);
+        if (match?.[1])
+            names.add(match[1]);
+    }
+    return [...names].sort();
+}
+function reconcileClaudeSkills(plan) {
+    const id = "claude-code";
+    const relativePath = ".claude/settings.json";
+    const desired = effective(plan.desired, id).skills;
+    const restore = findRestore(plan.nextState, id, "claude-skills");
+    const current = parseJsonFile(plan, relativePath);
+    if (current.skillOverrides !== undefined &&
+        !isObject(current.skillOverrides)) {
+        throw new Error("Expected an object for Claude skillOverrides.");
+    }
+    const overrides = isObject(current.skillOverrides)
+        ? current.skillOverrides
+        : {};
+    if (!desired) {
+        const previous = restore && isObject(restore.data) ? restore.data : {};
+        for (const name of claudeSkillNames(plan.projectRoot)) {
+            if (!Object.hasOwn(previous, name)) {
+                if (overrides[name] !== undefined &&
+                    !["on", "off", "auto"].includes(String(overrides[name]))) {
+                    throw new Error(`Unsupported Claude skill override: ${name}`);
+                }
+                previous[name] = Object.hasOwn(overrides, name)
+                    ? overrides[name]
+                    : null;
+            }
+            else if (overrides[name] !== undefined && overrides[name] !== "off") {
+                throw new Error(`Disabled Claude skill override changed: ${name}`);
+            }
+            overrides[name] = "off";
+        }
+        if (Object.keys(previous).length === 0)
+            return;
+        current.skillOverrides = overrides;
+        putRestore(plan.nextState, {
+            path: relativePath,
+            platform: id,
+            kind: "claude-skills",
+            data: previous,
+        });
+        planWrite(plan, relativePath, jsonText(current), "disable claude-code skills");
+    }
+    else if (desired && restore) {
+        if (!isObject(restore.data)) {
+            throw new Error("Malformed Claude skill restore state.");
+        }
+        for (const [name, previous] of Object.entries(restore.data)) {
+            if (overrides[name] !== "off") {
+                throw new Error(`Cannot restore Claude skill ${name}: managed override changed while disabled.`);
+            }
+            if (previous === null)
+                Reflect.deleteProperty(overrides, name);
+            else
+                overrides[name] = previous;
+        }
+        if (Object.keys(overrides).length === 0)
+            delete current.skillOverrides;
+        else
+            current.skillOverrides = overrides;
+        planWrite(plan, relativePath, jsonText(current), "restore claude-code skills");
+        dropRestore(plan.nextState, id, "claude-skills");
+    }
+}
+function reconcileParkedResources(plan, installed) {
+    const activeKeys = new Set();
+    for (const id of installed) {
+        if (!SUPPORTED_PLATFORMS.has(id))
+            continue;
+        const templates = ownedTemplates(plan.projectRoot, id);
+        for (const [relativePath, templateContent] of templates) {
+            const category = shouldParkPath(id, relativePath, plan.desired);
+            const key = `${id}:${relativePath}`;
+            const existing = plan.nextState.parked.find((entry) => `${entry.platform}:${entry.path}` === key);
+            if (category) {
+                activeKeys.add(key);
+                if (!existing) {
+                    const originalAbs = integrationPath(plan.projectRoot, relativePath, true);
+                    const original = fingerprintPath(originalAbs);
+                    if (original.kind === "absent")
+                        continue;
+                    const parkedPath = parkedPathFor(id, relativePath);
+                    planMove(plan, relativePath, parkedPath, `park ${id} ${category}`);
+                    plan.nextState.parked.push({
+                        path: relativePath,
+                        parkedPath,
+                        platform: id,
+                        category,
+                        fingerprint: original,
+                        templateHash: original.kind === "file" &&
+                            sha256(fs.readFileSync(originalAbs, "utf-8")) ===
+                                sha256(templateContent)
+                            ? sha256(templateContent)
+                            : undefined,
+                    });
+                }
+                else {
+                    const originalFingerprint = fingerprintPath(integrationPath(plan.projectRoot, existing.path, true));
+                    if (originalFingerprint.kind !== "absent") {
+                        const originalAbs = integrationPath(plan.projectRoot, existing.path, true);
+                        if (originalFingerprint.kind !== "file" ||
+                            fs.readFileSync(originalAbs, "utf-8") !== templateContent) {
+                            throw new Error(`Disabled Trellis resource reappeared with unowned content: ${existing.path}`);
+                        }
+                        planDelete(plan, existing.path, `withdraw regenerated ${id} ${category}`);
+                    }
+                    const parkedAbs = integrationPath(plan.projectRoot, existing.parkedPath, true);
+                    const parkedFingerprint = fingerprintPath(parkedAbs);
+                    if (!fingerprintsEqual(parkedFingerprint, existing.fingerprint)) {
+                        throw new Error(`Parked Trellis resource changed unexpectedly: ${existing.parkedPath}`);
+                    }
+                    if (existing.templateHash &&
+                        parkedFingerprint.kind === "file" &&
+                        existing.templateHash !== sha256(templateContent)) {
+                        planWrite(plan, existing.parkedPath, templateContent, `update parked ${id} ${category}`, parkedFingerprint.mode);
+                        existing.fingerprint = {
+                            kind: "file",
+                            sha256: sha256(templateContent),
+                            size: Buffer.byteLength(templateContent),
+                            mode: parkedFingerprint.mode,
+                        };
+                        existing.templateHash = sha256(templateContent);
+                    }
+                }
+            }
+            else if (existing) {
+                const parkedFingerprint = fingerprintPath(integrationPath(plan.projectRoot, existing.parkedPath, true));
+                if (!fingerprintsEqual(parkedFingerprint, existing.fingerprint)) {
+                    throw new Error(`Parked Trellis resource changed unexpectedly: ${existing.parkedPath}`);
+                }
+                const originalAbs = integrationPath(plan.projectRoot, existing.path, true);
+                if (fingerprintPath(originalAbs).kind !== "absent") {
+                    throw new Error(`Cannot restore Trellis resource over existing path: ${existing.path}`);
+                }
+                planMove(plan, existing.parkedPath, existing.path, `restore ${id} ${existing.category}`);
+            }
+        }
+    }
+    plan.nextState.parked = plan.nextState.parked.filter((entry) => {
+        if (entry.platform === "shared")
+            return true;
+        const key = `${entry.platform}:${entry.path}`;
+        return activeKeys.has(key);
+    });
+}
+function sharedSkillEntryPaths(projectRoot) {
+    const paths = new Set();
+    for (const id of SUPPORTED_PLATFORMS) {
+        for (const relativePath of ownedTemplates(projectRoot, id).keys()) {
+            if (/^\.agents\/skills\/[^/]+\/SKILL\.md$/.test(relativePath)) {
+                paths.add(relativePath);
+            }
+        }
+    }
+    return [...paths].sort();
+}
+function shouldHideSharedSkills(config, installed) {
+    if (installed.has("codex") && effective(config, "codex").skills)
+        return false;
+    return ((installed.has("codex") && !effective(config, "codex").skills) ||
+        (installed.has("pi") && !effective(config, "pi").skills));
+}
+function reconcileSharedSkills(plan, installed) {
+    const hidden = shouldHideSharedSkills(plan.desired, installed);
+    if (hidden) {
+        const blockers = ["gemini", "dsh", "kimi"].filter((id) => installed.has(id));
+        if (blockers.length > 0) {
+            throw new Error(`Cannot disable shared Trellis skills while unadapted shared consumers are active: ${blockers.join(", ")}. Remove those project integrations or keep shared Trellis skills enabled.`);
+        }
+    }
+    const templates = new Map();
+    for (const relativePath of sharedSkillEntryPaths(plan.projectRoot)) {
+        for (const id of SUPPORTED_PLATFORMS) {
+            const content = collectPlatformTemplates(id)?.get(relativePath);
+            if (content !== undefined) {
+                templates.set(relativePath, content);
+                break;
+            }
+        }
+    }
+    for (const [relativePath, templateContent] of templates) {
+        const key = `shared:${relativePath}`;
+        const existing = plan.nextState.parked.find((entry) => `${entry.platform}:${entry.path}` === key);
+        const hiddenPath = `${path.posix.dirname(relativePath)}/.trellis-disabled.md`;
+        if (hidden && !existing) {
+            const originalAbs = integrationPath(plan.projectRoot, relativePath, true);
+            const original = fingerprintPath(originalAbs);
+            if (original.kind === "absent") {
+                const hiddenFingerprint = fingerprintPath(integrationPath(plan.projectRoot, hiddenPath, true));
+                if (hiddenFingerprint.kind !== "absent") {
+                    throw new Error(`Hidden Trellis skill entry is not owned by recovery state: ${hiddenPath}`);
+                }
+                continue;
+            }
+            planMove(plan, relativePath, hiddenPath, "hide shared Trellis skill entry");
+            plan.nextState.parked.push({
+                path: relativePath,
+                parkedPath: hiddenPath,
+                platform: "shared",
+                category: "skill",
+                fingerprint: original,
+                templateHash: original.kind === "file" &&
+                    sha256(fs.readFileSync(originalAbs, "utf-8")) ===
+                        sha256(templateContent)
+                    ? sha256(templateContent)
+                    : undefined,
+            });
+        }
+        else if (existing) {
+            if (existing.parkedPath !== hiddenPath) {
+                throw new Error(`Unexpected shared skill recovery path: ${existing.parkedPath}`);
+            }
+            const parkedFingerprint = fingerprintPath(integrationPath(plan.projectRoot, existing.parkedPath, true));
+            if (!fingerprintsEqual(parkedFingerprint, existing.fingerprint)) {
+                throw new Error(`Hidden Trellis skill entry changed unexpectedly: ${existing.parkedPath}`);
+            }
+            const originalFingerprint = fingerprintPath(integrationPath(plan.projectRoot, relativePath, true));
+            if (hidden && originalFingerprint.kind !== "absent") {
+                const originalAbs = integrationPath(plan.projectRoot, relativePath, true);
+                if (originalFingerprint.kind !== "file" ||
+                    fs.readFileSync(originalAbs, "utf-8") !== templateContent) {
+                    throw new Error(`Disabled shared Trellis skill reappeared with unowned content: ${relativePath}`);
+                }
+                planDelete(plan, relativePath, "withdraw regenerated shared Trellis skill");
+            }
+            if (hidden &&
+                existing.templateHash &&
+                parkedFingerprint.kind === "file" &&
+                existing.templateHash !== sha256(templateContent)) {
+                planWrite(plan, existing.parkedPath, templateContent, "update hidden shared Trellis skill entry", parkedFingerprint.mode);
+                existing.fingerprint = {
+                    kind: "file",
+                    sha256: sha256(templateContent),
+                    size: Buffer.byteLength(templateContent),
+                    mode: parkedFingerprint.mode,
+                };
+                existing.templateHash = sha256(templateContent);
+            }
+            else if (!hidden) {
+                if (originalFingerprint.kind !== "absent") {
+                    throw new Error(`Cannot restore shared Trellis skill over existing path: ${relativePath}`);
+                }
+                planMove(plan, existing.parkedPath, relativePath, "restore shared Trellis skill entry");
+                plan.nextState.parked = plan.nextState.parked.filter((entry) => entry !== existing);
+            }
+        }
+    }
+    return hidden;
+}
+function extractManagedBlock(content) {
+    const start = content.indexOf(TRELLIS_BLOCK_START);
+    const end = content.indexOf(TRELLIS_BLOCK_END, start);
+    if (start === -1 || end === -1)
+        return null;
+    return content.slice(start, end + TRELLIS_BLOCK_END.length);
+}
+function removeManagedBlock(content) {
+    const block = extractManagedBlock(content);
+    if (!block)
+        return content;
+    return `${content.replace(block, "").trimEnd()}\n`;
+}
+function staticInstructionsNeeded(config, installed) {
+    if (config.enabled && installed.size === 0)
+        return true;
+    for (const id of installed) {
+        if (!SUPPORTED_PLATFORMS.has(id))
+            return true;
+        if (effective(config, id).enabled)
+            return true;
+    }
+    return false;
+}
+function reconcileStaticInstructions(plan, installed) {
+    const relativePath = "AGENTS.md";
+    const absPath = integrationPath(plan.projectRoot, relativePath);
+    const stat = lstatIfPresent(absPath);
+    if (!stat || !stat.isFile() || stat.isSymbolicLink())
+        return;
+    const content = fs.readFileSync(absPath, "utf-8");
+    const needed = staticInstructionsNeeded(plan.desired, installed);
+    if (!needed &&
+        !plan.nextState.markdownRestore &&
+        Object.hasOwn(loadHashes(plan.projectRoot), relativePath)) {
+        const block = extractManagedBlock(content);
+        if (!block)
+            return;
+        const templateBlock = extractManagedBlock(agentsMdContent);
+        plan.nextState.markdownRestore = {
+            path: relativePath,
+            block,
+            templateHash: templateBlock && templateBlock === block ? sha256(block) : undefined,
+        };
+        planWrite(plan, relativePath, removeManagedBlock(content), "withdraw Trellis static instructions");
+    }
+    else if (!needed && plan.nextState.markdownRestore) {
+        const block = extractManagedBlock(content);
+        if (block &&
+            block !== plan.nextState.markdownRestore.block &&
+            block !== extractManagedBlock(agentsMdContent)) {
+            throw new Error("Disabled Trellis AGENTS.md block changed; resolve the conflict before applying.");
+        }
+        if (block)
+            planWrite(plan, relativePath, removeManagedBlock(content), "withdraw regenerated Trellis static instructions");
+    }
+    else if (needed && plan.nextState.markdownRestore) {
+        if (extractManagedBlock(content)) {
+            throw new Error("Cannot restore Trellis AGENTS.md block: a managed block already exists.");
+        }
+        const stored = plan.nextState.markdownRestore;
+        const templateBlock = extractManagedBlock(agentsMdContent);
+        const block = stored.templateHash && templateBlock ? templateBlock : stored.block;
+        planWrite(plan, relativePath, `${content.trimEnd()}\n\n${block}\n`, "restore Trellis static instructions");
+        delete plan.nextState.markdownRestore;
+    }
+}
+function buildStatus(projectRoot, config, state) {
+    const installed = installedPlatforms(projectRoot, state);
+    const platforms = [];
+    for (const id of PLATFORM_IDS) {
+        if (!installed.has(id))
+            continue;
+        const supported = SUPPORTED_PLATFORMS.has(id);
+        const value = effective(config, id);
+        const notes = [];
+        if (supported) {
+            notes.push("Only project-managed Trellis resources are controlled; user/global sources are externally managed.");
+        }
+        if (!supported)
+            notes.push("Installed host is not adapted to project integration controls; existing Trellis resources remain active.");
+        if (id === "zcode" && AI_TOOLS.zcode.globalHookPlugin)
+            notes.push("A user-installed global ZCode hook plugin is externally managed.");
+        platforms.push({
+            id,
+            supported,
+            enabled: supported ? value.enabled : true,
+            skills: supported ? value.skills : true,
+            hooks: supported ? value.hooks : true,
+            applied: supported ? true : false,
+            notes,
+        });
+    }
+    return {
+        projectRoot,
+        config: cloneConfig(config),
+        platforms,
+        notes: [
+            "Changes affect new or reloaded host sessions; already injected context cannot be removed.",
+        ],
+    };
+}
+/** Inspect the current project without changing preferences, managed resources, or recovery state. */
+export function readIntegrationStatus(cwd) {
+    const projectRoot = fs.realpathSync(cwd);
+    const config = readConfig(projectRoot);
+    const state = loadState(projectRoot);
+    const status = buildStatus(projectRoot, config, state);
+    const preflight = planIntegrationInternal(projectRoot, config, state, false);
+    const applied = preflight.changes.length === 0;
+    for (const row of status.platforms) {
+        if (row.supported)
+            row.applied = applied;
+    }
+    if (!applied) {
+        status.notes.push(`${preflight.changes.length} integration change(s) are pending.`);
+    }
+    return status;
+}
+function planIntegrationInternal(projectRoot, desired, state, persistConfig) {
+    const nextState = cloneState(state);
+    const plan = {
+        status: buildStatus(projectRoot, desired, state),
+        changes: [],
+        projectRoot,
+        desired: cloneConfig(desired),
+        operations: [],
+        nextState,
+        stateFingerprint: fingerprintPath(integrationPath(projectRoot, STATE_PATH)),
+        manifestFingerprint: fingerprintPath(integrationPath(projectRoot, MANIFEST_PATH)),
+        configFingerprint: fingerprintPath(resolveConfigPath(projectRoot)),
+    };
+    const installed = installedPlatforms(projectRoot, state);
+    nextState.configuredPlatforms = [...installed].sort();
+    if (persistConfig &&
+        JSON.stringify(readConfig(projectRoot)) !== JSON.stringify(desired)) {
+        const configPath = resolveConfigPath(projectRoot);
+        const content = fs.existsSync(configPath)
+            ? fs.readFileSync(configPath, "utf-8")
+            : "";
+        planWrite(plan, ".trellis/config.yaml", replaceIntegrationSection(content, desired), "persist integration preferences");
+    }
+    reconcileParkedResources(plan, installed);
+    const hiddenSharedSkills = reconcileSharedSkills(plan, installed);
+    if (installed.has("pi"))
+        reconcilePiSkills(plan, hiddenSharedSkills);
+    if (installed.has("omp"))
+        reconcileOmpSkills(plan);
+    if (installed.has("codex")) {
+        reconcileHooks(plan, "codex", ".codex/hooks.json");
+    }
+    if (installed.has("claude-code")) {
+        reconcileClaudeSkills(plan);
+        reconcileHooks(plan, "claude-code", ".claude/settings.json");
+    }
+    if (installed.has("zcode"))
+        reconcileHooks(plan, "zcode", ".zcode/config.json");
+    reconcileStaticInstructions(plan, installed);
+    validateState(projectRoot, nextState);
+    const hasRecoveryState = nextState.parked.length > 0 ||
+        nextState.jsonRestores.length > 0 ||
+        nextState.markdownRestore !== undefined;
+    const stateContent = `${JSON.stringify(nextState, null, 2)}\n`;
+    const currentStatePath = integrationPath(projectRoot, STATE_PATH);
+    const currentStateStat = lstatIfPresent(currentStatePath);
+    const currentState = currentStateStat?.isFile()
+        ? fs.readFileSync(currentStatePath, "utf-8")
+        : null;
+    if ((hasRecoveryState || currentState !== null) &&
+        currentState !== stateContent) {
+        planWrite(plan, STATE_PATH, stateContent, "update integration recovery state", 0o600);
+    }
+    plan.status = buildStatus(projectRoot, desired, nextState);
+    const applied = plan.changes.length === 0;
+    for (const row of plan.status.platforms) {
+        if (row.supported)
+            row.applied = applied;
+    }
+    return plan;
+}
+/** Build a conflict-checked plan; omit desired to reconcile the policy already saved on disk. */
+export function planIntegration(cwd, desired) {
+    const projectRoot = fs.realpathSync(cwd);
+    const state = loadState(projectRoot);
+    const config = desired ? cloneConfig(desired) : readConfig(projectRoot);
+    return planIntegrationInternal(projectRoot, config, state, desired !== undefined);
+}
+function assertOperationFresh(projectRoot, operation) {
+    if (operation.kind === "move") {
+        const from = fingerprintPath(integrationPath(projectRoot, operation.from, true));
+        const to = fingerprintPath(integrationPath(projectRoot, operation.to, true));
+        if (!fingerprintsEqual(from, operation.fromBefore) ||
+            !fingerprintsEqual(to, operation.toBefore)) {
+            throw new Error(`Integration plan is stale for move ${operation.from} -> ${operation.to}.`);
+        }
+        return;
+    }
+    const actual = fingerprintPath(integrationPath(projectRoot, operation.relativePath));
+    if (!fingerprintsEqual(actual, operation.before)) {
+        throw new Error(`Integration plan is stale for ${operation.relativePath}.`);
+    }
+}
+function writeIntegrationFile(absPath, content, mode) {
+    fs.mkdirSync(path.dirname(absPath), { recursive: true });
+    // Reserve the atomic writer's temporary path before it can follow a planted
+    // symlink, and give sensitive mixed settings their final mode before writing.
+    const temporary = path.join(path.dirname(absPath), `.${path.basename(absPath)}.${process.pid}.tmp`);
+    const fd = fs.openSync(temporary, "wx", mode);
+    try {
+        if (process.platform !== "win32")
+            fs.fchmodSync(fd, mode);
+    }
+    catch (error) {
+        fs.unlinkSync(temporary);
+        throw error;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    writeFileAtomic(absPath, content);
+}
+function applyOperation(projectRoot, operation) {
+    if (operation.kind === "write") {
+        const absPath = integrationPath(projectRoot, operation.relativePath);
+        writeIntegrationFile(absPath, operation.content, operation.mode ?? 0o600);
+        return;
+    }
+    if (operation.kind === "delete") {
+        fs.unlinkSync(integrationPath(projectRoot, operation.relativePath));
+        return;
+    }
+    const from = integrationPath(projectRoot, operation.from, true);
+    const to = integrationPath(projectRoot, operation.to, true);
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.renameSync(from, to);
+}
+function rollbackOperation(projectRoot, operation) {
+    if (operation.kind === "move") {
+        const from = integrationPath(projectRoot, operation.from, true);
+        const to = integrationPath(projectRoot, operation.to, true);
+        if (lstatIfPresent(to) && !lstatIfPresent(from))
+            fs.renameSync(to, from);
+        return;
+    }
+    const absPath = integrationPath(projectRoot, operation.relativePath);
+    if (operation.before.kind === "absent") {
+        if (lstatIfPresent(absPath))
+            fs.unlinkSync(absPath);
+        return;
+    }
+    // Write operations are limited to regular text files. The stale-plan preflight
+    // guarantees the original bytes are still available before mutation.
+    if (operation.before.kind !== "file")
+        return;
+}
+function applyIntegrationLocked(plan) {
+    const projectRoot = fs.realpathSync(plan.projectRoot);
+    if (projectRoot !== plan.projectRoot)
+        throw new Error("Integration project root changed since planning.");
+    for (const operation of plan.operations)
+        assertOperationFresh(projectRoot, operation);
+    const currentStateFingerprint = fingerprintPath(integrationPath(projectRoot, STATE_PATH));
+    if (!fingerprintsEqual(currentStateFingerprint, plan.stateFingerprint)) {
+        throw new Error("Integration plan is stale for recovery state.");
+    }
+    if (!fingerprintsEqual(fingerprintPath(integrationPath(projectRoot, MANIFEST_PATH)), plan.manifestFingerprint)) {
+        throw new Error("Integration plan is stale for ownership manifest.");
+    }
+    if (!fingerprintsEqual(fingerprintPath(resolveConfigPath(projectRoot)), plan.configFingerprint)) {
+        throw new Error("Integration plan is stale for project preferences.");
+    }
+    validateState(projectRoot, plan.nextState);
+    const reserved = new Set();
+    for (const operation of plan.operations) {
+        const paths = operation.kind === "move"
+            ? [operation.from, operation.to]
+            : [operation.relativePath];
+        for (const relativePath of paths) {
+            if (reserved.has(relativePath))
+                throw new Error(`Overlapping integration operations: ${relativePath}`);
+            reserved.add(relativePath);
+        }
+    }
+    const backups = new Map();
+    for (const operation of plan.operations) {
+        if (operation.kind === "move" || operation.before.kind !== "file")
+            continue;
+        const absPath = integrationPath(projectRoot, operation.relativePath);
+        backups.set(operation.relativePath, {
+            content: fs.readFileSync(absPath),
+            mode: operation.before.mode,
+        });
+    }
+    const applied = [];
+    try {
+        for (const operation of plan.operations) {
+            assertOperationFresh(projectRoot, operation);
+            applyOperation(projectRoot, operation);
+            applied.push(operation);
+        }
+    }
+    catch (error) {
+        for (const operation of [...applied].reverse()) {
+            if (operation.kind !== "move" && operation.before.kind === "file") {
+                const backup = backups.get(operation.relativePath);
+                if (backup) {
+                    const absPath = integrationPath(projectRoot, operation.relativePath);
+                    writeIntegrationFile(absPath, backup.content, backup.mode);
+                }
+            }
+            else {
+                rollbackOperation(projectRoot, operation);
+            }
+        }
+        throw error;
+    }
+    return readIntegrationStatus(projectRoot);
+}
+/** Apply a fresh plan under a project reservation, preserving modes and rolling back caught write failures. */
+export function applyIntegration(plan) {
+    const root = fs.realpathSync(plan.projectRoot);
+    if (root !== plan.projectRoot)
+        throw new Error("Integration project root changed since planning.");
+    if (plan.operations.length === 0)
+        return applyIntegrationLocked(plan);
+    const stateRoot = integrationPath(root, STATE_DIR);
+    const lockFile = integrationPath(root, `${STATE_DIR}/operation.lock`);
+    return withAblationProjectLock({
+        stateRoot,
+        transactionDir: stateRoot,
+        stateFile: integrationPath(root, STATE_PATH),
+        backupDir: integrationPath(root, PARKED_ROOT),
+        lockFile,
+    }, () => applyIntegrationLocked(plan));
+}
+//# sourceMappingURL=integration.js.map