@neta-art/neta-search-cli 0.2.43 → 0.2.47

package/neta-search.mjs

@@ -2660,7 +2660,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const negativeNumberArg = (arg) => {
           if (!/^-(\d+|\d*\.\d+)(e[+-]?\d+)?$/.test(arg)) return false;
           return !this._getCommandAndAncestors().some(
-            (cmd) => cmd.options.map((opt) => opt.short).some((short2) => /^-\d$/.test(short2))
+            (cmd) => cmd.options.map((opt) => opt.short).some((short3) => /^-\d$/.test(short3))
           );
         };
         let activeVariadicOption = null;
@@ -7021,8 +7021,8 @@ var require_util2 = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve2, reject) => {
-        res = resolve2;
+      const promise = new Promise((resolve3, reject) => {
+        res = resolve3;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -8526,8 +8526,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
                 });
               }
             });
-            const busboyResolve = new Promise((resolve2, reject) => {
-              busboy.on("finish", resolve2);
+            const busboyResolve = new Promise((resolve3, reject) => {
+              busboy.on("finish", resolve3);
               busboy.on("error", (err) => reject(new TypeError(err)));
             });
             if (this.body !== null) for await (const chunk of consumeBody(this[kState].body)) busboy.write(chunk);
@@ -9061,9 +9061,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve2, reject) => {
+          return new Promise((resolve3, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve2(data);
+              return err ? reject(err) : resolve3(data);
             });
           });
         }
@@ -9101,12 +9101,12 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve2, reject) => {
+          return new Promise((resolve3, reject) => {
             this.destroy(err, (err2, data) => {
               return err2 ? (
                 /* istanbul ignore next: should never error */
                 reject(err2)
-              ) : resolve2(data);
+              ) : resolve3(data);
             });
           });
         }
@@ -10166,16 +10166,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       async [kClose]() {
-        return new Promise((resolve2) => {
+        return new Promise((resolve3) => {
           if (!this[kSize]) {
-            resolve2(null);
+            resolve3(null);
           } else {
-            this[kClosedResolve] = resolve2;
+            this[kClosedResolve] = resolve3;
           }
         });
       }
       async [kDestroy](err) {
-        return new Promise((resolve2) => {
+        return new Promise((resolve3) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request3 = requests[i];
@@ -10186,7 +10186,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve2();
+            resolve3();
           };
           if (this[kHTTP2Session] != null) {
             util.destroy(this[kHTTP2Session], err);
@@ -10766,7 +10766,7 @@ var require_client = __commonJS({
         });
       }
       try {
-        const socket = await new Promise((resolve2, reject) => {
+        const socket = await new Promise((resolve3, reject) => {
           client[kConnector]({
             host,
             hostname,
@@ -10778,7 +10778,7 @@ var require_client = __commonJS({
             if (err) {
               reject(err);
             } else {
-              resolve2(socket2);
+              resolve3(socket2);
             }
           });
         });
@@ -11402,12 +11402,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve2, reject) => {
+      const waitForDrain = () => new Promise((resolve3, reject) => {
         assert2(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve2;
+          callback = resolve3;
         }
       });
       if (client[kHTTPConnVersion] === "h2") {
@@ -11752,8 +11752,8 @@ var require_pool_base = __commonJS({
         if (this[kQueue].isEmpty()) {
           return Promise.all(this[kClients].map((c) => c.close()));
         } else {
-          return new Promise((resolve2) => {
-            this[kClosedResolve] = resolve2;
+          return new Promise((resolve3) => {
+            this[kClosedResolve] = resolve3;
           });
         }
       }
@@ -12331,7 +12331,7 @@ var require_readable = __commonJS({
         if (this.closed) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           const signalListenerCleanup = signal ? util.addAbortListener(signal, () => {
             this.destroy();
           }) : noop;
@@ -12340,7 +12340,7 @@ var require_readable = __commonJS({
             if (signal && signal.aborted) {
               reject(signal.reason || Object.assign(new Error("The operation was aborted"), { name: "AbortError" }));
             } else {
-              resolve2(null);
+              resolve3(null);
             }
           }).on("error", noop).on("data", function(chunk) {
             limit -= chunk.length;
@@ -12362,11 +12362,11 @@ var require_readable = __commonJS({
         throw new TypeError("unusable");
       }
       assert2(!stream[kConsume]);
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         stream[kConsume] = {
           type,
           stream,
-          resolve: resolve2,
+          resolve: resolve3,
           reject,
           length: 0,
           body: []
@@ -12401,12 +12401,12 @@ var require_readable = __commonJS({
       }
     }
     function consumeEnd(consume2) {
-      const { type, body, resolve: resolve2, stream, length } = consume2;
+      const { type, body, resolve: resolve3, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve2(toUSVString(Buffer.concat(body)));
+          resolve3(toUSVString(Buffer.concat(body)));
         } else if (type === "json") {
-          resolve2(JSON.parse(Buffer.concat(body)));
+          resolve3(JSON.parse(Buffer.concat(body)));
         } else if (type === "arrayBuffer") {
           const dst = new Uint8Array(length);
           let pos = 0;
@@ -12414,12 +12414,12 @@ var require_readable = __commonJS({
             dst.set(buf, pos);
             pos += buf.byteLength;
           }
-          resolve2(dst.buffer);
+          resolve3(dst.buffer);
         } else if (type === "blob") {
           if (!Blob2) {
             Blob2 = __require("buffer").Blob;
           }
-          resolve2(new Blob2(body, { type: stream[kContentType] }));
+          resolve3(new Blob2(body, { type: stream[kContentType] }));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -12674,9 +12674,9 @@ var require_api_request = __commonJS({
     };
     function request3(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           request3.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve2(data);
+            return err ? reject(err) : resolve3(data);
           });
         });
       }
@@ -12849,9 +12849,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve2(data);
+            return err ? reject(err) : resolve3(data);
           });
         });
       }
@@ -13132,9 +13132,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           upgrade.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve2(data);
+            return err ? reject(err) : resolve3(data);
           });
         });
       }
@@ -13223,9 +13223,9 @@ var require_api_connect = __commonJS({
     };
     function connect3(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           connect3.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve2(data);
+            return err ? reject(err) : resolve3(data);
           });
         });
       }
@@ -16847,7 +16847,7 @@ var require_fetch = __commonJS({
       async function dispatch({ body }) {
         const url = requestCurrentURL(request3);
         const agent = fetchParams.controller.dispatcher;
-        return new Promise((resolve2, reject) => agent.dispatch(
+        return new Promise((resolve3, reject) => agent.dispatch(
           {
             path: url.pathname + url.search,
             origin: url.origin,
@@ -16923,7 +16923,7 @@ var require_fetch = __commonJS({
                   }
                 }
               }
-              resolve2({
+              resolve3({
                 status,
                 statusText,
                 headersList: headers[kHeadersList],
@@ -16966,7 +16966,7 @@ var require_fetch = __commonJS({
                 const val = headersList[n + 1].toString("latin1");
                 headers[kHeadersList].append(key, val);
               }
-              resolve2({
+              resolve3({
                 status,
                 statusText: STATUS_CODES[status],
                 headersList: headers[kHeadersList],
@@ -24863,14 +24863,14 @@ var __asyncValues = function(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve2, reject) {
-        v = o[n](v), settle(resolve2, reject, v.done, v.value);
+      return new Promise(function(resolve3, reject) {
+        v = o[n](v), settle(resolve3, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve2, reject, d, v) {
+  function settle(resolve3, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve2({ value: v2, done: d });
+      resolve3({ value: v2, done: d });
     }, reject);
   }
 };
@@ -25395,14 +25395,14 @@ var __asyncValues2 = function(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve2, reject) {
-        v = o[n](v), settle(resolve2, reject, v.done, v.value);
+      return new Promise(function(resolve3, reject) {
+        v = o[n](v), settle(resolve3, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve2, reject, d, v) {
+  function settle(resolve3, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve2({ value: v2, done: d });
+      resolve3({ value: v2, done: d });
     }, reject);
   }
 };
@@ -26137,14 +26137,14 @@ var __asyncValues3 = function(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve2, reject) {
-        v = o[n](v), settle(resolve2, reject, v.done, v.value);
+      return new Promise(function(resolve3, reject) {
+        v = o[n](v), settle(resolve3, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve2, reject, d, v) {
+  function settle(resolve3, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve2({ value: v2, done: d });
+      resolve3({ value: v2, done: d });
     }, reject);
   }
 };
@@ -26782,17 +26782,17 @@ function closedOrError(reason) {
   return isCancel ? closed() : error(reason);
 }
 function connect2(authority, http2SessionOptions) {
-  let resolve2;
+  let resolve3;
   let reject;
   const conn = new Promise((res, rej) => {
-    resolve2 = res;
+    resolve3 = res;
     reject = rej;
   });
   const newConn = http2.connect(authority, http2SessionOptions);
   newConn.on("connect", onConnect);
   newConn.on("error", onError);
   function onConnect() {
-    resolve2 === null || resolve2 === void 0 ? void 0 : resolve2(newConn);
+    resolve3 === null || resolve3 === void 0 ? void 0 : resolve3(newConn);
     cleanup();
   }
   function onError(err) {
@@ -26878,13 +26878,13 @@ function ready(conn, options) {
     },
     verify() {
       conn.ref();
-      return new Promise((resolve2) => {
+      return new Promise((resolve3) => {
         commonPing(() => {
           if (streamCount == 0)
             conn.unref();
-          resolve2(true);
+          resolve3(true);
         });
-        conn.once("error", () => resolve2(false));
+        conn.once("error", () => resolve3(false));
       });
     },
     abort(reason) {
@@ -27015,7 +27015,7 @@ function createNodeHttpClient(options) {
 function createNodeHttp1Client(httpOptions) {
   return async function request3(req) {
     const sentinel = createSentinel(req.signal);
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       sentinel.catch((e) => {
         reject(e);
       });
@@ -27026,7 +27026,7 @@ function createNodeHttp1Client(httpOptions) {
           response.on("error", sentinel.reject);
           sentinel.catch((reason) => response.destroy(connectErrorFromNodeReason(reason)));
           const trailer = new Headers();
-          resolve2({
+          resolve3({
             status: (_a = response.statusCode) !== null && _a !== void 0 ? _a : 0,
             header: nodeHeaderToWebHeader(response.headers),
             body: h1ResponseIterable(sentinel, response, trailer),
@@ -27041,7 +27041,7 @@ function createNodeHttp2Client(sessionProvider) {
   return function request3(req) {
     const sentinel = createSentinel(req.signal);
     const sessionManager = sessionProvider(req.url);
-    return new Promise((resolve2, reject) => {
+    return new Promise((resolve3, reject) => {
       sentinel.catch((e) => {
         reject(e);
       });
@@ -27055,7 +27055,7 @@ function createNodeHttp2Client(sessionProvider) {
             body: h2ResponseIterable(sentinel, stream, sessionManager),
             trailer: h2ResponseTrailer(stream)
           };
-          resolve2(response);
+          resolve3(response);
         });
       });
     });
@@ -27120,7 +27120,7 @@ function h2Request(sentinel, sm, url, method, headers, options, onStream) {
         return;
       }
       const rstCode = reason instanceof ConnectError && reason.code == Code.Canceled ? H2Code.CANCEL : H2Code.INTERNAL_ERROR;
-      return new Promise((resolve2) => stream.close(rstCode, resolve2));
+      return new Promise((resolve3) => stream.close(rstCode, resolve3));
     });
     stream.on("error", function h2StreamError(e) {
       if (stream.writableEnded && unwrapNodeErrorChain(e).map(getNodeErrorProps).some((p) => p.code == "ERR_STREAM_WRITE_AFTER_END")) {
@@ -27172,11 +27172,11 @@ function h2ResponseIterable(sentinel, response, sm) {
 }
 async function sinkRequest(request3, nodeRequest, sentinel) {
   if (request3.body === void 0) {
-    await new Promise((resolve2) => nodeRequest.end(resolve2));
+    await new Promise((resolve3) => nodeRequest.end(resolve3));
     return;
   }
   const it = request3.body[Symbol.asyncIterator]();
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     writeNext();
     function writeNext() {
       if (sentinel.isRejected()) {
@@ -27184,7 +27184,7 @@ async function sinkRequest(request3, nodeRequest, sentinel) {
       }
       it.next().then((r) => {
         if (r.done === true) {
-          nodeRequest.end(resolve2);
+          nodeRequest.end(resolve3);
           return;
         }
         nodeRequest.write(r.value, "binary", function(e) {
@@ -27212,8 +27212,8 @@ function createSentinel(signal) {
   let rej;
   let resolved = false;
   let rejected = false;
-  const p = new Promise((resolve2, reject) => {
-    res = resolve2;
+  const p = new Promise((resolve3, reject) => {
+    res = resolve3;
     rej = reject;
   });
   const c = {
@@ -29000,42 +29000,557 @@ metadata:
 }
 
 // cli/src/skills/submit.ts
-import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
-import { basename as basename2, join as join6 } from "node:path";
-var SUBMISSION_PATH = "/v1/skills/submission";
+import { existsSync as existsSync6, lstatSync as lstatSync3, readFileSync as readFileSync6 } from "node:fs";
+import { join as join7 } from "node:path";
+
+// cli/src/skills/limits.ts
 var MAX_FILES = 1e3;
 var MAX_FILE_BYTES = 20 << 20;
 var MAX_TOTAL_BYTES = 100 << 20;
-function precheck(dir) {
-  const problems = [];
-  const md = join6(dir, "SKILL.md");
-  if (!existsSync5(md)) return ["there is no SKILL.md"];
-  const raw = readFileSync5(md, "utf8");
-  const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(raw);
-  if (!fm) problems.push("SKILL.md has no frontmatter (it must start with --- and have name / description)");
-  else if (!/^description\s*:\s*\S/m.test(fm[1])) problems.push("the frontmatter has no description (agents decide when to use a skill by it)");
-  const links = [];
+
+// cli/src/skills/lint.ts
+import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
+import { basename as basename2, join as join6, posix, resolve as resolve2 } from "node:path";
+var CJK_RANGE = "\\u3400-\\u9fff\\uf900-\\ufaff\\u3040-\\u30ff\\uac00-\\ud7af";
+var CJK = new RegExp(`[${CJK_RANGE}]`);
+var CJK_G = new RegExp(`[${CJK_RANGE}]`, "g");
+var CJK_RUN4 = new RegExp(`[${CJK_RANGE}]{4,}`);
+var NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+function resolveSkillDir(arg) {
+  const cands = arg ? [arg, join6(SKILLS_DIR, arg), join6(DRAFTS_DIR, arg)] : ["."];
+  for (const c of cands) if (existsSync5(join6(c, "SKILL.md"))) return c;
+  return null;
+}
+function readFiles(dir) {
+  const files = [];
+  const symlinks = [];
   const walk = (rel) => {
     for (const ent of readdirSync3(join6(dir, rel), { withFileTypes: true })) {
       const childRel = rel ? `${rel}/${ent.name}` : ent.name;
       const st = lstatSync2(join6(dir, childRel));
-      if (st.isSymbolicLink()) links.push(childRel);
-      else if (st.isDirectory() && !skipSegment(ent.name, true, basename2(rel))) walk(childRel);
+      if (st.isSymbolicLink()) {
+        if (!skipSegment(ent.name, false, basename2(rel))) symlinks.push(childRel);
+        continue;
+      }
+      if (skipSegment(ent.name, st.isDirectory(), basename2(rel))) continue;
+      if (st.isDirectory()) {
+        walk(childRel);
+        continue;
+      }
+      if (!st.isFile()) continue;
+      let text = null;
+      if (st.size < 2e6) {
+        const b = readFileSync5(join6(dir, childRel));
+        if (!b.includes(0)) text = b.toString("utf8");
+      }
+      files.push({ rel: childRel, size: st.size, text });
     }
   };
   walk("");
-  if (links.length) problems.push(`symbolic links are not accepted: ${links.slice(0, 5).join(", ")}${links.length > 5 ? ` (+${links.length - 5} more)` : ""}`);
+  return { files, symlinks };
+}
+var lineOf = (text, idx) => text.slice(0, Math.max(0, idx)).split("\n").length;
+var mb = (n) => `${(n / (1 << 20)).toFixed(1)} MB`;
+function frontmatter(raw) {
+  const text = raw.replace(/\r\n/g, "\n");
+  if (!text.startsWith("---\n")) return null;
+  const end = text.indexOf("\n---\n", 4);
+  const block = end >= 0 ? text.slice(4, end) : text.endsWith("\n---") ? text.slice(4, -4) : null;
+  if (block == null) return null;
+  const fm = {};
+  let key = "";
+  for (const l of block.split("\n")) {
+    const m = /^([A-Za-z_][\w.-]*):\s*(.*)$/.exec(l);
+    if (m) {
+      key = m[1];
+      fm[key] = m[2].replace(/^["']|["']$/g, "");
+    } else if (key && /^\s+\S/.test(l)) fm[key] = `${fm[key]} ${l.trim()}`.trim();
+  }
+  for (const k of Object.keys(fm)) if (/^[>|][-+]?$/.test(fm[k].split(" ")[0] ?? "")) fm[k] = fm[k].replace(/^[>|][-+]?\s*/, "");
+  const bodyAt = end >= 0 ? end + 5 : text.length;
+  return { fm, body: text.slice(bodyAt), bodyStart: lineOf(text, bodyAt) };
+}
+var SECRET_RULES = [
+  { kind: "AWS access key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/, captures: false },
+  { kind: "GitHub token", re: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{60,})\b/, captures: false },
+  { kind: "GitLab token", re: /\bglpat-[A-Za-z0-9_-]{20,}\b/, captures: false },
+  { kind: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, captures: false },
+  { kind: "Anthropic key", re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/, captures: false },
+  { kind: "OpenAI key", re: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{32,}\b/, captures: false },
+  { kind: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/, captures: false },
+  { kind: "Stripe key", re: /\b(?:sk|rk)_live_[A-Za-z0-9]{20,}\b/, captures: false },
+  { kind: "connection string with a password", re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s:/@]+:([^\s@/]+)@/g, captures: true },
+  { kind: "credentials embedded in a URL", re: /\bhttps?:\/\/[^\s:/@]+:([^\s@/]+)@/g, captures: true }
+];
+var PRIVATE_KEY_LABEL = /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY(?: BLOCK)?-----/g;
+var PLACEHOLDER = /^(?:\$\{?[A-Z0-9_]+\}?|<[^>]*>|\{\{[^}]*\}\}|x+|\*+|\.+|pass(?:word)?|passwd|pwd|secret|changeme|example|your[-_]?password|\[[^\]]*\])$/i;
+function privateKeyHit(text) {
+  for (const m of text.matchAll(PRIVATE_KEY_LABEL)) {
+    const start = m.index + m[0].length;
+    let w = text.slice(start, start + 400).replace(/\r/g, "");
+    w = w.replace(/\\+[rn]/g, "\n");
+    w = w.replace(/["'`]?[ \t]*\+?[ \t]*\n[ \t]*\+?[ \t]*["'`]?/g, "");
+    w = w.replace(/["'`][ \t]*\+[ \t]*["'`]/g, "");
+    w = w.replace(/^["'` ,;]+/, "");
+    if (/[A-Za-z0-9+/]{40}/.test(w)) return m.index;
+  }
+  return -1;
+}
+function scanSecret(text) {
+  const pk = privateKeyHit(text);
+  if (pk >= 0) return { kind: "private key", index: pk };
+  for (const r of SECRET_RULES) {
+    if (!r.captures) {
+      const m = r.re.exec(text);
+      if (m) return { kind: r.kind, index: m.index };
+      continue;
+    }
+    for (const m of text.matchAll(r.re)) if (!PLACEHOLDER.test(m[1])) return { kind: r.kind, index: m.index };
+  }
+  return null;
+}
+var SKILL_DIRS = "references|scripts|tools|templates|assets|bin|runtime|evals|examples|hub|lib|src";
+var PREFIX = String.raw`(?:\.\/|\$\{?[A-Za-z_]+\}?\/|<skill[-_ ]?dir>\/)?`;
+var REF_IN_CODE = new RegExp(String.raw`(?:\x60|\]\()` + PREFIX + String.raw`((?:${SKILL_DIRS})\/[^\s\x60)'"]+)`, "g");
+var REF_IN_CMD = new RegExp(String.raw`\b(?:node|python3?|bash|sh|deno|bun)\s+` + PREFIX + String.raw`([A-Za-z0-9_.\-/]+\.(?:m?js|cjs|ts|py|sh))\b`, "g");
+var ABS_WORKSPACE = /(^|[\s`'"(])(\/workspace\/[^\s`'")]*)/g;
+var PLATFORM_MODS = /* @__PURE__ */ new Set(["neta", "cohub_base"]);
+var ABS_MODS = /\/mods\/([a-z0-9_-]+)\//g;
+var NEGATED = /\b(never|not|don'?t|instead of|avoid|rather than)\b/i;
+var CREATES = /\b(save[sd]? (it )?(as|to)|write[s]? (it )?to|creat\w* |output[s]? to|generat\w* |produc\w* |render\w* to|export\w* to)\W*$/i;
+var leadIn = (t, idx) => {
+  const w = t.slice(Math.max(0, idx - 160), idx);
+  const cut = Math.max(w.lastIndexOf("\n\n"), w.search(/[.!?]\s[^.!?]*$/));
+  return cut >= 0 ? w.slice(cut) : w;
+};
+function checkPaths(dir, files, add) {
+  const all = files.map((f) => f.rel);
+  const tops = new Set(all.map((r) => r.split("/")[0]));
+  const exists = (p) => existsSync5(join6(dir, p)) || all.some((r) => r === p || r.endsWith(`/${p}`) || r.startsWith(`${p}/`) || r.includes(`/${p}/`));
+  const docs = files.filter((f) => f.text && (f.rel === "SKILL.md" || /^references\//.test(f.rel) && /\.md$/i.test(f.rel)));
+  const mods = /* @__PURE__ */ new Map();
+  for (const f of docs) {
+    const t = f.text;
+    const seen = /* @__PURE__ */ new Set();
+    const report = (p, idx) => {
+      const before = t.slice(Math.max(0, idx - 60), idx);
+      if (CREATES.test(before) || /['\u2019]s\s*$/.test(before.replace(/[`\s]+$/, "")) || /['\u2019]s\s+`?$/.test(before)) return;
+      const clean = p.replace(/[.,:;]+$/, "").replace(/\/$/, "");
+      if (seen.has(clean) || /[<>*{}$]|\.\.\.|\u2026|node_modules|(^|\/)\./.test(clean) || !tops.has(clean.split("/")[0])) return;
+      seen.add(clean);
+      if (!exists(clean)) add({ level: "warn", check: "paths", file: f.rel, line: lineOf(t, idx), message: `refers to ${clean}, which is not in the skill.`, fix: "Fix the path, or add the file. Paths are relative to the skill folder." });
+    };
+    for (const m of t.matchAll(REF_IN_CODE)) report(m[1], m.index);
+    for (const m of t.matchAll(REF_IN_CMD)) {
+      const p = m[1];
+      if (p.startsWith("/") || !new RegExp(`^(?:${SKILL_DIRS})/`).test(p)) continue;
+      report(p, m.index);
+    }
+    for (const m of t.matchAll(ABS_WORKSPACE)) {
+      if (NEGATED.test(leadIn(t, m.index))) continue;
+      add({ level: "warn", check: "paths", file: f.rel, line: lineOf(t, m.index), message: `hard-codes the absolute path ${m[2]}; the skill runs from different places (installed, used without installing, from a mod) and in different worlds.`, fix: "Use relative paths: the skill's own files relative to the skill folder (the folder that holds this SKILL.md), working files relative to the current folder." });
+      break;
+    }
+    for (const m of t.matchAll(ABS_MODS)) if (!PLATFORM_MODS.has(m[1]) && !mods.has(m[1]) && !NEGATED.test(leadIn(t, m.index))) mods.set(m[1], { file: f.rel, line: lineOf(t, m.index) });
+  }
+  for (const [mod, at] of mods) add({ level: "warn", check: "paths", file: at.file, line: at.line, message: `depends on files under /mods/${mod}/; it only works in worlds that mount the ${mod} mod.`, fix: "Fine if that is intended (for example /mods/neta in Neta worlds); otherwise ship what you need inside the skill." });
+}
+var KINDS = ["web", "media", "material", "text", "roleplay", "per-request"];
+var CHECK_TYPES = ["answer", "cmd", "no-cmd", "skill-added", "no-skill-added"];
+function checkMatrix(files, add) {
+  const mf = files.find((f) => f.rel === "evals/matrix.json");
+  const F = "evals/matrix.json";
+  const w = (message, fix) => add({ level: "warn", check: "test-declarations", file: F, line: 0, message, fix });
+  if (!mf) {
+    add({ level: "warn", check: "test-declarations", file: F, line: 0, message: "no test declarations: if Neta reviews this skill, it has to guess what each route should deliver.", fix: "Add evals/matrix.json with your scenarios and what each delivers (skill-creator writes one for you)." });
+    return;
+  }
+  let mx;
+  try {
+    mx = JSON.parse(mf.text ?? "");
+  } catch (e) {
+    w(`not valid JSON (${e.message}).`);
+    return;
+  }
+  const list = mx?.scenarios?.list ?? [];
+  if (!list.length) w("scenarios.list is empty.");
+  const ids = new Set(list.map((s) => s?.id));
+  const top = mx?.primaryKind?.kind;
+  for (const s of list) {
+    if (!s?.id) {
+      w("a scenario has no id.");
+      continue;
+    }
+    const k = s.primaryKind?.kind;
+    if (!k && !top) w(`scenario ${s.id} does not say what it delivers (primaryKind, on the scenario or once for the whole skill).`);
+    else if (k && !KINDS.includes(k)) w(`scenario ${s.id}: primaryKind.kind "${k}" is not one of ${KINDS.join(", ")}.`);
+    if (k === "text" && !(mx.checks?.[s.id]?.require?.length || mx.checks?.[s.id]?.oneOf?.length))
+      w(`scenario ${s.id} delivers text but declares no checks, so any reply would look like a pass.`, `Add checks.${s.id}.require with what the reply must do (cmd / no-cmd / skill-added / answer).`);
+    if (top && k && top !== "per-request" && k !== top && !mx.scenarios?.overrides?.[s.id]?.primaryKind)
+      w(`scenario ${s.id} delivers ${k} but the skill as a whole says ${top}.`, "Make them agree, or set primaryKind to per-request at the top.");
+  }
+  for (const [col, sid] of Object.entries(mx?.scenarios?.assign ?? {})) if (!ids.has(sid)) w(`assign.${col} points at "${String(sid)}", which is not a scenario id.`);
+  if (mx?.questionnaire && !["always", "conditional", "no"].includes(mx.questionnaire.mode)) w(`questionnaire.mode "${mx.questionnaire.mode}" must be always, conditional or no.`);
+  const assertIds = /* @__PURE__ */ new Set();
+  const checkA = (a, where) => {
+    if (!a?.id || !CHECK_TYPES.includes(a.type)) {
+      w(`${where}: each check needs an id and a type (${CHECK_TYPES.join(", ")}).`);
+      return;
+    }
+    assertIds.add(a.id);
+    if ((a.type === "cmd" || a.type === "no-cmd") && !a.match) w(`${where}.${a.id}: ${a.type} needs match.`);
+    if (a.type === "answer" && !a.point) w(`${where}.${a.id}: answer needs point.`);
+    for (const re of [a.match, a.handle]) if (re) {
+      try {
+        new RegExp(re, "i");
+      } catch (e) {
+        w(`${where}.${a.id}: invalid regular expression (${e.message}).`);
+      }
+    }
+  };
+  for (const [sid, c] of Object.entries(mx?.checks ?? {})) {
+    if (sid.startsWith("_")) continue;
+    if (!ids.has(sid)) w(`checks.${sid}: there is no scenario with that id.`);
+    for (const a of c?.require ?? []) checkA(a, `checks.${sid}`);
+    for (const b of c?.oneOf ?? []) for (const a of b?.require ?? []) checkA(a, `checks.${sid}.oneOf.${b?.id}`);
+  }
+  for (const r of Array.isArray(mx?.rules) ? mx.rules : []) {
+    for (const cid of r?.checks ?? []) if (!assertIds.has(cid)) w(`rule ${r.id}: check "${cid}" is not declared under checks.`);
+    if (r?.risk === "high" && !(r.checks ?? []).length && !r.waived) w(`rule ${r.id} is high-risk but nothing tests it.`, 'Add a check id, or waived: "<why it is not tested>".');
+  }
+}
+function checkWriting(body, bodyStart, add) {
+  const S = body;
+  const has = (re) => re.test(S);
+  const at = (re) => {
+    const m = re.exec(S);
+    return m ? lineOf(S, m.index) + bodyStart - 1 : 0;
+  };
+  const w = (line, message, fix) => add({ level: "warn", check: "writing", file: "SKILL.md", line, message, fix });
+  if (!has(/user'?s language|language of the user|same language as the user/i) && !has(new RegExp("\\u7528\\u6237\\u7684?\\u8bed\\u8a00|\\u8ddf\\u968f\\u7528\\u6237")))
+    w(0, "nothing says replies and the deliverable's text follow the user's language.", `Add: "Reply in the user's language. Text the user sees in the deliverable follows the user's language."`);
+  const makesWork = has(/neta(\/neta)?\s+(work\s+(init|publish)|generate)|\bwork init\b/i);
+  if (!has(/^#+[^\n]*(deliver|publish|output|hand ?(off|over)|result)/im) && !has(new RegExp("^#+[^\\n]*(\\u4ea4\\u4ed8|\\u53d1\\u5e03)", "m")))
+    w(0, "no section that says what the user gets at the end and how it reaches them.", "Add a Deliver section: the kind of deliverable and the steps that hand it over.");
+  if (makesWork && !has(/interaction-components/i))
+    w(at(/deliver/i), "makes a Work but does not say to hand it over with an interaction-components card pointing at it.", "Say: hand over with an interaction-components card whose target is the Work (its id comes from the publish output).");
+  if (has(/neta(\/neta)?\s+generate\s+(image|video|audio|3d)\b/i) && !has(/--work-title/))
+    w(at(/neta(\/neta)?\s+generate/i), "generates media without --work-title, so the Work is titled with the prompt's first words.", 'Pass --work-title "<title>" (again with --target-work when re-rendering).');
+  const OOS = new RegExp("^#+[^\\n]*(out of scope|not in scope|explicitly not|not doing|do not|don'?t|never|boundar|won'?t do|will not do|rules|guardrails|limits|\\u4e0d\\u505a|\\u7981\\u6b62|\\u786c\\u89c4\\u5219|\\u8fb9\\u754c|\\u4e0d\\u8981)[^\\n]*$", "im");
+  const oosAt = S.search(OOS);
+  if (oosAt < 0) w(0, "no Out of scope section.", "Add one: no changes to world settings, no deleting existing files, nothing beyond the deliverable.");
+  else {
+    const NEG = "(?:don'?t|do not|never|no|must not|without|\\u4e0d|\\u7981\\u6b62|\\u522b)";
+    const worldOk = new RegExp(`${NEG}[^\\n]{0,60}(world[^\\n]{0,20}(setting|config)|WORLD\\.md|visual ?style|\\u4e16\\u754c(\\u8bbe\\u5b9a|\\u8bbe\\u7f6e|\\u89c2|\\u914d\\u7f6e))`, "i").test(S);
+    const delOk = new RegExp(`${NEG}[^\\n]{0,60}(delet|remov|overwrit|\\u5220|\\u8986\\u76d6)`, "i").test(S);
+    if (!worldOk || !delOk)
+      w(lineOf(S, oosAt) + bodyStart - 1, 'Out of scope does not say "do not change world settings" and "do not delete existing files".', "Add both lines.");
+  }
+  if (!has(/counts? as given|already given|given when|if (a |any )?required .{0,40}missing|ask (once|only)|no questions|never asks?|do(es)? not ask|don'?t ask|without asking|questionnaire/i) && !has(new RegExp("\\u4f55\\u65f6\\u505c\\u4e0b\\u6765\\u95ee|\\u7f3a.{0,8}\\u95ee|\\u7b97\\u5df2\\u7ed9|\\u4e0d\\u95ee|\\u95ee\\u5377")))
+    w(0, "no rule for when to ask the user: which inputs are required, and when each counts as already given.", "List the required inputs with 'counts as given when'; missing \u2192 ask once before building; all given \u2192 build to delivery without asking.");
+  const WAIT = /(wait (for|until) (the )?user'?s? (confirm\w*|approv\w*|go-?ahead|reply|response|answer)|wait for (confirmation|approval)|(get|ask for|request|obtain) (the user'?s? )?(confirmation|approval|sign-?off) before|do not (start|proceed|render|generate|build)\w* until (the user|they)|stop and wait)/i;
+  S.split("\n").forEach((l, i) => {
+    if (WAIT.test(l) && !/\b(if|unless|only when|missing)\b/i.test(l))
+      w(i + bodyStart, `stops for confirmation every time: "${l.trim().slice(0, 100)}"`, "Stop only when something required is missing; otherwise state the default and keep going.");
+  });
+}
+var SHIPPED_DIR = /^(templates?|assets|runtime|public|static|web|site)\//;
+var UI_EXT = /\.(html?|m?js|jsx|tsx|vue|svelte|svg)$/i;
+var isShipped = (r) => !/(^|\/)(vendor|third_party|node_modules|scripts|tools|tests?|__tests__|i18n|locales?|lang)\//.test(r) && !/\.(test|spec)\.|selftest|\.(zh|ja|ko)([-_][a-z]+)?\.[a-z]+$/i.test(r) && // 测试、按语言命名的语言文件
+UI_EXT.test(r) && (SHIPPED_DIR.test(r) || /\.(html?|vue|svelte|svg)$/i.test(r));
+var NOT_UI_LINE = /\bconsole\.(log|warn|error|info|debug)\(|lang(uage)?\s*===?\s*['"](zh|ja|ko)|['"](zh|ja|ko)['"]\s*===?\s*\w*lang/i;
+var LOCALE_KEY = /^\s*['"]?(zh|ja|ko|zh[-_](?:cn|tw|hans|hant)|ja[-_]jp|ko[-_]kr)['"]?\s*:/i;
+function uiLines(text) {
+  const out = [];
+  let block = "";
+  let dictDepth = 0;
+  text.split("\n").forEach((raw, i) => {
+    let l = raw;
+    if (block === "c") {
+      const e = l.indexOf("*/");
+      if (e < 0) return;
+      l = l.slice(e + 2);
+      block = "";
+    }
+    if (block === "h") {
+      const e = l.indexOf("-->");
+      if (e < 0) return;
+      l = l.slice(e + 3);
+      block = "";
+    }
+    l = l.replace(/\/\*.*?\*\//g, "").replace(/<!--.*?-->/g, "");
+    const c0 = l.indexOf("/*");
+    if (c0 >= 0) {
+      l = l.slice(0, c0);
+      block = "c";
+    }
+    const h0 = l.indexOf("<!--");
+    if (h0 >= 0) {
+      l = l.slice(0, h0);
+      block = "h";
+    }
+    l = l.replace(/(^|[^:'"])\/\/.*$/, "$1");
+    if (dictDepth > 0) {
+      dictDepth += (l.match(/\{/g) ?? []).length - (l.match(/\}/g) ?? []).length;
+      return;
+    }
+    if (LOCALE_KEY.test(l)) {
+      const d = (l.match(/\{/g) ?? []).length - (l.match(/\}/g) ?? []).length;
+      if (d > 0) dictDepth = d;
+      return;
+    }
+    out.push({ line: i + 1, text: l });
+  });
+  return out;
+}
+function checkHardcodedUi(files, add) {
+  for (const f of files) {
+    if (!f.text || !isShipped(f.rel)) continue;
+    const hits = uiLines(f.text).filter((x) => CJK_RUN4.test(x.text) && !NOT_UI_LINE.test(x.text));
+    const lang = /<html[^>]*lang=["'](zh|ja|ko)/i.exec(f.text);
+    if (!hits.length && !lang) continue;
+    const first = hits[0] ?? { line: lineOf(f.text, lang.index), text: "hard-coded <html lang>" };
+    const n = hits.length || 1;
+    add({ level: "warn", check: "writing", file: f.rel, line: first.line, message: `${n} line(s) of non-English text the user will see: "${first.text.trim().slice(0, 80)}"`, fix: "Put UI text in a locale table (English plus your users' languages) chosen from the user's language; set <html lang> from it." });
+  }
+}
+var QUOTED = new RegExp(`(\u201C[^\u201D]*\u201D|\u300C[^\u300D]*\u300D|"[^"]*")`, "g");
+var CJK4 = new RegExp(`[${CJK_RANGE}][^"\u201D\u300D]*?(?:[${CJK_RANGE}][^"\u201D\u300D]*?){3}`);
+var AGENT_SAYS = new RegExp("\\b(ask(s|ed)?\\s+(the user|them|whether|which|if)|tell (the user|them)|reply with|respond with|say(ing)?\\s*[:\\uff1a]|message\\s*[:\\uff1a]|greet|options?\\s*[:\\uff1a]|choices?\\s*[:\\uff1a])|\\u95ee\\u7528\\u6237|\\u8be2\\u95ee|\\u56de\\u590d|\\u544a\\u8bc9\\u7528\\u6237|\\u5bf9\\u7528\\u6237\\u8bf4|\\u63d0\\u793a\\u7528\\u6237|\\u9009\\u9879", "i");
+var USER_SAYS = new RegExp("(user|they|users)\\s*(says?|said|types?|typed|writes?|wrote|asks?)\\s*$|\\u7528\\u6237(\\u8bf4|\\u5199|\\u70b9\\u540d|\\u95ee)\\s*$", "i");
+function checkUserPhrases(files, add) {
+  const docs = files.filter((f) => f.text && (f.rel === "SKILL.md" || /^references\//.test(f.rel) && /\.md$/i.test(f.rel)) && !/\.(zh|ja|ko|zh-cn|zh-tw)\.md$/i.test(f.rel));
+  for (const f of docs) {
+    let inFm = false, fence = false, n = 0, first = 0, sample = "";
+    const headings = (f.text.match(/^#+\s+.*$/gm) ?? []).map((h) => h.replace(/^#+\s+/, "").trim());
+    const isHeading = (q) => {
+      const x = q.slice(1, -1).trim();
+      return x.length > 0 && headings.some((h) => h.includes(x));
+    };
+    f.text.split("\n").forEach((l, i) => {
+      if (i === 0 && l.trim() === "---") {
+        inFm = true;
+        return;
+      }
+      if (inFm) {
+        if (l.trim() === "---") inFm = false;
+        return;
+      }
+      if (/^\s*```/.test(l)) {
+        fence = !fence;
+        return;
+      }
+      if (fence || !AGENT_SAYS.test(l)) return;
+      const said = [...l.matchAll(QUOTED)].some((m) => CJK4.test(m[0]) && !isHeading(m[0]) && !USER_SAYS.test(l.slice(0, m.index).replace(/[\s:\uff1a,\uff0c]+$/, "")));
+      if (said) {
+        n++;
+        if (!first) {
+          first = i + 1;
+          sample = l.trim().slice(0, 90);
+        }
+      }
+    });
+    if (n) add({ level: "warn", check: "user-phrases", file: f.rel, line: first, message: `${n} line(s) give the agent ready-made non-English words to say to the user (questions, options or fixed replies), e.g. "${sample}". Agents copy these, so users writing in another language get asked in this one.`, fix: `Describe what to ask instead (e.g. "ask which style the user wants"), or add "say it in the user's language" next to it.` });
+  }
+}
+function checkEnglish(files, fm, body, add) {
+  const agentDoc = (r) => r === "SKILL.md" || /^references\//.test(r) && /\.md$/i.test(r) && !/\.(zh|ja|ko|zh-cn|zh-tw)\.md$/i.test(r);
+  const mostlyNonEnglish = (t) => {
+    let fence = false, cjk = 0, latin = 0;
+    for (const l of t.split("\n")) {
+      if (/^\s*```/.test(l)) {
+        fence = !fence;
+        continue;
+      }
+      if (fence) continue;
+      const x = l.replace(/^\s*>.*$/, "").replace(/\u201c[^\u201d]*\u201d|\u300c[^\u300d]*\u300d|"[^"]*"|`[^`]*`/g, "");
+      cjk += (x.match(CJK_G) ?? []).length;
+      latin += (x.match(/[A-Za-z]/g) ?? []).length;
+    }
+    return cjk > 40 && cjk > latin / 4;
+  };
+  const descHead = (fm.description ?? "").split(/\bTriggers?\s*[-:\u2013]/i)[0];
+  const dc = (descHead.match(CJK_G) ?? []).length, dl = (descHead.match(/[A-Za-z]/g) ?? []).length;
+  const bad = files.filter((f) => f.text && agentDoc(f.rel) && mostlyNonEnglish(f.rel === "SKILL.md" ? body : f.text)).map((f) => f.rel);
+  if (dc > 8 && dl < 40 && !bad.includes("SKILL.md")) bad.unshift("SKILL.md (description)");
+  if (!bad.length) return;
+  add({ level: "warn", check: "english", file: bad[0].split(" ")[0], line: 0, message: `not written in English: ${bad.slice(0, 6).join(", ")}${bad.length > 6 ? ` (+${bad.length - 6} more)` : ""}. Writing what the agent reads in English is recommended: users speak many languages, and replies still follow each user's language.`, fix: "Translate to English (skill-creator can do it), keeping commands, paths, trigger words and quoted user text as they are. Trigger words in other languages can stay in the description." });
+}
+var LISTING_LOCALES = ["zh", "en"];
+var MAX_LISTING_NAME = 80;
+var MAX_LISTING_DESC = 300;
+var MAX_LISTING_WORKS = 6;
+var WORK_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var WORK_LINK = /^https:\/\/(?:[a-z0-9-]+\.)?neta\.art\/w\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/?$/i;
+var APP_LINK = /^https:\/\/(?:[a-z0-9-]+\.)?neta\.art\/w\/[^\s/]+\/[^\s/]+\/[^\s/]+\/?$/i;
+function checkListing(files, add) {
+  const F = "listing.json";
+  const w = (message, fix) => add({ level: "warn", check: "listing", file: F, line: 0, message, fix });
+  const lf = files.find((f) => f.rel === F);
+  if (!lf) {
+    w("no listing.json (optional): if the Neta team features this skill in Studio, the name, description and showcase you write here are used first.", 'Add {"en": {"name", "description"}, "zh": {...}, "media": {"works": ["<id or https://neta.art/w/<id> link of a Work made with this skill and shared publicly>"]}}. skill-creator can write it.');
+    return;
+  }
+  let j;
+  try {
+    j = JSON.parse(lf.text ?? "");
+  } catch (e) {
+    w(`not valid JSON (${e.message}).`);
+    return;
+  }
+  if (!j || typeof j !== "object" || Array.isArray(j)) {
+    w("must be a JSON object.");
+    return;
+  }
+  for (const k of Object.keys(j)) if (![...LISTING_LOCALES, "media"].includes(k)) w(`unknown key "${k}"; only ${LISTING_LOCALES.join(", ")} and media are read.`);
+  if (!LISTING_LOCALES.some((l) => j[l])) w(`no name and description: give at least one of ${LISTING_LOCALES.join(", ")}.`);
+  const text = (v, field, max) => {
+    if (v == null || v === "") {
+      w(`${field} is empty.`);
+      return;
+    }
+    if (typeof v !== "string") {
+      w(`${field} must be text.`);
+      return;
+    }
+    if ([...v].length > max) w(`${field} is ${[...v].length} characters; at most ${max}.`);
+    if (/[\u0000-\u001f\u007f]/.test(v)) w(`${field} contains control characters.`);
+  };
+  for (const l of LISTING_LOCALES) {
+    if (j[l] == null) continue;
+    text(j[l]?.name, `${l}.name`, MAX_LISTING_NAME);
+    text(j[l]?.description, `${l}.description`, MAX_LISTING_DESC);
+  }
+  if (j.media == null) return;
+  const works = j.media?.works;
+  if (!Array.isArray(works)) {
+    w('media.works must be a list of Works: ["<id or https://neta.art/w/<id> link>"].');
+    return;
+  }
+  if (works.length > MAX_LISTING_WORKS) w(`media.works has ${works.length} Works; at most ${MAX_LISTING_WORKS} (the Neta team picks one).`);
+  for (const x of works) {
+    if (typeof x === "string" && (WORK_ID.test(x) || WORK_LINK.test(x))) continue;
+    if (typeof x === "string" && APP_LINK.test(x)) {
+      w(`media.works: "${x.slice(0, 80)}" is the Work's page address; the skills site cannot match it to a Work.`, "Use the Work's id, or its https://neta.art/w/<id> link (from the share menu in Studio).");
+      continue;
+    }
+    w(`media.works: "${String(x).slice(0, 80)}" is not a Studio Work. Only Works made in Studio are shown (not links to other sites): they show the skill works in Studio, and sharing them publicly is how you agree to have them shown.`, "Use the id or the https://neta.art/w/<id> link of a Work made with this skill and shared publicly.");
+  }
+}
+function lintSkill(dir) {
+  const findings = [];
+  const add = (f) => findings.push(f);
+  const { files, symlinks } = readFiles(dir);
+  const name = basename2(resolve2(dir));
+  const skill = files.find((f) => f.rel === "SKILL.md");
+  const mdPath = join6(dir, "SKILL.md");
+  const mdIsLink = existsSync5(mdPath) && lstatSync2(mdPath).isSymbolicLink();
+  const rawFile = skill?.text ?? (mdIsLink ? readFileSync5(mdPath, "utf8") : "");
+  const bom = rawFile.startsWith("\uFEFF");
+  const raw = bom ? rawFile.slice(1) : rawFile;
+  const crlf = !bom && raw.replace(/\r\n/g, "\n").startsWith("---\n") && !(raw.startsWith("---\n") && raw.indexOf("\n---\n") >= 0);
+  const parsed = frontmatter(raw);
+  const fm = parsed?.fm ?? {};
+  const body = parsed?.body ?? raw;
+  const bodyStart = parsed?.bodyStart ?? 1;
+  if (lstatSync2(dir).isSymbolicLink()) add({ level: "error", check: "publish-limits", file: "", line: 0, message: "the skill folder itself is a symbolic link; the skills site rejects it.", fix: "Move the real folder here instead of linking to it." });
+  if (mdIsLink) add({ level: "error", check: "publish-limits", file: "SKILL.md", line: 0, message: "SKILL.md is a symbolic link; the skills site rejects it.", fix: "Replace it with the real file." });
+  if (bom) add({ level: "error", check: "structure", file: "SKILL.md", line: 1, message: "SKILL.md starts with a byte-order mark (BOM); the skills site needs it to start with --- and would not publish it.", fix: "Save SKILL.md as UTF-8 without BOM." });
+  else if (crlf) add({ level: "error", check: "structure", file: "SKILL.md", line: 1, message: "SKILL.md has Windows line endings (CRLF) around the frontmatter; the skills site only reads it with Unix line endings (LF) and would not publish it.", fix: "Save SKILL.md with LF line endings." });
+  if (!parsed) add({ level: "error", check: "structure", file: "SKILL.md", line: 1, message: "SKILL.md has no frontmatter (it must start with --- and have name and description).", fix: "Add a --- block at the top with name and description." });
+  else if (!fm.description?.trim()) add({ level: "error", check: "structure", file: "SKILL.md", line: 2, message: "the frontmatter has no description; agents decide when to use a skill by it.", fix: "Add description: what it makes and when to use it." });
+  if (parsed) {
+    if (fm.name && fm.name !== name) add({ level: "warn", check: "structure", file: "SKILL.md", line: 2, message: `name "${fm.name}" differs from the folder name "${name}"; the folder name is what gets published.`, fix: "Make them the same." });
+    if (fm.description && fm.description.length > 1024) add({ level: "warn", check: "structure", file: "SKILL.md", line: 3, message: `description is ${fm.description.length} characters; keep it under 1024.` });
+    if (fm.description && !/\b(use (it |this )?(when|for)|when the user)\b/i.test(fm.description) && !new RegExp("\\u5f53\\u7528\\u6237|\\u7528\\u4e8e|\\u89e6\\u53d1").test(fm.description))
+      add({ level: "warn", check: "structure", file: "SKILL.md", line: 3, message: "description does not say when to use the skill.", fix: 'Add "Use when the user wants ..." in the words users type.' });
+  }
+  if (!NAME_RE.test(name) || name.length > 60) add({ level: "warn", check: "structure", file: "", line: 0, message: `folder name "${name}" is not lowercase kebab-case of at most 60 characters; the picker skips it and submit refuses it.`, fix: "Rename the folder, e.g. my-skill." });
+  const lines = raw.split("\n").length;
+  if (lines > 500) add({ level: "warn", check: "structure", file: "SKILL.md", line: 0, message: `SKILL.md is ${lines} lines; long files are read less carefully.`, fix: "Keep it under about 500 lines; move detail into references/ and say when to read each file." });
+  const links = symlinks.filter((p) => p !== "SKILL.md");
+  if (links.length) add({ level: "warn", check: "publish-limits", file: links[0], line: 0, message: `symbolic links are skipped when publishing, so installed copies will not have: ${links.slice(0, 5).join(", ")}${links.length > 5 ? ` (+${links.length - 5} more)` : ""}.`, fix: "Replace them with real files if the skill needs them." });
+  if (files.length > MAX_FILES) add({ level: "error", check: "publish-limits", file: "", line: 0, message: `too many files: ${files.length} (at most ${MAX_FILES}).` });
+  let total = 0;
+  for (const f of files) {
+    total += f.size;
+    if (f.size > MAX_FILE_BYTES) add({ level: "error", check: "publish-limits", file: f.rel, line: 0, message: `${mb(f.size)}; at most ${mb(MAX_FILE_BYTES)} per file.` });
+  }
+  if (total > MAX_TOTAL_BYTES) add({ level: "error", check: "publish-limits", file: "", line: 0, message: `${mb(total)} in total; at most ${mb(MAX_TOTAL_BYTES)}.` });
+  if (existsSync5(join6(dir, SOURCE_FILE))) {
+    let h = "";
+    try {
+      const s = JSON.parse(readFileSync5(join6(dir, SOURCE_FILE), "utf8"));
+      h = s.handle || s.id || "";
+    } catch {
+    }
+    add({ level: "error", check: "installed-copy", file: SOURCE_FILE, line: 0, message: `this folder was installed from ${h || "another skill"}; only skills written in this space can be submitted.`, fix: "To publish your own version, copy it to a new name and make it yours; do not just delete the marker." });
+  }
+  for (const f of files) {
+    if (!f.text) continue;
+    const hit = scanSecret(f.text);
+    if (hit) add({ level: "error", check: "secrets", file: f.rel, line: lineOf(f.text, hit.index), message: `looks like a secret (${hit.kind}); one such file blocks publishing the whole skill.`, fix: "Remove the value (not just the file) and rotate it if it was real." });
+  }
+  if (skill?.text) {
+    checkPaths(dir, files, add);
+    checkWriting(body, bodyStart, add);
+    checkUserPhrases(files, add);
+    checkEnglish(files, fm, body, add);
+  }
+  checkHardcodedUi(files, add);
+  checkMatrix(files, add);
+  checkListing(files, add);
+  const errors = findings.filter((f) => f.level === "error").length;
+  return { dir, ok: errors === 0, errors, warnings: findings.length - errors, findings };
+}
+function formatFindings(r) {
+  const order = (f) => f.level === "error" ? 0 : 1;
+  return [...r.findings].sort((a, b) => order(a) - order(b)).map((f) => {
+    const where = f.file ? `${f.file}${f.line ? `:${f.line}` : ""}` : posix.basename(r.dir);
+    return `${f.level === "error" ? "error" : "warn "} [${f.check}] ${where}: ${f.message}${f.fix ? `
+        fix: ${f.fix}` : ""}`;
+  });
+}
+async function cmdLint(arg, opts) {
+  const dir = resolveSkillDir(arg);
+  if (!dir) {
+    console.error(arg ? `No skill found at ${arg}, ${SKILLS_DIR}/${arg} or ${DRAFTS_DIR}/${arg} (a skill folder has a SKILL.md).` : "There is no SKILL.md here. Give a skill name or folder: neta-search skills lint <name-or-dir>.");
+    return 2;
+  }
+  const r = lintSkill(dir);
+  if (opts.json) {
+    console.log(JSON.stringify(r));
+    return r.ok ? 0 : 1;
+  }
+  for (const l of formatFindings(r)) console.log(l);
+  console.log(`${r.findings.length ? "\n" : ""}Static check of ${dir}: ${r.errors} error(s), ${r.warnings} warning(s).${r.errors ? " Errors are what the skills site would reject; fix them before submitting." : ""}${r.warnings ? " Warnings are suggestions; they do not block submitting." : ""}`);
+  return r.ok ? 0 : 1;
+}
+
+// cli/src/skills/submit.ts
+var SUBMISSION_PATH = "/v1/skills/submission";
+function precheck(dir) {
+  const problems = [];
+  const md = join7(dir, "SKILL.md");
+  if (!existsSync6(md)) return ["there is no SKILL.md"];
+  if (lstatSync3(md).isSymbolicLink()) problems.push("SKILL.md is a symbolic link; replace it with the real file");
+  const raw = readFileSync6(md, "utf8");
+  const fm = /^---\n([\s\S]*?)\n---\n/.exec(raw);
+  if (raw.startsWith("\uFEFF")) problems.push("SKILL.md starts with a byte-order mark (BOM); save it as UTF-8 without BOM");
+  else if (!fm && /^---\r?\n[\s\S]*?\r?\n---\r?\n/.test(raw)) problems.push("SKILL.md has Windows line endings (CRLF) around the frontmatter; save it with LF line endings");
+  else if (!fm) problems.push("SKILL.md has no frontmatter (it must start with --- and have name / description)");
+  else if (!/^description\s*:\s*\S/m.test(fm[1])) problems.push("the frontmatter has no description (agents decide when to use a skill by it)");
   const files = readSkillFiles(dir);
   if (files.size > MAX_FILES) problems.push(`too many files: ${files.size} (at most ${MAX_FILES})`);
   let total = 0;
   for (const [p, b] of files) {
     total += b.length;
-    if (b.length > MAX_FILE_BYTES) problems.push(`${p} is ${mb(b.length)} (at most ${mb(MAX_FILE_BYTES)} per file)`);
+    if (b.length > MAX_FILE_BYTES) problems.push(`${p} is ${mb2(b.length)} (at most ${mb2(MAX_FILE_BYTES)} per file)`);
   }
-  if (total > MAX_TOTAL_BYTES) problems.push(`the skill is ${mb(total)} in total (at most ${mb(MAX_TOTAL_BYTES)})`);
+  if (total > MAX_TOTAL_BYTES) problems.push(`the skill is ${mb2(total)} in total (at most ${mb2(MAX_TOTAL_BYTES)})`);
   return problems;
 }
-var mb = (n) => `${(n / (1 << 20)).toFixed(1)} MB`;
+var mb2 = (n) => `${(n / (1 << 20)).toFixed(1)} MB`;
 function blockLabel(reason) {
   const head = reason.split(":")[0];
   switch (head) {
@@ -29089,9 +29604,9 @@ async function cmdSubmit(name, opts) {
     return 2;
   }
   if (opts.withdraw) return withdraw(env, name, opts);
-  const dir = join6(SKILLS_DIR, name);
-  if (!existsSync5(join6(dir, "SKILL.md"))) {
-    if (existsSync5(join6(DRAFTS_DIR, name, "SKILL.md"))) {
+  const dir = join7(SKILLS_DIR, name);
+  if (!existsSync6(join7(dir, "SKILL.md"))) {
+    if (existsSync6(join7(DRAFTS_DIR, name, "SKILL.md"))) {
       console.error(`${name} is still a draft (${DRAFTS_DIR}/${name}/). Drafts are not submitted; run neta-search skills add ${name} to move it to ${SKILLS_DIR}/ first.`);
     } else {
       console.error(`There is no skill at ${dir}/ (it needs a SKILL.md).`);
@@ -29113,11 +29628,20 @@ async function cmdSubmit(name, opts) {
     for (const p of problems) console.error(`  - ${p}`);
     return 1;
   }
+  const lint = lintSkill(dir);
+  if (!lint.ok) {
+    console.error(`Not submitted: the static check found ${lint.errors} problem(s) the skills site would reject:`);
+    for (const l of formatFindings({ ...lint, findings: lint.findings.filter((f) => f.level === "error") })) console.error(`  ${l}`);
+    return 1;
+  }
+  if (lint.warnings && !opts.json) {
+    console.error(`Static check: ${lint.warnings} suggestion(s) (not blocking). Run neta-search skills lint ${name} to see them.`);
+  }
   const files = readSkillFiles(dir);
   const digest = digestOf(files);
   const id = ownId(env, name);
   const total = [...files.values()].reduce((a, b) => a + b.length, 0);
-  if (!opts.json) console.error(`Checked: ${files.size} files, ${mb(total)}. Submitting ${digest} ...`);
+  if (!opts.json) console.error(`Checked: ${files.size} files, ${mb2(total)}. Submitting ${digest} ...`);
   const sent = await reportSkillEventDetail(env, "use", id, digest, name, { via: "submit", where: "local" });
   if (sent === "unreachable") {
     console.error("Not submitted: could not reach the server. Try again in a moment.");
@@ -29196,11 +29720,55 @@ function finish(opts, id, digest, name, s) {
       } else {
         lines.push("It appears on the public skills site and in find at the next publish (within a few minutes), marked as a community skill. Getting into Studio needs a review.");
       }
+      lines.push(...listingLines(s.listing));
       lines.push(`To take it down later: neta-search skills submit --withdraw ${name} (deleting the directory does not withdraw it).`);
-      return done(opts, base, lines.join("\n"), 0);
+      return done(opts, s.listing ? { ...base, listing: s.listing } : base, lines.join("\n"), 0);
     }
   }
 }
+function listingLines(l) {
+  if (!l) return [];
+  const out = [];
+  const text = Object.entries(l.text ?? {});
+  const okLangs = text.filter(([, c]) => c.ok).map(([lang]) => lang);
+  const badLangs = text.filter(([, c]) => !c.ok);
+  const works = l.works ?? [];
+  const hidden = works.filter((w) => !w.shown);
+  const noted = works.filter((w) => w.shown && w.note);
+  out.push(`listing.json: ${okLangs.length ? `name and description read for ${okLangs.join(", ")}` : "no usable name and description"}${works.length ? `; ${works.length - hidden.length} of ${works.length} showcase Work(s) can be shown` : ""}. This does not affect publishing.`);
+  for (const [lang, c] of badLangs) out.push(`  - ${lang}: ${textProblem(c.reason)}`);
+  for (const w of hidden) out.push(`  - ${w.work}: ${workProblem(w.reason)}`);
+  for (const w of noted) out.push(`  - ${w.work}: ${workNote(w.note)}`);
+  return out;
+}
+function textProblem(r) {
+  switch (r) {
+    case "too_long":
+      return "too long (name at most 80 characters, description at most 300), not used";
+    case "empty":
+      return "name or description is empty, not used";
+    case "invalid":
+      return "not a name and a description (or has control characters), not used";
+    default:
+      return r || "not usable";
+  }
+}
+function workProblem(r) {
+  switch (r) {
+    // 作品进作品表有大约一分钟的延迟；skill-creator 的流程正好是先分享、马上提交（PR #570 review）
+    case "not_found":
+      return "not shown: not found yet. A Work you just shared takes a few minutes to show up, so submit again later; refer to it by its id or its https://neta.art/w/<id> link";
+    case "not_public":
+      return "not shown: not shared publicly yet; choose Public in the Work's share menu in Studio";
+    case "not_yours":
+      return "not shown: it is someone else's Work";
+    default:
+      return `not shown${r ? `: ${r}` : ""}`;
+  }
+}
+function workNote(n) {
+  return n === "not_made_with_this_skill" ? "can be shown, but it does not look like it was made with this skill; the Neta team will check" : n || "";
+}
 function done(opts, json, text, code) {
   if (opts.json) console.log(JSON.stringify(json));
   else (code === 0 ? console.log : console.error)(text);
@@ -29254,15 +29822,168 @@ async function withdraw(env, name, opts) {
   }
 }
 
+// cli/src/skills/review-feedback.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join8 } from "node:path";
+var REVIEW_FEEDBACK_PATH = "/v1/skills/review-feedback";
+var FEEDBACK_DIR = ".neta-search/skill-feedback";
+var FEEDBACK_NOTE = "README.txt";
+var RENDERED = ["feedback.md", "fix-pack.md"];
+function refused(g) {
+  if (g === "unreachable" || g.status < 400 || g.status === 404) return false;
+  console.error(`The server refused the request (HTTP ${g.status}): ${g.body.reason || "no reason given"}.`);
+  return true;
+}
+var DIGEST_RE2 = /^sha256:[0-9a-f]{64}$/;
+async function call(env, method, params) {
+  const q = new URLSearchParams({ space: env.spaceId, turn: env.turnId, ...params });
+  try {
+    const r = await fetch(`${env.apiBase}${REVIEW_FEEDBACK_PATH}?${q}`, { method, signal: AbortSignal.timeout(1e4) });
+    if (r.status >= 500 || r.status !== 200 && r.status !== 404) return r.status >= 500 ? "unreachable" : { status: r.status, body: { state: "", reason: (await r.text()).trim() } };
+    return { status: r.status, body: await r.json() };
+  } catch {
+    return "unreachable";
+  }
+}
+var short = (d) => d.replace(/^sha256:/, "").slice(0, 7);
+async function cmdFeedback(name, opts) {
+  const env = detectEnv();
+  const say = (s) => console.log(s);
+  if (env.anonymous || !env.turnId) {
+    console.error("skills feedback only works inside a Cohub sandbox, in a chat in the space where you wrote the skill: it checks that you are its author.");
+    return 2;
+  }
+  if (name !== void 0 && !/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name)) {
+    console.error(`Skill names are kebab-case directory names (e.g. brawl-creator), got "${name}".`);
+    return 2;
+  }
+  if (opts.digest && !DIGEST_RE2.test(opts.digest)) {
+    console.error("--digest must look like sha256:<64 lowercase hex>.");
+    return 2;
+  }
+  let got = await call(env, "POST", { actor: env.actorId });
+  if (got === "unreachable") {
+    console.error("Could not reach the server. Try again in a moment.");
+    return 4;
+  }
+  if (refused(got)) return 2;
+  const deadline = Date.now() + (opts.wait ?? 30) * 1e3;
+  while (got !== "unreachable" && got.body.state === "queued" && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 1e3));
+    got = await call(env, "GET", {});
+  }
+  if (got === "unreachable") {
+    console.error("Could not reach the server. Try again in a moment.");
+    return 4;
+  }
+  if (refused(got)) return 2;
+  const st = got.body.state;
+  if (st === "queued" || st === "") {
+    console.error("Still checking that this chat is yours. Run the same command again in a moment.");
+    return 3;
+  }
+  if (st === "not_applicable") {
+    console.error(`Review feedback is not available here: ${got.body.reason || "skills in this space are reviewed and fixed by the Neta team"}.`);
+    return 1;
+  }
+  if (st === "rejected") {
+    console.error(`Could not confirm you are the author: ${got.body.reason || "rejected"}. Only the owner of this space can read its skills' review feedback, from a chat they started here.`);
+    return 1;
+  }
+  if (name === void 0) {
+    const list = await call(env, "GET", {});
+    if (list === "unreachable") {
+      console.error("Could not reach the server. Try again in a moment.");
+      return 4;
+    }
+    if (refused(list)) return 2;
+    const skills2 = list.body.skills ?? [];
+    if (opts.json) {
+      say(JSON.stringify({ skills: skills2.map(({ feedback: _f, ...s }) => s) }));
+      return 0;
+    }
+    if (!skills2.length) {
+      say("None of the skills in this space has review feedback from Neta. Neta reviews skills it nominates; if one of them needs changes, its feedback shows up here.");
+      return 0;
+    }
+    say("Review feedback from Neta:");
+    for (const s of skills2) say(`  ${s.name}  version ${short(s.digest)}${s.current ? " (your latest published version)" : ""}  ${s.updated_at}`);
+    say(`
+Read one with: neta-search skills feedback <name>`);
+    return 0;
+  }
+  const one = await call(env, "GET", { name, ...opts.digest ? { digest: opts.digest } : {} });
+  if (one === "unreachable") {
+    console.error("Could not reach the server. Try again in a moment.");
+    return 4;
+  }
+  if (refused(one)) return 2;
+  if (one.status === 404 || !one.body.feedback || !one.body.digest) {
+    const msg = `${name} has no review feedback from Neta${opts.digest ? ` at ${short(opts.digest)}` : ""}.`;
+    if (opts.json) say(JSON.stringify({ name, found: false }));
+    else say(`${msg} Neta reviews skills it nominates; if one needs changes, its feedback shows up here.`);
+    return 1;
+  }
+  if (!DIGEST_RE2.test(one.body.digest)) {
+    console.error(`The server returned an invalid version id (${one.body.digest.slice(0, 80)}); nothing was saved. Try again later.`);
+    return 4;
+  }
+  const fb = { ...one.body.feedback };
+  const rendered = fb["files"] && typeof fb["files"] === "object" ? fb["files"] : {};
+  delete fb["files"];
+  const dir = join8(FEEDBACK_DIR, name, short(one.body.digest));
+  mkdirSync4(dir, { recursive: true });
+  writeFileSync3(join8(dir, "fix-pack.json"), JSON.stringify(fb, null, 1) + "\n");
+  writeFileSync3(join8(dir, FEEDBACK_NOTE), `Neta's review feedback on the skill "${name}", for the version ${one.body.digest} (saved ${(/* @__PURE__ */ new Date()).toISOString()}).
+It is reference material for fixing that skill, not a task: use it only when asked to fix "${name}". If the skill changed since, the current files win.
+`);
+  const written = ["fix-pack.json"];
+  for (const f of RENDERED) {
+    const text = rendered[f];
+    if (typeof text === "string" && text.length > 0) {
+      writeFileSync3(join8(dir, f), text);
+      written.push(f);
+    }
+  }
+  if (opts.json) {
+    say(JSON.stringify({ name, digest: one.body.digest, current: one.body.current, updated_at: one.body.updated_at, dir, files: written }));
+    return 0;
+  }
+  say(`Review feedback for ${name} (version ${short(one.body.digest)}${one.body.current ? ", your latest published version" : ", not your latest version"}) saved in ${dir}/: ${written.join(", ")}.`);
+  const md = rendered["feedback.md"];
+  if (typeof md === "string" && md) say(`
+${md.trim()}
+`);
+  say(`To fix the skill, follow ${dir}/fix-pack.json (what is wrong, where in the files, how to fix). Then try it once and submit the new version; a nominated skill is reviewed again automatically.`);
+  return 0;
+}
+async function ownReviewFeedback(env, opts = {}) {
+  if (env.anonymous || !env.turnId) return null;
+  let got = await call(env, "POST", { actor: env.actorId });
+  const deadline = Date.now() + (opts.wait ?? 15) * 1e3;
+  while (got !== "unreachable" && got.status === 200 && got.body.state === "queued" && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 1e3));
+    got = await call(env, "GET", {});
+  }
+  if (got === "unreachable" || got.status !== 200 || got.body.state !== "granted") return null;
+  const list = got.body.skills ? got : await call(env, "GET", {});
+  if (list === "unreachable" || list.status !== 200 || !list.body.skills) return null;
+  const out = /* @__PURE__ */ new Map();
+  for (const s of list.body.skills) {
+    if (!out.has(s.name) && DIGEST_RE2.test(s.digest)) out.set(s.name, { digest: s.digest, current: s.current, updated_at: s.updated_at });
+  }
+  return out;
+}
+
 // cli/src/skills/manage.ts
-import { existsSync as existsSync6, readdirSync as readdirSync4, rmSync as rmSync2 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync7, readdirSync as readdirSync4, rmSync as rmSync2 } from "node:fs";
+import { join as join9 } from "node:path";
 function scanLocal(dir) {
-  if (!existsSync6(dir)) return [];
+  if (!existsSync7(dir)) return [];
   const out = [];
   for (const e of readdirSync4(dir, { withFileTypes: true })) {
     if (!e.isDirectory() || e.name.startsWith(".")) continue;
-    const path = join7(dir, e.name);
+    const path = join9(dir, e.name);
     if (!skillDirExists(path)) continue;
     const src = readSource(path);
     if (src) {
@@ -29298,14 +30019,17 @@ var STATUS_LABEL = { latest: "latest", outdated: "update available", unavailable
 async function cmdList(opts) {
   const env = detectEnv();
   const local = scanLocal(opts.dir);
+  const feedback = !opts.offline && local.some((s) => s.kind === "own") ? ownReviewFeedback(env, { pollMs: opts.pollMs }) : Promise.resolve(null);
   const rows = await Promise.all(
     local.map(async (s) => {
       const st = opts.offline ? { status: "unknown", handle: void 0 } : await statusOf(env, s);
       return { ...s, ...st, handle: s.handle ?? st.handle };
     })
   );
+  const fb = await feedback;
+  const withFeedback = rows.map((r) => r.kind === "own" && fb?.has(r.name) ? { ...r, review_feedback: fb.get(r.name) } : r);
   if (opts.json) {
-    console.log(JSON.stringify({ dir: opts.dir, count: rows.length, skills: rows }));
+    console.log(JSON.stringify({ dir: opts.dir, count: rows.length, skills: withFeedback }));
     return 0;
   }
   if (rows.length === 0) {
@@ -29313,14 +30037,21 @@ async function cmdList(opts) {
     return 0;
   }
   console.log(`${opts.dir}/ (${rows.length}):`);
-  for (const r of rows) {
+  for (const r of withFeedback) {
     const st = STATUS_LABEL[r.status] ? `  [${STATUS_LABEL[r.status]}]` : "";
     const from = r.id ? `  ${displayRef(r)}` : "";
-    console.log(`  ${r.name.padEnd(28)} ${KIND_LABEL[r.kind]}${st}${from}`);
+    const rf = "review_feedback" in r ? "  [Neta review feedback]" : "";
+    console.log(`  ${r.name.padEnd(28)} ${KIND_LABEL[r.kind]}${st}${from}${rf}`);
   }
   const outdated = rows.filter((r) => r.status === "outdated").length;
   if (outdated > 0) console.log(`
 ${outdated} with updates available: neta-search skills update`);
+  const reviewed = withFeedback.filter((r) => "review_feedback" in r).map((r) => r.name);
+  if (reviewed.length > 0) {
+    console.log(`
+Neta reviewed ${reviewed.length === 1 ? "this skill" : "these skills"} and left feedback on what to fix: ${reviewed.join(", ")}.`);
+    console.log(`Read it with: neta-search skills feedback ${reviewed.length === 1 ? reviewed[0] : "<name>"}`);
+  }
   return 0;
 }
 async function cmdUpdate(names, opts) {
@@ -29378,7 +30109,7 @@ async function cmdUpdate(names, opts) {
   }
   if (results.length === 0) console.log(`No installed skills in ${opts.dir}/; nothing to update.`);
   const say = {
-    updated: (r) => `Updated ${r.name} (${short(r.from)} \u2192 ${short(r.to)})`,
+    updated: (r) => `Updated ${r.name} (${short2(r.from)} \u2192 ${short2(r.to)})`,
     latest: (r) => `${r.name} is up to date`,
     unavailable: (r) => `${r.name} is no longer available from its source; keeping the local copy`,
     own_skipped: (r) => `${r.name} is your own skill; nothing to update`,
@@ -29389,7 +30120,7 @@ async function cmdUpdate(names, opts) {
   for (const r of results) console.log(say[r.result](r));
   return failed > 0 ? 1 : 0;
 }
-function short(d) {
+function short2(d) {
   return (d ?? "").replace(/^sha256:/, "").slice(0, 12) || "?";
 }
 async function cmdRemove(names, opts) {
@@ -29397,7 +30128,7 @@ async function cmdRemove(names, opts) {
   const local = scanLocal(opts.dir);
   const results = [];
   for (const n of names) {
-    const found = (await findLocal(env, local, n)).filter((s) => existsSync6(s.path));
+    const found = (await findLocal(env, local, n)).filter((s) => existsSync7(s.path));
     if (found.length === 0) results.push({ name: n, result: "not_found" });
     for (const s of found) {
       if (s.kind === "own" && !opts.force) {
@@ -29412,8 +30143,8 @@ async function cmdRemove(names, opts) {
   if (opts.json) console.log(JSON.stringify({ results }));
   else
     for (const r of results) {
-      if (r.result === "removed") console.log(`Removed ${join7(opts.dir, r.name)}`);
-      else if (r.result === "not_found") console.error(`${join7(opts.dir, r.name)} does not exist`);
+      if (r.result === "removed") console.log(`Removed ${join9(opts.dir, r.name)}`);
+      else if (r.result === "not_found") console.error(`${join9(opts.dir, r.name)} does not exist`);
       else console.error(`${r.name} is a skill you wrote yourself (no install source), so it was not removed. Add --force if you really want to delete it.`);
     }
   return failed > 0 ? 1 : 0;
@@ -29422,7 +30153,7 @@ async function cmdRemove(names, opts) {
 // cli/src/cli.ts
 var program2 = new Command();
 program2.name("neta-search").description("neta-search: search the Cohub skill ecosystem").version(cliVersion());
-var skills = program2.command("skills").description("skills: find / add / use / list / update / remove / init / submit");
+var skills = program2.command("skills").description("skills: find / add / use / list / update / remove / init / lint / submit / feedback");
 skills.command("find").description("search the ecosystem for skills").argument("<query>", "what you want to do (natural language or keywords)").option("-n, --limit <n>", "max results", "20").option("--json", "compact JSON output (for agents)").action(async (query, opts) => {
   await run(cmdFind(query, { limit: Number(opts.limit) || 20, json: opts.json }));
 });
@@ -29432,10 +30163,16 @@ skills.command("add").description("install a skill: an id or handle from find do
 skills.command("use").description("use a skill without installing it: prints the full SKILL.md and the skill directory (local copy, mounted mod, cache, or download)").argument("<id-or-name>", "skill id, handle (e.g. neta-skills/holo-pack-opening), or local skill name").option("--json", "compact JSON output (for agents)").option("--via <channel>", "where this use came from, recorded in usage stats (site / board-menu / skill-picker / find)").option("--entry <id>", "entry id (picker / menu entry), recorded in usage stats").addOption(new Option("--digest <sha256>", "use exactly this version (sha256:<hex>); needs a handle or id").hideHelp()).option("--verified", "use the version that passed Neta's review; fails if there is none (never falls back to the latest); needs a handle or id").action(async (idOrName, opts) => {
   await run(cmdUse(idOrName, opts));
 });
+skills.command("lint").description("static check of a skill folder before you submit it: errors are what the skills site would reject; warnings are suggestions (paths, test declarations, common writing problems). Runs locally, sends nothing").argument("[name-or-dir]", "skill name (.agents/skills/<name> or your drafts) or a folder; default: the current folder").option("--json", "compact JSON output (for agents)").action(async (arg, opts) => {
+  await run(cmdLint(arg, { json: !!opts.json }));
+});
 skills.command("submit").description("publish the current version of one of your skills (.agents/skills/<name>/ in this space) on the public skills site and wait for the result; only the space owner can publish. --withdraw takes it down").argument("<name>", "skill directory name under .agents/skills/").option("--withdraw", "take a published skill down (deleting the directory does not)").option("--wait <seconds>", "how long to wait for the server's result", "60").option("--json", "compact JSON output (for agents)").action(async (name, opts) => {
   const wait = Number(opts.wait);
   await run(cmdSubmit(name, { json: !!opts.json, withdraw: !!opts.withdraw, wait: Number.isFinite(wait) && wait >= 0 ? wait : 60 }));
 });
+skills.command("feedback").description("read Neta's review feedback on your own skills (only the space owner, from a chat in this space). No name: list the skills that have feedback; a name: save the latest feedback to .neta-search/skill-feedback/<name>/ and print it").argument("[name]", "skill directory name").option("--digest <sha256>", "a specific version (sha256:<hex>) instead of the latest one with feedback").option("--json", "compact JSON output (for agents)").action(async (name, opts) => {
+  await run(cmdFeedback(name, { json: !!opts.json, digest: opts.digest }));
+});
 skills.command("list").alias("ls").description("list local skills (installed / pointer / your own) and check installed ones for updates").option("--dir <dir>", "skills directory", ".agents/skills").option("--offline", "do not check for updates online").option("--json", "compact JSON output (for agents)").action(async (opts) => {
   await run(cmdList({ dir: opts.dir, offline: !!opts.offline, json: !!opts.json }));
 });