@notis_ai/cli 0.2.0-beta.136.1 → 0.2.0-beta.139.1

package/dist/skill-sync/index.js

@@ -0,0 +1,1528 @@
+// src/runtime/skill-sync/types.ts
+var DEFAULT_AGENT_TARGETS = {
+  notis: true,
+  claude_code: true,
+  cursor: true,
+  codex: true
+};
+function normalizeAgentTargets(targets) {
+  return {
+    notis: Boolean(targets?.notis ?? DEFAULT_AGENT_TARGETS.notis),
+    claude_code: Boolean(targets?.claude_code ?? DEFAULT_AGENT_TARGETS.claude_code),
+    cursor: Boolean(targets?.cursor ?? DEFAULT_AGENT_TARGETS.cursor),
+    codex: Boolean(targets?.codex ?? DEFAULT_AGENT_TARGETS.codex)
+  };
+}
+
+// src/runtime/skill-sync/local-scanner.ts
+import { createHash } from "crypto";
+import { execFile } from "child_process";
+import { promises as fs } from "fs";
+import os from "os";
+import path from "path";
+import { promisify } from "util";
+var HOME_DIR = os.homedir();
+var execFileAsync = promisify(execFile);
+var AGENTS_DIR = path.join(HOME_DIR, ".agents");
+var LEGACY_AGENTS_SKILLS_DIR = path.join(AGENTS_DIR, "skills");
+var NOTIS_SKILL_SYNC_ROOT = path.join(HOME_DIR, ".notis", "skills");
+var LEGACY_NOTIS_SYNC_STATE_PATH = path.join(
+  AGENTS_DIR,
+  ".notis-sync.json"
+);
+var AGENTS_SKILLS_DIR = LEGACY_AGENTS_SKILLS_DIR;
+var SKILL_LOCK_PATH = path.join(AGENTS_DIR, ".skill-lock.json");
+var DEFAULT_SYNC_STATE = {
+  version: 1,
+  lastSyncedAt: null,
+  skills: {}
+};
+var EXCLUDED_TOP_LEVEL_ROOT_NAMES = /* @__PURE__ */ new Set([
+  "backup",
+  "backups",
+  "builtin",
+  "builtins",
+  "cache",
+  "caches",
+  "marketplace",
+  "marketplaces",
+  "plugin",
+  "plugins",
+  "temp",
+  "tmp",
+  "worktree",
+  "worktrees"
+]);
+var DEFAULT_SYNC_PATHS = {
+  agentsDir: AGENTS_DIR,
+  syncRoot: NOTIS_SKILL_SYNC_ROOT,
+  legacySkillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  legacyScopedSkillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  legacyScopedSyncStatePath: LEGACY_NOTIS_SYNC_STATE_PATH,
+  skillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  syncStatePath: LEGACY_NOTIS_SYNC_STATE_PATH,
+  skillLockPath: SKILL_LOCK_PATH,
+  gatherMetadataPath: path.join(NOTIS_SKILL_SYNC_ROOT, "skill-gather-metadata.json")
+};
+function getDefaultSyncRootForAgentsDir(resolvedAgentsDir) {
+  if (resolvedAgentsDir === path.resolve(AGENTS_DIR)) {
+    return NOTIS_SKILL_SYNC_ROOT;
+  }
+  return path.join(resolvedAgentsDir, ".notis", "skills");
+}
+function isResolvedChildPath(baseDir, candidatePath) {
+  return candidatePath.startsWith(`${baseDir}${path.sep}`);
+}
+function sanitizePathSegment(value) {
+  const raw = value.trim();
+  const sanitized = raw.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^_+|_+$/g, "");
+  if (!sanitized) {
+    throw new Error("Invalid sync user id");
+  }
+  if (sanitized === raw) {
+    return sanitized;
+  }
+  return `${sanitized}-${createHash("sha256").update(raw).digest("hex").slice(0, 12)}`;
+}
+function getSkillSyncPathsForUser(authUserId, agentsDir = AGENTS_DIR) {
+  const safeUserId = sanitizePathSegment(authUserId);
+  const resolvedAgentsDir = path.resolve(agentsDir);
+  const syncRoot = getDefaultSyncRootForAgentsDir(resolvedAgentsDir);
+  const userRoot = path.join(syncRoot, "users", safeUserId);
+  const legacyUserRoot = path.join(resolvedAgentsDir, "notis", "users", safeUserId);
+  return {
+    agentsDir: resolvedAgentsDir,
+    syncRoot,
+    legacySkillsDir: path.join(resolvedAgentsDir, "skills"),
+    legacyScopedSkillsDir: path.join(legacyUserRoot, "skills"),
+    legacyScopedSyncStatePath: path.join(legacyUserRoot, ".notis-sync.json"),
+    skillsDir: path.join(userRoot, "skills"),
+    syncStatePath: path.join(userRoot, ".notis-sync.json"),
+    skillLockPath: path.join(resolvedAgentsDir, ".skill-lock.json"),
+    gatherMetadataPath: path.join(userRoot, ".notis-gathered-skills.json")
+  };
+}
+function assertRelativeBundlePath(relativePath) {
+  const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+  if (!normalized || normalized.startsWith("../") || `/${normalized}/`.includes("/../")) {
+    throw new Error(`Invalid bundle file path: ${relativePath}`);
+  }
+  return normalized;
+}
+function stripWrappingQuotes(value) {
+  return value.replace(/^['"]|['"]$/g, "").trim();
+}
+function parseFrontMatter(skillMd) {
+  const match = skillMd.match(/^---\s*\n([\s\S]*?)\n---\s*(?:\n|$)/);
+  if (!match) {
+    return { description: "" };
+  }
+  let description = "";
+  for (const line of match[1].split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const descriptionMatch = trimmed.match(/^description\s*:\s*(.+)$/i);
+    if (descriptionMatch) {
+      description = stripWrappingQuotes(descriptionMatch[1]);
+      break;
+    }
+  }
+  return { description };
+}
+async function readJsonFile(filePath) {
+  try {
+    const raw = await fs.readFile(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function listFilesRecursive(dirPath) {
+  const entries = await fs.readdir(dirPath, { withFileTypes: true });
+  const nested = await Promise.all(
+    entries.map(async (entry) => {
+      if (entry.name === ".DS_Store") {
+        return [];
+      }
+      const fullPath = path.join(dirPath, entry.name);
+      if (entry.isDirectory()) {
+        return listFilesRecursive(fullPath);
+      }
+      if (entry.isFile()) {
+        return [fullPath];
+      }
+      return [];
+    })
+  );
+  return nested.flat().sort();
+}
+async function computeFolderHash(dirPath) {
+  const hash = createHash("sha256");
+  const filePaths = await listFilesRecursive(dirPath);
+  for (const filePath of filePaths) {
+    const relativePath = path.relative(dirPath, filePath);
+    hash.update(relativePath);
+    hash.update("\0");
+    hash.update(await fs.readFile(filePath));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function resolveSkillBundleFilePath(skillDir, relativePath) {
+  const normalizedPath = assertRelativeBundlePath(relativePath);
+  const resolvedSkillDir = path.resolve(skillDir);
+  const candidatePath = path.resolve(resolvedSkillDir, normalizedPath);
+  if (candidatePath === resolvedSkillDir || !isResolvedChildPath(resolvedSkillDir, candidatePath)) {
+    throw new Error(
+      `Bundle file resolves outside the expected directory: ${relativePath}`
+    );
+  }
+  return candidatePath;
+}
+async function readSkillMdIfValid(skillDir) {
+  try {
+    await fs.readFile(path.join(skillDir, "SKILL.md"), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function moveDirectory(sourceDir, destinationDir) {
+  await fs.mkdir(path.dirname(destinationDir), { recursive: true });
+  try {
+    await fs.rename(sourceDir, destinationDir);
+  } catch (error) {
+    if (error.code !== "EXDEV") {
+      throw error;
+    }
+    await fs.cp(sourceDir, destinationDir, {
+      recursive: true,
+      errorOnExist: true,
+      force: false
+    });
+    await fs.rm(sourceDir, { recursive: true, force: true });
+  }
+}
+async function createDirectorySymlink(targetDir, linkPath) {
+  await fs.mkdir(path.dirname(linkPath), { recursive: true });
+  await fs.symlink(path.relative(path.dirname(linkPath), targetDir), linkPath, "dir");
+}
+function backupRootFor(paths, timestamp) {
+  return path.join(paths.syncRoot, "skill-dedupe-backups", timestamp);
+}
+function relativeBackupPath(label, skillName) {
+  return path.join(
+    label.replace(/[^A-Za-z0-9_.-]+/g, "_"),
+    safeName(skillName)
+  );
+}
+function isExcludedTopLevelSkillEntry(entryName) {
+  return entryName.startsWith(".") || isTransientSkillDirectoryName(entryName) || EXCLUDED_TOP_LEVEL_ROOT_NAMES.has(entryName.toLowerCase());
+}
+function isTransientSkillDirectoryName(entryName) {
+  return /\.(?:backup|staging)-/.test(entryName);
+}
+function defaultTopLevelSkillSources(paths) {
+  const sources = [];
+  if (path.resolve(paths.legacyScopedSkillsDir) !== path.resolve(paths.skillsDir)) {
+    sources.push({
+      label: "notis-legacy-scoped",
+      root: paths.legacyScopedSkillsDir,
+      priority: 1
+    });
+  }
+  sources.push(
+    { label: "agents", root: paths.legacySkillsDir, priority: 2 },
+    {
+      label: "codex",
+      root: path.join(HOME_DIR, ".codex", "skills"),
+      priority: 3
+    },
+    {
+      label: "cursor",
+      root: path.join(HOME_DIR, ".cursor", "skills"),
+      priority: 4
+    },
+    {
+      label: "claude",
+      root: path.join(HOME_DIR, ".claude", "skills"),
+      priority: 5
+    }
+  );
+  return sources;
+}
+function isManagedTopLevelSymlinkTarget(resolvedPath, paths) {
+  const managedRoots = [
+    path.resolve(paths.skillsDir),
+    path.resolve(paths.legacySkillsDir),
+    path.resolve(paths.legacyScopedSkillsDir),
+    path.join(path.resolve(paths.syncRoot), "base"),
+    path.join(path.resolve(paths.syncRoot), "users"),
+    path.join(path.resolve(paths.agentsDir), "notis", "users")
+  ];
+  return managedRoots.some(
+    (root) => resolvedPath === root || resolvedPath.startsWith(`${root}${path.sep}`)
+  );
+}
+async function listTopLevelSkillCandidates(paths, options) {
+  const sourceRoots = options.sourceRoots ? options.sourceRoots.map((source, index) => ({
+    ...source,
+    priority: index + 1
+  })) : defaultTopLevelSkillSources(paths);
+  const candidates = [];
+  try {
+    const scopedEntries = await fs.readdir(paths.skillsDir, {
+      withFileTypes: true
+    });
+    for (const entry of scopedEntries) {
+      if (!entry.isDirectory() && !entry.isSymbolicLink() || entry.name.startsWith(".") || isTransientSkillDirectoryName(entry.name)) {
+        continue;
+      }
+      const skillDir = path.join(paths.skillsDir, entry.name);
+      let resolvedPath = path.resolve(skillDir);
+      if (entry.isSymbolicLink()) {
+        try {
+          resolvedPath = path.resolve(path.dirname(skillDir), await fs.readlink(skillDir));
+        } catch {
+          continue;
+        }
+      }
+      if (await readSkillMdIfValid(skillDir)) {
+        candidates.push({
+          name: safeName(entry.name, paths.skillsDir),
+          root: paths.skillsDir,
+          label: "notis-managed",
+          path: skillDir,
+          resolvedPath,
+          priority: 0,
+          isScoped: true,
+          isSymlink: entry.isSymbolicLink()
+        });
+      }
+    }
+  } catch {
+  }
+  for (const source of sourceRoots) {
+    let entries;
+    try {
+      entries = await fs.readdir(source.root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (isExcludedTopLevelSkillEntry(entry.name) || !entry.isDirectory() && !entry.isSymbolicLink()) {
+        continue;
+      }
+      const candidatePath = path.join(source.root, entry.name);
+      let resolvedPath;
+      try {
+        resolvedPath = entry.isSymbolicLink() ? path.resolve(
+          path.dirname(candidatePath),
+          await fs.readlink(candidatePath)
+        ) : path.resolve(candidatePath);
+      } catch {
+        continue;
+      }
+      if (entry.isSymbolicLink() && isManagedTopLevelSymlinkTarget(resolvedPath, paths)) {
+        continue;
+      }
+      if (!await readSkillMdIfValid(resolvedPath)) {
+        continue;
+      }
+      candidates.push({
+        name: safeName(entry.name, paths.skillsDir),
+        root: source.root,
+        label: source.label,
+        path: candidatePath,
+        resolvedPath,
+        priority: source.priority,
+        isScoped: false,
+        isSymlink: entry.isSymbolicLink()
+      });
+    }
+  }
+  return candidates.sort(
+    (a, b) => a.priority - b.priority || a.name.localeCompare(b.name)
+  );
+}
+async function gatherTopLevelLocalSkills(paths, options = {}) {
+  await ensureCanonicalSkillsDir(paths);
+  const protectedSkillNames = options.protectedSkillNames || /* @__PURE__ */ new Set();
+  const timestamp = options.timestamp || (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backupRoot = backupRootFor(paths, timestamp);
+  const candidates = await listTopLevelSkillCandidates(paths, options);
+  const byName = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const existing = byName.get(candidate.name) || [];
+    existing.push(candidate);
+    byName.set(candidate.name, existing);
+  }
+  let gathered = 0;
+  let backedUp = 0;
+  let skipped = 0;
+  const metadata = {
+    version: 1,
+    gatheredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    skills: {}
+  };
+  for (const [skillName, skillCandidates] of byName) {
+    const protectedFromLocalGather = protectedSkillNames.has(skillName);
+    const canonical = protectedFromLocalGather ? skillCandidates.find((candidate) => candidate.isScoped) || null : skillCandidates[0];
+    const destinationName = safeName(skillName, paths.skillsDir);
+    const destinationDir = path.join(paths.skillsDir, destinationName);
+    const skippedSources = [];
+    if (!canonical) {
+      for (const candidate of skillCandidates) {
+        if (candidate.isSymlink) {
+          skipped += 1;
+          skippedSources.push(candidate.path);
+          continue;
+        }
+        const backupDir = path.join(
+          backupRoot,
+          relativeBackupPath(candidate.label, skillName)
+        );
+        try {
+          await moveDirectory(candidate.path, backupDir);
+          backedUp += 1;
+          skippedSources.push(candidate.path);
+        } catch {
+          skipped += 1;
+        }
+      }
+      metadata.skills[skillName] = {
+        canonicalPath: null,
+        skippedSources,
+        protectedFromLocalGather: true
+      };
+      continue;
+    }
+    if (!canonical.isScoped && !await pathExists(destinationDir)) {
+      try {
+        if (canonical.isSymlink) {
+          await createDirectorySymlink(canonical.resolvedPath, destinationDir);
+        } else {
+          await moveDirectory(canonical.path, destinationDir);
+        }
+        gathered += 1;
+      } catch {
+        skipped += 1;
+      }
+    }
+    for (const candidate of skillCandidates) {
+      if (candidate === canonical || candidate.isScoped) {
+        continue;
+      }
+      if (candidate.isSymlink) {
+        skippedSources.push(candidate.path);
+        continue;
+      }
+      const backupDir = path.join(
+        backupRoot,
+        relativeBackupPath(candidate.label, skillName)
+      );
+      try {
+        await moveDirectory(candidate.path, backupDir);
+        backedUp += 1;
+        skippedSources.push(candidate.path);
+      } catch {
+        skipped += 1;
+      }
+    }
+    metadata.skills[skillName] = {
+      canonicalPath: await pathExists(destinationDir) ? destinationDir : canonical.path,
+      skippedSources,
+      ...protectedFromLocalGather ? { protectedFromLocalGather: true } : {}
+    };
+  }
+  await fs.mkdir(path.dirname(paths.gatherMetadataPath), { recursive: true });
+  await fs.writeFile(
+    paths.gatherMetadataPath,
+    `${JSON.stringify(metadata, null, 2)}
+`,
+    "utf8"
+  );
+  return {
+    gathered,
+    backedUp,
+    skipped,
+    metadataPath: paths.gatherMetadataPath
+  };
+}
+async function readSkillLock(paths = DEFAULT_SYNC_PATHS) {
+  const lockData = await readJsonFile(paths.skillLockPath);
+  const sourceUrls = {};
+  for (const [skillName, entry] of Object.entries(lockData?.skills || {})) {
+    if (typeof entry?.sourceUrl === "string" && entry.sourceUrl.trim()) {
+      sourceUrls[skillName] = entry.sourceUrl.trim();
+    }
+  }
+  return sourceUrls;
+}
+async function ensureCanonicalSkillsDir(paths = DEFAULT_SYNC_PATHS) {
+  await fs.mkdir(paths.skillsDir, { recursive: true });
+}
+async function scanLocalSkills(paths = DEFAULT_SYNC_PATHS) {
+  await ensureCanonicalSkillsDir(paths);
+  const sourceUrls = await readSkillLock(paths);
+  const entries = await fs.readdir(paths.skillsDir, { withFileTypes: true });
+  const skills = await Promise.all(
+    entries.map(async (entry) => {
+      if (!entry.isDirectory() && !entry.isSymbolicLink() || isTransientSkillDirectoryName(entry.name)) {
+        return null;
+      }
+      const skillDir = path.join(paths.skillsDir, entry.name);
+      const skillMdPath = path.join(skillDir, "SKILL.md");
+      try {
+        const skillMd = await fs.readFile(skillMdPath, "utf8");
+        const { description } = parseFrontMatter(skillMd);
+        const folderHash = await computeFolderHash(skillDir);
+        const skill = {
+          name: entry.name,
+          skillMd,
+          description,
+          folderHash,
+          directoryPath: skillDir
+        };
+        if (sourceUrls[entry.name]) {
+          skill.sourceUrl = sourceUrls[entry.name];
+        }
+        return skill;
+      } catch {
+        return null;
+      }
+    })
+  );
+  return skills.filter((skill) => skill !== null).sort((a, b) => a.name.localeCompare(b.name));
+}
+function normalizeSyncState(state) {
+  if (!state || state.version !== 1 || typeof state.skills !== "object") {
+    return null;
+  }
+  const normalizeStoredAgentTargets = (targets) => ({
+    notis: Boolean(targets?.notis ?? true),
+    claude_code: Boolean(targets?.claude_code ?? true),
+    cursor: Boolean(targets?.cursor ?? true),
+    codex: Boolean(targets?.codex ?? true)
+  });
+  return {
+    version: 1,
+    lastSyncedAt: typeof state.lastSyncedAt === "string" ? state.lastSyncedAt : null,
+    skills: Object.fromEntries(
+      Object.entries(state.skills || {}).map(([skillName, skillState]) => [
+        skillName,
+        {
+          ...skillState,
+          agentTargets: normalizeStoredAgentTargets(skillState.agentTargets)
+        }
+      ])
+    )
+  };
+}
+async function readSyncState(paths = DEFAULT_SYNC_PATHS) {
+  const scopedState = normalizeSyncState(
+    await readJsonFile(paths.syncStatePath)
+  );
+  if (scopedState) {
+    return scopedState;
+  }
+  return DEFAULT_SYNC_STATE;
+}
+async function readLegacySyncState(paths = DEFAULT_SYNC_PATHS) {
+  const legacyStatePaths = [
+    paths.legacyScopedSyncStatePath,
+    path.resolve(paths.syncStatePath) === path.resolve(LEGACY_NOTIS_SYNC_STATE_PATH) ? paths.syncStatePath : path.join(paths.agentsDir, ".notis-sync.json")
+  ];
+  for (const legacyStatePath of legacyStatePaths) {
+    const state = normalizeSyncState(
+      await readJsonFile(legacyStatePath)
+    );
+    if (state) {
+      return state;
+    }
+  }
+  return null;
+}
+async function writeSyncState(state, paths = DEFAULT_SYNC_PATHS) {
+  await fs.mkdir(path.dirname(paths.syncStatePath), { recursive: true });
+  await fs.writeFile(
+    paths.syncStatePath,
+    `${JSON.stringify(state, null, 2)}
+`,
+    "utf8"
+  );
+}
+function safeName(name, baseDir = AGENTS_SKILLS_DIR) {
+  const sanitizedName = name.trim().replace(/[\\/]+/g, "").replace(/\.\./g, "");
+  if (!sanitizedName) {
+    throw new Error("Invalid skill name");
+  }
+  const resolvedBaseDir = path.resolve(baseDir);
+  const resolvedPath = path.resolve(resolvedBaseDir, sanitizedName);
+  if (!isResolvedChildPath(resolvedBaseDir, resolvedPath)) {
+    throw new Error("Skill name resolves outside the expected directory");
+  }
+  return sanitizedName;
+}
+async function deleteLocalSkill(skillName, paths = DEFAULT_SYNC_PATHS) {
+  const skillDir = path.join(
+    paths.skillsDir,
+    safeName(skillName, paths.skillsDir)
+  );
+  try {
+    await fs.rm(skillDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function createZipFromDirectory(directoryPath) {
+  const zipPath = path.join(
+    os.tmpdir(),
+    `notis-skill-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
+  );
+  const parentDir = path.dirname(directoryPath);
+  const directoryName = path.basename(directoryPath);
+  if (process.platform === "win32") {
+    await execFileAsync("powershell.exe", [
+      "-NoProfile",
+      "-Command",
+      `Compress-Archive -Path '${directoryPath.replace(/'/g, "''")}' -DestinationPath '${zipPath.replace(/'/g, "''")}' -Force`
+    ]);
+    return zipPath;
+  }
+  await execFileAsync("zip", ["-qry", zipPath, directoryName], {
+    cwd: parentDir
+  });
+  return zipPath;
+}
+async function extractZipToDirectory(zipPath, destinationDir) {
+  const extractRoot = await fs.mkdtemp(
+    path.join(os.tmpdir(), "notis-skill-extract-")
+  );
+  try {
+    if (process.platform === "win32") {
+      await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        `Expand-Archive -Path '${zipPath.replace(/'/g, "''")}' -DestinationPath '${extractRoot.replace(/'/g, "''")}' -Force`
+      ]);
+    } else {
+      await execFileAsync("unzip", ["-qq", zipPath, "-d", extractRoot]);
+    }
+    const extractedEntries = await fs.readdir(extractRoot, {
+      withFileTypes: true
+    });
+    const extractedDirectory = extractedEntries.find(
+      (entry) => entry.isDirectory()
+    );
+    const sourceDir = extractedDirectory ? path.join(extractRoot, extractedDirectory.name) : extractRoot;
+    await fs.rm(destinationDir, { recursive: true, force: true });
+    await fs.mkdir(path.dirname(destinationDir), { recursive: true });
+    await fs.cp(sourceDir, destinationDir, { recursive: true });
+  } finally {
+    await fs.rm(extractRoot, { recursive: true, force: true });
+  }
+}
+async function pathExists(targetPath) {
+  try {
+    await fs.access(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function replaceSkillDirectoryAtomically(skillDir, populateDir) {
+  const parentDir = path.dirname(skillDir);
+  const skillName = path.basename(skillDir);
+  await fs.mkdir(parentDir, { recursive: true });
+  const stagingDir = await fs.mkdtemp(
+    path.join(parentDir, `${skillName}.staging-`)
+  );
+  const backupDir = path.join(
+    parentDir,
+    `${skillName}.backup-${Date.now()}-${Math.random().toString(36).slice(2)}`
+  );
+  let movedExisting = false;
+  let promotedStaging = false;
+  let cleanupError = null;
+  try {
+    await populateDir(stagingDir);
+    if (await pathExists(skillDir)) {
+      await fs.rename(skillDir, backupDir);
+      movedExisting = true;
+    }
+    await fs.rename(stagingDir, skillDir);
+    promotedStaging = true;
+  } catch (error) {
+    if (movedExisting && !promotedStaging && await pathExists(backupDir)) {
+      await fs.rename(backupDir, skillDir);
+    }
+    throw error;
+  } finally {
+    if (!promotedStaging && await pathExists(stagingDir)) {
+      await fs.rm(stagingDir, { recursive: true, force: true });
+    }
+    if ((promotedStaging || !movedExisting) && await pathExists(backupDir)) {
+      try {
+        await fs.rm(backupDir, { recursive: true, force: true });
+      } catch (error) {
+        if (!cleanupError) {
+          cleanupError = error instanceof Error ? error : new Error(String(error));
+        }
+      }
+    }
+    if (cleanupError) {
+      console.warn(
+        `[Notis] Failed to clean up temporary skill directory backup for "${skillDir}"`,
+        cleanupError
+      );
+    }
+  }
+}
+function bundleFilesIncludeSkillMd(bundleFiles) {
+  return bundleFiles.some((bundleFile) => {
+    const basename = path.basename(bundleFile.path).toLowerCase();
+    return basename === "skill.md" || basename === "skills.md";
+  });
+}
+async function createSkillBundleBase64(skill) {
+  const zipPath = await createZipFromDirectory(skill.directoryPath);
+  try {
+    const zipBytes = await fs.readFile(zipPath);
+    return zipBytes.toString("base64");
+  } finally {
+    await fs.rm(zipPath, { force: true });
+  }
+}
+async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PATHS) {
+  const skillDir = path.join(
+    paths.skillsDir,
+    safeName(skill.name, paths.skillsDir)
+  );
+  if (bundleBytes?.length) {
+    const bundlePath = path.join(
+      os.tmpdir(),
+      `notis-skill-download-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
+    );
+    try {
+      await fs.writeFile(bundlePath, bundleBytes);
+      await extractZipToDirectory(bundlePath, skillDir);
+      return true;
+    } finally {
+      await fs.rm(bundlePath, { force: true });
+    }
+  }
+  if (!skill.skill_md && (!skill.bundle_files || skill.bundle_files.length === 0)) {
+    return false;
+  }
+  if (skill.bundle_files && skill.bundle_files.length > 0) {
+    if (!bundleFilesIncludeSkillMd(skill.bundle_files)) {
+      throw new Error(
+        `Synced bundle for "${skill.name}" is missing SKILL.md or SKILLS.md`
+      );
+    }
+    await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+      for (const bundleFile of skill.bundle_files || []) {
+        const filePath = resolveSkillBundleFilePath(
+          stagingDir,
+          bundleFile.path
+        );
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        await fs.writeFile(
+          filePath,
+          Buffer.from(bundleFile.content_b64, "base64")
+        );
+      }
+    });
+    return true;
+  }
+  await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+    await fs.writeFile(
+      path.join(stagingDir, "SKILL.md"),
+      skill.skill_md ?? "",
+      "utf8"
+    );
+  });
+  return true;
+}
+
+// src/runtime/skill-sync/cloud-client.ts
+async function requestJson(url, jwt, options = {}) {
+  const response = await fetch(url, {
+    method: options.method || "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${jwt}`
+    },
+    body: options.body ? JSON.stringify(options.body) : void 0
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`${options.method || "POST"} ${url} \u2192 ${response.status}: ${text}`);
+  }
+  return response.json();
+}
+async function fetchSyncSettings(serverUrl, jwt) {
+  return requestJson(`${serverUrl}/portal_skills/sync-settings`, jwt, {
+    body: {}
+  });
+}
+async function pullSkills(serverUrl, jwt) {
+  return requestJson(`${serverUrl}/portal_skills/sync-pull`, jwt, {
+    body: {}
+  });
+}
+async function pushChangedSkills(serverUrl, jwt, changedSkills) {
+  const payloadSkills = await Promise.all(changedSkills.map(async (skill) => ({
+    name: skill.name,
+    description: skill.description,
+    skill_md: skill.skillMd,
+    source_url: skill.sourceUrl,
+    folder_hash: skill.folderHash,
+    bundle_base64: await createSkillBundleBase64(skill)
+  })));
+  return requestJson(`${serverUrl}/portal_skills/sync-push`, jwt, {
+    body: {
+      skills: payloadSkills
+    }
+  });
+}
+async function downloadSkillBundle(bundleUrl) {
+  const response = await fetch(bundleUrl);
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`GET ${bundleUrl} \u2192 ${response.status}: ${text}`);
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+async function updateAgentTargets(serverUrl, jwt, skillId, targets) {
+  return requestJson(`${serverUrl}/portal_skills/agent-targets`, jwt, {
+    method: "PATCH",
+    body: {
+      skill_id: skillId,
+      agent_targets: targets
+    }
+  });
+}
+
+// src/runtime/skill-sync/symlink-manager.ts
+import { promises as fs2 } from "fs";
+import os2 from "os";
+import path2 from "path";
+var HOME_DIR2 = os2.homedir();
+var EXTERNAL_AGENT_SKILL_DIRS = {
+  claude_code: path2.join(HOME_DIR2, ".claude", "skills"),
+  cursor: path2.join(HOME_DIR2, ".cursor", "skills"),
+  codex: path2.join(HOME_DIR2, ".codex", "skills")
+};
+var EXTERNAL_AGENTS = Object.keys(EXTERNAL_AGENT_SKILL_DIRS);
+async function removeForeignAccountSymlinks(skillsDir, options = {}) {
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const currentRoot = path2.resolve(skillsDir);
+  const foreignCapableRoots = [
+    path2.join(path2.resolve(NOTIS_SKILL_SYNC_ROOT), "users"),
+    path2.join(path2.resolve(AGENTS_DIR), "notis", "users"),
+    path2.dirname(path2.dirname(currentRoot))
+  ];
+  let removed = 0;
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  for (const agentDir of /* @__PURE__ */ new Set([...Object.values(agentSkillDirs), legacyGlobalSkillsDir])) {
+    let entries;
+    try {
+      entries = await fs2.readdir(agentDir, { withFileTypes: true });
+    } catch (error) {
+      if (error?.code === "ENOENT") continue;
+      throw error;
+    }
+    for (const entry of entries) {
+      if (!entry.isSymbolicLink()) continue;
+      const entryPath = path2.join(agentDir, entry.name);
+      try {
+        const target = await fs2.readlink(entryPath);
+        const resolvedTarget = path2.resolve(path2.dirname(entryPath), target);
+        const belongsToAnyAccount = foreignCapableRoots.some((root) => resolvedTarget.startsWith(`${root}${path2.sep}`));
+        const belongsToCurrentAccount = resolvedTarget === currentRoot || resolvedTarget.startsWith(`${currentRoot}${path2.sep}`);
+        if (belongsToAnyAccount && !belongsToCurrentAccount) {
+          await fs2.unlink(entryPath);
+          removed += 1;
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") throw error;
+      }
+    }
+  }
+  return removed;
+}
+function managedSkillRoots(skillsDir, legacyGlobalSkillsDir = LEGACY_AGENTS_SKILLS_DIR) {
+  const resolvedSkillsDir = path2.resolve(skillsDir);
+  const scopedUsersRoot = path2.dirname(path2.dirname(resolvedSkillsDir));
+  const roots = [
+    resolvedSkillsDir,
+    path2.resolve(legacyGlobalSkillsDir),
+    path2.join(path2.resolve(NOTIS_SKILL_SYNC_ROOT), "users"),
+    path2.join(path2.resolve(AGENTS_DIR), "notis", "users")
+  ];
+  if (path2.basename(scopedUsersRoot) === "users") {
+    roots.push(scopedUsersRoot);
+  }
+  return roots;
+}
+async function isManagedSymlink(linkPath, managedRoots) {
+  try {
+    const stats = await fs2.lstat(linkPath);
+    if (!stats.isSymbolicLink()) {
+      return false;
+    }
+    const target = await fs2.readlink(linkPath);
+    const resolvedTarget = path2.resolve(path2.dirname(linkPath), target);
+    return managedRoots.some((root) => resolvedTarget === root || resolvedTarget.startsWith(`${root}${path2.sep}`));
+  } catch {
+    return false;
+  }
+}
+async function ensureCorrectSymlink(linkPath, targetPath) {
+  try {
+    const stats = await fs2.lstat(linkPath);
+    if (stats.isSymbolicLink()) {
+      const currentTarget = await fs2.readlink(linkPath);
+      const resolvedTarget = path2.resolve(path2.dirname(linkPath), currentTarget);
+      if (resolvedTarget === targetPath) {
+        return "skipped";
+      }
+      await fs2.unlink(linkPath);
+    } else {
+      return "blocked";
+    }
+  } catch {
+  }
+  const relativePath = path2.relative(path2.dirname(linkPath), targetPath);
+  await fs2.symlink(relativePath, linkPath);
+  return "linked";
+}
+function defaultAgentSkillDirs(skillsDir) {
+  return {
+    notis: skillsDir,
+    ...EXTERNAL_AGENT_SKILL_DIRS
+  };
+}
+async function removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots) {
+  let removed = 0;
+  try {
+    await fs2.mkdir(agentDir, { recursive: true });
+    const existingEntries = await fs2.readdir(agentDir, { withFileTypes: true });
+    for (const entry of existingEntries) {
+      const entryPath = path2.join(agentDir, entry.name);
+      if (!desiredSkills.has(entry.name) && await isManagedSymlink(entryPath, managedRoots)) {
+        await fs2.unlink(entryPath);
+        removed += 1;
+      }
+    }
+  } catch {
+  }
+  return removed;
+}
+async function removeAllSymlinksForSkill(skillName, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  let removed = 0;
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  const managedRoots = managedSkillRoots(skillsDir, legacyGlobalSkillsDir);
+  const agentDirs = /* @__PURE__ */ new Set([...Object.values(agentSkillDirs), legacyGlobalSkillsDir]);
+  const expectedTarget = path2.resolve(skillsDir, safeName(skillName, skillsDir));
+  for (const agentDir of agentDirs) {
+    const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
+    const owned = options.ownership === "exact-skill-dir" ? await isManagedSymlink(linkPath, [expectedTarget]) : await isManagedSymlink(linkPath, managedRoots);
+    if (owned) {
+      await fs2.unlink(linkPath);
+      removed += 1;
+    }
+  }
+  return removed;
+}
+async function detectDeletedAgentSymlinks(cloudSkills, previousState, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const deletions = [];
+  for (const agent of EXTERNAL_AGENTS) {
+    const agentDir = agentSkillDirs[agent];
+    if (path2.resolve(agentDir) === path2.resolve(skillsDir)) {
+      continue;
+    }
+    try {
+      const dirStat = await fs2.stat(agentDir);
+      if (!dirStat.isDirectory()) {
+        continue;
+      }
+    } catch {
+      continue;
+    }
+    for (const skill of cloudSkills) {
+      if (skill.status !== "active") {
+        continue;
+      }
+      if (!skill.id || skill.id.startsWith("local-")) {
+        continue;
+      }
+      const previous = previousState.skills[skill.name];
+      if (!previous) {
+        continue;
+      }
+      const cloudTargets = normalizeAgentTargets(skill.agent_targets);
+      const previousTargets = normalizeAgentTargets(previous.agentTargets);
+      if (!cloudTargets[agent] || !previousTargets[agent]) {
+        continue;
+      }
+      let safeSkillName;
+      try {
+        safeSkillName = safeName(skill.name, skillsDir);
+      } catch {
+        continue;
+      }
+      const linkPath = path2.join(agentDir, safeName(safeSkillName, agentDir));
+      try {
+        await fs2.lstat(linkPath);
+      } catch (error) {
+        if (error?.code === "ENOENT") {
+          deletions.push({ skillId: skill.id, skillName: skill.name, agent });
+        }
+      }
+    }
+  }
+  return deletions;
+}
+async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  await fs2.mkdir(skillsDir, { recursive: true });
+  const result = {
+    linked: 0,
+    removed: 0,
+    skipped: 0
+  };
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  const managedRoots = managedSkillRoots(skillsDir, legacyGlobalSkillsDir);
+  const desiredByAgent = {
+    notis: /* @__PURE__ */ new Set(),
+    claude_code: /* @__PURE__ */ new Set(),
+    cursor: /* @__PURE__ */ new Set(),
+    codex: /* @__PURE__ */ new Set()
+  };
+  for (const skill of skills) {
+    if (skill.status !== "active") {
+      continue;
+    }
+    const safeSkillName = safeName(skill.name, skillsDir);
+    const targets = normalizeAgentTargets(skill.agent_targets);
+    if (targets.notis) {
+      desiredByAgent.notis.add(safeSkillName);
+    }
+    if (targets.claude_code) {
+      desiredByAgent.claude_code.add(safeSkillName);
+    }
+    if (targets.cursor) {
+      desiredByAgent.cursor.add(safeSkillName);
+    }
+    if (targets.codex) {
+      desiredByAgent.codex.add(safeSkillName);
+    }
+  }
+  for (const [agent, agentDir] of Object.entries(agentSkillDirs)) {
+    if (path2.resolve(agentDir) === path2.resolve(skillsDir)) {
+      result.skipped += desiredByAgent[agent].size;
+      continue;
+    }
+    await fs2.mkdir(agentDir, { recursive: true });
+    const desiredSkills = desiredByAgent[agent];
+    if (options.removeUndesired !== false) {
+      result.removed += await removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots);
+    }
+    for (const skillName of desiredSkills) {
+      const targetPath = path2.join(skillsDir, skillName);
+      const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
+      try {
+        await fs2.access(targetPath);
+      } catch {
+        result.skipped += 1;
+        continue;
+      }
+      const syncOutcome = await ensureCorrectSymlink(linkPath, targetPath);
+      if (syncOutcome === "linked") {
+        result.linked += 1;
+      } else if (syncOutcome === "blocked") {
+        console.warn(
+          `[skill-sync] Could not link "${skillName}" for ${agent}: non-symlink entry blocks ${linkPath}`
+        );
+        result.skipped += 1;
+      } else {
+        result.skipped += 1;
+      }
+    }
+  }
+  if (options.removeUndesired !== false && !Object.values(agentSkillDirs).some(
+    (agentDir) => path2.resolve(agentDir) === path2.resolve(legacyGlobalSkillsDir)
+  )) {
+    result.removed += await removeUndesiredManagedSymlinks(
+      legacyGlobalSkillsDir,
+      /* @__PURE__ */ new Set(),
+      managedRoots
+    );
+  }
+  return result;
+}
+
+// src/runtime/skill-sync/sync-plan.ts
+function getPushCandidates(localSkills, syncState, cloudCuratedSkillNames = /* @__PURE__ */ new Set(), cloudSkillNames) {
+  return localSkills.filter((skill) => {
+    if (cloudCuratedSkillNames.has(skill.name)) {
+      return false;
+    }
+    const previous = syncState.skills[skill.name];
+    if (!previous) {
+      return true;
+    }
+    if (cloudSkillNames && !cloudSkillNames.has(skill.name)) {
+      return false;
+    }
+    return previous.folderHash !== skill.folderHash;
+  });
+}
+
+// src/runtime/skill-sync/write-cloud-skill.ts
+async function writeCloudSkillWithBundleFallback(skill, dependencies) {
+  if (skill.skill_source_url) {
+    try {
+      const bundleBytes = await dependencies.downloadSkillBundle(skill.skill_source_url);
+      const wroteBundleToDisk = await dependencies.writeCloudSkillToDisk(skill, bundleBytes);
+      if (wroteBundleToDisk) {
+        return true;
+      }
+      dependencies.onWarning?.(
+        `Bundle sync for "${skill.name}" produced no local changes, falling back to SKILL.md payload.`,
+        new Error("Bundle write returned false")
+      );
+    } catch (error) {
+      dependencies.onWarning?.(
+        `Failed to apply bundle sync for "${skill.name}", falling back to SKILL.md payload.`,
+        error
+      );
+    }
+  }
+  if (skill.bundle_hydration_failed) {
+    dependencies.onWarning?.(
+      `Skipping markdown fallback for synced skill "${skill.name}" because its stored bundle could not be hydrated by the server.`,
+      new Error("Bundle hydration failed")
+    );
+    return false;
+  }
+  try {
+    return await dependencies.writeCloudSkillToDisk(skill);
+  } catch (error) {
+    dependencies.onWarning?.(
+      `Failed to write synced skill "${skill.name}" to disk.`,
+      error
+    );
+    return false;
+  }
+}
+
+// src/runtime/skill-sync/index.ts
+var BASE_SKILL_NAMES = /* @__PURE__ */ new Set(["notis-apps", "notis-query", "notis-cli"]);
+function withoutBaseSkills(pullResponse) {
+  return {
+    ...pullResponse,
+    skills: pullResponse.skills.filter((skill) => !BASE_SKILL_NAMES.has(skill.name))
+  };
+}
+function withoutBaseSkillState(state) {
+  return {
+    ...state,
+    skills: Object.fromEntries(
+      Object.entries(state.skills).filter(([name]) => !BASE_SKILL_NAMES.has(name))
+    )
+  };
+}
+var DEFAULT_RUN_SKILL_SYNC_DEPS = {
+  fetchSyncSettings,
+  pullSkills,
+  pushChangedSkills,
+  downloadSkillBundle,
+  gatherTopLevelLocalSkills,
+  readLegacySyncState,
+  readSyncState,
+  scanLocalSkills,
+  deleteLocalSkill,
+  writeCloudSkillToDisk,
+  writeSyncState,
+  removeAllSymlinksForSkill,
+  syncSymlinks,
+  detectDeletedAgentSymlinks,
+  removeForeignAccountSymlinks,
+  updateAgentTargets
+};
+function toSkillMap(skills) {
+  return new Map(skills.map((skill) => [skill.name, skill]));
+}
+function decodeJwtSubject(jwt) {
+  try {
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const decoded = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString()
+    );
+    return typeof decoded.sub === "string" && decoded.sub.trim() ? decoded.sub.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function shouldWriteCloudSkill(cloudSkill, localSkills, previousState) {
+  const skillName = cloudSkill.name;
+  const cloudHash = cloudSkill.skill_folder_hash || "";
+  const localSkill = localSkills.get(skillName);
+  if (!localSkill) {
+    return true;
+  }
+  if (cloudSkill.source === "curated") {
+    return cloudHash ? cloudHash !== localSkill.folderHash : true;
+  }
+  const previous = previousState.skills[skillName];
+  const localChangedSinceLastSync = !previous || previous.folderHash !== localSkill.folderHash;
+  return !localChangedSinceLastSync && Boolean(cloudHash) && cloudHash !== localSkill.folderHash;
+}
+function buildSyncState(pullResponse, localSkills, lastSyncedAt) {
+  const localSkillMap = toSkillMap(localSkills);
+  const skills = Object.fromEntries(
+    pullResponse.skills.map((skill) => {
+      const localSkill = localSkillMap.get(skill.name);
+      return [
+        skill.name,
+        {
+          cloudId: skill.id,
+          folderHash: localSkill?.folderHash || skill.skill_folder_hash || "",
+          agentTargets: normalizeAgentTargets(skill.agent_targets),
+          syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString()
+        }
+      ];
+    })
+  );
+  return {
+    version: 1,
+    lastSyncedAt,
+    skills
+  };
+}
+function buildLocalSymlinkCandidates(pullResponse, localSkills, previousState) {
+  const cloudSkillNames = new Set(
+    pullResponse.skills.map((skill) => skill.name)
+  );
+  const localOnlySkills = localSkills.filter((skill) => !cloudSkillNames.has(skill.name)).map((skill) => {
+    const previous = previousState.skills[skill.name];
+    return {
+      id: previous?.cloudId || `local-${skill.name}`,
+      name: skill.name,
+      description: skill.description || null,
+      skill_md: skill.skillMd,
+      agent_targets: previous?.agentTargets,
+      skill_folder_hash: skill.folderHash,
+      source: "local",
+      status: "active"
+    };
+  });
+  return [...pullResponse.skills, ...localOnlySkills];
+}
+function isEmptySyncState(state) {
+  return state.lastSyncedAt === null && Object.keys(state.skills).length === 0;
+}
+function applyLegacyFirstRunState(localSkills, scopedState, legacyState) {
+  if (!isEmptySyncState(scopedState) || !legacyState) {
+    return scopedState;
+  }
+  const migratedSkills = Object.fromEntries(
+    localSkills.flatMap((skill) => {
+      const previous = legacyState.skills[skill.name];
+      if (!previous || previous.folderHash !== skill.folderHash) {
+        return [];
+      }
+      return [[skill.name, previous]];
+    })
+  );
+  if (Object.keys(migratedSkills).length === 0) {
+    return scopedState;
+  }
+  return {
+    version: 1,
+    lastSyncedAt: legacyState.lastSyncedAt,
+    skills: migratedSkills
+  };
+}
+async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previousState, syncPaths, deps) {
+  const localSkillMap = toSkillMap(localSkills);
+  const warnSkillSync = (message, error) => {
+    console.warn(`[Notis] ${message}`, error);
+  };
+  let downloaded = 0;
+  for (const cloudSkill of pullResponse.skills) {
+    if (!shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
+      continue;
+    }
+    if (await writeCloudSkillWithBundleFallback(cloudSkill, {
+      downloadSkillBundle: deps.downloadSkillBundle,
+      writeCloudSkillToDisk: (skill, bundleBytes) => deps.writeCloudSkillToDisk(skill, bundleBytes, syncPaths),
+      onWarning: warnSkillSync
+    })) {
+      downloaded += 1;
+    }
+  }
+  return downloaded;
+}
+function assertSkillsPullAuthorized(pullResponse) {
+  if (pullResponse.entitlement_access?.code === "entitlement_upgrade_required" && pullResponse.entitlement_access.entitlement === "skills") {
+    throw new Error(
+      "Skill sync access was denied; preserving existing local skills."
+    );
+  }
+}
+async function materializeCloudSkillsForLocalShell(serverUrl, jwt, dependencies = {}, options = {}) {
+  const deps = {
+    ...DEFAULT_RUN_SKILL_SYNC_DEPS,
+    ...dependencies
+  };
+  const authUserId = decodeJwtSubject(jwt);
+  if (!authUserId) {
+    throw new Error(
+      "Cannot materialize skills without a valid authenticated desktop session."
+    );
+  }
+  const syncPaths = getSkillSyncPathsForUser(authUserId);
+  const pullResponse = await deps.pullSkills(serverUrl, jwt);
+  assertSkillsPullAuthorized(pullResponse);
+  const previousState = await deps.readSyncState(syncPaths);
+  const localSkills = await deps.scanLocalSkills(syncPaths);
+  const downloaded = await writePulledSkillsToScopedMirror(
+    pullResponse,
+    localSkills,
+    previousState,
+    syncPaths,
+    deps
+  );
+  const finalLocalSkills = await deps.scanLocalSkills(syncPaths);
+  const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
+  const relinkSkillNames = new Set(options.relinkSkillNames || []);
+  if (relinkSkillNames.size > 0) {
+    await deps.syncSymlinks(
+      pullResponse.skills.filter((skill) => relinkSkillNames.has(skill.name)),
+      syncPaths.skillsDir,
+      { removeUndesired: false }
+    );
+  }
+  await deps.writeSyncState(
+    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt),
+    syncPaths
+  );
+  return {
+    pulled: pullResponse.skills.length,
+    downloaded,
+    deleted: 0,
+    removed: 0,
+    lastSyncedAt
+  };
+}
+async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previousState, scopedState, skillsDir, deps) {
+  if (isEmptySyncState(scopedState)) {
+    return 0;
+  }
+  const deletions = await deps.detectDeletedAgentSymlinks(
+    pullResponse.skills,
+    previousState,
+    skillsDir
+  );
+  if (deletions.length === 0) {
+    return 0;
+  }
+  const latestSkillsById = new Map(pullResponse.skills.map((skill) => [skill.id, skill]));
+  let fresh = null;
+  try {
+    fresh = await deps.pullSkills(serverUrl, jwt);
+  } catch (error) {
+    console.warn(
+      "[skill-sync] Could not re-pull latest agent targets before deactivation; using the top-of-sync snapshot.",
+      error
+    );
+  }
+  if (fresh) {
+    assertSkillsPullAuthorized(fresh);
+    for (const skill of fresh.skills) {
+      latestSkillsById.set(skill.id, skill);
+    }
+  }
+  const agentsBySkill = /* @__PURE__ */ new Map();
+  for (const deletion of deletions) {
+    const entry = agentsBySkill.get(deletion.skillId) ?? {
+      skillName: deletion.skillName,
+      agents: /* @__PURE__ */ new Set()
+    };
+    entry.agents.add(deletion.agent);
+    agentsBySkill.set(deletion.skillId, entry);
+  }
+  const inMemoryById = new Map(pullResponse.skills.map((skill) => [skill.id, skill]));
+  let deactivated = 0;
+  for (const [skillId, { skillName, agents }] of agentsBySkill) {
+    const latest = latestSkillsById.get(skillId);
+    if (!latest) {
+      continue;
+    }
+    const nextTargets = { ...normalizeAgentTargets(latest.agent_targets) };
+    for (const agent of agents) {
+      nextTargets[agent] = false;
+    }
+    try {
+      await deps.updateAgentTargets(serverUrl, jwt, skillId, nextTargets);
+      const inMemory = inMemoryById.get(skillId);
+      if (inMemory) {
+        inMemory.agent_targets = nextTargets;
+      }
+      deactivated += agents.size;
+    } catch (error) {
+      console.warn(
+        `[skill-sync] Failed to deactivate "${skillName}" for ${[...agents].join(", ")} after local symlink deletion:`,
+        error
+      );
+    }
+  }
+  return deactivated;
+}
+async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
+  const deps = {
+    ...DEFAULT_RUN_SKILL_SYNC_DEPS,
+    ...dependencies
+  };
+  const syncSettings = await deps.fetchSyncSettings(
+    serverUrl,
+    jwt
+  );
+  const syncUserId = syncSettings.user_id?.trim() || decodeJwtSubject(jwt);
+  if (!syncUserId) {
+    throw new Error(
+      "Cannot sync skills without a server-verified account identity."
+    );
+  }
+  const syncPaths = getSkillSyncPathsForUser(syncUserId);
+  const foreignLinksRemoved = await deps.removeForeignAccountSymlinks(
+    syncPaths.skillsDir
+  );
+  if (options.honorSyncEnabled !== false && !syncSettings.sync_enabled) {
+    return {
+      syncEnabled: false,
+      pushed: 0,
+      pulled: 0,
+      downloaded: 0,
+      deleted: 0,
+      deactivated: 0,
+      linked: 0,
+      removed: foreignLinksRemoved,
+      skipped: 0,
+      lastSyncedAt: syncSettings.last_synced_at,
+      failedPushes: []
+    };
+  }
+  let pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+  assertSkillsPullAuthorized(pullResponse);
+  const cloudCuratedSkillNames = new Set(
+    pullResponse.skills.filter((skill) => skill.source === "curated").map((skill) => skill.name)
+  );
+  const protectedSkillNames = /* @__PURE__ */ new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES]);
+  const authUserId = decodeJwtSubject(jwt);
+  let previousAuthState = null;
+  if (authUserId && authUserId !== syncUserId) {
+    const previousAuthPaths = getSkillSyncPathsForUser(authUserId);
+    previousAuthState = await deps.readSyncState(previousAuthPaths);
+    await deps.gatherTopLevelLocalSkills(syncPaths, {
+      sourceRoots: [{ label: "previous-auth-scope", root: previousAuthPaths.skillsDir }],
+      protectedSkillNames
+    });
+  }
+  await deps.gatherTopLevelLocalSkills(syncPaths, {
+    protectedSkillNames
+  });
+  const localSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+  const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
+  const previousState = withoutBaseSkillState(applyLegacyFirstRunState(
+    localSkills,
+    scopedState,
+    isEmptySyncState(scopedState) ? !previousAuthState || isEmptySyncState(previousAuthState) ? await deps.readLegacySyncState(syncPaths) : previousAuthState : null
+  ));
+  const deactivated = await deactivateDeletedAgentSkills(
+    serverUrl,
+    jwt,
+    pullResponse,
+    previousState,
+    scopedState,
+    syncPaths.skillsDir,
+    deps
+  );
+  await deps.syncSymlinks(
+    buildLocalSymlinkCandidates(pullResponse, localSkills, previousState),
+    syncPaths.skillsDir
+  );
+  const pushCandidates = getPushCandidates(
+    localSkills,
+    previousState,
+    cloudCuratedSkillNames,
+    new Set(pullResponse.skills.map((skill) => skill.name))
+  );
+  const failedPushes = [];
+  if (pushCandidates.length > 0) {
+    const pushResult = await deps.pushChangedSkills(serverUrl, jwt, pushCandidates);
+    if (Array.isArray(pushResult?.failed) && pushResult.failed.length > 0) {
+      failedPushes.push(...pushResult.failed);
+      console.warn(
+        `[skill-sync] ${pushResult.failed.length} skill(s) were rejected during push: ` + pushResult.failed.map((f) => `${f.name} (${f.error})`).join("; ")
+      );
+    }
+    pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+    assertSkillsPullAuthorized(pullResponse);
+  }
+  const cloudSkillNames = new Set(pullResponse.skills.map((s) => s.name));
+  let deleted = 0;
+  for (const skillName of Object.keys(previousState.skills)) {
+    if (!cloudSkillNames.has(skillName)) {
+      await deps.deleteLocalSkill(skillName, syncPaths);
+      await deps.removeAllSymlinksForSkill(skillName, syncPaths.skillsDir);
+      deleted += 1;
+    }
+  }
+  const downloaded = await writePulledSkillsToScopedMirror(
+    pullResponse,
+    localSkills,
+    previousState,
+    syncPaths,
+    deps
+  );
+  const finalLocalSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+  const symlinkResult = await deps.syncSymlinks(
+    buildLocalSymlinkCandidates(pullResponse, finalLocalSkills, previousState),
+    syncPaths.skillsDir
+  );
+  const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
+  await deps.writeSyncState(
+    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt),
+    syncPaths
+  );
+  return {
+    syncEnabled: true,
+    pushed: pushCandidates.length,
+    pulled: pullResponse.skills.length,
+    downloaded,
+    deleted,
+    deactivated,
+    linked: symlinkResult.linked,
+    removed: foreignLinksRemoved + symlinkResult.removed,
+    skipped: symlinkResult.skipped,
+    lastSyncedAt,
+    failedPushes
+  };
+}
+export {
+  materializeCloudSkillsForLocalShell,
+  runSkillSync
+};
+//# sourceMappingURL=index.js.map