@notis_ai/cli 0.2.0-beta.19.1 → 0.2.0-beta.196.1

package/dist/skill-sync/index.js

@@ -0,0 +1,2143 @@
+// src/runtime/skill-sync/index.ts
+import { createHash as createHash4 } from "node:crypto";
+import { join } from "node:path";
+
+// src/runtime/skill-sync/types.ts
+var DEFAULT_AGENT_TARGETS = {
+  notis: true,
+  claude_code: true,
+  cursor: true,
+  codex: true
+};
+function normalizeAgentTargets(targets) {
+  return {
+    notis: Boolean(targets?.notis ?? DEFAULT_AGENT_TARGETS.notis),
+    claude_code: Boolean(targets?.claude_code ?? DEFAULT_AGENT_TARGETS.claude_code),
+    cursor: Boolean(targets?.cursor ?? DEFAULT_AGENT_TARGETS.cursor),
+    codex: Boolean(targets?.codex ?? DEFAULT_AGENT_TARGETS.codex)
+  };
+}
+
+// src/runtime/skill-sync/native-identity.ts
+import { createHash } from "node:crypto";
+var NATIVE_IDENTITY_FILE = ".notis-native-skill.json";
+var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+function checkedNativeReference(value, cloudId) {
+  const reference = value;
+  if (!reference || typeof reference !== "object" || Array.isArray(reference) || Object.keys(reference).sort().join(",") !== "access_revision,kind,skill_id,version" || reference.kind !== "native_standalone_skill" || !UUID.test(reference.skill_id) || cloudId !== void 0 && reference.skill_id !== cloudId || !Number.isSafeInteger(reference.access_revision) || reference.access_revision < 0 || !reference.version || Object.keys(reference.version).sort().join(",") !== "digest,revision" || !Number.isSafeInteger(reference.version.revision) || reference.version.revision < 1 || !/^[a-f0-9]{64}$/.test(reference.version.digest)) {
+    throw new Error("Native Skill identity is unavailable. Refresh before syncing.");
+  }
+  return structuredClone(reference);
+}
+function nativeDirectory(reference) {
+  return "native-" + checkedNativeReference(reference).skill_id;
+}
+function sameNativeReference(left, right) {
+  return Boolean(left && right && left.skill_id === right.skill_id && left.access_revision === right.access_revision && left.version.revision === right.version.revision && left.version.digest === right.version.digest);
+}
+function isNativeSkill(skill) {
+  return skill.source === "native" || skill.native_reference !== void 0;
+}
+function assertNativePull(response) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const skill of response.skills) {
+    if (!isNativeSkill(skill)) continue;
+    const reference = checkedNativeReference(skill.native_reference, skill.id);
+    if (response.skill_sync_protocol !== 2 || skill.name !== nativeDirectory(reference) || ids.has(skill.id) || !/^[a-f0-9]{64}$/.test(response.sync_scope || "") || skill.native_scope !== response.sync_scope || !Array.isArray(skill.bundle_files) || skill.bundle_hydration_failed || typeof skill.skill_md !== "string") {
+      throw new Error("Native Skill inventory is incomplete. Existing local files were retained.");
+    }
+    const paths = /* @__PURE__ */ new Set();
+    let entrypoint = false;
+    for (const file of skill.bundle_files) {
+      if (typeof file.path !== "string" || typeof file.content_b64 !== "string" || file.path.startsWith("/") || file.path.includes("\\") || file.path.includes("\0") || file.path.split("/").some((part) => !part || part === "." || part === "..") || paths.has(file.path.toLowerCase()) || file.path.toLowerCase() === NATIVE_IDENTITY_FILE) {
+        throw new Error("Native Skill bundle has a conflicting managed path.");
+      }
+      paths.add(file.path.toLowerCase());
+      if (file.path === "SKILL.md") {
+        entrypoint = Buffer.from(file.content_b64, "base64").equals(Buffer.from(skill.skill_md, "utf8"));
+      }
+    }
+    if (!entrypoint) throw new Error("Native Skill instructions and files do not match.");
+    ids.add(skill.id);
+  }
+}
+function nativeFileDigest(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function nativeFrontmatterName(markdown) {
+  const header = markdown.match(/^---\s*\n([\s\S]*?)\n---/);
+  return header?.[1].match(/^name\s*:\s*(.+)$/m)?.[1].trim().replace(/^['"]|['"]$/g, "") || "";
+}
+function checkedNativeIdentity(value) {
+  const identity = value;
+  if (!identity || identity.schema !== 1 || typeof identity.cloudId !== "string" || typeof identity.displayName !== "string" || typeof identity.frontmatterName !== "string" || !/^[a-f0-9]{64}$/.test(identity.scope) || !/^[a-f0-9]{64}$/.test(identity.folderHash) || !identity.files || !Object.keys(identity.files).includes("SKILL.md") || Object.entries(identity.files).some(([name, hash]) => name.startsWith("/") || name.includes("\\") || name.split("/").some((part) => !part || part === "." || part === "..") || !/^[a-f0-9]{64}$/.test(hash))) {
+    throw new Error("Native Skill provenance is incomplete. Existing files were retained.");
+  }
+  return { ...identity, reference: checkedNativeReference(identity.reference, identity.cloudId) };
+}
+function nativeState(skill) {
+  if (!isNativeSkill(skill)) return {};
+  return {
+    nativeReference: checkedNativeReference(skill.native_reference, skill.id),
+    ...skill.native_settings ? { nativeSettingsRevision: skill.native_settings.revision } : {},
+    nativeDisplayName: skill.display_name || skill.name,
+    nativeScope: skill.native_scope,
+    nativeUnavailable: false
+  };
+}
+
+// src/runtime/skill-sync/native-plan.ts
+function bindNativeFolders(response, locals, state) {
+  const nativeIds = new Set(response.skills.filter(isNativeSkill).map((skill) => skill.id));
+  for (const entry of Object.values(state.skills)) if (entry.nativeReference || entry.nativeUnavailable) nativeIds.add(entry.cloudId);
+  const byId = /* @__PURE__ */ new Map();
+  for (const local of locals) {
+    const id = local.cloudId || state.skills[local.name]?.cloudId;
+    if (!id || !nativeIds.has(id) && !local.nativeReference) continue;
+    if (local.nativeReference) checkedNativeReference(local.nativeReference, id);
+    if (byId.has(id)) throw new Error("Two local folders claim the same native Skill. Keep both copies and resolve the conflict.");
+    byId.set(id, local);
+  }
+  const skills = response.skills.map((skill) => isNativeSkill(skill) && byId.has(skill.id) ? { ...skill, name: byId.get(skill.id).name } : skill);
+  for (const skill of skills.filter(isNativeSkill)) {
+    if (skills.some((other) => other.id !== skill.id && other.name === skill.name)) {
+      throw new Error("A native Skill and another Skill share a local folder. Existing files were retained.");
+    }
+  }
+  return { ...response, skills };
+}
+function previousNativeState(state, skill) {
+  const named = state.skills[skill.name];
+  return named?.cloudId === skill.id ? named : Object.values(state.skills).find((entry) => entry.cloudId === skill.id);
+}
+function nativeLocalReady(skill, local) {
+  return Boolean(local?.nativeFilesCurrent && local.folderHash === local.nativeBaseFolderHash && local.cloudId === skill.id && local.nativeScope === skill.native_scope && sameNativeReference(local.nativeReference, skill.native_reference));
+}
+function nativeLinkRows(response, locals) {
+  return response.skills.map((skill) => isNativeSkill(skill) && !nativeLocalReady(skill, locals.find((row) => row.name === skill.name)) ? { ...skill, status: "disabled" } : skill);
+}
+function retainMissingNativeState(previous, next) {
+  const present = new Set(Object.values(next.skills).map((row) => row.cloudId));
+  const retained = Object.fromEntries(Object.entries(previous.skills).filter(([, row]) => (row.nativeReference || row.nativeUnavailable) && !present.has(row.cloudId)).map(([name, row]) => [name, { ...row, nativeUnavailable: true, verifiedAgentLinks: {} }]));
+  const history = structuredClone(previous.nativeHistory || {});
+  for (const [name, row] of [...Object.entries(previous.skills), ...Object.entries(next.skills)]) {
+    if (!row.nativeReference && !row.nativeUnavailable) continue;
+    const names = history[row.cloudId]?.names || [];
+    history[row.cloudId] = { names: [.../* @__PURE__ */ new Set([...names, name])] };
+  }
+  return {
+    ...next,
+    skills: { ...retained, ...next.skills },
+    ...Object.keys(history).length ? { nativeHistory: history } : {}
+  };
+}
+function hasNativeFolderHistory(state, name) {
+  return Object.values(state.nativeHistory || {}).some((row) => row.names.includes(name));
+}
+
+// src/runtime/skill-sync/local-scanner.ts
+import { createHash as createHash2 } from "crypto";
+import { execFile } from "child_process";
+import { promises as fs } from "fs";
+import os from "os";
+import path from "path";
+import { promisify } from "util";
+var HOME_DIR = os.homedir();
+var execFileAsync = promisify(execFile);
+var NativeSkillIdentityError = class extends Error {
+};
+var AGENTS_DIR = path.join(HOME_DIR, ".agents");
+var LEGACY_AGENTS_SKILLS_DIR = path.join(AGENTS_DIR, "skills");
+var NOTIS_SKILL_SYNC_ROOT = path.join(HOME_DIR, ".notis", "skills");
+var LEGACY_NOTIS_SYNC_STATE_PATH = path.join(
+  AGENTS_DIR,
+  ".notis-sync.json"
+);
+var AGENTS_SKILLS_DIR = LEGACY_AGENTS_SKILLS_DIR;
+var SKILL_LOCK_PATH = path.join(AGENTS_DIR, ".skill-lock.json");
+var DEFAULT_SYNC_STATE = {
+  version: 1,
+  lastSyncedAt: null,
+  skills: {}
+};
+var EXCLUDED_TOP_LEVEL_ROOT_NAMES = /* @__PURE__ */ new Set([
+  "backup",
+  "backups",
+  "builtin",
+  "builtins",
+  "cache",
+  "caches",
+  "marketplace",
+  "marketplaces",
+  "plugin",
+  "plugins",
+  "temp",
+  "tmp",
+  "worktree",
+  "worktrees"
+]);
+var DEFAULT_SYNC_PATHS = {
+  agentsDir: AGENTS_DIR,
+  syncRoot: NOTIS_SKILL_SYNC_ROOT,
+  legacySkillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  legacyScopedSkillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  legacyScopedSyncStatePath: LEGACY_NOTIS_SYNC_STATE_PATH,
+  skillsDir: LEGACY_AGENTS_SKILLS_DIR,
+  syncStatePath: LEGACY_NOTIS_SYNC_STATE_PATH,
+  skillLockPath: SKILL_LOCK_PATH,
+  gatherMetadataPath: path.join(NOTIS_SKILL_SYNC_ROOT, "skill-gather-metadata.json")
+};
+function getDefaultSyncRootForAgentsDir(resolvedAgentsDir) {
+  if (resolvedAgentsDir === path.resolve(AGENTS_DIR)) {
+    return NOTIS_SKILL_SYNC_ROOT;
+  }
+  return path.join(resolvedAgentsDir, ".notis", "skills");
+}
+function isResolvedChildPath(baseDir, candidatePath) {
+  return candidatePath.startsWith(`${baseDir}${path.sep}`);
+}
+function sanitizePathSegment(value) {
+  const raw = value.trim();
+  const sanitized = raw.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^_+|_+$/g, "");
+  if (!sanitized) {
+    throw new Error("Invalid sync user id");
+  }
+  if (sanitized === raw) {
+    return sanitized;
+  }
+  return `${sanitized}-${createHash2("sha256").update(raw).digest("hex").slice(0, 12)}`;
+}
+function getSkillSyncPathsForUser(authUserId, agentsDir = AGENTS_DIR, namespace, syncHome) {
+  const safeUserId = sanitizePathSegment(authUserId);
+  const homeDir = syncHome ? path.resolve(syncHome) : void 0;
+  const resolvedAgentsDir = homeDir ? path.join(homeDir, ".agents") : path.resolve(agentsDir);
+  const syncRoot = homeDir ? path.join(homeDir, ".notis", "skills") : getDefaultSyncRootForAgentsDir(resolvedAgentsDir);
+  const userRoot = namespace ? path.join(syncRoot, "environments", sanitizePathSegment(namespace), "users", safeUserId) : path.join(syncRoot, "users", safeUserId);
+  const legacyUserRoot = path.join(resolvedAgentsDir, "notis", "users", safeUserId);
+  return {
+    ...homeDir ? { homeDir } : {},
+    ...namespace ? { isolatedNamespace: sanitizePathSegment(namespace) } : {},
+    agentsDir: resolvedAgentsDir,
+    syncRoot,
+    legacySkillsDir: path.join(resolvedAgentsDir, "skills"),
+    legacyScopedSkillsDir: path.join(legacyUserRoot, "skills"),
+    legacyScopedSyncStatePath: path.join(legacyUserRoot, ".notis-sync.json"),
+    skillsDir: path.join(userRoot, "skills"),
+    syncStatePath: path.join(userRoot, ".notis-sync.json"),
+    skillLockPath: path.join(resolvedAgentsDir, ".skill-lock.json"),
+    gatherMetadataPath: path.join(userRoot, ".notis-gathered-skills.json")
+  };
+}
+function assertRelativeBundlePath(relativePath) {
+  const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+  if (!normalized || normalized.startsWith("../") || `/${normalized}/`.includes("/../")) {
+    throw new Error(`Invalid bundle file path: ${relativePath}`);
+  }
+  return normalized;
+}
+function stripWrappingQuotes(value) {
+  return value.replace(/^['"]|['"]$/g, "").trim();
+}
+function parseFrontMatter(skillMd) {
+  const match = skillMd.match(/^---\s*\n([\s\S]*?)\n---\s*(?:\n|$)/);
+  if (!match) {
+    return { description: "" };
+  }
+  let description = "";
+  for (const line of match[1].split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const descriptionMatch = trimmed.match(/^description\s*:\s*(.+)$/i);
+    if (descriptionMatch) {
+      description = stripWrappingQuotes(descriptionMatch[1]);
+      break;
+    }
+  }
+  return { description };
+}
+async function readJsonFile(filePath) {
+  try {
+    const raw = await fs.readFile(filePath, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+var IGNORED_SKILL_DIRECTORIES = /* @__PURE__ */ new Set(["__pycache__", ".pytest_cache"]);
+function isIgnoredSkillEntry(entry) {
+  if (entry.name === ".DS_Store") return true;
+  if (entry.isDirectory()) return IGNORED_SKILL_DIRECTORIES.has(entry.name);
+  return /\.py[co]$/i.test(entry.name);
+}
+async function listFilesRecursive(dirPath, rootPath = dirPath, strictLinks = false) {
+  const entries = await fs.readdir(dirPath, { withFileTypes: true });
+  const nested = await Promise.all(
+    entries.map(async (entry) => {
+      if (isIgnoredSkillEntry(entry) || dirPath === rootPath && entry.name === NATIVE_IDENTITY_FILE) {
+        return [];
+      }
+      const fullPath = path.join(dirPath, entry.name);
+      if (strictLinks && entry.isSymbolicLink()) throw new Error("Native Skill bundles cannot contain symbolic links.");
+      if (entry.isDirectory()) {
+        return listFilesRecursive(fullPath, rootPath, strictLinks);
+      }
+      if (entry.isFile()) {
+        return [fullPath];
+      }
+      return [];
+    })
+  );
+  return nested.flat().sort();
+}
+async function computeFolderHash(dirPath) {
+  const hash = createHash2("sha256");
+  const filePaths = await listFilesRecursive(dirPath);
+  for (const filePath of filePaths) {
+    const relativePath = path.relative(dirPath, filePath);
+    hash.update(relativePath);
+    hash.update("\0");
+    hash.update(await fs.readFile(filePath));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function resolveSkillBundleFilePath(skillDir, relativePath) {
+  const normalizedPath = assertRelativeBundlePath(relativePath);
+  const resolvedSkillDir = path.resolve(skillDir);
+  const candidatePath = path.resolve(resolvedSkillDir, normalizedPath);
+  if (candidatePath === resolvedSkillDir || !isResolvedChildPath(resolvedSkillDir, candidatePath)) {
+    throw new Error(
+      `Bundle file resolves outside the expected directory: ${relativePath}`
+    );
+  }
+  return candidatePath;
+}
+async function readSkillMdIfValid(skillDir) {
+  try {
+    await fs.readFile(path.join(skillDir, "SKILL.md"), "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function moveDirectory(sourceDir, destinationDir) {
+  await fs.mkdir(path.dirname(destinationDir), { recursive: true });
+  try {
+    await fs.rename(sourceDir, destinationDir);
+  } catch (error) {
+    if (error.code !== "EXDEV") {
+      throw error;
+    }
+    await fs.cp(sourceDir, destinationDir, {
+      recursive: true,
+      errorOnExist: true,
+      force: false
+    });
+    await fs.rm(sourceDir, { recursive: true, force: true });
+  }
+}
+async function createDirectorySymlink(targetDir, linkPath) {
+  await fs.mkdir(path.dirname(linkPath), { recursive: true });
+  await fs.symlink(path.relative(path.dirname(linkPath), targetDir), linkPath, "dir");
+}
+function backupRootFor(paths, timestamp) {
+  return path.join(paths.syncRoot, "skill-dedupe-backups", timestamp);
+}
+function relativeBackupPath(label, skillName) {
+  return path.join(
+    label.replace(/[^A-Za-z0-9_.-]+/g, "_"),
+    safeName(skillName)
+  );
+}
+function isExcludedTopLevelSkillEntry(entryName) {
+  return entryName.startsWith(".") || isTransientSkillDirectoryName(entryName) || EXCLUDED_TOP_LEVEL_ROOT_NAMES.has(entryName.toLowerCase());
+}
+function isTransientSkillDirectoryName(entryName) {
+  return /\.(?:backup|staging)-/.test(entryName);
+}
+function defaultTopLevelSkillSources(paths) {
+  const sources = [];
+  if (path.resolve(paths.legacyScopedSkillsDir) !== path.resolve(paths.skillsDir)) {
+    sources.push({
+      label: "notis-legacy-scoped",
+      root: paths.legacyScopedSkillsDir,
+      priority: 1
+    });
+  }
+  sources.push(
+    { label: "agents", root: paths.legacySkillsDir, priority: 2 },
+    {
+      label: "codex",
+      root: path.join(paths.homeDir || HOME_DIR, ".codex", "skills"),
+      priority: 3
+    },
+    {
+      label: "cursor",
+      root: path.join(paths.homeDir || HOME_DIR, ".cursor", "skills"),
+      priority: 4
+    },
+    {
+      label: "claude",
+      root: path.join(paths.homeDir || HOME_DIR, ".claude", "skills"),
+      priority: 5
+    }
+  );
+  return sources;
+}
+function isManagedTopLevelSymlinkTarget(resolvedPath, paths) {
+  const managedRoots = [
+    path.resolve(paths.skillsDir),
+    path.resolve(paths.legacySkillsDir),
+    path.resolve(paths.legacyScopedSkillsDir),
+    path.join(path.resolve(paths.syncRoot), "base"),
+    path.join(path.resolve(paths.syncRoot), "users"),
+    path.join(path.resolve(paths.agentsDir), "notis", "users")
+  ];
+  return managedRoots.some(
+    (root) => resolvedPath === root || resolvedPath.startsWith(`${root}${path.sep}`)
+  );
+}
+async function listTopLevelSkillCandidates(paths, options) {
+  const sourceRoots = options.sourceRoots ? options.sourceRoots.map((source, index) => ({
+    ...source,
+    priority: index + 1
+  })) : defaultTopLevelSkillSources(paths);
+  const candidates = [];
+  try {
+    const scopedEntries = await fs.readdir(paths.skillsDir, {
+      withFileTypes: true
+    });
+    for (const entry of scopedEntries) {
+      if (!entry.isDirectory() && !entry.isSymbolicLink() || entry.name.startsWith(".") || isTransientSkillDirectoryName(entry.name)) {
+        continue;
+      }
+      const skillDir = path.join(paths.skillsDir, entry.name);
+      let resolvedPath = path.resolve(skillDir);
+      if (entry.isSymbolicLink()) {
+        try {
+          resolvedPath = path.resolve(path.dirname(skillDir), await fs.readlink(skillDir));
+        } catch {
+          continue;
+        }
+      }
+      if (await readSkillMdIfValid(skillDir)) {
+        candidates.push({
+          name: safeName(entry.name, paths.skillsDir),
+          root: paths.skillsDir,
+          label: "notis-managed",
+          path: skillDir,
+          resolvedPath,
+          priority: 0,
+          isScoped: true,
+          isSymlink: entry.isSymbolicLink()
+        });
+      }
+    }
+  } catch {
+  }
+  for (const source of sourceRoots) {
+    let entries;
+    try {
+      entries = await fs.readdir(source.root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (isExcludedTopLevelSkillEntry(entry.name) || !entry.isDirectory() && !entry.isSymbolicLink()) {
+        continue;
+      }
+      const candidatePath = path.join(source.root, entry.name);
+      let resolvedPath;
+      try {
+        resolvedPath = entry.isSymbolicLink() ? path.resolve(
+          path.dirname(candidatePath),
+          await fs.readlink(candidatePath)
+        ) : path.resolve(candidatePath);
+      } catch {
+        continue;
+      }
+      if (entry.isSymbolicLink() && isManagedTopLevelSymlinkTarget(resolvedPath, paths)) {
+        continue;
+      }
+      if (!await readSkillMdIfValid(resolvedPath)) {
+        continue;
+      }
+      candidates.push({
+        name: safeName(entry.name, paths.skillsDir),
+        root: source.root,
+        label: source.label,
+        path: candidatePath,
+        resolvedPath,
+        priority: source.priority,
+        isScoped: false,
+        isSymlink: entry.isSymbolicLink()
+      });
+    }
+  }
+  return candidates.sort(
+    (a, b) => a.priority - b.priority || a.name.localeCompare(b.name)
+  );
+}
+async function gatherTopLevelLocalSkills(paths, options = {}) {
+  await ensureCanonicalSkillsDir(paths);
+  const protectedSkillNames = options.protectedSkillNames || /* @__PURE__ */ new Set();
+  const timestamp = options.timestamp || (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backupRoot = backupRootFor(paths, timestamp);
+  const candidates = await listTopLevelSkillCandidates(paths, options);
+  const byName = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const existing = byName.get(candidate.name) || [];
+    existing.push(candidate);
+    byName.set(candidate.name, existing);
+  }
+  let gathered = 0;
+  let backedUp = 0;
+  let skipped = 0;
+  const metadata = {
+    version: 1,
+    gatheredAt: (/* @__PURE__ */ new Date()).toISOString(),
+    skills: {}
+  };
+  for (const [skillName, skillCandidates] of byName) {
+    const protectedFromLocalGather = protectedSkillNames.has(skillName);
+    const canonical = protectedFromLocalGather ? skillCandidates.find((candidate) => candidate.isScoped) || null : skillCandidates[0];
+    const destinationName = safeName(skillName, paths.skillsDir);
+    const destinationDir = path.join(paths.skillsDir, destinationName);
+    const skippedSources = [];
+    if (!canonical) {
+      for (const candidate of skillCandidates) {
+        if (candidate.isSymlink) {
+          skipped += 1;
+          skippedSources.push(candidate.path);
+          continue;
+        }
+        const backupDir = path.join(
+          backupRoot,
+          relativeBackupPath(candidate.label, skillName)
+        );
+        try {
+          await moveDirectory(candidate.path, backupDir);
+          backedUp += 1;
+          skippedSources.push(candidate.path);
+        } catch {
+          skipped += 1;
+        }
+      }
+      metadata.skills[skillName] = {
+        canonicalPath: null,
+        skippedSources,
+        protectedFromLocalGather: true
+      };
+      continue;
+    }
+    if (!canonical.isScoped && !await pathExists(destinationDir)) {
+      try {
+        if (canonical.isSymlink) {
+          await createDirectorySymlink(canonical.resolvedPath, destinationDir);
+        } else {
+          await moveDirectory(canonical.path, destinationDir);
+        }
+        gathered += 1;
+      } catch {
+        skipped += 1;
+      }
+    }
+    for (const candidate of skillCandidates) {
+      if (candidate === canonical || candidate.isScoped) {
+        continue;
+      }
+      if (candidate.isSymlink) {
+        skippedSources.push(candidate.path);
+        continue;
+      }
+      const backupDir = path.join(
+        backupRoot,
+        relativeBackupPath(candidate.label, skillName)
+      );
+      try {
+        await moveDirectory(candidate.path, backupDir);
+        backedUp += 1;
+        skippedSources.push(candidate.path);
+      } catch {
+        skipped += 1;
+      }
+    }
+    metadata.skills[skillName] = {
+      canonicalPath: await pathExists(destinationDir) ? destinationDir : canonical.path,
+      skippedSources,
+      ...protectedFromLocalGather ? { protectedFromLocalGather: true } : {}
+    };
+  }
+  await fs.mkdir(path.dirname(paths.gatherMetadataPath), { recursive: true });
+  await fs.writeFile(
+    paths.gatherMetadataPath,
+    `${JSON.stringify(metadata, null, 2)}
+`,
+    "utf8"
+  );
+  return {
+    gathered,
+    backedUp,
+    skipped,
+    metadataPath: paths.gatherMetadataPath
+  };
+}
+async function readSkillLock(paths = DEFAULT_SYNC_PATHS) {
+  const lockData = await readJsonFile(paths.skillLockPath);
+  const sourceUrls = {};
+  for (const [skillName, entry] of Object.entries(lockData?.skills || {})) {
+    if (typeof entry?.sourceUrl === "string" && entry.sourceUrl.trim()) {
+      sourceUrls[skillName] = entry.sourceUrl.trim();
+    }
+  }
+  return sourceUrls;
+}
+async function ensureCanonicalSkillsDir(paths = DEFAULT_SYNC_PATHS) {
+  await fs.mkdir(paths.skillsDir, { recursive: true });
+}
+async function scanLocalSkills(paths = DEFAULT_SYNC_PATHS) {
+  await ensureCanonicalSkillsDir(paths);
+  const sourceUrls = await readSkillLock(paths);
+  const previousState = await readSyncState(paths);
+  const entries = await fs.readdir(paths.skillsDir, { withFileTypes: true });
+  const skills = await Promise.all(
+    entries.map(async (entry) => {
+      if (!entry.isDirectory() && !entry.isSymbolicLink() || isTransientSkillDirectoryName(entry.name)) {
+        return null;
+      }
+      const skillDir = path.join(paths.skillsDir, entry.name);
+      const skillMdPath = path.join(skillDir, "SKILL.md");
+      let marker = null;
+      try {
+        marker = await fs.readFile(path.join(skillDir, NATIVE_IDENTITY_FILE), "utf8");
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw new NativeSkillIdentityError("Native Skill provenance could not be read; existing files were retained.");
+        }
+      }
+      const knownNative = marker !== null || Boolean(previousState.skills[entry.name]?.nativeReference) || Object.values(previousState.nativeHistory || {}).some((row) => row.names.includes(entry.name));
+      try {
+        const skillMd = await fs.readFile(skillMdPath, "utf8");
+        const { description } = parseFrontMatter(skillMd);
+        const folderHash = await computeFolderHash(skillDir);
+        const skill = {
+          name: entry.name,
+          skillMd,
+          description,
+          folderHash,
+          directoryPath: skillDir
+        };
+        if (marker !== null) {
+          let identity;
+          try {
+            identity = checkedNativeIdentity(JSON.parse(marker));
+          } catch {
+            throw new NativeSkillIdentityError("Native Skill provenance is unreadable; do not upload it as a new Skill.");
+          }
+          let current = true;
+          for (const [name, expected] of Object.entries(identity.files)) {
+            try {
+              if (nativeFileDigest(await fs.readFile(resolveSkillBundleFilePath(skillDir, name))) !== expected) current = false;
+            } catch {
+              current = false;
+            }
+          }
+          const editedName = nativeFrontmatterName(skillMd);
+          Object.assign(skill, {
+            cloudId: identity.cloudId,
+            nativeReference: identity.reference,
+            nativeScope: identity.scope,
+            nativeBaseFolderHash: identity.folderHash,
+            nativeFilesCurrent: current,
+            displayName: editedName && editedName !== identity.frontmatterName ? editedName : identity.displayName
+          });
+        }
+        if (sourceUrls[entry.name]) {
+          skill.sourceUrl = sourceUrls[entry.name];
+        }
+        return skill;
+      } catch (error) {
+        if (error instanceof NativeSkillIdentityError) throw error;
+        if (knownNative) throw new NativeSkillIdentityError("Native Skill files could not be read; existing files were retained.");
+        return null;
+      }
+    })
+  );
+  return skills.filter((skill) => skill !== null).sort((a, b) => a.name.localeCompare(b.name));
+}
+function normalizeSyncState(state) {
+  if (!state || state.version !== 1 || typeof state.skills !== "object") {
+    return null;
+  }
+  if (state.nativeHistory && (typeof state.nativeHistory !== "object" || Array.isArray(state.nativeHistory) || Object.values(state.nativeHistory).some((row) => !row || !Array.isArray(row.names) || row.names.some((name) => typeof name !== "string")))) {
+    throw new Error("Native Skill sync provenance is unreadable; existing files were retained.");
+  }
+  const normalizeStoredAgentTargets = (targets) => ({
+    notis: Boolean(targets?.notis ?? true),
+    claude_code: Boolean(targets?.claude_code ?? true),
+    cursor: Boolean(targets?.cursor ?? true),
+    codex: Boolean(targets?.codex ?? true)
+  });
+  return {
+    version: 1,
+    ...state.nativeHistory ? { nativeHistory: state.nativeHistory } : {},
+    lastSyncedAt: typeof state.lastSyncedAt === "string" ? state.lastSyncedAt : null,
+    skills: Object.fromEntries(
+      Object.entries(state.skills || {}).map(([skillName, skillState]) => [
+        skillName,
+        {
+          ...skillState,
+          agentTargets: normalizeStoredAgentTargets(skillState.agentTargets)
+        }
+      ])
+    )
+  };
+}
+async function readSyncState(paths = DEFAULT_SYNC_PATHS) {
+  const scopedState = normalizeSyncState(
+    await readJsonFile(paths.syncStatePath)
+  );
+  if (scopedState) {
+    return scopedState;
+  }
+  return DEFAULT_SYNC_STATE;
+}
+async function readLegacySyncState(paths = DEFAULT_SYNC_PATHS) {
+  const legacyStatePaths = [
+    paths.legacyScopedSyncStatePath,
+    path.resolve(paths.syncStatePath) === path.resolve(LEGACY_NOTIS_SYNC_STATE_PATH) ? paths.syncStatePath : path.join(paths.agentsDir, ".notis-sync.json")
+  ];
+  for (const legacyStatePath of legacyStatePaths) {
+    const state = normalizeSyncState(
+      await readJsonFile(legacyStatePath)
+    );
+    if (state) {
+      return state;
+    }
+  }
+  return null;
+}
+async function writeSyncState(state, paths = DEFAULT_SYNC_PATHS) {
+  await fs.mkdir(path.dirname(paths.syncStatePath), { recursive: true });
+  await fs.writeFile(
+    paths.syncStatePath,
+    `${JSON.stringify(state, null, 2)}
+`,
+    "utf8"
+  );
+}
+function safeName(name, baseDir = AGENTS_SKILLS_DIR) {
+  const sanitizedName = name.trim().replace(/[\\/]+/g, "").replace(/\.\./g, "");
+  if (!sanitizedName) {
+    throw new Error("Invalid skill name");
+  }
+  const resolvedBaseDir = path.resolve(baseDir);
+  const resolvedPath = path.resolve(resolvedBaseDir, sanitizedName);
+  if (!isResolvedChildPath(resolvedBaseDir, resolvedPath)) {
+    throw new Error("Skill name resolves outside the expected directory");
+  }
+  return sanitizedName;
+}
+async function deleteLocalSkill(skillName, paths = DEFAULT_SYNC_PATHS) {
+  const skillDir = path.join(
+    paths.skillsDir,
+    safeName(skillName, paths.skillsDir)
+  );
+  try {
+    await fs.rm(skillDir, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function createZipFromDirectory(directoryPath) {
+  const zipPath = path.join(
+    os.tmpdir(),
+    `notis-skill-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
+  );
+  const directoryName = path.basename(directoryPath);
+  const stagingRoot = await fs.mkdtemp(path.join(os.tmpdir(), "notis-skill-bundle-"));
+  try {
+    const stagedDir = path.join(stagingRoot, directoryName);
+    for (const filePath of await listFilesRecursive(directoryPath)) {
+      const target = path.join(stagedDir, path.relative(directoryPath, filePath));
+      await fs.mkdir(path.dirname(target), { recursive: true });
+      await fs.copyFile(filePath, target);
+    }
+    await fs.mkdir(stagedDir, { recursive: true });
+    if (process.platform === "win32") {
+      const systemTar = path.join(
+        process.env.SystemRoot || "C:\\Windows",
+        "System32",
+        "tar.exe"
+      );
+      if (await pathExists(systemTar)) {
+        await execFileAsync(systemTar, [
+          "-c",
+          "--format",
+          "zip",
+          "-f",
+          zipPath,
+          "-C",
+          stagingRoot,
+          directoryName
+        ]);
+        return zipPath;
+      }
+      await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        `Compress-Archive -Path '${stagedDir.replace(/'/g, "''")}' -DestinationPath '${zipPath.replace(/'/g, "''")}' -Force`
+      ]);
+      return zipPath;
+    }
+    await execFileAsync("zip", ["-qry", zipPath, directoryName], {
+      cwd: stagingRoot
+    });
+    return zipPath;
+  } finally {
+    await fs.rm(stagingRoot, { recursive: true, force: true });
+  }
+}
+async function extractZipToDirectory(zipPath, destinationDir) {
+  const extractRoot = await fs.mkdtemp(
+    path.join(os.tmpdir(), "notis-skill-extract-")
+  );
+  try {
+    if (process.platform === "win32") {
+      await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        `Expand-Archive -Path '${zipPath.replace(/'/g, "''")}' -DestinationPath '${extractRoot.replace(/'/g, "''")}' -Force`
+      ]);
+    } else {
+      await execFileAsync("unzip", ["-qq", zipPath, "-d", extractRoot]);
+    }
+    const extractedEntries = await fs.readdir(extractRoot, {
+      withFileTypes: true
+    });
+    const extractedDirectory = extractedEntries.find(
+      (entry) => entry.isDirectory()
+    );
+    const sourceDir = extractedDirectory ? path.join(extractRoot, extractedDirectory.name) : extractRoot;
+    await fs.rm(destinationDir, { recursive: true, force: true });
+    await fs.mkdir(path.dirname(destinationDir), { recursive: true });
+    await fs.cp(sourceDir, destinationDir, { recursive: true });
+    return await listRelativeFiles(destinationDir);
+  } finally {
+    await fs.rm(extractRoot, { recursive: true, force: true });
+  }
+}
+async function listRelativeFiles(dirPath) {
+  try {
+    const files = await listFilesRecursive(dirPath);
+    return files.map((filePath) => toPosixRelativePath(dirPath, filePath)).sort();
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  }
+}
+function toPosixRelativePath(rootDir, filePath) {
+  return path.relative(rootDir, filePath).split(path.sep).join("/");
+}
+async function preserveUnmanagedFiles(existingDir, stagingDir, previouslyApplied, strictConflicts = false) {
+  const managed = previouslyApplied ? new Set(previouslyApplied) : null;
+  for (const existingFile of await listFilesRecursive(existingDir)) {
+    const relativePath = toPosixRelativePath(existingDir, existingFile);
+    if (managed?.has(relativePath)) continue;
+    const stagedPath = path.join(stagingDir, ...relativePath.split("/"));
+    if (await pathExists(stagedPath)) {
+      if (strictConflicts && !(await fs.readFile(existingFile)).equals(await fs.readFile(stagedPath))) {
+        throw new Error("An incoming native Skill file conflicts with a local file. Local files were retained.");
+      }
+      continue;
+    }
+    await fs.mkdir(path.dirname(stagedPath), { recursive: true });
+    await fs.copyFile(existingFile, stagedPath);
+  }
+}
+async function pathExists(targetPath) {
+  try {
+    await fs.access(targetPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function replaceSkillDirectoryAtomically(skillDir, populateDir, preserve) {
+  const parentDir = path.dirname(skillDir);
+  const skillName = path.basename(skillDir);
+  await fs.mkdir(parentDir, { recursive: true });
+  const stagingDir = await fs.mkdtemp(
+    path.join(parentDir, `${skillName}.staging-`)
+  );
+  const backupDir = path.join(
+    parentDir,
+    `${skillName}.backup-${Date.now()}-${Math.random().toString(36).slice(2)}`
+  );
+  let movedExisting = false;
+  let promotedStaging = false;
+  let cleanupError = null;
+  try {
+    if (preserve?.native && preserve.expectedFolderHash === void 0) {
+      let existing = false;
+      try {
+        await fs.lstat(skillDir);
+        existing = true;
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      if (existing) throw new Error("Existing native Skill files need a readable baseline before replacement.");
+    }
+    if (preserve?.expectedFolderHash !== void 0 && (!await pathExists(skillDir) || await computeFolderHash(skillDir) !== preserve.expectedFolderHash)) {
+      throw new Error("Local Skill files changed before sync; the newer local edits were retained.");
+    }
+    await populateDir(stagingDir);
+    if (preserve && await pathExists(skillDir)) {
+      await preserveUnmanagedFiles(skillDir, stagingDir, preserve.previouslyApplied, preserve.native);
+    }
+    if (preserve?.native) {
+      const markerPath = path.join(stagingDir, NATIVE_IDENTITY_FILE);
+      const marker = checkedNativeIdentity(JSON.parse(await fs.readFile(markerPath, "utf8")));
+      marker.folderHash = await computeFolderHash(stagingDir);
+      await fs.writeFile(markerPath, JSON.stringify(marker), { mode: 384 });
+    }
+    if (preserve?.expectedFolderHash !== void 0 && (!await pathExists(skillDir) || await computeFolderHash(skillDir) !== preserve.expectedFolderHash)) {
+      throw new Error("Local Skill files changed during sync; the newer local edits were retained.");
+    }
+    if (await pathExists(skillDir)) {
+      await fs.rename(skillDir, backupDir);
+      movedExisting = true;
+      if (preserve?.native && preserve.expectedFolderHash === void 0) {
+        throw new Error("Native Skill files appeared during sync; existing files were retained.");
+      }
+      if (preserve?.expectedFolderHash !== void 0 && await computeFolderHash(backupDir) !== preserve.expectedFolderHash) {
+        throw new Error("Local Skill files changed before publication; the newer local edits were retained.");
+      }
+    }
+    await fs.rename(stagingDir, skillDir);
+    promotedStaging = true;
+  } catch (error) {
+    if (movedExisting && !promotedStaging && await pathExists(backupDir)) {
+      await fs.rename(backupDir, skillDir);
+    }
+    throw error;
+  } finally {
+    if (!promotedStaging && await pathExists(stagingDir)) {
+      await fs.rm(stagingDir, { recursive: true, force: true });
+    }
+    if ((promotedStaging || !movedExisting) && await pathExists(backupDir)) {
+      try {
+        await fs.rm(backupDir, { recursive: true, force: true });
+      } catch (error) {
+        if (!cleanupError) {
+          cleanupError = error instanceof Error ? error : new Error(String(error));
+        }
+      }
+    }
+    if (cleanupError) {
+      console.warn(
+        `[Notis] Failed to clean up temporary skill directory backup for "${skillDir}"`,
+        cleanupError
+      );
+    }
+  }
+}
+function bundleFilesIncludeSkillMd(bundleFiles) {
+  return bundleFiles.some((bundleFile) => {
+    const basename = path.basename(bundleFile.path).toLowerCase();
+    return basename === "skill.md" || basename === "skills.md";
+  });
+}
+async function createSkillBundleBase64(skill) {
+  const zipPath = await createZipFromDirectory(skill.directoryPath);
+  try {
+    const zipBytes = await fs.readFile(zipPath);
+    return zipBytes.toString("base64");
+  } finally {
+    await fs.rm(zipPath, { force: true });
+  }
+}
+async function captureNativeSkillFiles(skill) {
+  const hash = createHash2("sha256");
+  const files = [];
+  for (const filePath of await listFilesRecursive(skill.directoryPath, skill.directoryPath, true)) {
+    const relative = path.relative(skill.directoryPath, filePath);
+    const bytes = await fs.readFile(filePath);
+    hash.update(relative);
+    hash.update("\0");
+    hash.update(bytes);
+    hash.update("\0");
+    files.push({ path: relative.split(path.sep).join("/"), content_b64: bytes.toString("base64") });
+  }
+  if (hash.digest("hex") !== skill.folderHash) throw new Error("Local Skill files changed before upload. Sync again with the current files.");
+  return files;
+}
+async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PATHS, options = {}) {
+  if (isNativeSkill(skill)) {
+    assertNativePull({
+      skills: [{ ...skill, name: "native-" + skill.id }],
+      skill_sync_protocol: 2,
+      sync_scope: skill.native_scope,
+      sync_enabled: true,
+      last_synced_at: null
+    });
+    if (bundleBytes?.length) throw new Error("Native Skills require their verified complete file response.");
+  }
+  const skillDir = path.join(
+    paths.skillsDir,
+    safeName(skill.name, paths.skillsDir)
+  );
+  const preserve = {
+    previouslyApplied: options.previouslyApplied,
+    expectedFolderHash: options.expectedFolderHash,
+    native: isNativeSkill(skill)
+  };
+  if (bundleBytes?.length) {
+    const bundlePath = path.join(
+      os.tmpdir(),
+      `notis-skill-download-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
+    );
+    try {
+      await fs.writeFile(bundlePath, bundleBytes);
+      let appliedFiles = [];
+      await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+        appliedFiles = await extractZipToDirectory(bundlePath, stagingDir);
+      }, preserve);
+      return { written: true, appliedFiles };
+    } finally {
+      await fs.rm(bundlePath, { force: true });
+    }
+  }
+  if (!skill.skill_md && (!skill.bundle_files || skill.bundle_files.length === 0)) {
+    return false;
+  }
+  if (skill.bundle_files && skill.bundle_files.length > 0) {
+    if (!bundleFilesIncludeSkillMd(skill.bundle_files)) {
+      throw new Error(
+        `Synced bundle for "${skill.name}" is missing SKILL.md or SKILLS.md`
+      );
+    }
+    const appliedFiles = [];
+    await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+      for (const bundleFile of skill.bundle_files || []) {
+        const filePath = resolveSkillBundleFilePath(
+          stagingDir,
+          bundleFile.path
+        );
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        await fs.writeFile(
+          filePath,
+          Buffer.from(bundleFile.content_b64, "base64")
+        );
+        appliedFiles.push(toPosixRelativePath(stagingDir, filePath));
+      }
+      if (skill.native_reference) {
+        const identity = {
+          schema: 1,
+          cloudId: skill.id,
+          reference: skill.native_reference,
+          displayName: skill.display_name || skill.name,
+          frontmatterName: nativeFrontmatterName(skill.skill_md || ""),
+          scope: skill.native_scope,
+          folderHash: await computeFolderHash(stagingDir),
+          files: Object.fromEntries((skill.bundle_files || []).map((file) => [file.path, nativeFileDigest(Buffer.from(file.content_b64, "base64"))]))
+        };
+        await fs.writeFile(path.join(stagingDir, NATIVE_IDENTITY_FILE), JSON.stringify(identity), { mode: 384 });
+        appliedFiles.push(NATIVE_IDENTITY_FILE);
+      }
+    }, preserve);
+    return { written: true, appliedFiles: appliedFiles.sort() };
+  }
+  await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+    await fs.writeFile(
+      path.join(stagingDir, "SKILL.md"),
+      skill.skill_md ?? "",
+      "utf8"
+    );
+  }, preserve);
+  return { written: true, appliedFiles: ["SKILL.md"] };
+}
+
+// src/runtime/skill-sync/cloud-client.ts
+import { createHash as createHash3 } from "node:crypto";
+async function requestJson(url, jwt, options = {}) {
+  const response = await fetch(url, {
+    signal: AbortSignal.timeout(9e4),
+    method: options.method || "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${jwt}`
+    },
+    body: options.body ? JSON.stringify(options.body) : void 0
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`${options.method || "POST"} ${url} \u2192 ${response.status}: ${text}`);
+  }
+  return response.json();
+}
+async function fetchSyncSettings(serverUrl, jwt) {
+  return requestJson(`${serverUrl}/portal_skills/sync-settings`, jwt, {
+    body: {}
+  });
+}
+async function pullSkills(serverUrl, jwt) {
+  return requestJson(`${serverUrl}/portal_skills/sync-pull`, jwt, {
+    body: { skill_sync_protocol: 2 }
+  });
+}
+async function pushChangedSkills(serverUrl, jwt, changedSkills) {
+  const payloadSkills = await Promise.all(changedSkills.map(async (skill) => ({
+    name: skill.name,
+    description: skill.description,
+    skill_md: skill.skillMd,
+    source_url: skill.sourceUrl,
+    folder_hash: skill.folderHash,
+    ...skill.nativeReference ? { bundle_files: await captureNativeSkillFiles(skill) } : { bundle_base64: await createSkillBundleBase64(skill) },
+    ...skill.cloudId ? { cloud_id: skill.cloudId } : {},
+    ...skill.nativeReference ? {
+      native_reference: skill.nativeReference,
+      display_name: skill.displayName,
+      native_scope: skill.nativeScope
+    } : {}
+  })));
+  return requestJson(`${serverUrl}/portal_skills/sync-push`, jwt, {
+    body: {
+      skill_sync_protocol: 2,
+      skills: payloadSkills
+    }
+  });
+}
+async function downloadSkillBundle(bundleUrl) {
+  const response = await fetch(bundleUrl, { signal: AbortSignal.timeout(9e4) });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`GET ${bundleUrl} \u2192 ${response.status}: ${text}`);
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+async function updateAgentTargets(serverUrl, jwt, skillId, targets, expectedUpdatedAt, native) {
+  if (native) {
+    checkedNativeReference(native.reference, skillId);
+    if (!Number.isSafeInteger(native.settingsRevision) || native.settingsRevision < 0) throw new Error("Refresh native Skill settings before changing assignments.");
+    const payload = {
+      operation: "update",
+      target: { skill_id: skillId, access_revision: native.reference.access_revision },
+      revision: native.settingsRevision,
+      patch: { agent_targets: Object.fromEntries(Object.entries(targets).sort(([a], [b]) => a.localeCompare(b))) }
+    };
+    const requestId = "sync-settings-" + createHash3("sha256").update(JSON.stringify(payload)).digest("hex");
+    const saved = await requestJson(
+      `${serverUrl}/portal_skills/native-settings`,
+      jwt,
+      { body: { ...payload, request_id: requestId } }
+    );
+    const current = saved.current || saved;
+    if (saved.skill_id !== skillId || typeof saved.receipt_id !== "string" || !saved.receipt_id || current.target?.skill_id !== skillId || !current.settings) throw new Error("Native assignment update was not confirmed.");
+    return { success: true, agent_targets: current.settings.agent_targets, updated_at: current.settings.updated_at };
+  }
+  return requestJson(`${serverUrl}/portal_skills/agent-targets`, jwt, {
+    method: "PATCH",
+    body: {
+      skill_id: skillId,
+      agent_targets: targets,
+      ...expectedUpdatedAt ? { expected_updated_at: expectedUpdatedAt } : {}
+    }
+  });
+}
+
+// src/runtime/skill-sync/symlink-manager.ts
+import { promises as fs2 } from "fs";
+import os2 from "os";
+import path2 from "path";
+var HOME_DIR2 = os2.homedir();
+var EXTERNAL_AGENT_SKILL_DIRS = {
+  claude_code: path2.join(HOME_DIR2, ".claude", "skills"),
+  cursor: path2.join(HOME_DIR2, ".cursor", "skills"),
+  codex: path2.join(HOME_DIR2, ".codex", "skills")
+};
+var EXTERNAL_AGENTS = Object.keys(EXTERNAL_AGENT_SKILL_DIRS);
+var AGENT_FAILURE_LABELS = {
+  claude_code: "Claude Code",
+  cursor: "Cursor",
+  codex: "Codex",
+  legacy: "legacy ~/.agents/skills"
+};
+function agentFailureLabel(agent) {
+  return AGENT_FAILURE_LABELS[agent] ?? agent;
+}
+function agentFolderFailureName(agent) {
+  return `${agentFailureLabel(agent)} skills folder`;
+}
+async function removeForeignAccountSymlinks(skillsDir, options = {}) {
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const currentRoot = path2.resolve(skillsDir);
+  const foreignCapableRoots = [
+    path2.join(path2.resolve(NOTIS_SKILL_SYNC_ROOT), "users"),
+    path2.join(path2.resolve(AGENTS_DIR), "notis", "users"),
+    path2.dirname(path2.dirname(currentRoot))
+  ];
+  let removed = 0;
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  for (const agentDir of /* @__PURE__ */ new Set([...Object.values(agentSkillDirs), legacyGlobalSkillsDir])) {
+    let entries;
+    try {
+      entries = await fs2.readdir(agentDir, { withFileTypes: true });
+    } catch (error) {
+      if (error?.code === "ENOENT") continue;
+      throw error;
+    }
+    for (const entry of entries) {
+      if (!entry.isSymbolicLink()) continue;
+      const entryPath = path2.join(agentDir, entry.name);
+      try {
+        const target = await fs2.readlink(entryPath);
+        const resolvedTarget = path2.resolve(path2.dirname(entryPath), target);
+        const belongsToAnyAccount = foreignCapableRoots.some((root) => resolvedTarget.startsWith(`${root}${path2.sep}`));
+        const belongsToCurrentAccount = resolvedTarget === currentRoot || resolvedTarget.startsWith(`${currentRoot}${path2.sep}`);
+        if (belongsToAnyAccount && !belongsToCurrentAccount) {
+          await fs2.unlink(entryPath);
+          removed += 1;
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") throw error;
+      }
+    }
+  }
+  return removed;
+}
+function managedSkillRoots(skillsDir, legacyGlobalSkillsDir = LEGACY_AGENTS_SKILLS_DIR) {
+  const resolvedSkillsDir = path2.resolve(skillsDir);
+  const scopedUsersRoot = path2.dirname(path2.dirname(resolvedSkillsDir));
+  const roots = [
+    resolvedSkillsDir,
+    path2.resolve(legacyGlobalSkillsDir),
+    path2.join(path2.resolve(NOTIS_SKILL_SYNC_ROOT), "users"),
+    path2.join(path2.resolve(AGENTS_DIR), "notis", "users")
+  ];
+  if (path2.basename(scopedUsersRoot) === "users") {
+    roots.push(scopedUsersRoot);
+  }
+  return roots;
+}
+async function isManagedSymlink(linkPath, managedRoots) {
+  try {
+    const stats = await fs2.lstat(linkPath);
+    if (!stats.isSymbolicLink()) {
+      return false;
+    }
+    const target = await fs2.readlink(linkPath);
+    const resolvedTarget = path2.resolve(path2.dirname(linkPath), target);
+    return managedRoots.some((root) => resolvedTarget === root || resolvedTarget.startsWith(`${root}${path2.sep}`));
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
+  }
+}
+async function ensureCorrectSymlink(linkPath, targetPath) {
+  try {
+    const stats = await fs2.lstat(linkPath);
+    if (stats.isSymbolicLink()) {
+      const currentTarget = await fs2.readlink(linkPath);
+      const resolvedTarget = path2.resolve(path2.dirname(linkPath), currentTarget);
+      if (resolvedTarget === targetPath) {
+        return "skipped";
+      }
+      await fs2.unlink(linkPath);
+    } else {
+      return "blocked";
+    }
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
+  }
+  const relativePath = path2.relative(path2.dirname(linkPath), targetPath);
+  await fs2.symlink(relativePath, linkPath);
+  return "linked";
+}
+function defaultAgentSkillDirs(skillsDir) {
+  return {
+    notis: skillsDir,
+    ...EXTERNAL_AGENT_SKILL_DIRS
+  };
+}
+async function removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, failures, agent) {
+  let removed = 0;
+  try {
+    await fs2.mkdir(agentDir, { recursive: true });
+    const existingEntries = await fs2.readdir(agentDir, { withFileTypes: true });
+    for (const entry of existingEntries) {
+      const entryPath = path2.join(agentDir, entry.name);
+      try {
+        if (!desiredSkills.has(entry.name) && await isManagedSymlink(entryPath, managedRoots)) {
+          await fs2.unlink(entryPath);
+          removed += 1;
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") {
+          failures.push({ name: entry.name, error: `${agentFailureLabel(agent)}: could not remove skill link (${error.message})` });
+        }
+      }
+    }
+  } catch (error) {
+    failures.push({ name: agentFolderFailureName(agent), error: `Could not read agent skills directory (${error.message})` });
+  }
+  return removed;
+}
+async function removeAllSymlinksForSkill(skillName, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  let removed = 0;
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  const managedRoots = managedSkillRoots(skillsDir, legacyGlobalSkillsDir);
+  const agentDirs = /* @__PURE__ */ new Set([...Object.values(agentSkillDirs), legacyGlobalSkillsDir]);
+  const expectedTarget = path2.resolve(skillsDir, safeName(skillName, skillsDir));
+  for (const agentDir of agentDirs) {
+    const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
+    const owned = options.ownership === "exact-skill-dir" ? await isManagedSymlink(linkPath, [expectedTarget]) : await isManagedSymlink(linkPath, managedRoots);
+    if (owned) {
+      await fs2.unlink(linkPath);
+      removed += 1;
+    }
+  }
+  return removed;
+}
+async function detectDeletedAgentSymlinks(cloudSkills, previousState, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const deletions = [];
+  for (const agent of EXTERNAL_AGENTS) {
+    const agentDir = agentSkillDirs[agent];
+    if (path2.resolve(agentDir) === path2.resolve(skillsDir)) {
+      continue;
+    }
+    try {
+      const dirStat = await fs2.stat(agentDir);
+      if (!dirStat.isDirectory()) {
+        continue;
+      }
+    } catch {
+      continue;
+    }
+    for (const skill of cloudSkills) {
+      if (skill.status !== "active") {
+        continue;
+      }
+      if (!skill.id || skill.id.startsWith("local-")) {
+        continue;
+      }
+      const previous = previousState.skills[skill.name];
+      if (!previous || previous.cloudId !== skill.id || previous.verifiedAgentLinks?.[agent] !== true || !skill.updated_at || previous.cloudUpdatedAt !== skill.updated_at) {
+        continue;
+      }
+      const cloudTargets = normalizeAgentTargets(skill.agent_targets);
+      const previousTargets = normalizeAgentTargets(previous.agentTargets);
+      if (!cloudTargets[agent] || !previousTargets[agent]) {
+        continue;
+      }
+      let safeSkillName;
+      try {
+        safeSkillName = safeName(skill.name, skillsDir);
+      } catch {
+        continue;
+      }
+      const linkPath = path2.join(agentDir, safeName(safeSkillName, agentDir));
+      try {
+        await fs2.lstat(linkPath);
+      } catch (error) {
+        if (error?.code === "ENOENT") {
+          deletions.push({ skillId: skill.id, skillName: skill.name, agent });
+        }
+      }
+    }
+  }
+  return deletions;
+}
+async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, options = {}) {
+  await fs2.mkdir(skillsDir, { recursive: true });
+  const result = {
+    linked: 0,
+    removed: 0,
+    skipped: 0,
+    verifiedAgentLinks: {},
+    failures: []
+  };
+  const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
+  const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
+  const managedRoots = managedSkillRoots(skillsDir, legacyGlobalSkillsDir);
+  const desiredByAgent = {
+    notis: /* @__PURE__ */ new Set(),
+    claude_code: /* @__PURE__ */ new Set(),
+    cursor: /* @__PURE__ */ new Set(),
+    codex: /* @__PURE__ */ new Set()
+  };
+  for (const skill of skills) {
+    if (skill.status !== "active") {
+      continue;
+    }
+    const safeSkillName = safeName(skill.name, skillsDir);
+    const targets = normalizeAgentTargets(skill.agent_targets);
+    if (targets.notis) {
+      desiredByAgent.notis.add(safeSkillName);
+    }
+    if (targets.claude_code) {
+      desiredByAgent.claude_code.add(safeSkillName);
+    }
+    if (targets.cursor) {
+      desiredByAgent.cursor.add(safeSkillName);
+    }
+    if (targets.codex) {
+      desiredByAgent.codex.add(safeSkillName);
+    }
+  }
+  for (const [agent, agentDir] of Object.entries(agentSkillDirs)) {
+    if (path2.resolve(agentDir) === path2.resolve(skillsDir)) {
+      result.skipped += desiredByAgent[agent].size;
+      continue;
+    }
+    try {
+      await fs2.mkdir(agentDir, { recursive: true });
+    } catch (error) {
+      result.failures.push({ name: agentFolderFailureName(agent), error: `Could not create agent skills directory (${error.message})` });
+      continue;
+    }
+    const desiredSkills = desiredByAgent[agent];
+    if (options.removeUndesired !== false) {
+      result.removed += await removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, result.failures, agent);
+    }
+    for (const skillName of desiredSkills) {
+      const targetPath = path2.join(skillsDir, skillName);
+      const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
+      try {
+        if (!(await fs2.stat(path2.join(targetPath, "SKILL.md"))).isFile()) throw new Error("Missing SKILL.md");
+      } catch {
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: SKILL.md is missing or unreadable` });
+        continue;
+      }
+      let syncOutcome;
+      try {
+        syncOutcome = await ensureCorrectSymlink(linkPath, targetPath);
+      } catch (error) {
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: could not create skill link (${error.message})` });
+        continue;
+      }
+      if (syncOutcome === "linked") {
+        result.linked += 1;
+      } else if (syncOutcome === "blocked") {
+        console.warn(
+          `[skill-sync] Could not link "${skillName}" for ${agent}: non-symlink entry blocks ${linkPath}`
+        );
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: an existing file or folder blocks the skill link` });
+      } else {
+        result.skipped += 1;
+      }
+      if (syncOutcome !== "blocked") {
+        result.verifiedAgentLinks[skillName] = { ...result.verifiedAgentLinks[skillName], [agent]: true };
+      }
+    }
+  }
+  if (options.removeUndesired !== false && !Object.values(agentSkillDirs).some(
+    (agentDir) => path2.resolve(agentDir) === path2.resolve(legacyGlobalSkillsDir)
+  )) {
+    result.removed += await removeUndesiredManagedSymlinks(
+      legacyGlobalSkillsDir,
+      /* @__PURE__ */ new Set(),
+      managedRoots,
+      result.failures,
+      "legacy"
+    );
+  }
+  return result;
+}
+
+// src/runtime/skill-sync/sync-plan.ts
+function selectCloudSkillsToApply(skills) {
+  const winners = /* @__PURE__ */ new Map();
+  for (const skill of skills) {
+    const current = winners.get(skill.name);
+    if (!current || (skill.updated_at || "") >= (current.updated_at || "")) {
+      winners.set(skill.name, skill);
+    }
+  }
+  return [...winners.values()];
+}
+function getPushCandidates(localSkills, syncState, cloudCuratedSkillNames = /* @__PURE__ */ new Set(), cloudSkillNames, cloudSkills = []) {
+  return localSkills.filter((skill) => {
+    if (cloudCuratedSkillNames.has(skill.name)) {
+      return false;
+    }
+    const previous = syncState.skills[skill.name] || (skill.cloudId ? Object.values(syncState.skills).find((row) => row.cloudId === skill.cloudId) : void 0);
+    const native = cloudSkills.find((row) => isNativeSkill(row) && row.id === (skill.cloudId || previous?.cloudId));
+    if (native || skill.nativeReference || previous?.nativeReference || previous?.nativeUnavailable) {
+      return Boolean(native && skill.nativeReference && skill.nativeScope === native.native_scope && (previous ? previous.folderHash !== skill.folderHash : skill.nativeBaseFolderHash !== skill.folderHash));
+    }
+    if (!previous) {
+      if (hasNativeFolderHistory(syncState, skill.name) || /^native-[a-f0-9-]{36}$/.test(skill.name)) return false;
+      return true;
+    }
+    if (cloudSkillNames && !cloudSkillNames.has(skill.name)) {
+      return false;
+    }
+    return previous.folderHash !== skill.folderHash;
+  }).map((skill) => {
+    const previous = syncState.skills[skill.name] || Object.values(syncState.skills).find((row) => row.cloudId === skill.cloudId);
+    return { ...skill, ...skill.cloudId || previous?.cloudId ? { cloudId: skill.cloudId || previous.cloudId } : {} };
+  });
+}
+
+// src/runtime/skill-sync/write-cloud-skill.ts
+async function writeCloudSkillWithBundleFallback(skill, dependencies) {
+  if (skill.skill_source_url) {
+    try {
+      const bundleBytes = await dependencies.downloadSkillBundle(skill.skill_source_url);
+      const wroteBundleToDisk = await dependencies.writeCloudSkillToDisk(skill, bundleBytes);
+      if (wroteBundleToDisk) {
+        return wroteBundleToDisk;
+      }
+      dependencies.onWarning?.(
+        `Bundle sync for "${skill.name}" produced no local changes, falling back to SKILL.md payload.`,
+        new Error("Bundle write returned false")
+      );
+    } catch (error) {
+      dependencies.onWarning?.(
+        `Failed to apply bundle sync for "${skill.name}", falling back to SKILL.md payload.`,
+        error
+      );
+    }
+  }
+  if (skill.bundle_hydration_failed) {
+    dependencies.onWarning?.(
+      `Skipping markdown fallback for synced skill "${skill.name}" because its stored bundle could not be hydrated by the server.`,
+      new Error("Bundle hydration failed")
+    );
+    return false;
+  }
+  try {
+    return await dependencies.writeCloudSkillToDisk(skill);
+  } catch (error) {
+    dependencies.onWarning?.(
+      `Failed to write synced skill "${skill.name}" to disk.`,
+      error
+    );
+    return false;
+  }
+}
+
+// src/runtime/skill-sync/index.ts
+var BASE_SKILL_NAMES = /* @__PURE__ */ new Set(["notis-apps", "notis-query", "notis-cli"]);
+function withoutBaseSkills(pullResponse) {
+  return {
+    ...pullResponse,
+    skills: pullResponse.skills.filter((skill) => !BASE_SKILL_NAMES.has(skill.name))
+  };
+}
+function withoutBaseSkillState(state) {
+  return {
+    ...state,
+    skills: Object.fromEntries(
+      Object.entries(state.skills).filter(([name]) => !BASE_SKILL_NAMES.has(name))
+    )
+  };
+}
+var DEFAULT_RUN_SKILL_SYNC_DEPS = {
+  fetchSyncSettings,
+  pullSkills,
+  pushChangedSkills,
+  downloadSkillBundle,
+  gatherTopLevelLocalSkills,
+  readLegacySyncState,
+  readSyncState,
+  scanLocalSkills,
+  deleteLocalSkill,
+  writeCloudSkillToDisk,
+  writeSyncState,
+  removeAllSymlinksForSkill,
+  syncSymlinks,
+  detectDeletedAgentSymlinks,
+  removeForeignAccountSymlinks,
+  updateAgentTargets
+};
+function isolatedLinkOptions(paths) {
+  if (!paths.isolatedNamespace && !paths.homeDir) return void 0;
+  const root = paths.isolatedNamespace ? join(paths.syncRoot, "environments", paths.isolatedNamespace, "agents") : paths.homeDir;
+  return {
+    agentSkillDirs: {
+      notis: paths.skillsDir,
+      claude_code: join(root, ".claude", "skills"),
+      cursor: join(root, ".cursor", "skills"),
+      codex: join(root, ".codex", "skills")
+    },
+    legacyGlobalSkillsDir: join(root, ".agents", "skills")
+  };
+}
+function assertSyncEnvironment(pull, settings) {
+  if ((pull.sync_namespace || null) !== (settings.sync_namespace || null) || settings.sync_scope !== void 0 && pull.sync_scope !== settings.sync_scope) {
+    throw new Error("Skill sync environment changed. Existing mirrors were retained.");
+  }
+}
+function toSkillMap(skills) {
+  return new Map(skills.map((skill) => [skill.name, skill]));
+}
+function decodeJwtSubject(jwt) {
+  try {
+    const parts = jwt.split(".");
+    if (parts.length !== 3) return null;
+    const decoded = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString()
+    );
+    return typeof decoded.sub === "string" && decoded.sub.trim() ? decoded.sub.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function cloudContentHash(skill) {
+  return createHash4("sha256").update(JSON.stringify({
+    md: skill.skill_md,
+    hash: skill.skill_folder_hash,
+    source: skill.skill_source_url,
+    files: skill.bundle_files?.slice().sort((a, b) => a.path.localeCompare(b.path)),
+    hydrationFailed: skill.bundle_hydration_failed === true
+  })).digest("hex");
+}
+function shouldWriteCloudSkill(cloudSkill, localSkills, previousState) {
+  const skillName = cloudSkill.name;
+  const cloudHash = cloudSkill.skill_folder_hash || "";
+  const localSkill = localSkills.get(skillName);
+  if (!localSkill) {
+    return true;
+  }
+  if (isNativeSkill(cloudSkill)) {
+    if (localSkill.nativeScope && localSkill.nativeScope !== cloudSkill.native_scope) return false;
+    if (nativeLocalReady(cloudSkill, localSkill)) return false;
+    const nativePrevious = previousNativeState(previousState, cloudSkill);
+    return localSkill.nativeFilesCurrent === true && localSkill.folderHash === localSkill.nativeBaseFolderHash || !localSkill.nativeReference && nativePrevious?.cloudId === cloudSkill.id && nativePrevious.folderHash === localSkill.folderHash;
+  }
+  const previous = previousState.skills[skillName];
+  if (previous?.folderHash === localSkill.folderHash && previous.cloudContentHash === cloudContentHash(cloudSkill)) return false;
+  if (previous && previous.cloudContentHash === void 0 && previous.cloudId === cloudSkill.id && previous.appliedCloudFolderHash !== void 0 && previous.appliedCloudFolderHash === cloudHash && previous.cloudUpdatedAt === cloudSkill.updated_at && previous.folderHash === localSkill.folderHash) {
+    return false;
+  }
+  if (cloudSkill.source === "curated") {
+    return cloudHash ? cloudHash !== localSkill.folderHash : true;
+  }
+  const localChangedSinceLastSync = !previous || previous.folderHash !== localSkill.folderHash;
+  return !localChangedSinceLastSync && (Boolean(cloudHash) && cloudHash !== localSkill.folderHash || Boolean(previous?.cloudContentHash && previous.cloudContentHash !== cloudContentHash(cloudSkill)));
+}
+function collectAppliedCloudRevisions(pullResponse, previousState, writtenSkillNames) {
+  const applied = {};
+  for (const skill of selectCloudSkillsToApply(pullResponse.skills)) {
+    applied[skill.name] = writtenSkillNames.has(skill.name) ? skill.skill_folder_hash || "" : previousState.skills[skill.name]?.appliedCloudFolderHash;
+  }
+  return applied;
+}
+function collectAppliedFiles(pullResponse, previousState, appliedFilesByName) {
+  const applied = {};
+  for (const skill of selectCloudSkillsToApply(pullResponse.skills)) {
+    applied[skill.name] = appliedFilesByName[skill.name] ?? previousState.skills[skill.name]?.appliedFiles;
+  }
+  return applied;
+}
+function buildSyncState(pullResponse, localSkills, lastSyncedAt, verifiedAgentLinks = {}, failedContentNames = /* @__PURE__ */ new Set(), appliedRevisions = {}, appliedFiles = {}, previousState = { version: 1, lastSyncedAt: null, skills: {} }) {
+  const localSkillMap = toSkillMap(localSkills);
+  const skills = Object.fromEntries(
+    selectCloudSkillsToApply(pullResponse.skills).map((skill) => {
+      const localSkill = localSkillMap.get(skill.name);
+      const appliedCloudFolderHash = appliedRevisions[skill.name];
+      const appliedFileList = appliedFiles[skill.name];
+      if (isNativeSkill(skill) && !nativeLocalReady(skill, localSkill)) {
+        const previous = previousNativeState(previousState, skill);
+        return [skill.name, { ...previous || {
+          cloudId: skill.id,
+          folderHash: localSkill?.nativeBaseFolderHash || "",
+          agentTargets: normalizeAgentTargets(skill.agent_targets),
+          syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString(),
+          ...localSkill?.nativeReference ? { nativeReference: localSkill.nativeReference, nativeScope: localSkill.nativeScope } : {}
+        }, nativeUnavailable: true, verifiedAgentLinks: {} }];
+      }
+      return [
+        skill.name,
+        {
+          cloudId: skill.id,
+          ...nativeState(skill),
+          folderHash: localSkill?.folderHash || skill.skill_folder_hash || "",
+          agentTargets: normalizeAgentTargets(skill.agent_targets),
+          verifiedAgentLinks: skill.status === "active" ? verifiedAgentLinks[skill.name] ?? {} : {},
+          cloudUpdatedAt: skill.updated_at,
+          ...!failedContentNames.has(skill.name) && !skill.skill_source_url ? { cloudContentHash: cloudContentHash(skill) } : {},
+          ...appliedCloudFolderHash !== void 0 ? { appliedCloudFolderHash } : {},
+          ...appliedFileList !== void 0 ? { appliedFiles: appliedFileList } : {},
+          syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString()
+        }
+      ];
+    })
+  );
+  for (const local of localSkills) {
+    if (!local.nativeReference || Object.values(skills).some((row) => row.cloudId === local.cloudId)) continue;
+    skills[local.name] = {
+      cloudId: local.cloudId,
+      nativeReference: local.nativeReference,
+      nativeScope: local.nativeScope,
+      nativeUnavailable: true,
+      verifiedAgentLinks: {},
+      folderHash: local.nativeBaseFolderHash || "",
+      agentTargets: normalizeAgentTargets(),
+      syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  return retainMissingNativeState(previousState, {
+    version: 1,
+    lastSyncedAt,
+    skills
+  });
+}
+function buildLocalSymlinkCandidates(pullResponse, localSkills, previousState) {
+  const cloudSkillNames = new Set(
+    pullResponse.skills.map((skill) => skill.name)
+  );
+  const localOnlySkills = localSkills.filter((skill) => !cloudSkillNames.has(skill.name)).filter((skill) => !skill.nativeReference && !previousState.skills[skill.name]?.nativeReference && !previousState.skills[skill.name]?.nativeUnavailable && !hasNativeFolderHistory(previousState, skill.name) && !/^native-[a-f0-9-]{36}$/.test(skill.name)).map((skill) => {
+    const previous = previousState.skills[skill.name];
+    return {
+      id: previous?.cloudId || `local-${skill.name}`,
+      name: skill.name,
+      description: skill.description || null,
+      skill_md: skill.skillMd,
+      agent_targets: previous?.agentTargets,
+      skill_folder_hash: skill.folderHash,
+      source: "local",
+      status: "active"
+    };
+  });
+  return [...nativeLinkRows(pullResponse, localSkills), ...localOnlySkills];
+}
+function isEmptySyncState(state) {
+  return state.lastSyncedAt === null && Object.keys(state.skills).length === 0;
+}
+function applyLegacyFirstRunState(localSkills, scopedState, legacyState) {
+  if (!isEmptySyncState(scopedState) || !legacyState) {
+    return scopedState;
+  }
+  const migratedSkills = Object.fromEntries(
+    localSkills.flatMap((skill) => {
+      const previous = legacyState.skills[skill.name];
+      if (!previous || previous.folderHash !== skill.folderHash) {
+        return [];
+      }
+      return [[skill.name, previous]];
+    })
+  );
+  if (Object.keys(migratedSkills).length === 0) {
+    return scopedState;
+  }
+  return {
+    version: 1,
+    lastSyncedAt: legacyState.lastSyncedAt,
+    skills: migratedSkills
+  };
+}
+async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previousState, syncPaths, deps, failures = [], writtenSkillNames = /* @__PURE__ */ new Set(), appliedFilesByName = {}, acknowledgedNative = /* @__PURE__ */ new Map()) {
+  const localSkillMap = toSkillMap(localSkills);
+  const warnSkillSync = (message, error) => {
+    console.warn(`[Notis] ${message}`, error);
+  };
+  let downloaded = 0;
+  for (const cloudSkill of selectCloudSkillsToApply(pullResponse.skills)) {
+    const local = localSkillMap.get(cloudSkill.name);
+    const acknowledged = isNativeSkill(cloudSkill) && local && acknowledgedNative.get(cloudSkill.id) === local.folderHash;
+    if (!acknowledged && !shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
+      if (isNativeSkill(cloudSkill) && !nativeLocalReady(cloudSkill, local)) {
+        failures.push({ name: cloudSkill.name, error: "Local native Skill changes were retained; resolve the version or identity conflict before using them." });
+      }
+      continue;
+    }
+    const outcome = await writeCloudSkillWithBundleFallback(cloudSkill, {
+      downloadSkillBundle: deps.downloadSkillBundle,
+      writeCloudSkillToDisk: (skill, bundleBytes) => deps.writeCloudSkillToDisk(skill, bundleBytes, syncPaths, {
+        // What the last write put there. Everything else in the folder was
+        // produced locally and survives this one.
+        previouslyApplied: previousNativeState(previousState, skill)?.appliedFiles,
+        ...isNativeSkill(skill) && local ? { expectedFolderHash: local.folderHash } : {}
+      }),
+      onWarning: warnSkillSync
+    });
+    if (outcome) {
+      downloaded += 1;
+      writtenSkillNames.add(cloudSkill.name);
+      if (typeof outcome === "object" && Array.isArray(outcome.appliedFiles)) {
+        appliedFilesByName[cloudSkill.name] = outcome.appliedFiles;
+      }
+    } else {
+      failures.push({ name: cloudSkill.name, error: "Skill content could not be downloaded or written; sync will retry" });
+    }
+  }
+  return downloaded;
+}
+function assertSkillsPullAuthorized(pullResponse) {
+  if (!Array.isArray(pullResponse.skills)) throw new Error("Skill inventory is unavailable; existing files were retained.");
+  assertNativePull(pullResponse);
+  if (pullResponse.entitlement_access?.code === "entitlement_upgrade_required" && pullResponse.entitlement_access.entitlement === "skills") {
+    throw new Error(
+      "Skill sync access was denied; preserving existing local skills."
+    );
+  }
+}
+async function materializeCloudSkillsForLocalShell(serverUrl, jwt, dependencies = {}, options = {}) {
+  const deps = {
+    ...DEFAULT_RUN_SKILL_SYNC_DEPS,
+    ...dependencies
+  };
+  const authUserId = decodeJwtSubject(jwt);
+  if (!authUserId) {
+    throw new Error(
+      "Cannot materialize skills without a valid authenticated desktop session."
+    );
+  }
+  let pullResponse = await deps.pullSkills(serverUrl, jwt);
+  assertSkillsPullAuthorized(pullResponse);
+  if (options.syncSettings) assertSyncEnvironment(pullResponse, options.syncSettings);
+  const syncPaths = getSkillSyncPathsForUser(options.canonicalUserId?.trim() || authUserId, void 0, pullResponse.sync_namespace);
+  const previousState = await deps.readSyncState(syncPaths);
+  const localSkills = await deps.scanLocalSkills(syncPaths);
+  pullResponse = bindNativeFolders(pullResponse, localSkills, previousState);
+  const failedDownloads = [];
+  const writtenSkillNames = /* @__PURE__ */ new Set();
+  const appliedFilesByName = {};
+  const downloaded = await writePulledSkillsToScopedMirror(
+    pullResponse,
+    localSkills,
+    previousState,
+    syncPaths,
+    deps,
+    failedDownloads,
+    writtenSkillNames,
+    appliedFilesByName
+  );
+  const finalLocalSkills = await deps.scanLocalSkills(syncPaths);
+  const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
+  const relinkSkillNames = new Set(options.relinkSkillNames || []);
+  const failures = [...failedDownloads];
+  const verifiedLinks = {};
+  for (const skill of pullResponse.skills) {
+    const previous = previousState.skills[skill.name];
+    if (skill.updated_at && previous?.cloudId === skill.id && previous.cloudUpdatedAt === skill.updated_at) {
+      verifiedLinks[skill.name] = { ...previous.verifiedAgentLinks };
+    }
+  }
+  if (relinkSkillNames.size > 0) {
+    const relinked = await deps.syncSymlinks(
+      nativeLinkRows(pullResponse, finalLocalSkills).filter((skill) => relinkSkillNames.has(skill.name)),
+      syncPaths.skillsDir,
+      { ...isolatedLinkOptions(syncPaths), removeUndesired: false }
+    );
+    failures.push(...(relinked.failures ?? []).filter(
+      (failure) => !failedDownloads.some((download) => download.name === failure.name)
+    ));
+    for (const name of relinkSkillNames) {
+      verifiedLinks[name] = relinked.verifiedAgentLinks?.[name] ?? {};
+    }
+  }
+  for (const failure of failedDownloads) delete verifiedLinks[failure.name];
+  const materializedState = buildSyncState(
+    pullResponse,
+    finalLocalSkills,
+    lastSyncedAt,
+    verifiedLinks,
+    new Set(failedDownloads.map((item) => item.name)),
+    collectAppliedCloudRevisions(pullResponse, previousState, writtenSkillNames),
+    collectAppliedFiles(pullResponse, previousState, appliedFilesByName),
+    previousState
+  );
+  for (const [name, entry] of Object.entries(materializedState.skills)) {
+    if (writtenSkillNames.has(name)) continue;
+    const previous = previousState.skills[name];
+    if (previous) {
+      entry.folderHash = previous.folderHash;
+      entry.cloudContentHash = previous.cloudContentHash;
+    } else {
+      delete materializedState.skills[name];
+    }
+  }
+  materializedState.skills = { ...previousState.skills, ...materializedState.skills };
+  let removed = 0;
+  for (const [name, previous] of Object.entries(previousState.skills)) {
+    if (!previous.nativeReference && !previous.nativeUnavailable) continue;
+    const current = pullResponse.skills.find((skill) => skill.id === previous.cloudId);
+    if (!current || !nativeLocalReady(current, finalLocalSkills.find((local) => local.name === current.name))) {
+      removed += await deps.removeAllSymlinksForSkill(name, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
+    }
+  }
+  await deps.writeSyncState(materializedState, syncPaths);
+  return {
+    materializedSkillNames: pullResponse.skills.filter((skill) => finalLocalSkills.some((local) => local.name === skill.name) && (!isNativeSkill(skill) || skill.status === "active" && skill.agent_targets?.notis !== false && nativeLocalReady(skill, finalLocalSkills.find((local) => local.name === skill.name))) && !failedDownloads.some((failure) => failure.name === skill.name)).map((skill) => skill.name),
+    pulled: pullResponse.skills.length,
+    downloaded,
+    deleted: 0,
+    removed,
+    lastSyncedAt,
+    ...failures.length ? { failedLinks: failures } : {}
+  };
+}
+async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previousState, scopedState, skillsDir, deps, failures, linkOptions) {
+  if (isEmptySyncState(scopedState)) {
+    return 0;
+  }
+  const deletions = await deps.detectDeletedAgentSymlinks(
+    pullResponse.skills.map((skill) => {
+      const previous = isNativeSkill(skill) ? Object.entries(previousState.skills).find(([, row]) => row.cloudId === skill.id) : void 0;
+      return previous ? { ...skill, name: previous[0] } : skill;
+    }),
+    previousState,
+    skillsDir,
+    linkOptions
+  );
+  if (deletions.length === 0) {
+    return 0;
+  }
+  const agentsBySkill = /* @__PURE__ */ new Map();
+  for (const deletion of deletions) {
+    const entry = agentsBySkill.get(deletion.skillId) ?? {
+      skillName: deletion.skillName,
+      agents: /* @__PURE__ */ new Set()
+    };
+    entry.agents.add(deletion.agent);
+    agentsBySkill.set(deletion.skillId, entry);
+  }
+  const fresh = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+  assertSkillsPullAuthorized(fresh);
+  assertSyncEnvironment(fresh, pullResponse);
+  Object.assign(pullResponse, fresh);
+  let needsRefresh = false;
+  let deactivated = 0;
+  for (const [skillId, { skillName, agents }] of agentsBySkill) {
+    const skill = pullResponse.skills.find((item) => item.id === skillId);
+    const previous = previousState.skills[skillName];
+    if (!skill) continue;
+    const native = isNativeSkill(skill);
+    if (native) {
+      if (!skill.native_settings || previous?.nativeSettingsRevision !== skill.native_settings.revision) continue;
+    } else if (!skill.updated_at || previous?.cloudUpdatedAt !== skill.updated_at) continue;
+    const patch = Object.fromEntries([...agents].map((agent) => [agent, false]));
+    try {
+      const saved = await deps.updateAgentTargets(
+        serverUrl,
+        jwt,
+        skillId,
+        patch,
+        native ? void 0 : skill.updated_at,
+        native ? { reference: skill.native_reference, settingsRevision: skill.native_settings.revision } : void 0
+      );
+      if (saved.success !== true || !saved.updated_at?.trim() || !native && saved.updated_at === skill.updated_at || !["notis", "claude_code", "cursor", "codex"].every((agent) => typeof saved.agent_targets?.[agent] === "boolean") || ![...agents].every((agent) => saved.agent_targets[agent] === false)) {
+        throw new Error("Assignment update did not return a verified saved revision");
+      }
+      skill.agent_targets = saved.agent_targets;
+      skill.updated_at = saved.updated_at;
+      if (native) needsRefresh = true;
+      deactivated += agents.size;
+    } catch (error) {
+      needsRefresh = true;
+      failures.push({ name: skillName, error: "Could not save the local agent removal; refreshed saved assignments" });
+      console.warn(`[skill-sync] Assignment changed or could not be saved for "${skillName}"; refreshing before reconciliation.`, error);
+    }
+  }
+  if (needsRefresh) {
+    const refreshed = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+    assertSkillsPullAuthorized(refreshed);
+    assertSyncEnvironment(refreshed, pullResponse);
+    Object.assign(pullResponse, refreshed);
+  }
+  return deactivated;
+}
+async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
+  const deps = {
+    ...DEFAULT_RUN_SKILL_SYNC_DEPS,
+    ...dependencies
+  };
+  const syncSettings = await deps.fetchSyncSettings(
+    serverUrl,
+    jwt
+  );
+  const syncUserId = syncSettings.user_id?.trim() || decodeJwtSubject(jwt);
+  if (!syncUserId) {
+    throw new Error(
+      "Cannot sync skills without a server-verified account identity."
+    );
+  }
+  const syncPaths = getSkillSyncPathsForUser(syncUserId, void 0, syncSettings.sync_namespace, options.syncHome);
+  if (options.honorSyncEnabled !== false && !syncSettings.sync_enabled) {
+    const foreignLinksRemoved2 = await deps.removeForeignAccountSymlinks(
+      syncPaths.skillsDir,
+      isolatedLinkOptions(syncPaths)
+    );
+    return {
+      syncEnabled: false,
+      pushed: 0,
+      pulled: 0,
+      downloaded: 0,
+      deleted: 0,
+      deactivated: 0,
+      linked: 0,
+      removed: foreignLinksRemoved2,
+      skipped: 0,
+      lastSyncedAt: syncSettings.last_synced_at,
+      failedPushes: []
+    };
+  }
+  let pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+  assertSkillsPullAuthorized(pullResponse);
+  assertSyncEnvironment(pullResponse, syncSettings);
+  const foreignLinksRemoved = await deps.removeForeignAccountSymlinks(
+    syncPaths.skillsDir,
+    isolatedLinkOptions(syncPaths)
+  );
+  const cloudCuratedSkillNames = new Set(
+    pullResponse.skills.filter((skill) => skill.source === "curated").map((skill) => skill.name)
+  );
+  const protectedSkillNames = /* @__PURE__ */ new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES]);
+  const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
+  const assignmentFailures = [];
+  const deactivated = !syncPaths.isolatedNamespace && syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
+    serverUrl,
+    jwt,
+    pullResponse,
+    scopedState,
+    scopedState,
+    syncPaths.skillsDir,
+    deps,
+    assignmentFailures,
+    isolatedLinkOptions(syncPaths)
+  ) : 0;
+  assertSyncEnvironment(pullResponse, syncSettings);
+  const authUserId = decodeJwtSubject(jwt);
+  let previousAuthState = null;
+  if (!syncPaths.isolatedNamespace && authUserId && authUserId !== syncUserId) {
+    const previousAuthPaths = getSkillSyncPathsForUser(authUserId, void 0, void 0, options.syncHome);
+    previousAuthState = await deps.readSyncState(previousAuthPaths);
+    await deps.gatherTopLevelLocalSkills(syncPaths, {
+      sourceRoots: [{ label: "previous-auth-scope", root: previousAuthPaths.skillsDir }],
+      protectedSkillNames
+    });
+  }
+  if (!syncPaths.isolatedNamespace) {
+    await deps.gatherTopLevelLocalSkills(syncPaths, { protectedSkillNames });
+  }
+  const localSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+  const previousState = withoutBaseSkillState(applyLegacyFirstRunState(
+    localSkills,
+    scopedState,
+    !syncPaths.isolatedNamespace && isEmptySyncState(scopedState) ? !previousAuthState || isEmptySyncState(previousAuthState) ? await deps.readLegacySyncState(syncPaths) : previousAuthState : null
+  ));
+  pullResponse = bindNativeFolders(pullResponse, localSkills, previousState);
+  const gatheredSymlinkResult = await deps.syncSymlinks(
+    buildLocalSymlinkCandidates(pullResponse, localSkills, previousState),
+    syncPaths.skillsDir,
+    isolatedLinkOptions(syncPaths)
+  );
+  const pushCandidates = getPushCandidates(
+    localSkills,
+    previousState,
+    cloudCuratedSkillNames,
+    new Set(pullResponse.skills.map((skill) => skill.name)),
+    pullResponse.skills
+  );
+  const failedPushes = [];
+  const acknowledgedNative = /* @__PURE__ */ new Map();
+  let writeLocalSkills = localSkills;
+  if (pushCandidates.length > 0) {
+    const pushResult = await deps.pushChangedSkills(serverUrl, jwt, pushCandidates);
+    for (const result of pushResult.skills || []) {
+      const saved = result;
+      const candidate = pushCandidates.find((local) => local.nativeReference && local.cloudId === saved.id);
+      if (candidate && saved.native_reference) {
+        checkedNativeReference(saved.native_reference, candidate.cloudId);
+        acknowledgedNative.set(candidate.cloudId, candidate.folderHash);
+      }
+    }
+    if (Array.isArray(pushResult?.failed) && pushResult.failed.length > 0) {
+      failedPushes.push(...pushResult.failed);
+      console.warn(
+        `[skill-sync] ${pushResult.failed.length} skill(s) were rejected during push: ` + pushResult.failed.map((f) => `${f.name} (${f.error})`).join("; ")
+      );
+    }
+    pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+    assertSkillsPullAuthorized(pullResponse);
+    assertSyncEnvironment(pullResponse, syncSettings);
+    writeLocalSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+    pullResponse = bindNativeFolders(pullResponse, writeLocalSkills, previousState);
+  }
+  const cloudSkillNames = new Set(pullResponse.skills.map((s) => s.name));
+  let deleted = 0;
+  for (const skillName of Object.keys(previousState.skills)) {
+    if (!cloudSkillNames.has(skillName)) {
+      const previous = previousState.skills[skillName];
+      if (previous.nativeReference || previous.nativeUnavailable || pullResponse.skills.some((skill) => isNativeSkill(skill) && skill.id === previous.cloudId)) {
+        await deps.removeAllSymlinksForSkill(skillName, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
+        continue;
+      }
+      await deps.deleteLocalSkill(skillName, syncPaths);
+      await deps.removeAllSymlinksForSkill(skillName, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
+      deleted += 1;
+    }
+  }
+  const failedDownloads = [];
+  const writtenSkillNames = /* @__PURE__ */ new Set();
+  const appliedFilesByName = {};
+  const downloaded = await writePulledSkillsToScopedMirror(
+    pullResponse,
+    writeLocalSkills,
+    previousState,
+    syncPaths,
+    deps,
+    failedDownloads,
+    writtenSkillNames,
+    appliedFilesByName,
+    acknowledgedNative
+  );
+  const finalLocalSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+  const symlinkResult = await deps.syncSymlinks(
+    buildLocalSymlinkCandidates(pullResponse, finalLocalSkills, previousState),
+    syncPaths.skillsDir,
+    isolatedLinkOptions(syncPaths)
+  );
+  const verifiedLinks = { ...symlinkResult.verifiedAgentLinks ?? {} };
+  for (const failure of failedDownloads) delete verifiedLinks[failure.name];
+  const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
+  await deps.writeSyncState(
+    buildSyncState(
+      pullResponse,
+      finalLocalSkills,
+      lastSyncedAt,
+      verifiedLinks,
+      new Set(failedDownloads.map((item) => item.name)),
+      collectAppliedCloudRevisions(pullResponse, previousState, writtenSkillNames),
+      collectAppliedFiles(pullResponse, previousState, appliedFilesByName),
+      previousState
+    ),
+    syncPaths
+  );
+  return {
+    syncEnabled: true,
+    pushed: pushCandidates.length,
+    pulled: pullResponse.skills.length,
+    downloaded,
+    deleted,
+    deactivated,
+    linked: gatheredSymlinkResult.linked + symlinkResult.linked,
+    removed: foreignLinksRemoved + gatheredSymlinkResult.removed + symlinkResult.removed,
+    skipped: symlinkResult.skipped,
+    failedLinks: [...assignmentFailures, ...failedDownloads, ...(symlinkResult.failures ?? []).filter(
+      (failure) => !failedDownloads.some((download) => download.name === failure.name)
+    )],
+    lastSyncedAt,
+    failedPushes
+  };
+}
+export {
+  fetchSyncSettings,
+  isolatedLinkOptions,
+  materializeCloudSkillsForLocalShell,
+  runSkillSync,
+  shouldWriteCloudSkill
+};
+//# sourceMappingURL=index.js.map