@notis_ai/cli 0.2.17 → 0.2.19

package/dist/skill-sync/index.js

@@ -1,3 +1,8 @@
+// src/runtime/skill-sync/index.ts
+import { createHash as createHash4 } from "node:crypto";
+import { promises as fs3 } from "node:fs";
+import { dirname, join } from "node:path";
+
 // src/runtime/skill-sync/types.ts
 var DEFAULT_AGENT_TARGETS = {
   notis: true,
@@ -14,8 +19,133 @@ function normalizeAgentTargets(targets) {
   };
 }
 
+// src/runtime/skill-sync/native-identity.ts
+import { createHash } from "node:crypto";
+var NATIVE_IDENTITY_FILE = ".notis-native-skill.json";
+var UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+function checkedNativeReference(value, cloudId) {
+  const reference = value;
+  if (!reference || typeof reference !== "object" || Array.isArray(reference) || Object.keys(reference).sort().join(",") !== "access_revision,kind,skill_id,version" || reference.kind !== "native_standalone_skill" || !UUID.test(reference.skill_id) || cloudId !== void 0 && reference.skill_id !== cloudId || !Number.isSafeInteger(reference.access_revision) || reference.access_revision < 0 || !reference.version || Object.keys(reference.version).sort().join(",") !== "digest,revision" || !Number.isSafeInteger(reference.version.revision) || reference.version.revision < 1 || !/^[a-f0-9]{64}$/.test(reference.version.digest)) {
+    throw new Error("Native Skill identity is unavailable. Refresh before syncing.");
+  }
+  return structuredClone(reference);
+}
+function nativeDirectory(reference) {
+  return "native-" + checkedNativeReference(reference).skill_id;
+}
+function sameNativeReference(left, right) {
+  return Boolean(left && right && left.skill_id === right.skill_id && left.access_revision === right.access_revision && left.version.revision === right.version.revision && left.version.digest === right.version.digest);
+}
+function isNativeSkill(skill) {
+  return skill.source === "native" || skill.native_reference !== void 0;
+}
+function assertNativePull(response) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const skill of response.skills) {
+    if (!isNativeSkill(skill)) continue;
+    const reference = checkedNativeReference(skill.native_reference, skill.id);
+    if (response.skill_sync_protocol !== 2 || skill.name !== nativeDirectory(reference) || ids.has(skill.id) || !/^[a-f0-9]{64}$/.test(response.sync_scope || "") || skill.native_scope !== response.sync_scope || !Array.isArray(skill.bundle_files) || skill.bundle_hydration_failed || typeof skill.skill_md !== "string") {
+      throw new Error("Native Skill inventory is incomplete. Existing local files were retained.");
+    }
+    const paths = /* @__PURE__ */ new Set();
+    let entrypoint = false;
+    for (const file of skill.bundle_files) {
+      if (typeof file.path !== "string" || typeof file.content_b64 !== "string" || file.path.startsWith("/") || file.path.includes("\\") || file.path.includes("\0") || file.path.split("/").some((part) => !part || part === "." || part === "..") || paths.has(file.path.toLowerCase()) || file.path.toLowerCase() === NATIVE_IDENTITY_FILE) {
+        throw new Error("Native Skill bundle has a conflicting managed path.");
+      }
+      paths.add(file.path.toLowerCase());
+      if (file.path === "SKILL.md") {
+        entrypoint = Buffer.from(file.content_b64, "base64").equals(Buffer.from(skill.skill_md, "utf8"));
+      }
+    }
+    if (!entrypoint) throw new Error("Native Skill instructions and files do not match.");
+    ids.add(skill.id);
+  }
+}
+function nativeFileDigest(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function nativeFrontmatterName(markdown) {
+  const header = markdown.match(/^---\s*\n([\s\S]*?)\n---/);
+  return header?.[1].match(/^name\s*:\s*(.+)$/m)?.[1].trim().replace(/^['"]|['"]$/g, "") || "";
+}
+function checkedNativeIdentity(value) {
+  const identity = value;
+  if (!identity || identity.schema !== 1 || typeof identity.cloudId !== "string" || typeof identity.displayName !== "string" || typeof identity.frontmatterName !== "string" || !/^[a-f0-9]{64}$/.test(identity.scope) || !/^[a-f0-9]{64}$/.test(identity.folderHash) || !identity.files || !Object.keys(identity.files).includes("SKILL.md") || Object.entries(identity.files).some(([name, hash]) => name.startsWith("/") || name.includes("\\") || name.split("/").some((part) => !part || part === "." || part === "..") || !/^[a-f0-9]{64}$/.test(hash))) {
+    throw new Error("Native Skill provenance is incomplete. Existing files were retained.");
+  }
+  return { ...identity, reference: checkedNativeReference(identity.reference, identity.cloudId) };
+}
+function nativeState(skill) {
+  if (!isNativeSkill(skill)) return {};
+  return {
+    nativeReference: checkedNativeReference(skill.native_reference, skill.id),
+    ...skill.native_settings ? { nativeSettingsRevision: skill.native_settings.revision } : {},
+    nativeDisplayName: skill.display_name || skill.name,
+    nativeScope: skill.native_scope,
+    nativeUnavailable: false
+  };
+}
+
+// src/runtime/skill-sync/native-plan.ts
+function bindNativeFolders(response, locals, state) {
+  const nativeIds = new Set(response.skills.filter(isNativeSkill).map((skill) => skill.id));
+  for (const entry of Object.values(state.skills)) if (entry.nativeReference || entry.nativeUnavailable) nativeIds.add(entry.cloudId);
+  const byId = /* @__PURE__ */ new Map();
+  for (const local of locals) {
+    const id = local.cloudId || state.skills[local.name]?.cloudId;
+    if (!id || !nativeIds.has(id) && !local.nativeReference) continue;
+    if (local.nativeReference) checkedNativeReference(local.nativeReference, id);
+    if (byId.has(id)) throw new Error("Two local folders claim the same native Skill. Keep both copies and resolve the conflict.");
+    byId.set(id, local);
+  }
+  const skills = response.skills.map((skill) => isNativeSkill(skill) && byId.has(skill.id) ? { ...skill, name: byId.get(skill.id).name } : skill);
+  for (const skill of skills.filter(isNativeSkill)) {
+    if (skills.some((other) => other.id !== skill.id && other.name === skill.name)) {
+      throw new Error("A native Skill and another Skill share a local folder. Existing files were retained.");
+    }
+  }
+  return { ...response, skills };
+}
+function previousNativeState(state, skill) {
+  const named = state.skills[skill.name];
+  return named?.cloudId === skill.id ? named : Object.values(state.skills).find((entry) => entry.cloudId === skill.id);
+}
+function nativeLocalReady(skill, local) {
+  return Boolean(local?.nativeFilesCurrent && local.folderHash === local.nativeBaseFolderHash && local.cloudId === skill.id && local.nativeScope === skill.native_scope && sameNativeReference(local.nativeReference, skill.native_reference));
+}
+function pendingLegacyUpgrade(skill, local, state) {
+  if (!isNativeSkill(skill) || !local || local.nativeReference || local.cloudId) return false;
+  const previous = previousNativeState(state, skill);
+  return Boolean(previous && !previous.nativeReference);
+}
+function nativeLinkRows(response, locals, state) {
+  return response.skills.map((skill) => {
+    const local = locals.find((row) => row.name === skill.name);
+    return isNativeSkill(skill) && !nativeLocalReady(skill, local) && !(state && pendingLegacyUpgrade(skill, local, state)) ? { ...skill, status: "disabled" } : skill;
+  });
+}
+function retainMissingNativeState(previous, next) {
+  const present = new Set(Object.values(next.skills).map((row) => row.cloudId));
+  const retained = Object.fromEntries(Object.entries(previous.skills).filter(([, row]) => (row.nativeReference || row.nativeUnavailable) && !present.has(row.cloudId)).map(([name, row]) => [name, { ...row, nativeUnavailable: true, verifiedAgentLinks: {} }]));
+  const history = structuredClone(previous.nativeHistory || {});
+  for (const [name, row] of [...Object.entries(previous.skills), ...Object.entries(next.skills)]) {
+    if (!row.nativeReference && !row.nativeUnavailable) continue;
+    const names = history[row.cloudId]?.names || [];
+    history[row.cloudId] = { names: [.../* @__PURE__ */ new Set([...names, name])] };
+  }
+  return {
+    ...next,
+    skills: { ...retained, ...next.skills },
+    ...Object.keys(history).length ? { nativeHistory: history } : {}
+  };
+}
+function hasNativeFolderHistory(state, name) {
+  return Object.values(state.nativeHistory || {}).some((row) => row.names.includes(name));
+}
+
 // src/runtime/skill-sync/local-scanner.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { execFile } from "child_process";
 import { promises as fs } from "fs";
 import os from "os";
@@ -23,6 +153,8 @@ import path from "path";
 import { promisify } from "util";
 var HOME_DIR = os.homedir();
 var execFileAsync = promisify(execFile);
+var NativeSkillIdentityError = class extends Error {
+};
 var AGENTS_DIR = path.join(HOME_DIR, ".agents");
 var LEGACY_AGENTS_SKILLS_DIR = path.join(AGENTS_DIR, "skills");
 var NOTIS_SKILL_SYNC_ROOT = path.join(HOME_DIR, ".notis", "skills");
@@ -82,15 +214,18 @@ function sanitizePathSegment(value) {
   if (sanitized === raw) {
     return sanitized;
   }
-  return `${sanitized}-${createHash("sha256").update(raw).digest("hex").slice(0, 12)}`;
+  return `${sanitized}-${createHash2("sha256").update(raw).digest("hex").slice(0, 12)}`;
 }
-function getSkillSyncPathsForUser(authUserId, agentsDir = AGENTS_DIR) {
+function getSkillSyncPathsForUser(authUserId, agentsDir = AGENTS_DIR, namespace, syncHome) {
   const safeUserId = sanitizePathSegment(authUserId);
-  const resolvedAgentsDir = path.resolve(agentsDir);
-  const syncRoot = getDefaultSyncRootForAgentsDir(resolvedAgentsDir);
-  const userRoot = path.join(syncRoot, "users", safeUserId);
+  const homeDir = syncHome ? path.resolve(syncHome) : void 0;
+  const resolvedAgentsDir = homeDir ? path.join(homeDir, ".agents") : path.resolve(agentsDir);
+  const syncRoot = homeDir ? path.join(homeDir, ".notis", "skills") : getDefaultSyncRootForAgentsDir(resolvedAgentsDir);
+  const userRoot = namespace ? path.join(syncRoot, "environments", sanitizePathSegment(namespace), "users", safeUserId) : path.join(syncRoot, "users", safeUserId);
   const legacyUserRoot = path.join(resolvedAgentsDir, "notis", "users", safeUserId);
   return {
+    ...homeDir ? { homeDir } : {},
+    ...namespace ? { isolatedNamespace: sanitizePathSegment(namespace) } : {},
     agentsDir: resolvedAgentsDir,
     syncRoot,
     legacySkillsDir: path.join(resolvedAgentsDir, "skills"),
@@ -139,16 +274,23 @@ async function readJsonFile(filePath) {
     return null;
   }
 }
-async function listFilesRecursive(dirPath) {
+var IGNORED_SKILL_DIRECTORIES = /* @__PURE__ */ new Set(["__pycache__", ".pytest_cache"]);
+function isIgnoredSkillEntry(entry) {
+  if (entry.name === ".DS_Store") return true;
+  if (entry.isDirectory()) return IGNORED_SKILL_DIRECTORIES.has(entry.name);
+  return /\.py[co]$/i.test(entry.name);
+}
+async function listFilesRecursive(dirPath, rootPath = dirPath, strictLinks = false) {
   const entries = await fs.readdir(dirPath, { withFileTypes: true });
   const nested = await Promise.all(
     entries.map(async (entry) => {
-      if (entry.name === ".DS_Store") {
+      if (isIgnoredSkillEntry(entry) || dirPath === rootPath && entry.name === NATIVE_IDENTITY_FILE) {
         return [];
       }
       const fullPath = path.join(dirPath, entry.name);
+      if (strictLinks && entry.isSymbolicLink()) throw new Error("Native Skill bundles cannot contain symbolic links.");
       if (entry.isDirectory()) {
-        return listFilesRecursive(fullPath);
+        return listFilesRecursive(fullPath, rootPath, strictLinks);
       }
       if (entry.isFile()) {
         return [fullPath];
@@ -159,7 +301,7 @@ async function listFilesRecursive(dirPath) {
   return nested.flat().sort();
 }
 async function computeFolderHash(dirPath) {
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   const filePaths = await listFilesRecursive(dirPath);
   for (const filePath of filePaths) {
     const relativePath = path.relative(dirPath, filePath);
@@ -237,17 +379,17 @@ function defaultTopLevelSkillSources(paths) {
     { label: "agents", root: paths.legacySkillsDir, priority: 2 },
     {
       label: "codex",
-      root: path.join(HOME_DIR, ".codex", "skills"),
+      root: path.join(paths.homeDir || HOME_DIR, ".codex", "skills"),
       priority: 3
     },
     {
       label: "cursor",
-      root: path.join(HOME_DIR, ".cursor", "skills"),
+      root: path.join(paths.homeDir || HOME_DIR, ".cursor", "skills"),
       priority: 4
     },
     {
       label: "claude",
-      root: path.join(HOME_DIR, ".claude", "skills"),
+      root: path.join(paths.homeDir || HOME_DIR, ".claude", "skills"),
       priority: 5
     }
   );
@@ -467,6 +609,7 @@ async function ensureCanonicalSkillsDir(paths = DEFAULT_SYNC_PATHS) {
 async function scanLocalSkills(paths = DEFAULT_SYNC_PATHS) {
   await ensureCanonicalSkillsDir(paths);
   const sourceUrls = await readSkillLock(paths);
+  const previousState = await readSyncState(paths);
   const entries = await fs.readdir(paths.skillsDir, { withFileTypes: true });
   const skills = await Promise.all(
     entries.map(async (entry) => {
@@ -475,6 +618,15 @@ async function scanLocalSkills(paths = DEFAULT_SYNC_PATHS) {
       }
       const skillDir = path.join(paths.skillsDir, entry.name);
       const skillMdPath = path.join(skillDir, "SKILL.md");
+      let marker = null;
+      try {
+        marker = await fs.readFile(path.join(skillDir, NATIVE_IDENTITY_FILE), "utf8");
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw new NativeSkillIdentityError("Native Skill provenance could not be read; existing files were retained.");
+        }
+      }
+      const knownNative = marker !== null || Boolean(previousState.skills[entry.name]?.nativeReference) || Object.values(previousState.nativeHistory || {}).some((row) => row.names.includes(entry.name));
       try {
         const skillMd = await fs.readFile(skillMdPath, "utf8");
         const { description } = parseFrontMatter(skillMd);
@@ -486,11 +638,38 @@ async function scanLocalSkills(paths = DEFAULT_SYNC_PATHS) {
           folderHash,
           directoryPath: skillDir
         };
+        if (marker !== null) {
+          let identity;
+          try {
+            identity = checkedNativeIdentity(JSON.parse(marker));
+          } catch {
+            throw new NativeSkillIdentityError("Native Skill provenance is unreadable; do not upload it as a new Skill.");
+          }
+          let current = true;
+          for (const [name, expected] of Object.entries(identity.files)) {
+            try {
+              if (nativeFileDigest(await fs.readFile(resolveSkillBundleFilePath(skillDir, name))) !== expected) current = false;
+            } catch {
+              current = false;
+            }
+          }
+          const editedName = nativeFrontmatterName(skillMd);
+          Object.assign(skill, {
+            cloudId: identity.cloudId,
+            nativeReference: identity.reference,
+            nativeScope: identity.scope,
+            nativeBaseFolderHash: identity.folderHash,
+            nativeFilesCurrent: current,
+            displayName: editedName && editedName !== identity.frontmatterName ? editedName : identity.displayName
+          });
+        }
         if (sourceUrls[entry.name]) {
           skill.sourceUrl = sourceUrls[entry.name];
         }
         return skill;
-      } catch {
+      } catch (error) {
+        if (error instanceof NativeSkillIdentityError) throw error;
+        if (knownNative) throw new NativeSkillIdentityError("Native Skill files could not be read; existing files were retained.");
         return null;
       }
     })
@@ -501,6 +680,9 @@ function normalizeSyncState(state) {
   if (!state || state.version !== 1 || typeof state.skills !== "object") {
     return null;
   }
+  if (state.nativeHistory && (typeof state.nativeHistory !== "object" || Array.isArray(state.nativeHistory) || Object.values(state.nativeHistory).some((row) => !row || !Array.isArray(row.names) || row.names.some((name) => typeof name !== "string")))) {
+    throw new Error("Native Skill sync provenance is unreadable; existing files were retained.");
+  }
   const normalizeStoredAgentTargets = (targets) => ({
     notis: Boolean(targets?.notis ?? true),
     claude_code: Boolean(targets?.claude_code ?? true),
@@ -509,6 +691,7 @@ function normalizeSyncState(state) {
   });
   return {
     version: 1,
+    ...state.nativeHistory ? { nativeHistory: state.nativeHistory } : {},
     lastSyncedAt: typeof state.lastSyncedAt === "string" ? state.lastSyncedAt : null,
     skills: Object.fromEntries(
       Object.entries(state.skills || {}).map(([skillName, skillState]) => [
@@ -583,20 +766,49 @@ async function createZipFromDirectory(directoryPath) {
     os.tmpdir(),
     `notis-skill-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
   );
-  const parentDir = path.dirname(directoryPath);
   const directoryName = path.basename(directoryPath);
-  if (process.platform === "win32") {
-    await execFileAsync("powershell.exe", [
-      "-NoProfile",
-      "-Command",
-      `Compress-Archive -Path '${directoryPath.replace(/'/g, "''")}' -DestinationPath '${zipPath.replace(/'/g, "''")}' -Force`
-    ]);
+  const stagingRoot = await fs.mkdtemp(path.join(os.tmpdir(), "notis-skill-bundle-"));
+  try {
+    const stagedDir = path.join(stagingRoot, directoryName);
+    for (const filePath of await listFilesRecursive(directoryPath)) {
+      const target = path.join(stagedDir, path.relative(directoryPath, filePath));
+      await fs.mkdir(path.dirname(target), { recursive: true });
+      await fs.copyFile(filePath, target);
+    }
+    await fs.mkdir(stagedDir, { recursive: true });
+    if (process.platform === "win32") {
+      const systemTar = path.join(
+        process.env.SystemRoot || "C:\\Windows",
+        "System32",
+        "tar.exe"
+      );
+      if (await pathExists(systemTar)) {
+        await execFileAsync(systemTar, [
+          "-c",
+          "--format",
+          "zip",
+          "-f",
+          zipPath,
+          "-C",
+          stagingRoot,
+          directoryName
+        ]);
+        return zipPath;
+      }
+      await execFileAsync("powershell.exe", [
+        "-NoProfile",
+        "-Command",
+        `Compress-Archive -Path '${stagedDir.replace(/'/g, "''")}' -DestinationPath '${zipPath.replace(/'/g, "''")}' -Force`
+      ]);
+      return zipPath;
+    }
+    await execFileAsync("zip", ["-qry", zipPath, directoryName], {
+      cwd: stagingRoot
+    });
     return zipPath;
+  } finally {
+    await fs.rm(stagingRoot, { recursive: true, force: true });
   }
-  await execFileAsync("zip", ["-qry", zipPath, directoryName], {
-    cwd: parentDir
-  });
-  return zipPath;
 }
 async function extractZipToDirectory(zipPath, destinationDir) {
   const extractRoot = await fs.mkdtemp(
@@ -622,10 +834,39 @@ async function extractZipToDirectory(zipPath, destinationDir) {
     await fs.rm(destinationDir, { recursive: true, force: true });
     await fs.mkdir(path.dirname(destinationDir), { recursive: true });
     await fs.cp(sourceDir, destinationDir, { recursive: true });
+    return await listRelativeFiles(destinationDir);
   } finally {
     await fs.rm(extractRoot, { recursive: true, force: true });
   }
 }
+async function listRelativeFiles(dirPath) {
+  try {
+    const files = await listFilesRecursive(dirPath);
+    return files.map((filePath) => toPosixRelativePath(dirPath, filePath)).sort();
+  } catch (error) {
+    if (error?.code === "ENOENT") return [];
+    throw error;
+  }
+}
+function toPosixRelativePath(rootDir, filePath) {
+  return path.relative(rootDir, filePath).split(path.sep).join("/");
+}
+async function preserveUnmanagedFiles(existingDir, stagingDir, previouslyApplied, strictConflicts = false) {
+  const managed = previouslyApplied ? new Set(previouslyApplied) : null;
+  for (const existingFile of await listFilesRecursive(existingDir)) {
+    const relativePath = toPosixRelativePath(existingDir, existingFile);
+    if (managed?.has(relativePath)) continue;
+    const stagedPath = path.join(stagingDir, ...relativePath.split("/"));
+    if (await pathExists(stagedPath)) {
+      if (strictConflicts && !(await fs.readFile(existingFile)).equals(await fs.readFile(stagedPath))) {
+        throw new Error("An incoming native Skill file conflicts with a local file. Local files were retained.");
+      }
+      continue;
+    }
+    await fs.mkdir(path.dirname(stagedPath), { recursive: true });
+    await fs.copyFile(existingFile, stagedPath);
+  }
+}
 async function pathExists(targetPath) {
   try {
     await fs.access(targetPath);
@@ -634,7 +875,7 @@ async function pathExists(targetPath) {
     return false;
   }
 }
-async function replaceSkillDirectoryAtomically(skillDir, populateDir) {
+async function replaceSkillDirectoryAtomically(skillDir, populateDir, preserve) {
   const parentDir = path.dirname(skillDir);
   const skillName = path.basename(skillDir);
   await fs.mkdir(parentDir, { recursive: true });
@@ -649,10 +890,46 @@ async function replaceSkillDirectoryAtomically(skillDir, populateDir) {
   let promotedStaging = false;
   let cleanupError = null;
   try {
+    if (preserve?.native && preserve.expectedFolderHash === void 0) {
+      let existing = false;
+      try {
+        await fs.lstat(skillDir);
+        existing = true;
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+      if (existing) throw new Error("Existing native Skill files need a readable baseline before replacement.");
+    }
+    if (preserve?.expectedFolderHash !== void 0 && (!await pathExists(skillDir) || await computeFolderHash(skillDir) !== preserve.expectedFolderHash)) {
+      throw new Error("Local Skill files changed before sync; the newer local edits were retained.");
+    }
     await populateDir(stagingDir);
+    if (preserve && await pathExists(skillDir)) {
+      await preserveUnmanagedFiles(
+        skillDir,
+        stagingDir,
+        preserve.previouslyApplied,
+        preserve.native && !preserve.legacyBaseline
+      );
+    }
+    if (preserve?.native) {
+      const markerPath = path.join(stagingDir, NATIVE_IDENTITY_FILE);
+      const marker = checkedNativeIdentity(JSON.parse(await fs.readFile(markerPath, "utf8")));
+      marker.folderHash = await computeFolderHash(stagingDir);
+      await fs.writeFile(markerPath, JSON.stringify(marker), { mode: 384 });
+    }
+    if (preserve?.expectedFolderHash !== void 0 && (!await pathExists(skillDir) || await computeFolderHash(skillDir) !== preserve.expectedFolderHash)) {
+      throw new Error("Local Skill files changed during sync; the newer local edits were retained.");
+    }
     if (await pathExists(skillDir)) {
       await fs.rename(skillDir, backupDir);
       movedExisting = true;
+      if (preserve?.native && preserve.expectedFolderHash === void 0) {
+        throw new Error("Native Skill files appeared during sync; existing files were retained.");
+      }
+      if (preserve?.expectedFolderHash !== void 0 && await computeFolderHash(backupDir) !== preserve.expectedFolderHash) {
+        throw new Error("Local Skill files changed before publication; the newer local edits were retained.");
+      }
     }
     await fs.rename(stagingDir, skillDir);
     promotedStaging = true;
@@ -697,11 +974,43 @@ async function createSkillBundleBase64(skill) {
     await fs.rm(zipPath, { force: true });
   }
 }
-async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PATHS) {
+async function captureNativeSkillFiles(skill) {
+  const hash = createHash2("sha256");
+  const files = [];
+  for (const filePath of await listFilesRecursive(skill.directoryPath, skill.directoryPath, true)) {
+    const relative = path.relative(skill.directoryPath, filePath);
+    const bytes = await fs.readFile(filePath);
+    hash.update(relative);
+    hash.update("\0");
+    hash.update(bytes);
+    hash.update("\0");
+    files.push({ path: relative.split(path.sep).join("/"), content_b64: bytes.toString("base64") });
+  }
+  if (hash.digest("hex") !== skill.folderHash) throw new Error("Local Skill files changed before upload. Sync again with the current files.");
+  return files;
+}
+async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PATHS, options = {}) {
+  if (isNativeSkill(skill)) {
+    assertNativePull({
+      skills: [{ ...skill, name: "native-" + skill.id }],
+      skill_sync_protocol: 2,
+      sync_scope: skill.native_scope,
+      sync_enabled: true,
+      last_synced_at: null
+    });
+    if (bundleBytes?.length) throw new Error("Native Skills require their verified complete file response.");
+  }
   const skillDir = path.join(
     paths.skillsDir,
     safeName(skill.name, paths.skillsDir)
   );
+  const preserve = {
+    previouslyApplied: options.previouslyApplied,
+    expectedFolderHash: options.expectedFolderHash,
+    native: isNativeSkill(skill),
+    // An unchanged legacy folder upgrading in place: shared files take the cloud version.
+    legacyBaseline: isNativeSkill(skill) && options.legacyBaseline === true && options.expectedFolderHash !== void 0
+  };
   if (bundleBytes?.length) {
     const bundlePath = path.join(
       os.tmpdir(),
@@ -709,8 +1018,11 @@ async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PA
     );
     try {
       await fs.writeFile(bundlePath, bundleBytes);
-      await extractZipToDirectory(bundlePath, skillDir);
-      return true;
+      let appliedFiles = [];
+      await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
+        appliedFiles = await extractZipToDirectory(bundlePath, stagingDir);
+      }, preserve);
+      return { written: true, appliedFiles };
     } finally {
       await fs.rm(bundlePath, { force: true });
     }
@@ -724,6 +1036,7 @@ async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PA
         `Synced bundle for "${skill.name}" is missing SKILL.md or SKILLS.md`
       );
     }
+    const appliedFiles = [];
     await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
       for (const bundleFile of skill.bundle_files || []) {
         const filePath = resolveSkillBundleFilePath(
@@ -735,9 +1048,24 @@ async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PA
           filePath,
           Buffer.from(bundleFile.content_b64, "base64")
         );
+        appliedFiles.push(toPosixRelativePath(stagingDir, filePath));
       }
-    });
-    return true;
+      if (skill.native_reference) {
+        const identity = {
+          schema: 1,
+          cloudId: skill.id,
+          reference: skill.native_reference,
+          displayName: skill.display_name || skill.name,
+          frontmatterName: nativeFrontmatterName(skill.skill_md || ""),
+          scope: skill.native_scope,
+          folderHash: await computeFolderHash(stagingDir),
+          files: Object.fromEntries((skill.bundle_files || []).map((file) => [file.path, nativeFileDigest(Buffer.from(file.content_b64, "base64"))]))
+        };
+        await fs.writeFile(path.join(stagingDir, NATIVE_IDENTITY_FILE), JSON.stringify(identity), { mode: 384 });
+        appliedFiles.push(NATIVE_IDENTITY_FILE);
+      }
+    }, preserve);
+    return { written: true, appliedFiles: appliedFiles.sort() };
   }
   await replaceSkillDirectoryAtomically(skillDir, async (stagingDir) => {
     await fs.writeFile(
@@ -745,13 +1073,15 @@ async function writeCloudSkillToDisk(skill, bundleBytes, paths = DEFAULT_SYNC_PA
       skill.skill_md ?? "",
       "utf8"
     );
-  });
-  return true;
+  }, preserve);
+  return { written: true, appliedFiles: ["SKILL.md"] };
 }
 
 // src/runtime/skill-sync/cloud-client.ts
+import { createHash as createHash3 } from "node:crypto";
 async function requestJson(url, jwt, options = {}) {
   const response = await fetch(url, {
+    signal: AbortSignal.timeout(9e4),
     method: options.method || "POST",
     headers: {
       "Content-Type": "application/json",
@@ -772,7 +1102,7 @@ async function fetchSyncSettings(serverUrl, jwt) {
 }
 async function pullSkills(serverUrl, jwt) {
   return requestJson(`${serverUrl}/portal_skills/sync-pull`, jwt, {
-    body: {}
+    body: { skill_sync_protocol: 2 }
   });
 }
 async function pushChangedSkills(serverUrl, jwt, changedSkills) {
@@ -782,28 +1112,55 @@ async function pushChangedSkills(serverUrl, jwt, changedSkills) {
     skill_md: skill.skillMd,
     source_url: skill.sourceUrl,
     folder_hash: skill.folderHash,
-    bundle_base64: await createSkillBundleBase64(skill)
+    ...skill.nativeReference ? { bundle_files: await captureNativeSkillFiles(skill) } : { bundle_base64: await createSkillBundleBase64(skill) },
+    ...skill.cloudId ? { cloud_id: skill.cloudId } : {},
+    ...skill.nativeReference ? {
+      native_reference: skill.nativeReference,
+      display_name: skill.displayName,
+      native_scope: skill.nativeScope
+    } : {}
   })));
   return requestJson(`${serverUrl}/portal_skills/sync-push`, jwt, {
     body: {
+      skill_sync_protocol: 2,
       skills: payloadSkills
     }
   });
 }
 async function downloadSkillBundle(bundleUrl) {
-  const response = await fetch(bundleUrl);
+  const response = await fetch(bundleUrl, { signal: AbortSignal.timeout(9e4) });
   if (!response.ok) {
     const text = await response.text();
     throw new Error(`GET ${bundleUrl} \u2192 ${response.status}: ${text}`);
   }
   return Buffer.from(await response.arrayBuffer());
 }
-async function updateAgentTargets(serverUrl, jwt, skillId, targets) {
+async function updateAgentTargets(serverUrl, jwt, skillId, targets, expectedUpdatedAt, native) {
+  if (native) {
+    checkedNativeReference(native.reference, skillId);
+    if (!Number.isSafeInteger(native.settingsRevision) || native.settingsRevision < 0) throw new Error("Refresh native Skill settings before changing assignments.");
+    const payload = {
+      operation: "update",
+      target: { skill_id: skillId, access_revision: native.reference.access_revision },
+      revision: native.settingsRevision,
+      patch: { agent_targets: Object.fromEntries(Object.entries(targets).sort(([a], [b]) => a.localeCompare(b))) }
+    };
+    const requestId = "sync-settings-" + createHash3("sha256").update(JSON.stringify(payload)).digest("hex");
+    const saved = await requestJson(
+      `${serverUrl}/portal_skills/native-settings`,
+      jwt,
+      { body: { ...payload, request_id: requestId } }
+    );
+    const current = saved.current || saved;
+    if (saved.skill_id !== skillId || typeof saved.receipt_id !== "string" || !saved.receipt_id || current.target?.skill_id !== skillId || !current.settings) throw new Error("Native assignment update was not confirmed.");
+    return { success: true, agent_targets: current.settings.agent_targets, updated_at: current.settings.updated_at };
+  }
   return requestJson(`${serverUrl}/portal_skills/agent-targets`, jwt, {
     method: "PATCH",
     body: {
       skill_id: skillId,
-      agent_targets: targets
+      agent_targets: targets,
+      ...expectedUpdatedAt ? { expected_updated_at: expectedUpdatedAt } : {}
     }
   });
 }
@@ -819,6 +1176,18 @@ var EXTERNAL_AGENT_SKILL_DIRS = {
   codex: path2.join(HOME_DIR2, ".codex", "skills")
 };
 var EXTERNAL_AGENTS = Object.keys(EXTERNAL_AGENT_SKILL_DIRS);
+var AGENT_FAILURE_LABELS = {
+  claude_code: "Claude Code",
+  cursor: "Cursor",
+  codex: "Codex",
+  legacy: "legacy ~/.agents/skills"
+};
+function agentFailureLabel(agent) {
+  return AGENT_FAILURE_LABELS[agent] ?? agent;
+}
+function agentFolderFailureName(agent) {
+  return `${agentFailureLabel(agent)} skills folder`;
+}
 async function removeForeignAccountSymlinks(skillsDir, options = {}) {
   const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
   const currentRoot = path2.resolve(skillsDir);
@@ -879,8 +1248,9 @@ async function isManagedSymlink(linkPath, managedRoots) {
     const target = await fs2.readlink(linkPath);
     const resolvedTarget = path2.resolve(path2.dirname(linkPath), target);
     return managedRoots.some((root) => resolvedTarget === root || resolvedTarget.startsWith(`${root}${path2.sep}`));
-  } catch {
-    return false;
+  } catch (error) {
+    if (error?.code === "ENOENT") return false;
+    throw error;
   }
 }
 async function ensureCorrectSymlink(linkPath, targetPath) {
@@ -896,7 +1266,8 @@ async function ensureCorrectSymlink(linkPath, targetPath) {
     } else {
       return "blocked";
     }
-  } catch {
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw error;
   }
   const relativePath = path2.relative(path2.dirname(linkPath), targetPath);
   await fs2.symlink(relativePath, linkPath);
@@ -908,19 +1279,26 @@ function defaultAgentSkillDirs(skillsDir) {
     ...EXTERNAL_AGENT_SKILL_DIRS
   };
 }
-async function removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots) {
+async function removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, failures, agent) {
   let removed = 0;
   try {
     await fs2.mkdir(agentDir, { recursive: true });
     const existingEntries = await fs2.readdir(agentDir, { withFileTypes: true });
     for (const entry of existingEntries) {
       const entryPath = path2.join(agentDir, entry.name);
-      if (!desiredSkills.has(entry.name) && await isManagedSymlink(entryPath, managedRoots)) {
-        await fs2.unlink(entryPath);
-        removed += 1;
+      try {
+        if (!desiredSkills.has(entry.name) && await isManagedSymlink(entryPath, managedRoots)) {
+          await fs2.unlink(entryPath);
+          removed += 1;
+        }
+      } catch (error) {
+        if (error?.code !== "ENOENT") {
+          failures.push({ name: entry.name, error: `${agentFailureLabel(agent)}: could not remove skill link (${error.message})` });
+        }
       }
     }
-  } catch {
+  } catch (error) {
+    failures.push({ name: agentFolderFailureName(agent), error: `Could not read agent skills directory (${error.message})` });
   }
   return removed;
 }
@@ -965,7 +1343,7 @@ async function detectDeletedAgentSymlinks(cloudSkills, previousState, skillsDir
         continue;
       }
       const previous = previousState.skills[skill.name];
-      if (!previous) {
+      if (!previous || previous.cloudId !== skill.id || previous.verifiedAgentLinks?.[agent] !== true || !skill.updated_at || previous.cloudUpdatedAt !== skill.updated_at) {
         continue;
       }
       const cloudTargets = normalizeAgentTargets(skill.agent_targets);
@@ -996,7 +1374,9 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
   const result = {
     linked: 0,
     removed: 0,
-    skipped: 0
+    skipped: 0,
+    verifiedAgentLinks: {},
+    failures: []
   };
   const agentSkillDirs = { ...defaultAgentSkillDirs(skillsDir), ...options.agentSkillDirs };
   const legacyGlobalSkillsDir = options.legacyGlobalSkillsDir || LEGACY_AGENTS_SKILLS_DIR;
@@ -1031,21 +1411,34 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
       result.skipped += desiredByAgent[agent].size;
       continue;
     }
-    await fs2.mkdir(agentDir, { recursive: true });
+    try {
+      await fs2.mkdir(agentDir, { recursive: true });
+    } catch (error) {
+      result.failures.push({ name: agentFolderFailureName(agent), error: `Could not create agent skills directory (${error.message})` });
+      continue;
+    }
     const desiredSkills = desiredByAgent[agent];
     if (options.removeUndesired !== false) {
-      result.removed += await removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots);
+      result.removed += await removeUndesiredManagedSymlinks(agentDir, desiredSkills, managedRoots, result.failures, agent);
     }
     for (const skillName of desiredSkills) {
       const targetPath = path2.join(skillsDir, skillName);
       const linkPath = path2.join(agentDir, safeName(skillName, agentDir));
       try {
-        await fs2.access(targetPath);
+        if (!(await fs2.stat(path2.join(targetPath, "SKILL.md"))).isFile()) throw new Error("Missing SKILL.md");
       } catch {
         result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: SKILL.md is missing or unreadable` });
+        continue;
+      }
+      let syncOutcome;
+      try {
+        syncOutcome = await ensureCorrectSymlink(linkPath, targetPath);
+      } catch (error) {
+        result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: could not create skill link (${error.message})` });
         continue;
       }
-      const syncOutcome = await ensureCorrectSymlink(linkPath, targetPath);
       if (syncOutcome === "linked") {
         result.linked += 1;
       } else if (syncOutcome === "blocked") {
@@ -1053,9 +1446,13 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
           `[skill-sync] Could not link "${skillName}" for ${agent}: non-symlink entry blocks ${linkPath}`
         );
         result.skipped += 1;
+        result.failures.push({ name: skillName, error: `${agentFailureLabel(agent)}: an existing file or folder blocks the skill link` });
       } else {
         result.skipped += 1;
       }
+      if (syncOutcome !== "blocked") {
+        result.verifiedAgentLinks[skillName] = { ...result.verifiedAgentLinks[skillName], [agent]: true };
+      }
     }
   }
   if (options.removeUndesired !== false && !Object.values(agentSkillDirs).some(
@@ -1064,26 +1461,46 @@ async function syncSymlinks(skills, skillsDir = LEGACY_AGENTS_SKILLS_DIR, option
     result.removed += await removeUndesiredManagedSymlinks(
       legacyGlobalSkillsDir,
       /* @__PURE__ */ new Set(),
-      managedRoots
+      managedRoots,
+      result.failures,
+      "legacy"
     );
   }
   return result;
 }
 
 // src/runtime/skill-sync/sync-plan.ts
-function getPushCandidates(localSkills, syncState, cloudCuratedSkillNames = /* @__PURE__ */ new Set(), cloudSkillNames) {
+function selectCloudSkillsToApply(skills) {
+  const winners = /* @__PURE__ */ new Map();
+  for (const skill of skills) {
+    const current = winners.get(skill.name);
+    if (!current || (skill.updated_at || "") >= (current.updated_at || "")) {
+      winners.set(skill.name, skill);
+    }
+  }
+  return [...winners.values()];
+}
+function getPushCandidates(localSkills, syncState, cloudCuratedSkillNames = /* @__PURE__ */ new Set(), cloudSkillNames, cloudSkills = []) {
   return localSkills.filter((skill) => {
     if (cloudCuratedSkillNames.has(skill.name)) {
       return false;
     }
-    const previous = syncState.skills[skill.name];
+    const previous = syncState.skills[skill.name] || (skill.cloudId ? Object.values(syncState.skills).find((row) => row.cloudId === skill.cloudId) : void 0);
+    const native = cloudSkills.find((row) => isNativeSkill(row) && row.id === (skill.cloudId || previous?.cloudId));
+    if (native || skill.nativeReference || previous?.nativeReference || previous?.nativeUnavailable) {
+      return Boolean(native && skill.nativeReference && skill.nativeScope === native.native_scope && (previous ? previous.folderHash !== skill.folderHash : skill.nativeBaseFolderHash !== skill.folderHash));
+    }
     if (!previous) {
+      if (hasNativeFolderHistory(syncState, skill.name) || /^native-[a-f0-9-]{36}$/.test(skill.name)) return false;
       return true;
     }
     if (cloudSkillNames && !cloudSkillNames.has(skill.name)) {
       return false;
     }
     return previous.folderHash !== skill.folderHash;
+  }).map((skill) => {
+    const previous = syncState.skills[skill.name] || Object.values(syncState.skills).find((row) => row.cloudId === skill.cloudId);
+    return { ...skill, ...skill.cloudId || previous?.cloudId ? { cloudId: skill.cloudId || previous.cloudId } : {} };
   });
 }
 
@@ -1094,7 +1511,7 @@ async function writeCloudSkillWithBundleFallback(skill, dependencies) {
       const bundleBytes = await dependencies.downloadSkillBundle(skill.skill_source_url);
       const wroteBundleToDisk = await dependencies.writeCloudSkillToDisk(skill, bundleBytes);
       if (wroteBundleToDisk) {
-        return true;
+        return wroteBundleToDisk;
       }
       dependencies.onWarning?.(
         `Bundle sync for "${skill.name}" produced no local changes, falling back to SKILL.md payload.`,
@@ -1126,7 +1543,7 @@ async function writeCloudSkillWithBundleFallback(skill, dependencies) {
 }
 
 // src/runtime/skill-sync/index.ts
-var BASE_SKILL_NAMES = /* @__PURE__ */ new Set(["notis-apps", "notis-query", "notis-cli"]);
+var BASE_SKILL_NAMES = /* @__PURE__ */ new Set(["notis-spaces", "notis-query", "notis-cli"]);
 function withoutBaseSkills(pullResponse) {
   return {
     ...pullResponse,
@@ -1159,6 +1576,62 @@ var DEFAULT_RUN_SKILL_SYNC_DEPS = {
   removeForeignAccountSymlinks,
   updateAgentTargets
 };
+var MIRROR_ONLY_DEPS = {
+  removeForeignAccountSymlinks: async () => 0,
+  removeAllSymlinksForSkill: async () => 0,
+  syncSymlinks: async () => ({ linked: 0, removed: 0, skipped: 0, verifiedAgentLinks: {} })
+};
+async function forgetOtherAccountsAgentLinks(paths) {
+  const usersDir = dirname(dirname(paths.syncStatePath));
+  let entries;
+  try {
+    entries = await fs3.readdir(usersDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const statePath = join(usersDir, entry.name, ".notis-sync.json");
+    if (statePath === paths.syncStatePath) continue;
+    let state = null;
+    try {
+      state = JSON.parse(await fs3.readFile(statePath, "utf8"));
+    } catch {
+      continue;
+    }
+    if (!state || typeof state !== "object" || !state.skills || typeof state.skills !== "object") continue;
+    let changed = false;
+    for (const skill of Object.values(state.skills)) {
+      if (skill && typeof skill === "object" && "verifiedAgentLinks" in skill) {
+        delete skill.verifiedAgentLinks;
+        changed = true;
+      }
+    }
+    if (!changed) continue;
+    const temporaryPath = `${statePath}.${process.pid}.${Date.now()}.tmp`;
+    await fs3.writeFile(temporaryPath, `${JSON.stringify(state, null, 2)}
+`, "utf8");
+    await fs3.rename(temporaryPath, statePath);
+  }
+}
+function isolatedLinkOptions(paths) {
+  if (!paths.isolatedNamespace && !paths.homeDir) return void 0;
+  const root = paths.isolatedNamespace ? join(paths.syncRoot, "environments", paths.isolatedNamespace, "agents") : paths.homeDir;
+  return {
+    agentSkillDirs: {
+      notis: paths.skillsDir,
+      claude_code: join(root, ".claude", "skills"),
+      cursor: join(root, ".cursor", "skills"),
+      codex: join(root, ".codex", "skills")
+    },
+    legacyGlobalSkillsDir: join(root, ".agents", "skills")
+  };
+}
+function assertSyncEnvironment(pull, settings) {
+  if ((pull.sync_namespace || null) !== (settings.sync_namespace || null) || settings.sync_scope !== void 0 && pull.sync_scope !== settings.sync_scope) {
+    throw new Error("Skill sync environment changed. Existing mirrors were retained.");
+  }
+}
 function toSkillMap(skills) {
   return new Map(skills.map((skill) => [skill.name, skill]));
 }
@@ -1174,6 +1647,15 @@ function decodeJwtSubject(jwt) {
     return null;
   }
 }
+function cloudContentHash(skill) {
+  return createHash4("sha256").update(JSON.stringify({
+    md: skill.skill_md,
+    hash: skill.skill_folder_hash,
+    source: skill.skill_source_url,
+    files: skill.bundle_files?.slice().sort((a, b) => a.path.localeCompare(b.path)),
+    hydrationFailed: skill.bundle_hydration_failed === true
+  })).digest("hex");
+}
 function shouldWriteCloudSkill(cloudSkill, localSkills, previousState) {
   const skillName = cloudSkill.name;
   const cloudHash = cloudSkill.skill_folder_hash || "";
@@ -1181,40 +1663,99 @@ function shouldWriteCloudSkill(cloudSkill, localSkills, previousState) {
   if (!localSkill) {
     return true;
   }
+  if (isNativeSkill(cloudSkill)) {
+    if (localSkill.nativeScope && localSkill.nativeScope !== cloudSkill.native_scope) return false;
+    if (nativeLocalReady(cloudSkill, localSkill)) return false;
+    const nativePrevious = previousNativeState(previousState, cloudSkill);
+    return localSkill.nativeFilesCurrent === true && localSkill.folderHash === localSkill.nativeBaseFolderHash || !localSkill.nativeReference && nativePrevious?.cloudId === cloudSkill.id && nativePrevious.folderHash === localSkill.folderHash;
+  }
+  const previous = previousState.skills[skillName];
+  if (previous?.folderHash === localSkill.folderHash && previous.cloudContentHash === cloudContentHash(cloudSkill)) return false;
+  if (previous && previous.cloudContentHash === void 0 && previous.cloudId === cloudSkill.id && previous.appliedCloudFolderHash !== void 0 && previous.appliedCloudFolderHash === cloudHash && previous.cloudUpdatedAt === cloudSkill.updated_at && previous.folderHash === localSkill.folderHash) {
+    return false;
+  }
   if (cloudSkill.source === "curated") {
     return cloudHash ? cloudHash !== localSkill.folderHash : true;
   }
-  const previous = previousState.skills[skillName];
   const localChangedSinceLastSync = !previous || previous.folderHash !== localSkill.folderHash;
-  return !localChangedSinceLastSync && Boolean(cloudHash) && cloudHash !== localSkill.folderHash;
+  return !localChangedSinceLastSync && (Boolean(cloudHash) && cloudHash !== localSkill.folderHash || Boolean(previous?.cloudContentHash && previous.cloudContentHash !== cloudContentHash(cloudSkill)));
+}
+function collectAppliedCloudRevisions(pullResponse, previousState, writtenSkillNames) {
+  const applied = {};
+  for (const skill of selectCloudSkillsToApply(pullResponse.skills)) {
+    applied[skill.name] = writtenSkillNames.has(skill.name) ? skill.skill_folder_hash || "" : previousState.skills[skill.name]?.appliedCloudFolderHash;
+  }
+  return applied;
+}
+function collectAppliedFiles(pullResponse, previousState, appliedFilesByName) {
+  const applied = {};
+  for (const skill of selectCloudSkillsToApply(pullResponse.skills)) {
+    applied[skill.name] = appliedFilesByName[skill.name] ?? previousState.skills[skill.name]?.appliedFiles;
+  }
+  return applied;
 }
-function buildSyncState(pullResponse, localSkills, lastSyncedAt) {
+function buildSyncState(pullResponse, localSkills, lastSyncedAt, verifiedAgentLinks = {}, failedContentNames = /* @__PURE__ */ new Set(), appliedRevisions = {}, appliedFiles = {}, previousState = { version: 1, lastSyncedAt: null, skills: {} }) {
   const localSkillMap = toSkillMap(localSkills);
   const skills = Object.fromEntries(
-    pullResponse.skills.map((skill) => {
+    selectCloudSkillsToApply(pullResponse.skills).map((skill) => {
       const localSkill = localSkillMap.get(skill.name);
+      const appliedCloudFolderHash = appliedRevisions[skill.name];
+      const appliedFileList = appliedFiles[skill.name];
+      if (pendingLegacyUpgrade(skill, localSkill, previousState)) {
+        const { nativeUnavailable: _unavailable, ...previous } = previousNativeState(previousState, skill);
+        return [skill.name, { ...previous, verifiedAgentLinks: verifiedAgentLinks[skill.name] ?? {} }];
+      }
+      if (isNativeSkill(skill) && !nativeLocalReady(skill, localSkill)) {
+        const previous = previousNativeState(previousState, skill);
+        return [skill.name, { ...previous || {
+          cloudId: skill.id,
+          folderHash: localSkill?.nativeBaseFolderHash || "",
+          agentTargets: normalizeAgentTargets(skill.agent_targets),
+          syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString(),
+          ...localSkill?.nativeReference ? { nativeReference: localSkill.nativeReference, nativeScope: localSkill.nativeScope } : {}
+        }, nativeUnavailable: true, verifiedAgentLinks: {} }];
+      }
       return [
         skill.name,
         {
           cloudId: skill.id,
+          ...nativeState(skill),
           folderHash: localSkill?.folderHash || skill.skill_folder_hash || "",
           agentTargets: normalizeAgentTargets(skill.agent_targets),
+          verifiedAgentLinks: skill.status === "active" ? verifiedAgentLinks[skill.name] ?? {} : {},
+          cloudUpdatedAt: skill.updated_at,
+          ...!failedContentNames.has(skill.name) && !skill.skill_source_url ? { cloudContentHash: cloudContentHash(skill) } : {},
+          ...appliedCloudFolderHash !== void 0 ? { appliedCloudFolderHash } : {},
+          ...appliedFileList !== void 0 ? { appliedFiles: appliedFileList } : {},
           syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString()
         }
       ];
     })
   );
-  return {
+  for (const local of localSkills) {
+    if (!local.nativeReference || Object.values(skills).some((row) => row.cloudId === local.cloudId)) continue;
+    skills[local.name] = {
+      cloudId: local.cloudId,
+      nativeReference: local.nativeReference,
+      nativeScope: local.nativeScope,
+      nativeUnavailable: true,
+      verifiedAgentLinks: {},
+      folderHash: local.nativeBaseFolderHash || "",
+      agentTargets: normalizeAgentTargets(),
+      syncedAt: lastSyncedAt || (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  return retainMissingNativeState(previousState, {
     version: 1,
     lastSyncedAt,
     skills
-  };
+  });
 }
 function buildLocalSymlinkCandidates(pullResponse, localSkills, previousState) {
   const cloudSkillNames = new Set(
     pullResponse.skills.map((skill) => skill.name)
   );
-  const localOnlySkills = localSkills.filter((skill) => !cloudSkillNames.has(skill.name)).map((skill) => {
+  const localOnlySkills = localSkills.filter((skill) => !cloudSkillNames.has(skill.name)).filter((skill) => !skill.nativeReference && !previousState.skills[skill.name]?.nativeReference && !previousState.skills[skill.name]?.nativeUnavailable && !hasNativeFolderHistory(previousState, skill.name) && !/^native-[a-f0-9-]{36}$/.test(skill.name)).map((skill) => {
     const previous = previousState.skills[skill.name];
     return {
       id: previous?.cloudId || `local-${skill.name}`,
@@ -1227,7 +1768,7 @@ function buildLocalSymlinkCandidates(pullResponse, localSkills, previousState) {
       status: "active"
     };
   });
-  return [...pullResponse.skills, ...localOnlySkills];
+  return [...nativeLinkRows(pullResponse, localSkills, previousState), ...localOnlySkills];
 }
 function isEmptySyncState(state) {
   return state.lastSyncedAt === null && Object.keys(state.skills).length === 0;
@@ -1254,27 +1795,48 @@ function applyLegacyFirstRunState(localSkills, scopedState, legacyState) {
     skills: migratedSkills
   };
 }
-async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previousState, syncPaths, deps) {
+async function writePulledSkillsToScopedMirror(pullResponse, localSkills, previousState, syncPaths, deps, failures = [], writtenSkillNames = /* @__PURE__ */ new Set(), appliedFilesByName = {}, acknowledgedNative = /* @__PURE__ */ new Map()) {
   const localSkillMap = toSkillMap(localSkills);
   const warnSkillSync = (message, error) => {
     console.warn(`[Notis] ${message}`, error);
   };
   let downloaded = 0;
-  for (const cloudSkill of pullResponse.skills) {
-    if (!shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
+  for (const cloudSkill of selectCloudSkillsToApply(pullResponse.skills)) {
+    const local = localSkillMap.get(cloudSkill.name);
+    const acknowledged = isNativeSkill(cloudSkill) && local && acknowledgedNative.get(cloudSkill.id) === local.folderHash;
+    const legacyBaseline = Boolean(local && pendingLegacyUpgrade(cloudSkill, local, previousState) && previousNativeState(previousState, cloudSkill)?.folderHash === local.folderHash);
+    if (!acknowledged && !shouldWriteCloudSkill(cloudSkill, localSkillMap, previousState)) {
+      if (isNativeSkill(cloudSkill) && !nativeLocalReady(cloudSkill, local)) {
+        failures.push({ name: cloudSkill.name, error: "Local native Skill changes were retained; resolve the version or identity conflict before using them." });
+      }
       continue;
     }
-    if (await writeCloudSkillWithBundleFallback(cloudSkill, {
+    const outcome = await writeCloudSkillWithBundleFallback(cloudSkill, {
       downloadSkillBundle: deps.downloadSkillBundle,
-      writeCloudSkillToDisk: (skill, bundleBytes) => deps.writeCloudSkillToDisk(skill, bundleBytes, syncPaths),
+      writeCloudSkillToDisk: (skill, bundleBytes) => deps.writeCloudSkillToDisk(skill, bundleBytes, syncPaths, {
+        // What the last write put there. Everything else in the folder was
+        // produced locally and survives this one.
+        previouslyApplied: previousNativeState(previousState, skill)?.appliedFiles,
+        ...isNativeSkill(skill) && local ? { expectedFolderHash: local.folderHash } : {},
+        ...legacyBaseline ? { legacyBaseline } : {}
+      }),
       onWarning: warnSkillSync
-    })) {
+    });
+    if (outcome) {
       downloaded += 1;
+      writtenSkillNames.add(cloudSkill.name);
+      if (typeof outcome === "object" && Array.isArray(outcome.appliedFiles)) {
+        appliedFilesByName[cloudSkill.name] = outcome.appliedFiles;
+      }
+    } else {
+      failures.push({ name: cloudSkill.name, error: "Skill content could not be downloaded or written; sync will retry" });
     }
   }
   return downloaded;
 }
 function assertSkillsPullAuthorized(pullResponse) {
+  if (!Array.isArray(pullResponse.skills)) throw new Error("Skill inventory is unavailable; existing files were retained.");
+  assertNativePull(pullResponse);
   if (pullResponse.entitlement_access?.code === "entitlement_upgrade_required" && pullResponse.entitlement_access.entitlement === "skills") {
     throw new Error(
       "Skill sync access was denied; preserving existing local skills."
@@ -1292,68 +1854,108 @@ async function materializeCloudSkillsForLocalShell(serverUrl, jwt, dependencies
       "Cannot materialize skills without a valid authenticated desktop session."
     );
   }
-  const syncPaths = getSkillSyncPathsForUser(authUserId);
-  const pullResponse = await deps.pullSkills(serverUrl, jwt);
+  let pullResponse = await deps.pullSkills(serverUrl, jwt);
   assertSkillsPullAuthorized(pullResponse);
+  if (options.syncSettings) assertSyncEnvironment(pullResponse, options.syncSettings);
+  const syncPaths = getSkillSyncPathsForUser(options.canonicalUserId?.trim() || authUserId, void 0, pullResponse.sync_namespace);
   const previousState = await deps.readSyncState(syncPaths);
   const localSkills = await deps.scanLocalSkills(syncPaths);
+  pullResponse = bindNativeFolders(pullResponse, localSkills, previousState);
+  const failedDownloads = [];
+  const writtenSkillNames = /* @__PURE__ */ new Set();
+  const appliedFilesByName = {};
   const downloaded = await writePulledSkillsToScopedMirror(
     pullResponse,
     localSkills,
     previousState,
     syncPaths,
-    deps
+    deps,
+    failedDownloads,
+    writtenSkillNames,
+    appliedFilesByName
   );
   const finalLocalSkills = await deps.scanLocalSkills(syncPaths);
   const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
   const relinkSkillNames = new Set(options.relinkSkillNames || []);
+  const failures = [...failedDownloads];
+  const verifiedLinks = {};
+  for (const skill of pullResponse.skills) {
+    const previous = previousState.skills[skill.name];
+    if (skill.updated_at && previous?.cloudId === skill.id && previous.cloudUpdatedAt === skill.updated_at) {
+      verifiedLinks[skill.name] = { ...previous.verifiedAgentLinks };
+    }
+  }
   if (relinkSkillNames.size > 0) {
-    await deps.syncSymlinks(
-      pullResponse.skills.filter((skill) => relinkSkillNames.has(skill.name)),
+    const relinked = await deps.syncSymlinks(
+      nativeLinkRows(pullResponse, finalLocalSkills, previousState).filter((skill) => relinkSkillNames.has(skill.name)),
       syncPaths.skillsDir,
-      { removeUndesired: false }
+      { ...isolatedLinkOptions(syncPaths), removeUndesired: false }
     );
+    failures.push(...(relinked.failures ?? []).filter(
+      (failure) => !failedDownloads.some((download) => download.name === failure.name)
+    ));
+    for (const name of relinkSkillNames) {
+      verifiedLinks[name] = relinked.verifiedAgentLinks?.[name] ?? {};
+    }
   }
-  await deps.writeSyncState(
-    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt),
-    syncPaths
+  for (const failure of failedDownloads) delete verifiedLinks[failure.name];
+  const materializedState = buildSyncState(
+    pullResponse,
+    finalLocalSkills,
+    lastSyncedAt,
+    verifiedLinks,
+    new Set(failedDownloads.map((item) => item.name)),
+    collectAppliedCloudRevisions(pullResponse, previousState, writtenSkillNames),
+    collectAppliedFiles(pullResponse, previousState, appliedFilesByName),
+    previousState
   );
+  for (const [name, entry] of Object.entries(materializedState.skills)) {
+    if (writtenSkillNames.has(name)) continue;
+    const previous = previousState.skills[name];
+    if (previous) {
+      entry.folderHash = previous.folderHash;
+      entry.cloudContentHash = previous.cloudContentHash;
+    } else {
+      delete materializedState.skills[name];
+    }
+  }
+  materializedState.skills = { ...previousState.skills, ...materializedState.skills };
+  let removed = 0;
+  for (const [name, previous] of Object.entries(previousState.skills)) {
+    if (!previous.nativeReference && !previous.nativeUnavailable) continue;
+    const current = pullResponse.skills.find((skill) => skill.id === previous.cloudId);
+    const local = current && finalLocalSkills.find((row) => row.name === current.name);
+    if (!current || !nativeLocalReady(current, local) && !pendingLegacyUpgrade(current, local, previousState)) {
+      removed += await deps.removeAllSymlinksForSkill(name, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
+    }
+  }
+  await deps.writeSyncState(materializedState, syncPaths);
   return {
+    materializedSkillNames: pullResponse.skills.filter((skill) => finalLocalSkills.some((local) => local.name === skill.name) && (!isNativeSkill(skill) || skill.status === "active" && skill.agent_targets?.notis !== false && nativeLocalReady(skill, finalLocalSkills.find((local) => local.name === skill.name))) && !failedDownloads.some((failure) => failure.name === skill.name)).map((skill) => skill.name),
     pulled: pullResponse.skills.length,
     downloaded,
     deleted: 0,
-    removed: 0,
-    lastSyncedAt
+    removed,
+    lastSyncedAt,
+    ...failures.length ? { failedLinks: failures } : {}
   };
 }
-async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previousState, scopedState, skillsDir, deps) {
+async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previousState, scopedState, skillsDir, deps, failures, linkOptions) {
   if (isEmptySyncState(scopedState)) {
     return 0;
   }
   const deletions = await deps.detectDeletedAgentSymlinks(
-    pullResponse.skills,
+    pullResponse.skills.map((skill) => {
+      const previous = isNativeSkill(skill) ? Object.entries(previousState.skills).find(([, row]) => row.cloudId === skill.id) : void 0;
+      return previous ? { ...skill, name: previous[0] } : skill;
+    }),
     previousState,
-    skillsDir
+    skillsDir,
+    linkOptions
   );
   if (deletions.length === 0) {
     return 0;
   }
-  const latestSkillsById = new Map(pullResponse.skills.map((skill) => [skill.id, skill]));
-  let fresh = null;
-  try {
-    fresh = await deps.pullSkills(serverUrl, jwt);
-  } catch (error) {
-    console.warn(
-      "[skill-sync] Could not re-pull latest agent targets before deactivation; using the top-of-sync snapshot.",
-      error
-    );
-  }
-  if (fresh) {
-    assertSkillsPullAuthorized(fresh);
-    for (const skill of fresh.skills) {
-      latestSkillsById.set(skill.id, skill);
-    }
-  }
   const agentsBySkill = /* @__PURE__ */ new Map();
   for (const deletion of deletions) {
     const entry = agentsBySkill.get(deletion.skillId) ?? {
@@ -1363,37 +1965,57 @@ async function deactivateDeletedAgentSkills(serverUrl, jwt, pullResponse, previo
     entry.agents.add(deletion.agent);
     agentsBySkill.set(deletion.skillId, entry);
   }
-  const inMemoryById = new Map(pullResponse.skills.map((skill) => [skill.id, skill]));
+  const fresh = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+  assertSkillsPullAuthorized(fresh);
+  assertSyncEnvironment(fresh, pullResponse);
+  Object.assign(pullResponse, fresh);
+  let needsRefresh = false;
   let deactivated = 0;
   for (const [skillId, { skillName, agents }] of agentsBySkill) {
-    const latest = latestSkillsById.get(skillId);
-    if (!latest) {
-      continue;
-    }
-    const nextTargets = { ...normalizeAgentTargets(latest.agent_targets) };
-    for (const agent of agents) {
-      nextTargets[agent] = false;
-    }
+    const skill = pullResponse.skills.find((item) => item.id === skillId);
+    const previous = previousState.skills[skillName];
+    if (!skill) continue;
+    const native = isNativeSkill(skill);
+    if (native) {
+      if (!skill.native_settings || previous?.nativeSettingsRevision !== skill.native_settings.revision) continue;
+    } else if (!skill.updated_at || previous?.cloudUpdatedAt !== skill.updated_at) continue;
+    const patch = Object.fromEntries([...agents].map((agent) => [agent, false]));
     try {
-      await deps.updateAgentTargets(serverUrl, jwt, skillId, nextTargets);
-      const inMemory = inMemoryById.get(skillId);
-      if (inMemory) {
-        inMemory.agent_targets = nextTargets;
+      const saved = await deps.updateAgentTargets(
+        serverUrl,
+        jwt,
+        skillId,
+        patch,
+        native ? void 0 : skill.updated_at,
+        native ? { reference: skill.native_reference, settingsRevision: skill.native_settings.revision } : void 0
+      );
+      if (saved.success !== true || !saved.updated_at?.trim() || !native && saved.updated_at === skill.updated_at || !["notis", "claude_code", "cursor", "codex"].every((agent) => typeof saved.agent_targets?.[agent] === "boolean") || ![...agents].every((agent) => saved.agent_targets[agent] === false)) {
+        throw new Error("Assignment update did not return a verified saved revision");
       }
+      skill.agent_targets = saved.agent_targets;
+      skill.updated_at = saved.updated_at;
+      if (native) needsRefresh = true;
       deactivated += agents.size;
     } catch (error) {
-      console.warn(
-        `[skill-sync] Failed to deactivate "${skillName}" for ${[...agents].join(", ")} after local symlink deletion:`,
-        error
-      );
+      needsRefresh = true;
+      failures.push({ name: skillName, error: "Could not save the local agent removal; refreshed saved assignments" });
+      console.warn(`[skill-sync] Assignment changed or could not be saved for "${skillName}"; refreshing before reconciliation.`, error);
     }
   }
+  if (needsRefresh) {
+    const refreshed = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
+    assertSkillsPullAuthorized(refreshed);
+    assertSyncEnvironment(refreshed, pullResponse);
+    Object.assign(pullResponse, refreshed);
+  }
   return deactivated;
 }
 async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
+  const linkAgentFolders = options.linkAgentFolders !== false;
   const deps = {
     ...DEFAULT_RUN_SKILL_SYNC_DEPS,
-    ...dependencies
+    ...dependencies,
+    ...linkAgentFolders ? {} : MIRROR_ONLY_DEPS
   };
   const syncSettings = await deps.fetchSyncSettings(
     serverUrl,
@@ -1405,11 +2027,12 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
       "Cannot sync skills without a server-verified account identity."
     );
   }
-  const syncPaths = getSkillSyncPathsForUser(syncUserId);
-  const foreignLinksRemoved = await deps.removeForeignAccountSymlinks(
-    syncPaths.skillsDir
-  );
+  const syncPaths = getSkillSyncPathsForUser(syncUserId, void 0, syncSettings.sync_namespace, options.syncHome);
   if (options.honorSyncEnabled !== false && !syncSettings.sync_enabled) {
+    const foreignLinksRemoved2 = await deps.removeForeignAccountSymlinks(
+      syncPaths.skillsDir,
+      isolatedLinkOptions(syncPaths)
+    );
     return {
       syncEnabled: false,
       pushed: 0,
@@ -1418,7 +2041,7 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
       deleted: 0,
       deactivated: 0,
       linked: 0,
-      removed: foreignLinksRemoved,
+      removed: foreignLinksRemoved2,
       skipped: 0,
       lastSyncedAt: syncSettings.last_synced_at,
       failedPushes: []
@@ -1426,52 +2049,77 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
   }
   let pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
   assertSkillsPullAuthorized(pullResponse);
+  assertSyncEnvironment(pullResponse, syncSettings);
+  const foreignLinksRemoved = await deps.removeForeignAccountSymlinks(
+    syncPaths.skillsDir,
+    isolatedLinkOptions(syncPaths)
+  );
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
+    await forgetOtherAccountsAgentLinks(syncPaths);
+  }
   const cloudCuratedSkillNames = new Set(
     pullResponse.skills.filter((skill) => skill.source === "curated").map((skill) => skill.name)
   );
   const protectedSkillNames = /* @__PURE__ */ new Set([...cloudCuratedSkillNames, ...BASE_SKILL_NAMES]);
+  const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
+  const assignmentFailures = [];
+  const deactivated = linkAgentFolders && !syncPaths.isolatedNamespace && syncSettings.agent_targets_conditional_updates === true ? await deactivateDeletedAgentSkills(
+    serverUrl,
+    jwt,
+    pullResponse,
+    scopedState,
+    scopedState,
+    syncPaths.skillsDir,
+    deps,
+    assignmentFailures,
+    isolatedLinkOptions(syncPaths)
+  ) : 0;
+  assertSyncEnvironment(pullResponse, syncSettings);
   const authUserId = decodeJwtSubject(jwt);
   let previousAuthState = null;
-  if (authUserId && authUserId !== syncUserId) {
-    const previousAuthPaths = getSkillSyncPathsForUser(authUserId);
+  if (!syncPaths.isolatedNamespace && authUserId && authUserId !== syncUserId) {
+    const previousAuthPaths = getSkillSyncPathsForUser(authUserId, void 0, void 0, options.syncHome);
     previousAuthState = await deps.readSyncState(previousAuthPaths);
     await deps.gatherTopLevelLocalSkills(syncPaths, {
       sourceRoots: [{ label: "previous-auth-scope", root: previousAuthPaths.skillsDir }],
       protectedSkillNames
     });
   }
-  await deps.gatherTopLevelLocalSkills(syncPaths, {
-    protectedSkillNames
-  });
+  if (linkAgentFolders && !syncPaths.isolatedNamespace) {
+    await deps.gatherTopLevelLocalSkills(syncPaths, { protectedSkillNames });
+  }
   const localSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
-  const scopedState = withoutBaseSkillState(await deps.readSyncState(syncPaths));
   const previousState = withoutBaseSkillState(applyLegacyFirstRunState(
     localSkills,
     scopedState,
-    isEmptySyncState(scopedState) ? !previousAuthState || isEmptySyncState(previousAuthState) ? await deps.readLegacySyncState(syncPaths) : previousAuthState : null
+    !syncPaths.isolatedNamespace && isEmptySyncState(scopedState) ? !previousAuthState || isEmptySyncState(previousAuthState) ? await deps.readLegacySyncState(syncPaths) : previousAuthState : null
   ));
-  const deactivated = await deactivateDeletedAgentSkills(
-    serverUrl,
-    jwt,
-    pullResponse,
-    previousState,
-    scopedState,
-    syncPaths.skillsDir,
-    deps
-  );
-  await deps.syncSymlinks(
+  pullResponse = bindNativeFolders(pullResponse, localSkills, previousState);
+  const gatheredSymlinkResult = await deps.syncSymlinks(
     buildLocalSymlinkCandidates(pullResponse, localSkills, previousState),
-    syncPaths.skillsDir
+    syncPaths.skillsDir,
+    isolatedLinkOptions(syncPaths)
   );
   const pushCandidates = getPushCandidates(
     localSkills,
     previousState,
     cloudCuratedSkillNames,
-    new Set(pullResponse.skills.map((skill) => skill.name))
+    new Set(pullResponse.skills.map((skill) => skill.name)),
+    pullResponse.skills
   );
   const failedPushes = [];
+  const acknowledgedNative = /* @__PURE__ */ new Map();
+  let writeLocalSkills = localSkills;
   if (pushCandidates.length > 0) {
     const pushResult = await deps.pushChangedSkills(serverUrl, jwt, pushCandidates);
+    for (const result of pushResult.skills || []) {
+      const saved = result;
+      const candidate = pushCandidates.find((local) => local.nativeReference && local.cloudId === saved.id);
+      if (candidate && saved.native_reference) {
+        checkedNativeReference(saved.native_reference, candidate.cloudId);
+        acknowledgedNative.set(candidate.cloudId, candidate.folderHash);
+      }
+    }
     if (Array.isArray(pushResult?.failed) && pushResult.failed.length > 0) {
       failedPushes.push(...pushResult.failed);
       console.warn(
@@ -1480,31 +2128,58 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     }
     pullResponse = withoutBaseSkills(await deps.pullSkills(serverUrl, jwt));
     assertSkillsPullAuthorized(pullResponse);
+    assertSyncEnvironment(pullResponse, syncSettings);
+    writeLocalSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
+    pullResponse = bindNativeFolders(pullResponse, writeLocalSkills, previousState);
   }
   const cloudSkillNames = new Set(pullResponse.skills.map((s) => s.name));
   let deleted = 0;
   for (const skillName of Object.keys(previousState.skills)) {
     if (!cloudSkillNames.has(skillName)) {
+      const previous = previousState.skills[skillName];
+      if (previous.nativeReference || previous.nativeUnavailable || pullResponse.skills.some((skill) => isNativeSkill(skill) && skill.id === previous.cloudId)) {
+        await deps.removeAllSymlinksForSkill(skillName, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
+        continue;
+      }
       await deps.deleteLocalSkill(skillName, syncPaths);
-      await deps.removeAllSymlinksForSkill(skillName, syncPaths.skillsDir);
+      await deps.removeAllSymlinksForSkill(skillName, syncPaths.skillsDir, isolatedLinkOptions(syncPaths));
       deleted += 1;
     }
   }
+  const failedDownloads = [];
+  const writtenSkillNames = /* @__PURE__ */ new Set();
+  const appliedFilesByName = {};
   const downloaded = await writePulledSkillsToScopedMirror(
     pullResponse,
-    localSkills,
+    writeLocalSkills,
     previousState,
     syncPaths,
-    deps
+    deps,
+    failedDownloads,
+    writtenSkillNames,
+    appliedFilesByName,
+    acknowledgedNative
   );
   const finalLocalSkills = (await deps.scanLocalSkills(syncPaths)).filter((skill) => !BASE_SKILL_NAMES.has(skill.name));
   const symlinkResult = await deps.syncSymlinks(
     buildLocalSymlinkCandidates(pullResponse, finalLocalSkills, previousState),
-    syncPaths.skillsDir
+    syncPaths.skillsDir,
+    isolatedLinkOptions(syncPaths)
   );
+  const verifiedLinks = { ...symlinkResult.verifiedAgentLinks ?? {} };
+  for (const failure of failedDownloads) delete verifiedLinks[failure.name];
   const lastSyncedAt = pullResponse.last_synced_at || (/* @__PURE__ */ new Date()).toISOString();
   await deps.writeSyncState(
-    buildSyncState(pullResponse, finalLocalSkills, lastSyncedAt),
+    buildSyncState(
+      pullResponse,
+      finalLocalSkills,
+      lastSyncedAt,
+      verifiedLinks,
+      new Set(failedDownloads.map((item) => item.name)),
+      collectAppliedCloudRevisions(pullResponse, previousState, writtenSkillNames),
+      collectAppliedFiles(pullResponse, previousState, appliedFilesByName),
+      previousState
+    ),
     syncPaths
   );
   return {
@@ -1514,15 +2189,21 @@ async function runSkillSync(serverUrl, jwt, dependencies = {}, options = {}) {
     downloaded,
     deleted,
     deactivated,
-    linked: symlinkResult.linked,
-    removed: foreignLinksRemoved + symlinkResult.removed,
+    linked: gatheredSymlinkResult.linked + symlinkResult.linked,
+    removed: foreignLinksRemoved + gatheredSymlinkResult.removed + symlinkResult.removed,
     skipped: symlinkResult.skipped,
+    failedLinks: [...assignmentFailures, ...failedDownloads, ...(symlinkResult.failures ?? []).filter(
+      (failure) => !failedDownloads.some((download) => download.name === failure.name)
+    )],
     lastSyncedAt,
     failedPushes
   };
 }
 export {
+  fetchSyncSettings,
+  isolatedLinkOptions,
   materializeCloudSkillsForLocalShell,
-  runSkillSync
+  runSkillSync,
+  shouldWriteCloudSkill
 };
 //# sourceMappingURL=index.js.map