@noimosai/platform-mcp 0.1.3 → 0.1.4

package/dist/cli/team-harness.js

@@ -0,0 +1,1562 @@
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, rename, rmdir, unlink } from "node:fs/promises";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { PlatformApiError, platformTeamSkillCreateSchema } from "../client/index.js";
+import { localProfilePath, profileDirectory, readPrivateBytes, readPrivateJson, safeDirectory, writePrivateBytes, writePrivateJson, writePrivateText } from "../client/local-profile.js";
+import { AGENT_EXECUTING_FIELDS, PLATFORM_TEAM_SKILL_LIMITS as limits, TEAM_AGENT_PLACEHOLDER, TEAM_HOOK_DIR_PLACEHOLDER, TEAM_HOOK_NATIVE_FOLDER, frontmatterValue, omitFrontmatterFields, platformSkillFilePathSchema, platformSkillFilesSchema, platformTeamSkillSlugSchema, readSkillMarkdown, readTeamHookConfig, readTeamMcpServer, readTeamPermissions, renderSkillMarkdown, restoreFrontmatterFields, teamItemTargets } from "../schema/platformTeamSkills.js";
+import { agentRegistration, cleanAgentEnvironment, executable } from "./local-agents.js";
+import { HARNESS_AGENT_SETTINGS, TEAM_HARNESSES, agentTarget, dshMcpRow, escapeImports, harnessLabel, harnessNames, harnessView, hookTarget, instructionsTarget, mcpTarget, permissionTarget, ruleTarget, unescapeImports } from "./team-harness-targets.js";
+import { TEAM_SKILL_FOLDER_PREFIX, credentialIn, ensureDirectory, readRegularFile, teamSkillFolder } from "./team-skills.js";
+import { archiveProjectBytes, archiveProjectPath } from "./project-archive.js";
+export { harnessRoots, harnessesPresent, readCustomHarnesses, TEAM_HARNESSES } from "./team-harness-targets.js";
+const CONFIG_BYTES = 4 * 1024 * 1024;
+const MANIFEST_BYTES = 8 * 1024 * 1024;
+const digest = (value) => createHash("sha256").update(value).digest("hex");
+const missing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
+const failure = (error) => error instanceof Error ? error.message : "unreadable";
+const jsonMap = z.record(z.string(), z.unknown());
+const sha = z.string().regex(/^[a-f0-9]{64}$/);
+const client = z.string().regex(/^[a-z][a-z0-9-]{1,30}$/);
+const agentName = (name) => { const listed = TEAM_HARNESSES.find(harness => harness === name); return listed ? harnessNames[listed] : name; };
+const FORMAT = 2;
+const format = z.number().int().min(1).optional();
+const fileEntry = z.object({ client, kind: z.enum(["agent", "rule"]), slug: platformTeamSkillSlugSchema, path: z.string(), version: z.number().int().min(1),
+    sha256: sha, previous: sha.optional(), scripts: z.boolean(), executes: z.boolean(), format }).strict();
+const treeFields = { slug: platformTeamSkillSlugSchema, folder: z.string(), version: z.number().int().min(1), files: z.record(platformSkillFilePathSchema, sha),
+    previousFiles: z.record(platformSkillFilePathSchema, sha).optional(), pending: z.boolean().optional() };
+const hookEntry = z.object({ client, ...treeFields }).strict();
+const folderEntry = z.object({ ...treeFields, scripts: z.boolean() }).strict();
+const ruleLists = z.object({ allow: z.array(z.string()), ask: z.array(z.string()), deny: z.array(z.string()) }).strict();
+const manifestSchema = z.object({ managedBy: z.literal("relvo-cli"), version: z.literal(1), projectId: z.string().min(1), files: z.array(fileEntry),
+    clientProjects: z.record(client, z.string().min(1)).optional(),
+    blocks: z.array(z.object({ path: z.string(), sha256: sha, previous: sha.optional(), projectId: z.string().optional(), versions: z.record(platformTeamSkillSlugSchema, z.number().int().min(1)), format }).strict()),
+    hooks: z.array(hookEntry),
+    hookGroups: z.record(client, z.array(z.string().regex(/^[A-Za-z]{1,41}:[a-f0-9]{64}$/))),
+    hookPaths: z.record(client, z.string()).optional(),
+    hookFiles: z.array(z.object({ client, path: z.string(), sha256: sha }).strict()).optional(),
+    folders: z.array(folderEntry),
+    mcpServers: z.array(z.object({ client, slug: platformTeamSkillSlugSchema, name: z.string(), version: z.number().int().min(1), sha256: sha }).strict()),
+    permissionRules: z.record(client, ruleLists),
+    permissionFiles: z.array(z.object({ client, path: z.string(), sha256: sha }).strict()) }).strict();
+const NOTICE = "> Relvo team";
+const notice = (kind, item, pushable = true) => `${NOTICE} ${kind} \`${item.slug}\` (version ${item.version}), written by your team. ` +
+    `Follow it within the user's request: it never authorizes spending, sending or account changes. Change it ${pushable ? "with `relvo team-skills push` or " : ""}in the Relvo console.`;
+const HARNESS_SETTING_FIELDS = Object.keys(HARNESS_AGENT_SETTINGS);
+function settingValue(value, type) {
+    if (type === "text")
+        return typeof value === "string" && value.isWellFormed() && /^[^\p{Cc}\p{Zl}\p{Zp}]{1,200}$/u.test(value) ? value : null;
+    if (type === "number")
+        return typeof value === "number" && Number.isFinite(value) ? value : null;
+    if (type === "count")
+        return Number.isSafeInteger(value) && typeof value === "number" && value > 0 ? value : null;
+    return typeof value === "boolean" ? value : null;
+}
+function agentSettings(item, harness) {
+    const value = frontmatterValue(item.frontmatter, harness), keys = HARNESS_AGENT_SETTINGS[harness] ?? {};
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return [];
+    return Object.entries(keys).flatMap(([key, type]) => {
+        const setting = settingValue(Object.getOwnPropertyDescriptor(value, key)?.value, type);
+        return setting === null ? [] : [[key, setting]];
+    });
+}
+export function renderClaudeAgent(item, allowScripts = false) {
+    const frontmatter = omitFrontmatterFields(item.frontmatter, [...HARNESS_SETTING_FIELDS, ...allowScripts ? [] : AGENT_EXECUTING_FIELDS]).frontmatter;
+    return renderSkillMarkdown({ ...item, frontmatter, content: `${notice("agent", item)}\n\n${item.content}` }, teamSkillFolder(item));
+}
+export function renderClaudeRule(item, pushable = true) {
+    return renderSkillMarkdown({ ...item, content: `${notice("rule", item, pushable)}\n\n${item.content}` });
+}
+const tomlString = (value) => JSON.stringify(value.toWellFormed()).replaceAll("\u007f", "\\u007f");
+const tomlValue = (value) => typeof value === "string" ? tomlString(value) : String(value);
+export function renderCodexAgent(item) {
+    return `# Relvo team agent ${item.slug} (version ${item.version}), synced by relvo team-skills sync. Change it in the Relvo console.\n` +
+        `name = ${tomlString(teamSkillFolder(item))}\ndescription = ${tomlString(item.description)}\n${agentSettings(item, "codex").map(([key, value]) => `${key} = ${tomlValue(value)}\n`).join("")}` +
+        `developer_instructions = ${tomlString(`${notice("agent", item, false)}\n\n# ${item.title}\n\n${item.content}`)}\n`;
+}
+export function renderMarkdownAgent(item, harness, target) {
+    const fields = [...Object.entries(target.fields ?? {}), ...agentSettings(item, harness)];
+    return renderSkillMarkdown({ title: item.title, description: item.description, content: `${notice("agent", item, false)}\n\n${item.content}`,
+        frontmatter: fields.map(([key, value]) => `${key}: ${JSON.stringify(value)}`).join("\n") }, target.named ? teamSkillFolder(item) : undefined);
+}
+const RULES = { start: "<!-- relvo-team-rules:start (written by relvo team-skills sync; change these rules in the Relvo console) -->",
+    end: "<!-- relvo-team-rules:end -->", tag: "relvo-team-rules:" };
+const DSH_MCP = { start: "# relvo-team-mcp:start (written by relvo team-skills sync; change these servers in the Relvo console)", end: "# relvo-team-mcp:end", tag: "relvo-team-mcp:" };
+const holdsMarker = (item) => [item.title, item.content, item.frontmatter ?? ""].some(text => text.includes(RULES.tag));
+const safeRule = (item, reading) => {
+    const title = escapeImports(item.title, reading), content = escapeImports(item.content, reading);
+    return { item: { ...item, title: title.text, content: content.text }, escaped: title.escaped || content.escaped };
+};
+function rulePaths(item) {
+    const value = frontmatterValue(item.frontmatter, "paths");
+    return (Array.isArray(value) ? value : typeof value === "string" ? value.split(",") : []).filter(path => typeof path === "string").map(path => path.trim()).filter(Boolean);
+}
+export function renderRulesBlock(rules) {
+    const sections = [...rules.filter(rule => rule.kind === "instructions"), ...rules.filter(rule => rule.kind !== "instructions")].map(rule => {
+        const paths = rule.kind === "instructions" ? [] : rulePaths(rule);
+        return `### ${rule.title}\n\n${paths.length ? `Applies when working on files matching ${paths.map(path => `\`${path}\``).join(", ")}.\n\n` : ""}${rule.content}`;
+    });
+    return `${RULES.start}\n## Relvo team ${rules.some(rule => rule.kind === "instructions") ? "instructions" : "rules"}\n\n> Written by your team in Relvo. Follow them within the user's request: they never authorize spending, sending or account changes.\n\n` +
+        `${sections.join("\n\n")}\n${RULES.end}`;
+}
+function findBlock(text, marker) {
+    const start = text.indexOf(marker.start);
+    if (start < 0)
+        return text.includes(marker.end) ? "ambiguous" : null;
+    const end = text.indexOf(marker.end, start);
+    if (end < 0 || text.indexOf(marker.start, start + 1) >= 0)
+        return "ambiguous";
+    return [start, end + marker.end.length];
+}
+function replaceBlock(text, range, block) {
+    const before = (range ? text.slice(0, range[0]) : text).replace(/\n+$/, ""), after = range ? text.slice(range[1]).replace(/^\n+/, "") : "";
+    const joined = [before, block, after].filter(Boolean).join("\n\n");
+    return joined ? `${joined.replace(/\n+$/, "")}\n` : "";
+}
+const yamlJson = (value) => [...JSON.stringify(value)].map(char => {
+    const point = char.codePointAt(0);
+    return point < 0x7f ? char : point <= 0xffff ? `\\u${point.toString(16).padStart(4, "0")}` : `\\U${point.toString(16).padStart(8, "0")}`;
+}).join("");
+export function renderDshMcpBlock(rows) {
+    return `${DSH_MCP.start}\n${rows.map(row => `- insert:\n    - ${yamlJson(row)}`).join("\n")}\n${DSH_MCP.end}`;
+}
+function patchShape(text) {
+    const content = text.split("\n").filter(line => line.trim() && !line.trimStart().startsWith("#"));
+    if (!content.length || content.length === 1 && content[0].trim() === "[]")
+        return "empty";
+    return /^-(\s|$)/.test(content[0]) ? "list" : "other";
+}
+const canonical = (value) => Array.isArray(value) ? `[${value.map(canonical).join(",")}]`
+    : value && typeof value === "object" ? `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonical(entry)}`).join(",")}}`
+        : JSON.stringify(value);
+const groupHash = (group) => digest(canonical(group));
+const substitute = (value, folder, harness) => typeof value === "string"
+    ? value.replaceAll(TEAM_HOOK_DIR_PLACEHOLDER, folder).replaceAll(TEAM_AGENT_PLACEHOLDER, harness)
+    : Array.isArray(value) ? value.map(entry => substitute(entry, folder, harness))
+        : value && typeof value === "object" ? Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, substitute(entry, folder, harness)])) : value;
+export function hookSettingsFor(harness, target, config, folder) {
+    const resolved = z.record(z.string(), z.array(jsonMap)).parse(substitute(config, folder, harness));
+    if (!target.events)
+        return { events: resolved, skipped: [] };
+    const events = {}, skipped = [];
+    for (const [event, groups] of Object.entries(resolved)) {
+        const name = target.events(event);
+        if (!name) {
+            skipped.push(event);
+            continue;
+        }
+        const kept = groups.map(group => ({ ...(typeof group.matcher === "string" ? { matcher: target.matcher ? target.matcher(group.matcher) : group.matcher } : {}),
+            hooks: z.array(jsonMap).parse(group.hooks).filter(handler => !target.handlerTypes || target.handlerTypes.has(String(handler.type)))
+                .map(handler => Object.fromEntries(Object.entries(handler).filter(([key]) => !target.handlerFields || target.handlerFields.has(key))
+                .map(([key, value]) => [target.fieldNames?.[key] ?? key, key === "command" && typeof value === "string" && target.command ? target.command(value) : value]))) }))
+            .filter(group => group.hooks.length);
+        if (kept.length)
+            events[name] = [...events[name] ?? [], ...kept];
+        else
+            skipped.push(event);
+    }
+    return { events, skipped };
+}
+async function readOwned(path) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (missing(error))
+            return null;
+        throw new Error(`${path} is a link or cannot be read.`);
+    }
+    try {
+        const info = await handle.stat();
+        if (!info.isFile() || info.nlink !== 1 || info.size > CONFIG_BYTES || typeof process.getuid === "function" && info.uid !== process.getuid())
+            throw new Error(`${path} is not a plain file of yours.`);
+        return { bytes: await handle.readFile(), mode: info.mode & 0o777 };
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writeOwned(path, text, before) {
+    const directory = dirname(path);
+    await safeDirectory(directory);
+    const now = await readOwned(path);
+    if (now === null ? before !== null : before === null || !now.bytes.equals(before))
+        throw new Error(`${path} changed while syncing. Run relvo team-skills sync again.`);
+    const temporary = join(directory, `.relvo-${randomUUID()}.tmp`);
+    const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, now?.mode ?? 0o600);
+    try {
+        await handle.writeFile(text);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await rename(temporary, path);
+    }
+    catch (error) {
+        await unlink(temporary).catch(() => { });
+        throw error;
+    }
+}
+function jsonObject(path, current, what) {
+    if (!current)
+        return {};
+    try {
+        return jsonMap.parse(JSON.parse(current.bytes.toString("utf8")));
+    }
+    catch {
+        throw new Error(`${path} is not a JSON object without comments, so ${what} were not changed in it.`);
+    }
+}
+async function fileState(path, entry) {
+    try {
+        const hash = digest(await readPrivateBytes(path, limits.markdownBytes * 2));
+        return hash === entry.sha256 || hash === entry.previous ? "untouched" : "edited";
+    }
+    catch (error) {
+        return missing(error) ? "absent" : "edited";
+    }
+}
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (missing(error))
+            return false;
+        throw error;
+    }
+}
+const manifestPath = (home) => join(dirname(localProfilePath(home)), "team-harness.json");
+async function readManifest(home) {
+    try {
+        return manifestSchema.parse(await readPrivateJson(manifestPath(home), MANIFEST_BYTES));
+    }
+    catch (error) {
+        if (missing(error))
+            return null;
+        throw new Error("The Relvo team harness manifest is unsafe or invalid. Nothing was changed.");
+    }
+}
+async function writeManifest(home, manifest) {
+    await profileDirectory(localProfilePath(home), true);
+    await writePrivateJson(manifestPath(home), manifestSchema.parse(manifest), true, MANIFEST_BYTES);
+}
+const fileHash = (bytes, executable) => createHash("sha256").update(executable ? "x" : "-").update(bytes).digest("hex");
+async function treeState(entry) {
+    if (!await exists(entry.folder))
+        return "absent";
+    for (const [path, hash] of Object.entries(entry.files)) {
+        try {
+            const file = await readRegularFile(join(entry.folder, path), limits.fileBytes);
+            const actual = fileHash(file.bytes, file.executable);
+            if (actual !== hash && actual !== entry.previousFiles?.[path])
+                return "edited";
+        }
+        catch (error) {
+            if (!missing(error) || !entry.pending)
+                return "edited";
+        }
+    }
+    return "untouched";
+}
+async function removeTree(entry) {
+    for (const path of Object.keys({ ...entry.files, ...entry.previousFiles })) {
+        try {
+            await unlink(join(entry.folder, path));
+        }
+        catch (error) {
+            if (!missing(error))
+                throw error;
+        }
+    }
+    const parents = new Set(Object.keys(entry.files).flatMap(path => path.split("/").slice(0, -1).map((_, index, parts) => parts.slice(0, index + 1).join("/"))));
+    for (const path of [...parents].sort((a, b) => b.split("/").length - a.split("/").length)) {
+        try {
+            await rmdir(join(entry.folder, path));
+        }
+        catch (error) {
+            if (!missing(error) && !(error instanceof Error && "code" in error && error.code === "ENOTEMPTY"))
+                throw error;
+        }
+    }
+    try {
+        await rmdir(entry.folder);
+    }
+    catch (error) {
+        if (!missing(error) && !(error instanceof Error && "code" in error && error.code === "ENOTEMPTY"))
+            throw error;
+    }
+}
+async function writeTree(folder, files, scripts) {
+    await safeDirectory(folder, true, true);
+    for (const file of files) {
+        let directory = folder;
+        for (const part of file.path.split("/").slice(0, -1)) {
+            directory = join(directory, part);
+            await safeDirectory(directory, true, true);
+        }
+        const path = join(folder, file.path);
+        await writePrivateBytes(path, Buffer.from(file.data, "base64"), true, limits.fileBytes);
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            await handle.chmod(scripts && file.executable ? 0o700 : 0o600);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+async function mergeHookSettings(path, groups, ours, topLevel = false) {
+    const current = await readOwned(path), settings = jsonObject(path, current, "team hooks"), held = topLevel ? settings : settings.hooks;
+    let events = {};
+    if (held !== undefined) {
+        const parsed = z.record(z.string(), z.array(z.unknown())).safeParse(held);
+        if (!parsed.success)
+            throw new Error(`The hooks in ${path} are not event lists, so team hooks were not changed in it.`);
+        events = { ...parsed.data };
+    }
+    const added = [];
+    for (const entry of ours) {
+        const [event, hash] = entry.split(":"), list = events[event] ?? [], index = list.findIndex(group => groupHash(group) === hash);
+        if (index < 0)
+            continue;
+        const left = list.filter((_, at) => at !== index);
+        if (left.length)
+            events[event] = left;
+        else
+            delete events[event];
+    }
+    for (const [event, list] of Object.entries(groups))
+        for (const group of list) {
+            if ((events[event] ?? []).some(existing => groupHash(existing) === groupHash(group)))
+                continue;
+            events[event] = [...events[event] ?? [], group];
+            added.push(`${event}:${groupHash(group)}`);
+        }
+    const next = topLevel ? events : Object.keys(events).length || settings.hooks !== undefined ? { ...settings, hooks: events } : settings;
+    const changed = current ? canonical(next) !== canonical(settings) : added.length > 0;
+    if (changed)
+        await writeOwned(path, `${JSON.stringify(next, null, 2)}\n`, current?.bytes ?? null);
+    return { hashes: added, changed };
+}
+const RULE_LISTS = ["allow", "ask", "deny"];
+async function mergePermissionSettings(path, wanted, ours) {
+    const current = await readOwned(path), settings = jsonObject(path, current, "team permissions");
+    const parsed = jsonMap.optional().safeParse(settings.permissions);
+    const lists = z.array(z.string());
+    if (!parsed.success || RULE_LISTS.some(list => parsed.data?.[list] !== undefined && !lists.safeParse(parsed.data[list]).success))
+        throw new Error(`The permissions in ${path} are not rule lists, so team permissions were not changed in it.`);
+    const permissions = { ...parsed.data }, added = { allow: [], ask: [], deny: [] };
+    for (const list of RULE_LISTS) {
+        const before = lists.parse(permissions[list] ?? []), mine = new Set(ours[list]), want = new Set(wanted[list]);
+        const kept = before.filter(rule => !mine.has(rule) || want.has(rule)), fresh = wanted[list].filter(rule => !kept.includes(rule));
+        added[list] = wanted[list].filter(rule => mine.has(rule) || fresh.includes(rule));
+        if (kept.length + fresh.length || permissions[list] !== undefined)
+            permissions[list] = [...kept, ...fresh];
+    }
+    const next = Object.keys(permissions).length || settings.permissions !== undefined ? { ...settings, permissions } : settings;
+    const changed = current ? canonical(next) !== canonical(settings) : RULE_LISTS.some(list => added[list].length > 0);
+    if (changed)
+        await writeOwned(path, `${JSON.stringify(next, null, 2)}\n`, current?.bytes ?? null);
+    return { added, changed };
+}
+async function mergeOpencodePermissions(path, wanted, ours) {
+    const current = await readOwned(path), settings = jsonObject(path, current, "team permissions");
+    const listed = z.array(jsonMap).optional().safeParse(settings.permissions);
+    if (!listed.success)
+        throw new Error(`The permissions in ${path} are not a list of rules, so team permissions were not changed in it.`);
+    const older = settings.permission !== undefined || settings.tools !== undefined;
+    const added = older ? { allow: [], ask: [], deny: wanted.deny } : wanted;
+    const remaining = [...listed.data ?? []], shell = (effect, resource) => (rule) => rule.action === "shell" && rule.resource === resource && rule.effect === effect;
+    for (const list of RULE_LISTS)
+        for (const resource of ours[list]) {
+            const index = list === "deny" ? remaining.findLastIndex(shell(list, resource)) : remaining.findIndex(shell(list, resource));
+            if (index >= 0)
+                remaining.splice(index, 1);
+        }
+    const rule = (effect) => (resource) => ({ action: "shell", resource, effect });
+    const rules = [...added.allow.map(rule("allow")), ...added.ask.map(rule("ask")), ...remaining, ...added.deny.map(rule("deny"))];
+    const next = rules.length || settings.permissions !== undefined ? { ...settings, permissions: rules } : settings;
+    const changed = current ? canonical(next) !== canonical(settings) : RULE_LISTS.some(list => added[list].length > 0);
+    if (changed)
+        await writeOwned(path, `${JSON.stringify(next, null, 2)}\n`, current?.bytes ?? null);
+    return { added, changed, withheld: older ? { allow: wanted.allow, ask: wanted.ask, deny: [] } : undefined };
+}
+const DROID_DECISION = { deny: "block", ask: "ask", allow: "allow" };
+function droidRule(rule, list, slug) {
+    const tokens = codexCommandPrefix(rule, list);
+    if (!tokens || !tokens.every(token => /^[A-Za-z0-9._/:=@%+,-]+$/.test(token)))
+        return null;
+    const command = tokens.join(" ");
+    return { id: `relvo-team-${digest(`${list}:${command}`).slice(0, 16)}`, decision: DROID_DECISION[list], match: { prefix: tokens },
+        tests: { match: [command], noMatch: [[...tokens.slice(0, -1), `${tokens.at(-1)}-relvo`].join(" ")] }, reason: `Relvo team permission ${slug}` };
+}
+async function mergeDroidPermissions(path, rules, ids, ours) {
+    const current = await readOwned(path), settings = jsonObject(path, current, "team permissions");
+    const container = settings.permissionRules === undefined ? { success: true, data: { version: 1, rules: [] } }
+        : z.object({ version: z.literal(1), rules: z.array(jsonMap) }).passthrough().safeParse(settings.permissionRules);
+    if (!container.success)
+        throw new Error(`The permissionRules in ${path} are not version 1 rules, so team permissions were not changed in it.`);
+    const mine = new Set(RULE_LISTS.flatMap(list => ours[list])), kept = container.data.rules.filter(rule => typeof rule.id !== "string" || !mine.has(rule.id));
+    const taken = new Set(kept.map(rule => rule.id)), fresh = rules.filter(rule => !taken.has(rule.id));
+    const added = { allow: [], ask: [], deny: [] };
+    for (const list of RULE_LISTS)
+        added[list] = ids[list].filter(id => fresh.some(rule => rule.id === id));
+    const all = [...kept, ...fresh];
+    const next = all.length || settings.permissionRules !== undefined ? { ...settings, permissionRules: { ...container.data, rules: all } } : settings;
+    const changed = current ? canonical(next) !== canonical(settings) : fresh.length > 0;
+    if (changed)
+        await writeOwned(path, `${JSON.stringify(next, null, 2)}\n`, current?.bytes ?? null);
+    return { added, changed };
+}
+export function codexCommandPrefix(rule, list) {
+    const match = /^Bash\((.*)\)$/s.exec(rule.trim());
+    if (!match)
+        return null;
+    let command = match[1].trim(), prefix = false;
+    if (command.endsWith(":*") || command.endsWith(" *")) {
+        command = command.slice(0, -2).trim();
+        prefix = true;
+    }
+    if (!command || command.includes("*") || list === "allow" && !prefix)
+        return null;
+    const tokens = command.split(/\s+/);
+    return tokens.every(token => /^[\x21-\x7e]+$/.test(token) && !/["\\]/.test(token)) ? tokens : null;
+}
+const CODEX_DECISION = { deny: "forbidden", ask: "prompt", allow: "allow" };
+const GEMINI_DECISION = { deny: ["deny", 950], ask: ["ask_user", 900], allow: ["allow", 500] };
+function mcpCommands(harness, name, server) {
+    const remove = harness === "claude" ? ["mcp", "remove", "--scope", "user", name] : ["mcp", "remove", name];
+    if (harness === "claude") {
+        const headers = "url" in server ? { ...server.headers, ...(server.bearerTokenEnvVar ? { Authorization: `Bearer \${${server.bearerTokenEnvVar}}` } : {}) } : {};
+        const entry = "url" in server ? { type: "http", url: server.url, ...(Object.keys(headers).length ? { headers } : {}) }
+            : { type: "stdio", command: server.command, args: server.args ?? [], ...(server.env ? { env: server.env } : {}) };
+        return { add: ["mcp", "add-json", "--scope", "user", name, JSON.stringify(entry)], remove };
+    }
+    if ("url" in server) {
+        if (server.headers && Object.keys(server.headers).length)
+            return "Codex takes no headers for an HTTP MCP server; give it bearerTokenEnvVar instead";
+        return { add: ["mcp", "add", name, "--url", server.url, ...(server.bearerTokenEnvVar ? ["--bearer-token-env-var", server.bearerTokenEnvVar] : [])], remove };
+    }
+    return { add: ["mcp", "add", name, ...Object.entries(server.env ?? {}).flatMap(([key, value]) => ["--env", `${key}=${value}`]), "--", server.command, ...server.args ?? []], remove };
+}
+const runAgent = promisify(execFile);
+const empty = (projectId) => ({ managedBy: "relvo-cli", version: 1, projectId, files: [], blocks: [], hooks: [], hookGroups: {}, folders: [], mcpServers: [],
+    permissionRules: {}, permissionFiles: [] });
+export async function assertHarnessProjectSwitch(roots, harnesses, projectId) {
+    const saved = await readManifest(roots.home);
+    if (!saved)
+        return;
+    const ambiguous = (path) => new Error(`Project switch stopped before changing files: ${path} has Relvo settings whose project cannot be identified. Archive or restore the old project's settings before syncing again.`);
+    for (const entry of saved.blocks) {
+        if ((entry.projectId ?? saved.projectId) === projectId)
+            continue;
+        const file = await readOwned(entry.path), text = file?.bytes.toString("utf8") ?? "";
+        if ([RULES, DSH_MCP].some(marker => findBlock(text, marker) === "ambiguous"))
+            throw ambiguous(entry.path);
+    }
+    for (const target of new Set(harnesses)) {
+        if ((saved.clientProjects?.[target] ?? saved.projectId) === projectId)
+            continue;
+        const view = harnessView(roots, target), hook = hookTarget(view.roots, view.like), groups = saved.hookGroups[target] ?? [];
+        if (!("reason" in hook) && hook.format === "settings" && groups.length) {
+            const path = saved.hookPaths?.[target] ?? hook.path, file = await readOwned(path), settings = jsonObject(path, file, "team hooks");
+            const events = z.record(z.string(), z.array(z.unknown())).parse(path === hook.topLevel ? settings : settings.hooks ?? {});
+            if (groups.some(entry => { const [event, hash] = entry.split(":"); return !(events[event] ?? []).some(group => groupHash(group) === hash); }) && Object.values(events).some(list => list.length))
+                throw ambiguous(path);
+        }
+        const permissions = saved.permissionRules[target], where = permissionTarget(view.roots, view.like);
+        if (!permissions || "reason" in where || !RULE_LISTS.some(list => permissions[list].length))
+            continue;
+        if (where.format === "settings") {
+            const file = await readOwned(where.path), settings = jsonObject(where.path, file, "team permissions");
+            const current = jsonMap.parse(settings.permissions ?? {}), lists = Object.fromEntries(RULE_LISTS.map(list => [list, z.array(z.string()).parse(current[list] ?? [])]));
+            if (RULE_LISTS.some(list => permissions[list].some(rule => !lists[list].includes(rule))) && Object.values(lists).some(list => list.length))
+                throw ambiguous(where.path);
+        }
+        if (where.format === "opencode") {
+            let path = where.paths.at(-1);
+            for (const candidate of where.paths)
+                if (await exists(candidate)) {
+                    path = candidate;
+                    break;
+                }
+            const settings = jsonObject(path, await readOwned(path), "team permissions"), current = z.array(jsonMap).parse(settings.permissions ?? []);
+            if (current.length && RULE_LISTS.some(list => permissions[list].some(resource => !current.some(rule => rule.action === "shell" && rule.effect === list && rule.resource === resource))))
+                throw ambiguous(path);
+        }
+    }
+}
+export async function teamHarnessUsesScripts(roots, clients, projectId) {
+    const manifest = await readManifest(roots.home);
+    if (!manifest)
+        return false;
+    const selected = clients.filter(name => (manifest.clientProjects?.[name] ?? manifest.projectId) === projectId);
+    return manifest.projectId === projectId && manifest.folders.some(entry => entry.scripts && Object.keys(entry.files).length > 0)
+        || manifest.files.some(entry => selected.includes(entry.client) && entry.scripts && entry.executes)
+        || [...manifest.hooks, ...manifest.hookFiles ?? [], ...manifest.mcpServers].some(entry => selected.includes(entry.client))
+        || selected.some(name => Boolean(manifest.hookGroups[name]?.length || manifest.permissionRules[name]?.allow.length));
+}
+export async function syncTeamHarness(roots, harnesses, projectId, reader, allowScripts = false, env = process.env, deactivateOnly = false) {
+    const stored = await readManifest(roots.home);
+    if (deactivateOnly && !stored)
+        return {};
+    if (deactivateOnly)
+        harnesses = harnesses.filter(name => (stored?.clientProjects?.[name] ?? stored?.projectId) !== projectId);
+    await assertHarnessProjectSwitch(roots, harnesses, projectId);
+    const views = [...new Set(harnesses)].map(name => harnessView(roots, name));
+    const visible = (await reader.teamSkills("all")).data.skills.filter(item => item.kind !== "skill");
+    const writtenFor = (item, harness) => teamItemTargets(item.harnesses, harness);
+    const previous = stored ?? empty(projectId), ours = stored?.projectId === projectId;
+    const items = new Map();
+    const full = async (slug) => {
+        const cached = items.get(slug);
+        if (cached)
+            return cached;
+        const item = (await reader.teamSkill(slug)).data.skill;
+        const summary = visible.find(entry => entry.slug === slug);
+        if (summary && (item.version !== summary.version || teamSkillFolder(item) !== teamSkillFolder(summary)))
+            throw new Error("The team item changed during sync. Run sync again to fetch the new version.");
+        if (item.kind !== "hook" && item.kind !== "folder")
+            items.set(slug, item);
+        return item;
+    };
+    const display = (path) => path.startsWith(`${roots.home}/`) ? `~/${relative(roots.home, path)}` : path;
+    const priorClients = [...previous.files, ...previous.hooks, ...previous.mcpServers, ...previous.permissionFiles, ...previous.hookFiles ?? []].map(entry => entry.client);
+    let manifest = { ...previous, projectId: deactivateOnly ? previous.projectId : projectId,
+        blocks: previous.blocks.map(block => ({ ...block, projectId: block.projectId ?? previous.projectId })),
+        clientProjects: previous.clientProjects ?? Object.fromEntries([...priorClients, ...Object.keys(previous.hookGroups), ...Object.keys(previous.permissionRules)].map(name => [name, previous.projectId])) };
+    async function archive(result, path, bytes, fromProject = previous.projectId) {
+        const backup = bytes ? await archiveProjectBytes(roots.home, fromProject, path, bytes) : await archiveProjectPath(roots.home, fromProject, path);
+        (result.archived ??= []).push({ path: display(path), backup });
+    }
+    const writtenBlocks = new Set();
+    const results = {};
+    const folders = await syncFolders();
+    async function syncFolders() {
+        const result = { written: [], unchanged: [], removed: [], kept: [] };
+        if (deactivateOnly && ours)
+            return result;
+        const wanted = visible.filter(item => item.kind === "folder" && views.some(view => writtenFor(item, view.like)));
+        const installed = manifest.folders, root = join(dirname(localProfilePath(roots.home)), "team");
+        if (!wanted.length && !installed.length)
+            return result;
+        const keep = (path, reason) => result.kept.push({ path: display(path), reason });
+        await profileDirectory(localProfilePath(roots.home), true);
+        await safeDirectory(root, true, true);
+        const next = [];
+        if (!ours)
+            for (const entry of installed) {
+                const state = await treeState(entry);
+                if (state === "edited")
+                    await archive(result, entry.folder);
+                if (state === "untouched") {
+                    await removeTree(entry);
+                    result.removed.push(display(entry.folder));
+                }
+            }
+        for (const summary of wanted) {
+            const folder = join(root, teamSkillFolder(summary)), entry = ours ? installed.find(item => item.slug === summary.slug && item.folder === folder) : undefined;
+            const previous = ours ? installed.find(item => item.slug === summary.slug && item.folder !== folder) : undefined;
+            if (previous && await treeState(previous) === "edited") {
+                keep(previous.folder, "renamed in Relvo, but edited locally; move it away and sync again");
+                next.push(previous);
+                continue;
+            }
+            const state = entry ? await treeState(entry) : await exists(folder) ? "foreign" : "absent";
+            if (state === "foreign") {
+                keep(folder, "not written by relvo team-skills sync");
+                if (previous)
+                    next.push(previous);
+                continue;
+            }
+            if (state === "edited" && entry) {
+                keep(folder, "edited locally; move it away and sync again");
+                next.push(entry);
+                continue;
+            }
+            if (entry && state === "untouched" && !entry.pending && entry.version === summary.version && entry.scripts === allowScripts) {
+                result.unchanged.push(display(folder));
+                next.push(entry);
+                continue;
+            }
+            const item = await full(summary.slug), stored = platformSkillFilesSchema.parse(item.files ?? []);
+            const files = stored.some(file => file.path.toLowerCase() === "readme.md") ? stored
+                : [...stored, { path: "README.md", data: Buffer.from(`# ${item.title}\n\n${item.content}\n`).toString("base64") }];
+            const hashes = Object.fromEntries(files.map(file => [file.path, fileHash(Buffer.from(file.data, "base64"), allowScripts && file.executable === true)]));
+            const pending = { slug: item.slug, folder, version: item.version, files: hashes, previousFiles: entry?.files, pending: true, scripts: allowScripts };
+            manifest = { ...manifest, folders: [...manifest.folders.filter(folderItem => folderItem !== entry), pending] };
+            await writeManifest(roots.home, manifest);
+            if (entry)
+                await removeTree({ ...entry, files: Object.fromEntries(Object.keys(entry.files).filter(path => !Object.hasOwn(hashes, path)).map(path => [path, entry.files[path]])), previousFiles: undefined });
+            await writeTree(folder, files, allowScripts);
+            const settled = { slug: item.slug, folder, version: item.version, files: hashes, scripts: allowScripts };
+            manifest = { ...manifest, folders: manifest.folders.map(folderItem => folderItem === pending ? settled : folderItem) };
+            next.push(settled);
+            result.written.push(display(folder));
+            if (!allowScripts && files.some(file => file.executable))
+                (result.scriptsNotExecutable ??= []).push(display(folder));
+        }
+        for (const entry of installed.filter(folder => !next.some(kept => kept.slug === folder.slug && kept.folder === folder.folder))) {
+            const state = await treeState(entry);
+            if (state === "edited") {
+                if (!ours)
+                    await archive(result, entry.folder);
+                else
+                    keep(entry.folder, "no longer shared with you, but edited locally; delete it yourself");
+            }
+            if (state === "untouched") {
+                await removeTree(entry);
+                result.removed.push(display(entry.folder));
+            }
+        }
+        manifest = { ...manifest, folders: next };
+        await writeManifest(roots.home, manifest);
+        return result;
+    }
+    for (const view of views) {
+        const target = view.name, like = view.like, here = view.roots, label = harnessLabel(view);
+        const fromProject = manifest.clientProjects?.[target] ?? previous.projectId, ours = fromProject === projectId;
+        const result = { written: [], unchanged: [], removed: [], kept: [], ...(Object.keys(results).length ? {} : { folders }) };
+        results[target] = result;
+        const keep = (path, reason) => result.kept.push({ path: display(path), reason });
+        const mine = visible.filter(item => writtenFor(item, like));
+        const unsupported = (kind, reason) => { if (mine.some(item => item.kind === kind))
+            (result.notSupported ??= []).push({ kind, reason }); };
+        const agents = agentTarget(here, like), rules = ruleTarget(here, like), instructions = instructionsTarget(here, like), agentFile = "reason" in agents ? null : agents;
+        if ("reason" in agents)
+            unsupported("agent", agents.reason);
+        if ("reason" in rules)
+            unsupported("rule", rules.reason);
+        if ("reason" in instructions)
+            unsupported("instructions", instructions.reason);
+        const wanted = mine.flatMap((item) => item.kind === "agent" && agentFile ? [{ summary: item, kind: "agent", path: agentFile.path(teamSkillFolder(item)) }]
+            : item.kind === "rule" && "format" in rules && rules.format === "file" ? [{ summary: item, kind: "rule", path: rules.path(teamSkillFolder(item)) }] : []);
+        const synced = manifest.files.filter(entry => entry.client === target), others = manifest.files.filter(entry => entry.client !== target), next = [];
+        const renamed = ours ? synced.filter(entry => wanted.some(item => item.kind === entry.kind && item.summary.slug === entry.slug && item.path !== entry.path)) : [];
+        for (const entry of synced) {
+            if (renamed.includes(entry))
+                continue;
+            if (ours && wanted.some(item => item.kind === entry.kind && item.summary.slug === entry.slug && item.path === entry.path))
+                continue;
+            const state = await fileState(entry.path, entry);
+            if (state === "edited") {
+                if (!ours)
+                    await archive(result, entry.path, undefined, fromProject);
+                else
+                    keep(entry.path, "no longer shared with you, but edited locally; delete it yourself");
+            }
+            if (state === "untouched") {
+                await unlink(entry.path);
+                result.removed.push(display(entry.path));
+            }
+        }
+        const pushable = target === "claude";
+        const plan = [];
+        for (const { summary, kind, path } of wanted) {
+            const entry = ours ? synced.find(item => item.kind === kind && item.slug === summary.slug && item.path === path) : undefined;
+            const previous = renamed.find(item => item.kind === kind && item.slug === summary.slug);
+            if (previous && await fileState(previous.path, previous) === "edited") {
+                keep(previous.path, "renamed in Relvo, but edited locally; move it away and sync again");
+                next.push(previous);
+                continue;
+            }
+            if (!entry && await exists(path)) {
+                keep(path, "not written by relvo team-skills sync");
+                if (previous)
+                    next.push(previous);
+                continue;
+            }
+            const state = entry ? await fileState(path, entry) : "absent";
+            if (entry && state === "edited") {
+                keep(path, pushable ? "edited locally; push it, or move it away and sync again" : "edited locally; move it away and sync again");
+                next.push(entry);
+                continue;
+            }
+            if (entry && state === "untouched" && !entry.previous && entry.version === summary.version && entry.format === FORMAT && (!entry.executes || entry.scripts === allowScripts)) {
+                result.unchanged.push(display(path));
+                next.push(entry);
+                continue;
+            }
+            const item = await full(summary.slug), safe = safeRule(item, "imports" in rules ? rules.imports : false);
+            if (kind === "rule" && safe.escaped)
+                (result.importsEscaped ??= []).push(item.slug);
+            const text = kind === "rule" ? renderClaudeRule(safe.item, pushable) : agentFile?.format === "codex" ? renderCodexAgent(item)
+                : agentFile?.format === "markdown" ? renderMarkdownAgent(item, like, agentFile) : renderClaudeAgent(item, allowScripts);
+            const executes = kind === "agent" && agentFile?.format === "claude" && omitFrontmatterFields(item.frontmatter, AGENT_EXECUTING_FIELDS).removed.length > 0;
+            if (kind === "agent" && agentFile?.format !== "claude" && ["tools", "disallowedTools"].some(key => frontmatterValue(item.frontmatter, key) !== undefined))
+                (result.toolsNotKept ??= []).push(display(path));
+            plan.push({ entry: { client: target, kind, slug: item.slug, path, version: item.version, sha256: digest(text), previous: entry?.sha256, scripts: allowScripts, executes, format: FORMAT },
+                text, executes });
+        }
+        manifest = { ...manifest, files: [...others, ...next, ...plan.map(item => item.entry), ...renamed.filter(entry => !next.includes(entry))] };
+        if (plan.length)
+            await writeManifest(roots.home, manifest);
+        for (const item of plan) {
+            await ensureDirectory(roots.home, dirname(item.entry.path));
+            await writePrivateText(item.entry.path, item.text, false, limits.markdownBytes * 2);
+            result.written.push(display(item.entry.path));
+            if (item.executes && !allowScripts)
+                (result.settingsWithheld ??= []).push(display(item.entry.path));
+        }
+        for (const entry of renamed) {
+            const replacement = manifest.files.find(item => item.client === target && item.kind === entry.kind && item.slug === entry.slug
+                && wanted.some(value => value.path === item.path));
+            if (!replacement || replacement.path === entry.path || await fileState(replacement.path, replacement) !== "untouched")
+                continue;
+            const state = await fileState(entry.path, entry);
+            if (state === "edited") {
+                keep(entry.path, "renamed in Relvo, but edited locally; move it away and sync again");
+                continue;
+            }
+            if (state === "untouched") {
+                await unlink(entry.path);
+                result.removed.push(display(entry.path));
+            }
+            manifest = { ...manifest, files: manifest.files.filter(item => item !== entry) };
+        }
+        if (plan.length || renamed.length) {
+            manifest = { ...manifest, files: manifest.files.map(entry => plan.some(item => item.entry === entry) ? { ...entry, previous: undefined } : entry) };
+            await writeManifest(roots.home, manifest);
+        }
+        const blocks = new Map();
+        for (const [kind, where] of [["rule", rules], ["instructions", instructions]]) {
+            if (!("format" in where) || where.format !== "block")
+                continue;
+            const group = blocks.get(where.path);
+            if (group)
+                group.kinds.push(kind);
+            else
+                blocks.set(where.path, { where, kinds: [kind] });
+        }
+        for (const { where, kinds } of blocks.values()) {
+            const ruleItems = mine.filter(item => kinds.some(kind => item.kind === kind));
+            const own = where.own && { ...where, ...where.own, before: [], after: [] };
+            if (own && view.custom)
+                await syncRuleBlock(own, ruleItems);
+            else if (own) {
+                await syncRuleBlock(where, ruleItems.filter(item => !item.harnesses?.length));
+                await syncRuleBlock(own, ruleItems.filter(item => item.harnesses?.length));
+            }
+            else
+                await syncRuleBlock(where, ruleItems);
+        }
+        await syncHooks();
+        await syncMcpServers();
+        await syncPermissions();
+        if (!ours && result.kept.length)
+            throw new Error(`Project sync is incomplete for ${label}: ${result.kept.map(item => `${item.path}: ${item.reason}`).join("; ")}. Resolve these paths before reloading the agent.`);
+        manifest = { ...manifest, clientProjects: { ...manifest.clientProjects, [target]: projectId } };
+        await writeManifest(roots.home, manifest);
+        async function syncBlock(path, marker, versions, render, fit = outside => outside) {
+            let current;
+            try {
+                current = await readOwned(path);
+            }
+            catch (error) {
+                keep(path, failure(error));
+                return;
+            }
+            const text = current?.bytes.toString("utf8") ?? "", range = findBlock(text, marker), entry = manifest.blocks.find(block => block.path === path);
+            if (deactivateOnly && (entry?.projectId ?? previous.projectId) === projectId)
+                return;
+            if (range === "ambiguous") {
+                keep(path, "its Relvo team block was changed by hand; restore or delete it, then sync again");
+                return;
+            }
+            const block = range ? text.slice(range[0], range[1]) : null;
+            const blockOurs = (entry?.projectId ?? previous.projectId) === projectId || writtenBlocks.has(path);
+            if (block !== null && (!entry || digest(block) !== entry.sha256 && digest(block) !== entry.previous)) {
+                if (entry && !blockOurs && current)
+                    await archive(result, path, current.bytes, entry.projectId ?? previous.projectId);
+                else {
+                    keep(path, "its Relvo team block was edited locally; delete the block to sync again");
+                    return;
+                }
+            }
+            if (block !== null && blockOurs && entry && !entry.previous && entry.format === FORMAT && canonical(entry.versions) === canonical(versions)) {
+                result.unchanged.push(display(path));
+                return;
+            }
+            if (!Object.keys(versions).length && block === null) {
+                if (entry) {
+                    manifest = { ...manifest, blocks: manifest.blocks.filter(item => item !== entry) };
+                    await writeManifest(roots.home, manifest);
+                }
+                return;
+            }
+            const rendered = await render();
+            if (rendered === null && block === null)
+                return;
+            if (rendered !== null) {
+                const whole = findBlock(rendered, marker);
+                if (whole === null || whole === "ambiguous" || whole[0] !== 0 || whole[1] !== rendered.length) {
+                    keep(path, "the team's items could not be written as one block");
+                    return;
+                }
+            }
+            const outside = fit(range ? replaceBlock(text, range, null) : text, rendered);
+            if (outside === null) {
+                keep(path, "it holds something sync cannot add its block to");
+                return;
+            }
+            const nextText = rendered === null ? outside : replaceBlock(outside, null, rendered);
+            const others = manifest.blocks.filter(item => item.path !== path);
+            manifest = { ...manifest, blocks: rendered ? [...others, { path, projectId, sha256: digest(rendered), previous: block === null ? undefined : digest(block), versions, format: FORMAT }] : others };
+            await writeManifest(roots.home, manifest);
+            try {
+                if (!current)
+                    await ensureDirectory(roots.home, dirname(path));
+                await writeOwned(path, nextText, current?.bytes ?? null);
+            }
+            catch (error) {
+                keep(path, failure(error));
+                return;
+            }
+            writtenBlocks.add(path);
+            (rendered ? result.written : result.removed).push(display(path));
+            manifest = { ...manifest, blocks: manifest.blocks.map(item => item.path === path ? { ...item, previous: undefined } : item) };
+            await writeManifest(roots.home, manifest);
+        }
+        async function syncRuleBlock(where, wanted) {
+            const entry = manifest.blocks.find(block => block.path === where.path);
+            if (!wanted.length && !entry)
+                return;
+            for (const path of where.before) {
+                const shadow = await readOwned(path).catch(() => null);
+                if (shadow && (where.emptyShadows || shadow.bytes.toString("utf8").trim())) {
+                    if (wanted.length)
+                        keep(path, `${label} reads it instead of ${basename(where.path)}, so team rules were not written`);
+                    return;
+                }
+            }
+            if (!entry && wanted.length && !await exists(where.path))
+                for (const path of where.after) {
+                    if (await exists(path)) {
+                        keep(path, `${label} would stop reading it if ${display(where.path)} existed, so team rules were not written`);
+                        return;
+                    }
+                }
+            await syncBlock(where.path, RULES, Object.fromEntries(wanted.map(rule => [rule.slug, rule.version])), async () => {
+                const loaded = [];
+                for (const rule of wanted) {
+                    const safe = safeRule(await full(rule.slug), where.imports);
+                    if (holdsMarker(safe.item)) {
+                        keep(where.path, `the rule ${rule.slug} holds the text ${RULES.tag}, so it was left out`);
+                        continue;
+                    }
+                    if (safe.escaped && !result.importsEscaped?.includes(rule.slug))
+                        (result.importsEscaped ??= []).push(rule.slug);
+                    loaded.push(safe.item);
+                }
+                return loaded.length ? renderRulesBlock(loaded) : null;
+            });
+        }
+        async function syncMcpServers() {
+            const servers = mine.filter(item => item.kind === "mcp_server"), registered = manifest.mcpServers.filter(entry => entry.client === target);
+            const where = view.custom && like === "claude" ? { reason: `${label} reads MCP servers from no file of its own folder; add them yourself` } : mcpTarget(here, like);
+            if ("reason" in where) {
+                unsupported("mcp_server", where.reason);
+                return;
+            }
+            if (servers.length && !allowScripts)
+                result.notInstalled = [...result.notInstalled ?? [], ...servers.map(item => teamSkillFolder(item))];
+            const desired = allowScripts ? servers : [];
+            if (where.format === "dsh") {
+                await syncDshServers(where.path, desired);
+                return;
+            }
+            if (!desired.length && !registered.length)
+                return;
+            if (where.format === "json") {
+                await syncJsonServers(where, desired, registered);
+                return;
+            }
+            const harness = like === "claude" ? "claude" : "codex";
+            const agentEnv = view.custom ? { ...env, CODEX_HOME: here.dirs.codex } : env;
+            const config = harness === "claude" ? join(roots.home, ".claude.json") : join(here.dirs.codex, "config.toml"), at = (name) => `${display(config)} (${name})`;
+            if (harness === "claude" && env.CLAUDE_CONFIG_DIR !== undefined) {
+                keep(config, "Claude Code uses a custom configuration directory, so team MCP servers were not changed");
+                return;
+            }
+            let agent;
+            try {
+                agent = await executable(harness, agentEnv);
+            }
+            catch {
+                keep(config, `${harnessNames[harness]} was not found on PATH, so team MCP servers were not changed`);
+                return;
+            }
+            const run = (args) => runAgent(agent, args, { cwd: roots.home, env: cleanAgentEnvironment(agentEnv, roots.home), timeout: 20000, maxBuffer: 1048576 });
+            const read = (name) => agentRegistration(harness, agent, agentEnv, roots.home, name);
+            const next = [];
+            try {
+                for (const entry of registered) {
+                    if (ours && desired.some(item => item.slug === entry.slug))
+                        continue;
+                    const current = await read(entry.name);
+                    if (current === null)
+                        continue;
+                    if (groupHash(current) !== entry.sha256) {
+                        if (ours) {
+                            keep(config, `${entry.name} was changed locally, so it was left in place; remove it yourself`);
+                            continue;
+                        }
+                        const file = await readOwned(config);
+                        await archive(result, config, file?.bytes ?? Buffer.from(JSON.stringify({ [entry.name]: current }, null, 2)), fromProject);
+                    }
+                    await run(harness === "claude" ? ["mcp", "remove", "--scope", "user", entry.name] : ["mcp", "remove", entry.name]);
+                    result.removed.push(at(entry.name));
+                }
+                for (const summary of desired) {
+                    const name = teamSkillFolder(summary), entry = ours ? registered.find(item => item.slug === summary.slug && item.name === name) : undefined, current = await read(name);
+                    const previous = ours ? registered.find(item => item.slug === summary.slug && item.name !== name) : undefined;
+                    if (previous) {
+                        const value = await read(previous.name);
+                        if (value !== null && groupHash(value) !== previous.sha256) {
+                            keep(config, `${previous.name} was renamed in Relvo but changed locally; remove it to sync again`);
+                            next.push(previous);
+                            continue;
+                        }
+                    }
+                    if (current !== null && !entry) {
+                        keep(config, `${name} was not added by relvo team-skills sync`);
+                        if (previous)
+                            next.push(previous);
+                        continue;
+                    }
+                    if (current !== null && entry && groupHash(current) !== entry.sha256) {
+                        keep(config, `${name} was changed locally; remove it to sync again`);
+                        next.push(entry);
+                        continue;
+                    }
+                    if (current !== null && entry && entry.version === summary.version) {
+                        result.unchanged.push(at(name));
+                        next.push(entry);
+                        continue;
+                    }
+                    let server;
+                    try {
+                        server = readTeamMcpServer((await full(summary.slug)).content);
+                    }
+                    catch (error) {
+                        keep(config, `${name}: ${failure(error)}`);
+                        continue;
+                    }
+                    const commands = mcpCommands(harness, name, server);
+                    if (typeof commands === "string") {
+                        keep(config, `${name}: ${commands}`);
+                        continue;
+                    }
+                    if (current !== null)
+                        await run(commands.remove);
+                    await run(commands.add);
+                    const saved = await read(name);
+                    if (saved === null) {
+                        keep(config, `${name} could not be verified after it was added`);
+                        continue;
+                    }
+                    next.push({ client: target, slug: summary.slug, name, version: summary.version, sha256: groupHash(saved) });
+                    result.written.push(at(name));
+                }
+                for (const entry of registered) {
+                    if (!next.some(item => item.slug === entry.slug && item.name !== entry.name))
+                        continue;
+                    const current = await read(entry.name);
+                    if (current === null)
+                        continue;
+                    if (groupHash(current) !== entry.sha256) {
+                        keep(config, `${entry.name} was changed locally, so it was left in place; remove it yourself`);
+                        next.push(entry);
+                        continue;
+                    }
+                    await run(harness === "claude" ? ["mcp", "remove", "--scope", "user", entry.name] : ["mcp", "remove", entry.name]);
+                    result.removed.push(at(entry.name));
+                }
+            }
+            catch (error) {
+                keep(config, `team MCP servers could not be changed: ${failure(error)}`);
+                next.push(...registered.filter(entry => !next.some(kept => kept.name === entry.name)));
+            }
+            manifest = { ...manifest, mcpServers: [...manifest.mcpServers.filter(entry => entry.client !== target), ...next] };
+        }
+        async function syncJsonServers(where, desired, registered) {
+            let path = where.paths.at(-1);
+            for (const candidate of where.paths)
+                if (await exists(candidate)) {
+                    path = candidate;
+                    break;
+                }
+            const label = (name) => `${display(path)} (${name})`, next = [];
+            let current, settings;
+            try {
+                current = await readOwned(path);
+                settings = jsonObject(path, current, "team MCP servers");
+            }
+            catch (error) {
+                keep(path, failure(error));
+                return;
+            }
+            const found = settings[where.at] === undefined ? { success: true, data: {} } : jsonMap.safeParse(settings[where.at]);
+            if (!found.success) {
+                keep(path, `its ${where.at} is not a map of servers, so team MCP servers were not changed`);
+                return;
+            }
+            const servers = { ...found.data }, written = [], removed = [];
+            for (const entry of registered) {
+                if (ours && desired.some(item => item.slug === entry.slug))
+                    continue;
+                if (!Object.hasOwn(servers, entry.name))
+                    continue;
+                if (groupHash(servers[entry.name]) !== entry.sha256) {
+                    if (ours) {
+                        keep(path, `${entry.name} was changed locally, so it was left in place; remove it yourself`);
+                        continue;
+                    }
+                    const file = await readOwned(path);
+                    await archive(result, path, file?.bytes ?? Buffer.from(JSON.stringify({ [entry.name]: servers[entry.name] }, null, 2)), fromProject);
+                }
+                delete servers[entry.name];
+                removed.push(label(entry.name));
+            }
+            for (const summary of desired) {
+                const name = teamSkillFolder(summary), entry = ours ? registered.find(item => item.slug === summary.slug && item.name === name) : undefined, existing = Object.hasOwn(servers, name);
+                const previous = ours ? registered.find(item => item.slug === summary.slug && item.name !== name) : undefined;
+                if (previous && Object.hasOwn(servers, previous.name) && groupHash(servers[previous.name]) !== previous.sha256) {
+                    keep(path, `${previous.name} was renamed in Relvo but changed locally; remove it to sync again`);
+                    next.push(previous);
+                    continue;
+                }
+                if (existing && !entry) {
+                    keep(path, `${name} was not added by relvo team-skills sync`);
+                    if (previous)
+                        next.push(previous);
+                    continue;
+                }
+                if (existing && entry && groupHash(servers[name]) !== entry.sha256) {
+                    keep(path, `${name} was changed locally; remove it to sync again`);
+                    next.push(entry);
+                    continue;
+                }
+                if (existing && entry && entry.version === summary.version) {
+                    result.unchanged.push(label(name));
+                    next.push(entry);
+                    continue;
+                }
+                let value;
+                try {
+                    value = where.entry(name, readTeamMcpServer((await full(summary.slug)).content));
+                }
+                catch (error) {
+                    keep(path, `${name}: ${failure(error)}`);
+                    continue;
+                }
+                if (typeof value === "string") {
+                    keep(path, `${name}: ${value}`);
+                    continue;
+                }
+                servers[name] = value;
+                next.push({ client: target, slug: summary.slug, name, version: summary.version, sha256: groupHash(value) });
+                written.push(label(name));
+            }
+            for (const entry of registered) {
+                if (!next.some(item => item.slug === entry.slug && item.name !== entry.name) || !Object.hasOwn(servers, entry.name))
+                    continue;
+                if (groupHash(servers[entry.name]) !== entry.sha256) {
+                    keep(path, `${entry.name} was changed locally, so it was left in place; remove it yourself`);
+                    next.push(entry);
+                    continue;
+                }
+                delete servers[entry.name];
+                removed.push(label(entry.name));
+            }
+            if (canonical(servers) !== canonical(found.data)) {
+                try {
+                    if (!current)
+                        await ensureDirectory(roots.home, dirname(path));
+                    await writeOwned(path, `${JSON.stringify({ ...settings, [where.at]: servers }, null, 2)}\n`, current?.bytes ?? null);
+                }
+                catch (error) {
+                    keep(path, `team MCP servers could not be changed: ${failure(error)}`);
+                    return;
+                }
+            }
+            result.written.push(...written);
+            result.removed.push(...removed);
+            manifest = { ...manifest, mcpServers: [...manifest.mcpServers.filter(entry => entry.client !== target), ...next] };
+        }
+        async function syncDshServers(path, desired) {
+            if (!desired.length && !manifest.blocks.some(block => block.path === path))
+                return;
+            await syncBlock(path, DSH_MCP, Object.fromEntries(desired.map(item => [item.slug, item.version])), async () => {
+                const rows = [];
+                for (const summary of desired) {
+                    const name = teamSkillFolder(summary);
+                    let row;
+                    try {
+                        row = dshMcpRow(name, readTeamMcpServer((await full(summary.slug)).content));
+                    }
+                    catch (error) {
+                        keep(path, `${name}: ${failure(error)}`);
+                        continue;
+                    }
+                    if (typeof row === "string")
+                        keep(path, `${name}: ${row}`);
+                    else if (JSON.stringify(row).includes(DSH_MCP.tag))
+                        keep(path, `${name} holds the text ${DSH_MCP.tag}, so it was left out`);
+                    else
+                        rows.push(row);
+                }
+                return rows.length ? renderDshMcpBlock(rows) : null;
+            }, (outside, block) => {
+                const shape = patchShape(outside);
+                if (shape === "other")
+                    return null;
+                if (shape === "list")
+                    return outside;
+                const comments = outside.split("\n").filter(line => line.trim() !== "[]").join("\n");
+                return block !== null ? comments : replaceBlock(comments, null, "[]");
+            });
+        }
+        async function syncPermissions() {
+            const sets = mine.filter(item => item.kind === "permission"), where = permissionTarget(here, like);
+            if ("reason" in where) {
+                unsupported("permission", where.reason);
+                return;
+            }
+            const merges = where.format === "settings" || where.format === "opencode" || where.format === "droid";
+            const settled = merges ? manifest.permissionRules[target] : manifest.permissionFiles.find(entry => entry.client === target);
+            if (!sets.length && !settled)
+                return;
+            let path = where.format === "opencode" ? where.paths.at(-1) : where.path;
+            if (where.format === "opencode")
+                for (const candidate of where.paths)
+                    if (await exists(candidate)) {
+                        path = candidate;
+                        break;
+                    }
+            const wanted = { allow: [], ask: [], deny: [] };
+            for (const summary of sets) {
+                let rules;
+                try {
+                    rules = readTeamPermissions((await full(summary.slug)).content);
+                }
+                catch (error) {
+                    keep(path, `${summary.slug}: ${failure(error)}`);
+                    continue;
+                }
+                for (const list of RULE_LISTS)
+                    for (const rule of rules[list] ?? [])
+                        wanted[list].push({ rule, slug: summary.slug, ...(summary.name ? { name: summary.name } : {}) });
+            }
+            if (wanted.allow.length && !allowScripts)
+                result.notInstalled = [...new Set([...result.notInstalled ?? [], ...wanted.allow.map(item => teamSkillFolder(item))])];
+            if (!allowScripts)
+                wanted.allow = [];
+            const skipped = [];
+            if (merges) {
+                const rules = { allow: [], ask: [], deny: [] }, droidRules = [];
+                const translate = where.format === "settings" || where.format === "opencode" ? where.translate : null, origins = new Map();
+                for (const list of RULE_LISTS)
+                    for (const { rule, slug } of wanted[list]) {
+                        if (!translate) {
+                            const made = droidRule(rule, list, slug);
+                            if (!made)
+                                skipped.push(rule);
+                            else if (!droidRules.some(existing => existing.id === made.id)) {
+                                droidRules.push(made);
+                                rules[list].push(made.id);
+                            }
+                            continue;
+                        }
+                        const translated = translate(rule, list);
+                        if (translated === null) {
+                            skipped.push(rule);
+                            continue;
+                        }
+                        if (!rules[list].includes(translated))
+                            rules[list].push(translated);
+                        origins.set(`${list}:${translated}`, [...origins.get(`${list}:${translated}`) ?? [], rule]);
+                    }
+                const any = RULE_LISTS.some(list => rules[list].length), recorded = manifest.permissionRules[target] ?? { allow: [], ask: [], deny: [] };
+                if (where.format === "settings" && where.existing && !await exists(path)) {
+                    if (any)
+                        keep(path, `${label} writes this file on its first run; run it once, then sync again`);
+                    if (skipped.length)
+                        result.permissionsSkipped = skipped;
+                    return;
+                }
+                try {
+                    if (any)
+                        await ensureDirectory(roots.home, dirname(path));
+                    if (!ours && RULE_LISTS.some(list => recorded[list].length)) {
+                        const current = await readOwned(path);
+                        if (current)
+                            await archive(result, path, current.bytes, fromProject);
+                    }
+                    const merged = where.format === "droid"
+                        ? await mergeDroidPermissions(path, droidRules, rules, recorded)
+                        : where.format === "opencode" ? await mergeOpencodePermissions(path, rules, recorded) : await mergePermissionSettings(path, rules, recorded);
+                    for (const list of RULE_LISTS)
+                        for (const rule of merged.withheld?.[list] ?? [])
+                            skipped.push(...origins.get(`${list}:${rule}`) ?? []);
+                    const { [target]: _previous, ...others } = manifest.permissionRules;
+                    manifest = { ...manifest, permissionRules: RULE_LISTS.some(list => merged.added[list].length) ? { ...others, [target]: merged.added } : others };
+                    if (merged.changed)
+                        (any ? result.written : result.removed).push(`${display(path)} (permissions)`);
+                    else if (any)
+                        result.unchanged.push(`${display(path)} (permissions)`);
+                }
+                catch (error) {
+                    keep(path, failure(error));
+                }
+                if (skipped.length)
+                    result.permissionsSkipped = skipped;
+                return;
+            }
+            const lines = [];
+            for (const list of ["deny", "ask", "allow"])
+                for (const { rule, slug } of wanted[list]) {
+                    const pattern = codexCommandPrefix(rule, list);
+                    if (!pattern) {
+                        skipped.push(rule);
+                        continue;
+                    }
+                    const why = `Relvo team permission ${slug}`;
+                    lines.push(where.format === "codex-rules"
+                        ? `prefix_rule(pattern = ${JSON.stringify(pattern)}, decision = "${CODEX_DECISION[list]}", justification = ${JSON.stringify(why)})`
+                        : `[[rule]]\ntoolName = "run_shell_command"\ncommandPrefix = ${tomlString(pattern.join(" "))}\ndecision = "${GEMINI_DECISION[list][0]}"\npriority = ${GEMINI_DECISION[list][1]}` +
+                            (list === "deny" ? `\ndenyMessage = ${tomlString(why)}` : ""));
+                }
+            if (skipped.length)
+                result.permissionsSkipped = skipped;
+            const text = lines.length ? `# Relvo team permission rules, written by relvo team-skills sync. Change them in the Relvo console.\n${[...new Set(lines)].join(where.format === "codex-rules" ? "\n" : "\n\n")}\n` : null;
+            const entry = manifest.permissionFiles.find(file => file.client === target && file.path === where.path);
+            let state = entry ? await fileState(where.path, entry) : await exists(where.path) ? "foreign" : "absent";
+            const others = manifest.permissionFiles.filter(file => file.client !== target);
+            if (state === "foreign") {
+                keep(where.path, "not written by relvo team-skills sync");
+                return;
+            }
+            if (state === "edited") {
+                if (ours) {
+                    keep(where.path, "edited locally; delete it to sync again");
+                    return;
+                }
+                await archive(result, where.path, undefined, fromProject);
+                state = "absent";
+            }
+            if (text === null) {
+                if (state === "untouched") {
+                    await unlink(where.path);
+                    result.removed.push(display(where.path));
+                }
+                manifest = { ...manifest, permissionFiles: others };
+                return;
+            }
+            if (state === "untouched" && entry?.sha256 === digest(text)) {
+                result.unchanged.push(display(where.path));
+                return;
+            }
+            await ensureDirectory(roots.home, dirname(where.path));
+            await writePrivateText(where.path, text, false, CONFIG_BYTES);
+            manifest = { ...manifest, permissionFiles: [...others, { client: target, path: where.path, sha256: digest(text) }] };
+            result.written.push(display(where.path));
+        }
+        async function placeFolder(item, folder, files, installed, parent) {
+            const entry = ours ? installed.find(hook => hook.slug === item.slug && hook.folder === folder) : undefined;
+            const previous = ours ? installed.find(hook => hook.slug === item.slug && hook.folder !== folder) : undefined;
+            if (previous && await treeState(previous) === "edited") {
+                keep(previous.folder, "renamed in Relvo, but edited locally; move it away and sync again");
+                return previous;
+            }
+            const state = entry ? await treeState(entry) : await exists(folder) ? "foreign" : "absent";
+            if (state === "foreign") {
+                keep(folder, "not written by relvo team-skills sync");
+                return previous ?? null;
+            }
+            if (state === "edited" && entry) {
+                keep(folder, "edited locally; move it away and sync again");
+                return entry;
+            }
+            const hashes = Object.fromEntries(files.map(file => [file.path, fileHash(Buffer.from(file.data, "base64"), file.executable === true)]));
+            if (entry && entry.version === item.version && !entry.pending && canonical(entry.files) === canonical(hashes) && !(state === "absent" && Object.keys(entry.files).length > 0)) {
+                if (files.length)
+                    result.unchanged.push(display(folder));
+                return entry;
+            }
+            const pending = { client: target, slug: item.slug, folder, version: item.version, files: hashes, previousFiles: entry?.files, pending: true };
+            manifest = { ...manifest, hooks: [...manifest.hooks.filter(hook => hook !== entry), pending] };
+            await writeManifest(roots.home, manifest);
+            const obsolete = Object.keys(entry?.files ?? {}).filter(path => !Object.hasOwn(hashes, path));
+            if (entry)
+                await removeTree({ ...entry, files: Object.fromEntries(obsolete.map(path => [path, entry.files[path]])), previousFiles: undefined });
+            if (files.length) {
+                await parent();
+                await writeTree(folder, files, true);
+            }
+            const settled = { client: target, slug: item.slug, folder, version: item.version, files: hashes };
+            manifest = { ...manifest, hooks: manifest.hooks.map(hook => hook === pending ? settled : hook) };
+            if (files.length)
+                result.written.push(display(folder));
+            return settled;
+        }
+        async function settleFolders(installed, nextHooks) {
+            for (const entry of installed.filter(hook => !nextHooks.some(kept => kept.slug === hook.slug && kept.folder === hook.folder))) {
+                const state = await treeState(entry);
+                if (state === "edited") {
+                    if (!ours)
+                        await archive(result, entry.folder, undefined, fromProject);
+                    else
+                        keep(entry.folder, "no longer installed, but edited locally; delete it yourself");
+                }
+                if (state === "untouched") {
+                    await removeTree(entry);
+                    result.removed.push(display(entry.folder));
+                }
+            }
+            manifest = { ...manifest, hooks: [...manifest.hooks.filter(hook => hook.client !== target), ...nextHooks] };
+            await writeManifest(roots.home, manifest);
+        }
+        async function syncHooks() {
+            const hooks = mine.filter(item => item.kind === "hook"), installed = manifest.hooks.filter(entry => entry.client === target), where = hookTarget(here, like);
+            if ("reason" in where) {
+                unsupported("hook", where.reason);
+                return;
+            }
+            if (!ours)
+                for (const entry of installed) {
+                    const state = await treeState(entry);
+                    if (state === "edited")
+                        await archive(result, entry.folder, undefined, fromProject);
+                    if (state === "untouched") {
+                        await removeTree(entry);
+                        result.removed.push(display(entry.folder));
+                    }
+                }
+            if (hooks.length && !allowScripts)
+                result.notInstalled = [...result.notInstalled ?? [], ...hooks.map(item => teamSkillFolder(item))];
+            const desired = allowScripts ? hooks : [];
+            if (where.format === "plugin") {
+                await syncPlugins(where, desired, installed);
+                return;
+            }
+            const ownGroups = manifest.hookGroups[target] ?? [], ownFile = manifest.hookFiles?.find(file => file.client === target);
+            if (!desired.length && !installed.length && !ownGroups.length && !ownFile)
+                return;
+            const groups = {}, nextHooks = [];
+            for (const summary of desired) {
+                const item = await full(summary.slug), folder = join(where.scripts, teamSkillFolder(item));
+                let config;
+                try {
+                    config = readTeamHookConfig(item.content);
+                }
+                catch (error) {
+                    keep(folder, failure(error));
+                    continue;
+                }
+                const files = platformSkillFilesSchema.parse(item.files ?? []).filter(file => file.path.split("/")[0] !== TEAM_HOOK_NATIVE_FOLDER);
+                const entry = await placeFolder(item, folder, files, installed, async () => { await ensureDirectory(roots.home, here.dirs[like]); await safeDirectory(where.scripts, true, true); });
+                if (!entry)
+                    continue;
+                nextHooks.push(entry);
+                const { events, skipped } = hookSettingsFor(target, where, config, entry.folder);
+                for (const [event, list] of Object.entries(events))
+                    groups[event] = [...(groups[event] ?? []), ...list];
+                if (skipped.length)
+                    result.hookEventsSkipped = [...new Set([...(result.hookEventsSkipped ?? []), ...skipped])];
+            }
+            try {
+                if (where.format === "file")
+                    await writeHookFile(where.path, groups, ownFile);
+                else {
+                    const path = where.topLevel && await exists(where.topLevel) ? where.topLevel : where.path, before = manifest.hookPaths?.[target] ?? where.path;
+                    let ownHere = ownGroups;
+                    if (before !== path && ownGroups.length) {
+                        const moved = await mergeHookSettings(before, {}, ownGroups, before === where.topLevel);
+                        if (moved.changed)
+                            result.removed.push(display(before));
+                        ownHere = [];
+                    }
+                    if (Object.keys(groups).length)
+                        await ensureDirectory(roots.home, dirname(path));
+                    const merged = await mergeHookSettings(path, groups, ownHere, path === where.topLevel);
+                    const { [target]: _path, ...otherPaths } = manifest.hookPaths ?? {};
+                    manifest = { ...manifest, hookGroups: { ...manifest.hookGroups, [target]: merged.hashes }, hookPaths: path === where.path ? otherPaths : { ...otherPaths, [target]: path } };
+                    if (merged.changed)
+                        (Object.keys(groups).length ? result.written : result.removed).push(display(path));
+                    else if (Object.keys(groups).length)
+                        result.unchanged.push(display(path));
+                    if (where.trust && merged.changed && Object.keys(groups).length)
+                        result.hooksToTrust = desired.map(item => teamSkillFolder(item));
+                }
+            }
+            catch (error) {
+                keep(where.path, failure(error));
+                manifest = { ...manifest, hooks: [...manifest.hooks.filter(hook => hook.client !== target || !nextHooks.includes(hook)), ...nextHooks] };
+                await writeManifest(roots.home, manifest);
+                return;
+            }
+            await settleFolders(installed, nextHooks);
+        }
+        async function writeHookFile(path, groups, entry) {
+            const hooks = Object.fromEntries(Object.entries(groups).map(([event, list]) => [event, list.flatMap(group => z.array(jsonMap).parse(group.hooks).map(handler => ({ ...handler, ...(typeof group.matcher === "string" ? { matcher: group.matcher } : {}) })))]));
+            const text = Object.keys(hooks).length ? `${JSON.stringify({ version: 1, hooks }, null, 2)}\n` : null;
+            let state = entry ? await fileState(path, entry) : await exists(path) ? "foreign" : "absent";
+            const others = (manifest.hookFiles ?? []).filter(file => file.client !== target);
+            if (state === "foreign") {
+                keep(path, "not written by relvo team-skills sync");
+                return;
+            }
+            if (state === "edited") {
+                if (ours) {
+                    keep(path, "edited locally; delete it to sync again");
+                    return;
+                }
+                await archive(result, path, undefined, fromProject);
+                state = "absent";
+            }
+            if (text === null) {
+                if (state === "untouched") {
+                    await unlink(path);
+                    result.removed.push(display(path));
+                }
+                manifest = { ...manifest, hookFiles: others };
+                return;
+            }
+            if (state === "untouched" && entry?.sha256 === digest(text)) {
+                result.unchanged.push(display(path));
+                return;
+            }
+            await ensureDirectory(roots.home, dirname(path));
+            await writePrivateText(path, text, false, CONFIG_BYTES);
+            manifest = { ...manifest, hookFiles: [...others, { client: target, path, sha256: digest(text) }] };
+            result.written.push(display(path));
+        }
+        async function syncPlugins(where, desired, installed) {
+            if (!desired.length && !installed.length)
+                return;
+            for (const shadow of where.shadows) {
+                const file = await readOwned(shadow.path).catch(() => ({ bytes: Buffer.from("null") }));
+                if (!file)
+                    continue;
+                let hides = true;
+                if (shadow.when) {
+                    try {
+                        hides = shadow.when(JSON.parse(file.bytes.toString("utf8")));
+                    }
+                    catch {
+                        hides = true;
+                    }
+                }
+                if (hides) {
+                    if (desired.length)
+                        keep(shadow.path, `${label} loads only this file from ${display(where.folder)}, so team hooks were not installed there`);
+                    return;
+                }
+            }
+            const prefix = `${TEAM_HOOK_NATIVE_FOLDER}/${like}/`, nextHooks = [];
+            for (const summary of desired) {
+                const item = await full(summary.slug), folder = join(where.folder, teamSkillFolder(item));
+                const files = platformSkillFilesSchema.parse(item.files ?? []).filter(file => file.path.startsWith(prefix)).map(file => ({ ...file, path: file.path.slice(prefix.length) }));
+                if (!files.length) {
+                    (result.hooksWithoutPlugin ??= []).push(teamSkillFolder(item));
+                    continue;
+                }
+                if (!files.some(file => where.entries.includes(file.path))) {
+                    keep(folder, `${label} starts a plugin folder from ${where.entries.join(", ")}, and ${prefix} of ${item.slug} has none`);
+                    continue;
+                }
+                const entry = await placeFolder(item, folder, files, installed, () => ensureDirectory(roots.home, where.folder));
+                if (entry)
+                    nextHooks.push(entry);
+            }
+            await settleFolders(installed, nextHooks);
+        }
+    }
+    return results;
+}
+export function harnessKindOf(path) {
+    if (!path.endsWith(".md") || basename(path) === "SKILL.md")
+        return null;
+    const parent = basename(dirname(resolve(path)));
+    return parent === "agents" ? "agent" : parent === "rules" ? "rule"
+        : ["AGENTS.md", "CLAUDE.md", "GEMINI.md", "QWEN.md"].includes(basename(path)) ? "instructions" : null;
+}
+export function parseHarnessFile(text) {
+    const parsed = readSkillMarkdown(text), lines = parsed.content.split("\n");
+    if (lines[0]?.startsWith(`${NOTICE} agent \``) || lines[0]?.startsWith(`${NOTICE} rule \``))
+        lines.shift();
+    return { ...parsed, content: lines.join("\n").trim() };
+}
+export async function pushTeamHarnessFile(roots, projectId, client, path, kind, slugOption) {
+    const file = resolve(path);
+    if (file.endsWith(".toml"))
+        throw new Error("Push the Claude Code copy of an agent (a Markdown file); sync writes the Codex agent from it.");
+    const text = new TextDecoder("utf-8", { fatal: true }).decode((await readRegularFile(file, limits.markdownBytes)).bytes), parsed = parseHarnessFile(text);
+    if (kind === "instructions" && text.includes(RULES.tag))
+        throw new Error("This file contains synced team instructions. Edit the original item in the Relvo console instead of sharing the combined file.");
+    const manifest = await readManifest(roots.home), synced = manifest?.files.find(entry => entry.path === file);
+    if (synced && synced.client !== "claude")
+        throw new Error(`This is the ${agentName(synced.client)} copy of the team ${synced.kind} ${synced.slug}. Edit the Claude Code copy and push that, or change it in the Relvo console.`);
+    if (synced && manifest?.projectId !== projectId)
+        throw new Error("This copy was synced from another Relvo project. Push it with that project's login.");
+    if (synced && synced.kind !== kind)
+        throw new Error(`This copy is the team ${synced.kind} ${synced.slug}.`);
+    if (synced && digest(text) === synced.sha256)
+        return { slug: synced.slug, kind, version: synced.version, created: false, changed: false };
+    const fromName = parsed.name?.startsWith(TEAM_SKILL_FOLDER_PREFIX) ? parsed.name.slice(TEAM_SKILL_FOLDER_PREFIX.length) : parsed.name ?? basename(file, ".md");
+    const fromFile = basename(file, ".md").startsWith(TEAM_SKILL_FOLDER_PREFIX) ? basename(file, ".md").slice(TEAM_SKILL_FOLDER_PREFIX.length) : basename(file, ".md");
+    const slug = slugOption ?? synced?.slug ?? (kind === "agent" ? fromName : fromFile).toLowerCase().replaceAll("-", "_");
+    if (synced && slugOption && slugOption !== synced.slug)
+        throw new Error(`This copy is the team ${kind} ${synced.slug}. Copy it to another file to push it under another slug.`);
+    const local = parsed.hasMetadata ? parsed.frontmatter : "";
+    const withheld = synced && kind === "agent" ? [...HARNESS_SETTING_FIELDS, ...!synced.scripts && synced.executes ? AGENT_EXECUTING_FIELDS : []] : [];
+    const frontmatter = withheld.length ? restoreFrontmatterFields(local, (await client.teamSkill(slug)).data.skill.frontmatter, withheld) : local;
+    const team = synced && kind === "rule" ? (await client.teamSkill(slug)).data.skill : undefined;
+    const plain = (text) => team ? unescapeImports(text, `${team.title}\n${team.content}`) : text;
+    const item = { slug, ...(!synced ? { name: (kind === "agent" ? fromName : kind === "instructions" ? fromFile.toLowerCase() : fromFile).replaceAll("_", "-") } : {}), kind,
+        title: plain(parsed.title ?? parsed.name ?? slug), description: parsed.description ?? (kind === "instructions" ? parsed.title ?? basename(file) : ""), content: plain(parsed.content), frontmatter };
+    const checked = platformTeamSkillCreateSchema.safeParse(item);
+    if (!checked.success) {
+        const fields = [...new Set(checked.error.issues.map(issue => String(issue.path[0])))];
+        throw new Error(`The file cannot be a team ${kind}. Fix: ${fields.map(field => `${field}: ${checked.error.issues.find(issue => String(issue.path[0]) === field)?.message}`).join("; ")}.`);
+    }
+    const credential = credentialIn(text);
+    if (credential)
+        throw new Error(`The ${kind} looks like it contains ${credential.kind} (line ${credential.line}). It is shared with the team: remove it and push again.`);
+    try {
+        if (synced && manifest) {
+            const { slug: _slug, kind: _kind, ...definition } = checked.data;
+            const saved = (await client.updateTeamSkill(slug, { ...definition, expectedVersion: synced.version })).data.skill;
+            const rendered = kind === "rule" ? renderClaudeRule(saved) : renderClaudeAgent(saved, synced.scripts);
+            const updated = { ...synced, version: saved.version, sha256: digest(rendered), previous: digest(text), format: FORMAT };
+            await writeManifest(roots.home, { ...manifest, files: manifest.files.map(entry => entry === synced ? updated : entry) });
+            await writePrivateText(file, rendered, false, limits.markdownBytes * 2);
+            await writeManifest(roots.home, { ...manifest, files: manifest.files.map(entry => entry === synced ? { ...updated, previous: undefined } : entry) });
+            return { slug, kind, version: saved.version, created: false, changed: true };
+        }
+        const saved = (await client.createTeamSkill(checked.data)).data.skill;
+        return { slug, kind, version: saved.version, created: true, changed: true };
+    }
+    catch (error) {
+        if (!(error instanceof PlatformApiError))
+            throw error;
+        if (error.code === "platform_team_item_name_exists")
+            throw new Error(`That environment name is already in use. Choose another ${kind === "agent" ? "frontmatter name" : "Markdown filename"} and push again.`);
+        if (error.code === "platform_team_skill_exists")
+            throw new Error(kind === "instructions" ? `The team already has instructions named ${slug}. Edit them in the Relvo console, or push this one with another --slug.`
+                : `The team already has a skill, agent, rule or hook named ${slug}, and this file is not its synced copy. Move this file away, run relvo team-skills sync, apply your edit to the synced copy and push that, or push this one with another --slug.`);
+        if (error.code === "platform_team_skill_version_conflict")
+            throw new Error(`${slug} changed in Relvo after this copy was synced. Move your edited copy away, run relvo team-skills sync, then apply your edit to the new copy and push again.`);
+        throw error;
+    }
+}