@nowcrew/daemon 0.5.34 → 0.5.36

package/README.md

@@ -166,6 +166,52 @@ Old daemons that omit `executionRuntimes` are conservatively interpreted as the
 CLIs and server-supported adapters. Unknown required protocol semantics are rejected before side effects.
 Protocol-0 `agent:start` remains only for the server-governed compatibility window.
 
+## Project Skills
+
+On macOS and Linux, an owner or admin can register multiple local project repositories from a Computer
+profile and bind selected Skills to individual Agents. The daemon keeps the only durable copy of each
+absolute path in:
+
+```text
+<CREW_AGENTS_ROOT>/.crew/projects.json
+```
+
+Each project is scanned at `<project>/.agents/skills/*/SKILL.md`. The server stores only a bounded,
+path-free inventory and logical `(projectId, skillName)` bindings. The local path crosses the server only
+while an add command is forwarded to the selected online Computer; it is not written to the workspace
+database, structured logs, inventory frames, or responses. Project Skills are disabled on Windows.
+
+One binding set is projected into both Runtime discovery layouts:
+
+```text
+<agentsRoot>/<handle>/.agents/skills/<name>                         # Codex symlink
+<agentsRoot>/<handle>/.crew/claude-skills/.claude/skills/<name>    # Claude symlink
+```
+
+The two complete directories switch under one per-Agent reconcile/launch lock. A failed switch restores
+the prior complete projection; a missing project or Skill removes only that link and does not block other
+work. These are ordinary writable symlinks, not snapshots or a sandbox: an Agent running as the daemon
+user can modify the source Skill through them. That write-through risk is intentionally accepted.
+
+Codex protocol-v1 task directories are opaque
+`<agentsRoot>/<handle>/tasks/<safe-prefix>-<sha256>` paths. The daemon writes `.nowwork-root` at the Agent
+root and adds it to Codex `project_root_markers`, so upward discovery reaches `.agents/skills` without
+changing the task cwd. Claude receives
+`--add-dir <agentsRoot>/<handle>/.crew/claude-skills`; Claude treats those Skills as `projectSettings`,
+so a machine policy that disables project settings also disables this source even when the projection is
+healthy.
+
+Existing user-level discovery is unchanged. Claude may still load `~/.claude/skills`; Codex may still
+load `$CODEX_HOME/skills`. The DeepSeek Codex variant uses its Agent-private `.codex-deepseek` home.
+Project bindings do not hide or rewrite any of those sources.
+
+Binding changes reconcile immediately when the Computer is online. On reconnect the server sends the
+complete binding set for every Agent assigned to that Computer, including empty sets that clear stale
+links left by offline unbinds. Every non-empty execution snapshot is also reconciled immediately before
+Runtime launch, which recovers from a missed notification or daemon restart. Skill file content changes
+are visible through the symlink immediately; adding, deleting, renaming, or changing frontmatter requires
+a rescan. Web descriptions remain at the last inventory value until that rescan.
+
 ## Reliability
 
 Protocol-v1 lifecycle is `accepted → started → completed`, followed by a server

package/dist/atomic-private-write.js

@@ -0,0 +1,18 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+export async function atomicPrivateWrite(path, content, beforeCommit) {
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await beforeCommit?.(temporary);
+        await rename(temporary, path);
+        await chmod(path, 0o600);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}

package/dist/computer-profile.js

@@ -1,13 +1,13 @@
-import { access, chmod, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { access, readFile, readdir, rm, stat } from "node:fs/promises";
 import { constants } from "node:fs";
 import { realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, posix, resolve, win32 } from "node:path";
-import { randomUUID } from "node:crypto";
+import { posix, resolve, win32 } from "node:path";
 import { spawn } from "node:child_process";
 import { z } from "zod";
 import { acquireProfileSaveLock, } from "./computer-profile-lock.js";
 import { formatDaemonText } from "./i18n.js";
+import { atomicPrivateWrite } from "./atomic-private-write.js";
 const PROFILE_NAME = /^[a-z0-9][a-z0-9_-]{0,47}$/;
 const ServerUrlSchema = z.string().url().max(2048).refine((value) => {
     const url = new URL(value);
@@ -130,20 +130,6 @@ export function validateProfileName(name) {
 export function profilePath(name, home = daemonHome()) {
     return resolve(home, "profiles", `${validateProfileName(name)}.json`);
 }
-async function atomicPrivateWrite(path, content, beforeCommit) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    await chmod(dirname(path), 0o700);
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    try {
-        await writeFile(temporary, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
-        await beforeCommit?.(temporary);
-        await rename(temporary, path);
-        await chmod(path, 0o600);
-    }
-    finally {
-        await rm(temporary, { force: true });
-    }
-}
 const DPAPI_PROTECT = "$p=[Console]::In.ReadToEnd();$b=[Text.Encoding]::UTF8.GetBytes($p);$e=[Security.Cryptography.ProtectedData]::Protect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Convert]::ToBase64String($e)";
 const DPAPI_UNPROTECT = "$p=[Console]::In.ReadToEnd();$b=[Convert]::FromBase64String($p);$d=[Security.Cryptography.ProtectedData]::Unprotect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Text.Encoding]::UTF8.GetString($d))";
 async function powershellStdin(script, input) {

package/dist/execution-protocol.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { MAX_AGENT_PROJECT_SKILL_BINDINGS } from "./project-skills/types.js";
 const ExecutionIdSchema = z.string().uuid();
 const ProtocolVersionSchema = z.literal(1);
 const TimestampSchema = z.string().datetime({ offset: true });
@@ -10,13 +11,17 @@ const ExitCodeSchema = z.number().int().min(MIN_SIGNED_32_INTEGER).max(MAX_PG_IN
 const RuntimeSchema = z.enum(["claude", "codex", "kimi"]);
 const UnsafePathCharacterSchema = /[\p{Cc}<>:"/\\|?*]/u;
 const WindowsReservedNameSchema = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
-const AgentHandleSchema = z.string().min(1).max(64).refine((handle) => handle !== "."
+export const AgentHandleSchema = z.string().min(1).max(64).refine((handle) => handle !== "."
     && handle !== ".."
     && !UnsafePathCharacterSchema.test(handle)
     && !WindowsReservedNameSchema.test(handle)
     && !handle.endsWith(".")
     && !handle.endsWith(" ")
     && Buffer.byteLength(handle, "utf8") <= 255, "agent handle must be a cross-platform safe filesystem component");
+const ProjectSkillRefSchema = z.object({
+    projectId: z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9._-]*$/u),
+    skillName: z.string().min(1).max(128).regex(/^[a-z0-9][a-z0-9._:-]*$/u),
+}).strict();
 export const ReasoningSchema = z.enum([
     "default",
     "none",
@@ -99,6 +104,7 @@ export const ExecutionStartSchema = z.object({
         id: z.string().min(1),
         handle: AgentHandleSchema,
         memoryEnabled: z.boolean().optional(),
+        projectSkills: z.array(ProjectSkillRefSchema).max(MAX_AGENT_PROJECT_SKILL_BINDINGS).optional(),
     }).strict(),
     workspace: z.object({
         taskKey: z.string().min(1).max(200),

package/dist/execution-runner.js

@@ -505,6 +505,7 @@ export async function runExecution(config, input, dependencies) {
             ...(dependencies.startupTimeoutMs === undefined
                 ? {}
                 : { startupTimeoutMs: dependencies.startupTimeoutMs }),
+            ...(dependencies.projectSkills === undefined ? {} : { projectSkills: dependencies.projectSkills }),
             launchRuntime: async (request) => {
                 if (launchClosed || dependencies.cancellation?.isRequested())
                     throw new ExecutionCancelledError();
@@ -572,6 +573,7 @@ export async function runExecution(config, input, dependencies) {
             ...(spec.workspace.resumeKey === undefined ? {} : { resumeKey: spec.workspace.resumeKey }),
             ...(spec.context.wakeMessageId === undefined ? {} : { wakeMessageId: spec.context.wakeMessageId }),
             ...(spec.context.attachments === undefined ? {} : { attachments: spec.context.attachments }),
+            ...(spec.agent.projectSkills === undefined ? {} : { projectSkills: spec.agent.projectSkills }),
             systemPrompt: boundedSystemPrompt,
             wakePrompt: spec.instructions.wakePrompt,
             runtime: {

package/dist/local-executor.js

@@ -18,6 +18,19 @@ import { routeRuntimeAttachments, runtimeCapability, } from "./runtime-capabilit
 import { awaitWithCancellation, RuntimeCancelledError, } from "./runtime-cancellation.js";
 import { isRuntimeReadyEvent, } from "./runtime-startup-gate.js";
 import { dslog } from "./slog.js";
+import { inspectMemoryPruneFiles, parseMemoryPruneTraceId, } from "./memory-prune-diagnostics.js";
+function memoryPruneSnapshotFields(snapshot) {
+    const fields = {};
+    for (const [label, fact] of Object.entries(snapshot)) {
+        fields[`${label}_exists`] = fact.exists;
+        fields[`${label}_size`] = fact.size;
+        fields[`${label}_mtime_ms`] = fact.mtime_ms;
+        fields[`${label}_sha256`] = fact.sha256;
+        fields[`${label}_hash_skipped_reason`] = fact.hash_skipped_reason;
+        fields[`${label}_error`] = fact.error;
+    }
+    return fields;
+}
 function truncateUtf8(value, maxBytes) {
     if (maxBytes <= 0)
         return "";
@@ -116,6 +129,9 @@ async function launchLegacyRuntime(request) {
             ...common,
             systemPromptPath: request.systemPromptPath,
             wakePrompt: request.wakePrompt,
+            ...(request.agentRoot === undefined ? {} : {
+                projectSkillsDirectory: join(request.agentRoot, ".crew", "claude-skills"),
+            }),
             ...(request.sessionId === undefined ? {} : {
                 sessionId: request.sessionId,
                 resume: request.resume,
@@ -201,6 +217,10 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     let materialized = null;
     let knownAttachmentDirectory = null;
     let startupReservation = null;
+    let memoryPruneTraceId = null;
+    let memoryPruneRuntimeExitCode;
+    let memoryPruneExecutorCompleted = false;
+    let memoryPruneFailurePhase = "diagnostics_before";
     try {
         if (isDeepSeekCodex && !providerConfig.providerApiKey) {
             throw new Error("DeepSeek API key is not configured for this Agent");
@@ -265,7 +285,20 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
         }
         const attachmentPlan = routeRuntimeAttachments(runtime.name, materialized?.attachments ?? []);
         const wakePrompt = `${resolvePrompt(input.wakePrompt, promptContext)}${attachmentPlan.promptSuffix}`;
+        memoryPruneTraceId = parseMemoryPruneTraceId(wakePrompt);
+        if (memoryPruneTraceId !== null) {
+            const snapshot = await inspectMemoryPruneFiles(workspace.dir, workspace.workLogPath);
+            dslog("memory_prune.files_before", "长期记忆收尾执行前文件指纹", {
+                execution_id: input.executionId,
+                agent_handle: input.handle,
+                task_key: input.taskKey,
+                prune_trace_id: memoryPruneTraceId,
+                ...memoryPruneSnapshotFields(snapshot),
+            });
+        }
+        memoryPruneFailurePhase = "prompt_write";
         await awaitWithCancellation(writeFile(workspace.systemPromptPath, systemPrompt, "utf8"), dependencies.cancellation);
+        memoryPruneFailurePhase = "runtime_prepare";
         const inheritedEnv = { ...process.env };
         for (const key of Object.keys(inheritedEnv)) {
             if (key.startsWith("CREW_AGENT_MEMORY_"))
@@ -318,10 +351,12 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             }
         }
         const runtimeLaunchAt = Date.now();
-        const child = await launchRuntime({
+        memoryPruneFailurePhase = "runtime_launch";
+        const launchRequest = {
             runtime: runtime.name,
             bin: runtime.name,
             cwd: workspace.runDir,
+            ...(input.projectSkills === undefined ? {} : { agentRoot: workspace.dir }),
             systemPromptPath: workspace.systemPromptPath,
             systemPrompt,
             wakePrompt,
@@ -334,7 +369,11 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             ...(attachmentPlan.nativeImagePaths.length > 0
                 ? { imagePaths: attachmentPlan.nativeImagePaths }
                 : {}),
-        });
+        };
+        const child = input.projectSkills !== undefined && dependencies.projectSkills !== undefined
+            ? await dependencies.projectSkills.prepareAndLaunch(input.launch.agentsRoot, input.handle, input.projectSkills, () => launchRuntime(launchRequest))
+            : await launchRuntime(launchRequest);
+        memoryPruneFailurePhase = "runtime_execution";
         if (child.cancel !== undefined) {
             dependencies.cancellation?.register(child.cancel);
         }
@@ -449,6 +488,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             throw error;
         }
         const { exitCode, spawnError, terminationSignal } = runtimeExit;
+        memoryPruneRuntimeExitCode = exitCode;
         const errorTail = [
             stderrTail.trim(),
             spawnError,
@@ -463,6 +503,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
             }
         }
         if (input.session.enabled && supportsNativeResume && sessionId) {
+            memoryPruneFailurePhase = "session_finalize";
             const contextTokens = usage
                 ? usage.inputTokens + usage.cacheReadTokens + usage.cacheCreationTokens
                 : (resuming ? prior?.contextTokens : undefined);
@@ -476,6 +517,7 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
                 ...(contextTokens === undefined ? {} : { contextTokens }),
             });
         }
+        memoryPruneExecutorCompleted = true;
         return {
             workspaceRunDir: workspace.runDir,
             exitCode,
@@ -498,6 +540,27 @@ async function executeLocalUnlocked(input, callbacks, dependencies) {
     }
     finally {
         startupReservation?.release();
+        if (memoryPruneTraceId !== null) {
+            const snapshot = await inspectMemoryPruneFiles(workspace.dir, workspace.workLogPath);
+            dslog("memory_prune.files_after", "长期记忆收尾执行后文件指纹", {
+                execution_id: input.executionId,
+                agent_handle: input.handle,
+                task_key: input.taskKey,
+                prune_trace_id: memoryPruneTraceId,
+                runtime_exit_code: memoryPruneRuntimeExitCode,
+                executor_outcome: memoryPruneExecutorCompleted ? "succeeded" : "failed",
+                ...memoryPruneSnapshotFields(snapshot),
+            });
+            dslog("memory_prune.execution_completed", "长期记忆收尾执行结束", {
+                execution_id: input.executionId,
+                agent_handle: input.handle,
+                task_key: input.taskKey,
+                prune_trace_id: memoryPruneTraceId,
+                executor_outcome: memoryPruneExecutorCompleted ? "succeeded" : "failed",
+                runtime_exit_code: memoryPruneRuntimeExitCode,
+                ...(memoryPruneExecutorCompleted ? {} : { failure_phase: memoryPruneFailurePhase }),
+            });
+        }
         const attachmentDirectories = new Set([
             ...(knownAttachmentDirectory === null ? [] : [knownAttachmentDirectory]),
             ...(materialized === null ? [] : [materialized.directory]),

package/dist/machine-info.js

@@ -27,7 +27,11 @@ export const DAEMON_CAPABILITIES = [
     "execution_answer_stream_v1",
     "execution_machine_queue_v1",
     "execution_agent_memory_policy_v1",
+    "project_skills_v1",
 ];
+export const daemonCapabilities = (runtimePlatform = process.platform) => runtimePlatform === "darwin" || runtimePlatform === "linux"
+    ? DAEMON_CAPABILITIES
+    : DAEMON_CAPABILITIES.filter((capability) => capability !== "project_skills_v1");
 export const EXECUTION_PROTOCOL = Object.freeze({ min: 1, max: 1 });
 /** 候选 runtime CLI:展示名 → 可执行文件名。 */
 const RUNTIME_BINS = [
@@ -117,7 +121,7 @@ export async function collectMachineHello(agentsRoot, executionLimits, runtimePl
         daemonVersion: daemonVersion(),
         runtimes,
         executionRuntimes,
-        capabilities: [...DAEMON_CAPABILITIES, ...additionalCapabilities],
+        capabilities: [...daemonCapabilities(runtimePlatform), ...additionalCapabilities],
         ...(backend.supported ? {
             executionProtocol: EXECUTION_PROTOCOL,
             executionLimits: Object.freeze({

package/dist/memory-prune-diagnostics.js

@@ -0,0 +1,57 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { join } from "node:path";
+const TRACE_PATTERN = /\[memory-prune trace_id=([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\]/i;
+export const MEMORY_PRUNE_HASH_LIMIT_BYTES = 10 * 1024 * 1024;
+export function parseMemoryPruneTraceId(wakePrompt) {
+    return TRACE_PATTERN.exec(wakePrompt)?.[1] ?? null;
+}
+async function inspectFile(path) {
+    let metadata;
+    try {
+        metadata = await stat(path);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return { exists: false };
+        return { exists: false, error: code ?? (error instanceof Error ? error.name : "unknown") };
+    }
+    const fact = { exists: true, size: metadata.size, mtime_ms: metadata.mtimeMs };
+    if (!metadata.isFile())
+        return { ...fact, hash_skipped_reason: "not_regular_file" };
+    if (metadata.size > MEMORY_PRUNE_HASH_LIMIT_BYTES) {
+        return { ...fact, hash_skipped_reason: "file_too_large" };
+    }
+    try {
+        const hash = createHash("sha256");
+        let bytesRead = 0;
+        const stream = createReadStream(path);
+        try {
+            for await (const chunk of stream) {
+                bytesRead += chunk.length;
+                if (bytesRead > MEMORY_PRUNE_HASH_LIMIT_BYTES) {
+                    return { ...fact, hash_skipped_reason: "grew_too_large" };
+                }
+                hash.update(chunk);
+            }
+        }
+        finally {
+            stream.destroy();
+        }
+        return { ...fact, sha256: hash.digest("hex") };
+    }
+    catch (error) {
+        const code = error.code;
+        return { ...fact, error: code ?? (error instanceof Error ? error.name : "unknown") };
+    }
+}
+export async function inspectMemoryPruneFiles(homeDir, workLogPath) {
+    const [memory, lessons, workLog] = await Promise.all([
+        inspectFile(join(homeDir, "MEMORY.md")),
+        inspectFile(join(homeDir, "notes", "lessons.md")),
+        inspectFile(workLogPath),
+    ]);
+    return { memory, lessons, work_log: workLog };
+}

package/dist/project-skills/agent-projection-coordinator.js

@@ -0,0 +1,10 @@
+import { createKeyedPromiseTail } from "../promise-tail.js";
+export function createAgentProjectionCoordinator() {
+    const tails = createKeyedPromiseTail();
+    return {
+        runExclusive(agentsRoot, handle, operation) {
+            const key = JSON.stringify([agentsRoot, handle]);
+            return tails.enqueue(key, operation);
+        },
+    };
+}

package/dist/project-skills/controller.js

@@ -0,0 +1,167 @@
+import { z } from "zod";
+import { scanProjects } from "./scanner.js";
+import { ProjectRegistryError } from "./registry.js";
+import { isProjectId, isProjectSkillName, MAX_AGENT_PROJECT_SKILL_BINDINGS, } from "./types.js";
+import { AgentHandleSchema } from "../execution-protocol.js";
+import { createPromiseTail } from "../promise-tail.js";
+const ProjectIdSchema = z.string().refine(isProjectId);
+const ProjectCommandSchema = z.discriminatedUnion("type", [
+    z.object({
+        type: z.literal("project:add"),
+        reqId: z.string().min(1).max(128),
+        projectId: ProjectIdSchema,
+        root: z.string().min(1).max(4_096),
+    }).strict(),
+    z.object({
+        type: z.literal("project:remove"),
+        reqId: z.string().min(1).max(128),
+        projectId: ProjectIdSchema,
+    }).strict(),
+    z.object({
+        type: z.literal("project:rescan"),
+        reqId: z.string().min(1).max(128),
+        projectId: ProjectIdSchema,
+    }).strict(),
+    z.object({
+        type: z.literal("agent:skills:sync"),
+        reqId: z.string().min(1).max(128),
+        handle: AgentHandleSchema,
+        bindings: z.array(z.object({
+            projectId: ProjectIdSchema,
+            skillName: z.string().refine(isProjectSkillName),
+        }).strict()).max(MAX_AGENT_PROJECT_SKILL_BINDINGS),
+    }).strict(),
+]);
+const DEFAULT_PROJECT_SCAN_TIMEOUT_MS = 10_000;
+class ProjectScanTimeoutError extends Error {
+    code = "project_scan_timeout";
+    constructor() {
+        super("project_scan_timeout");
+        this.name = "ProjectScanTimeoutError";
+    }
+}
+const withinScanDeadline = async (operation, timeoutMs) => {
+    let timer;
+    try {
+        return await Promise.race([
+            operation,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new ProjectScanTimeoutError()), timeoutMs);
+                timer.unref?.();
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+};
+export function createProjectSkillsController(deps) {
+    let scanned = Object.freeze([]);
+    const operationTail = createPromiseTail();
+    let initialization = null;
+    let initializationState = "idle";
+    const scan = deps.scan ?? scanProjects;
+    const scanTimeoutMs = deps.scanTimeoutMs ?? DEFAULT_PROJECT_SCAN_TIMEOUT_MS;
+    const scanCurrent = async (deferredProjectId) => withinScanDeadline(scan(await deps.registry.list(), undefined, [
+        ...scanned
+            .map((project) => project.inventory.projectId)
+            .filter((projectId) => projectId !== deferredProjectId),
+        ...(deferredProjectId === undefined ? [] : [deferredProjectId]),
+    ]), scanTimeoutMs);
+    const refresh = async (deferredProjectId) => {
+        const next = await scanCurrent(deferredProjectId);
+        scanned = next;
+    };
+    const publishCurrent = async () => {
+        await deps.publish(Object.freeze({
+            type: "machine:projects",
+            projects: Object.freeze(scanned.map((project) => project.inventory)),
+        }));
+    };
+    const enqueue = (operation) => operationTail.enqueue(operation);
+    const initialize = () => {
+        if (initializationState === "ready" && initialization !== null)
+            return initialization;
+        if (initializationState === "initializing" && initialization !== null)
+            return initialization;
+        initializationState = "initializing";
+        const attempt = enqueue(refresh).then(() => { initializationState = "ready"; }, (error) => {
+            initializationState = "failed";
+            if (initialization === attempt)
+                initialization = null;
+            throw error;
+        });
+        initialization = attempt;
+        return attempt;
+    };
+    return {
+        initialize,
+        publishCurrent: () => enqueue(publishCurrent),
+        scannedProjects: () => scanned,
+        async handle(input) {
+            const parsed = ProjectCommandSchema.safeParse(input);
+            if (!parsed.success)
+                return { ok: false, error: "invalid_project_command" };
+            if (parsed.data.type === "agent:skills:sync") {
+                try {
+                    await initialize();
+                }
+                catch {
+                    return { ok: false, error: "project_skills_unavailable" };
+                }
+            }
+            return enqueue(async () => {
+                const command = parsed.data;
+                try {
+                    if (command.type === "agent:skills:sync") {
+                        if (deps.reconcile === undefined)
+                            return { ok: false, error: "skill_projection_failed" };
+                        return {
+                            ok: true,
+                            data: { bindings: await deps.reconcile(command.handle, command.bindings) },
+                        };
+                    }
+                    if (command.type === "project:add") {
+                        const existed = (await deps.registry.list())
+                            .some((project) => project.projectId === command.projectId);
+                        await deps.registry.add(command.projectId, command.root);
+                        const next = await scanCurrent();
+                        const added = next.find((project) => project.inventory.projectId === command.projectId);
+                        if (!existed && added?.inventory.errorCode === "machine_project_skill_limit_exceeded") {
+                            await deps.registry.remove(command.projectId);
+                            return { ok: false, error: "machine_project_skill_limit_exceeded" };
+                        }
+                        scanned = next;
+                    }
+                    else if (command.type === "project:remove") {
+                        await deps.registry.remove(command.projectId);
+                    }
+                    else {
+                        const projects = await deps.registry.list();
+                        if (!projects.some((project) => project.projectId === command.projectId)) {
+                            return { ok: false, error: "project_not_found" };
+                        }
+                    }
+                    if (command.type !== "project:add") {
+                        await refresh(command.type === "project:rescan" ? command.projectId : undefined);
+                    }
+                    await publishCurrent();
+                    return { ok: true, data: { projectId: command.projectId } };
+                }
+                catch (error) {
+                    return {
+                        ok: false,
+                        error: error instanceof ProjectRegistryError
+                            ? error.code
+                            : error.code === "skill_name_conflict"
+                                ? "skill_name_conflict"
+                                : error.code === "skill_projection_failed"
+                                    ? "skill_projection_failed"
+                                    : "project_operation_failed",
+                    };
+                }
+            });
+        },
+    };
+}