@omnidev-ai/cli 0.14.0 → 0.17.0

package/dist/index.js

@@ -1243,6 +1243,15 @@ var init_stringify = __esm(() => {
 });
 
 // ../../node_modules/.bun/smol-toml@1.6.0/node_modules/smol-toml/dist/index.js
+var exports_dist = {};
+__export(exports_dist, {
+  stringify: () => stringify,
+  parse: () => parse,
+  default: () => dist_default,
+  TomlError: () => TomlError,
+  TomlDate: () => TomlDate
+});
+var dist_default;
 var init_dist = __esm(() => {
   init_parse();
   init_stringify();
@@ -1275,6 +1284,43 @@ var init_dist = __esm(() => {
    * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
    * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    */
+  dist_default = { parse, stringify, TomlDate, TomlError };
+});
+
+// ../core/src/providers.ts
+function normalizeProviderId(provider) {
+  if (provider in PROVIDER_ALIAS_MAP) {
+    return PROVIDER_ALIAS_MAP[provider];
+  }
+  throw new Error(`Unknown provider: ${provider}`);
+}
+function normalizeProviderApplicability(value, fieldName) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${fieldName} must be a table of provider = boolean entries`);
+  }
+  const normalized = {};
+  for (const [rawProvider, rawEnabled] of Object.entries(value)) {
+    if (typeof rawEnabled !== "boolean") {
+      throw new Error(`${fieldName}.${rawProvider} must be a boolean`);
+    }
+    const canonicalProvider = normalizeProviderId(rawProvider);
+    const existing = normalized[canonicalProvider];
+    if (existing !== undefined && existing !== rawEnabled) {
+      throw new Error(`Conflicting provider entries in ${fieldName}: ${rawProvider} maps to ${canonicalProvider}`);
+    }
+    normalized[canonicalProvider] = rawEnabled;
+  }
+  return normalized;
+}
+var PROVIDER_ALIAS_MAP;
+var init_providers = __esm(() => {
+  PROVIDER_ALIAS_MAP = {
+    claude: "claude-code",
+    "claude-code": "claude-code",
+    codex: "codex",
+    cursor: "cursor",
+    opencode: "opencode"
+  };
 });
 
 // ../core/src/config/parser.ts
@@ -1301,6 +1347,9 @@ function validateCapabilityConfig(parsed) {
   if (typeof capability["version"] !== "string") {
     throw new Error("capability.version is required in capability.toml");
   }
+  if (capability["providers"] !== undefined) {
+    capability["providers"] = normalizeProviderApplicability(capability["providers"], "capability.providers");
+  }
 }
 function parseCapabilityConfig(tomlContent) {
   try {
@@ -1314,6 +1363,7 @@ function parseCapabilityConfig(tomlContent) {
 }
 var init_parser = __esm(() => {
   init_dist();
+  init_providers();
 });
 
 // ../core/src/hooks/constants.ts
@@ -2401,21 +2451,122 @@ var init_loader = __esm(() => {
   init_constants();
 });
 
-// ../core/src/capability/rules.ts
-import { existsSync as existsSync6, readdirSync as readdirSync3 } from "node:fs";
+// ../core/src/capability/mcp-env.ts
+import { existsSync as existsSync6 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
-import { basename as basename3, join as join4 } from "node:path";
+import { join as join4 } from "node:path";
+import { parseEnv } from "node:util";
+function hasEnvPlaceholder(value) {
+  return ENV_PLACEHOLDER_DETECTOR.test(value);
+}
+function mergeEnvSources(capabilityEnv) {
+  const merged = { ...capabilityEnv };
+  for (const [key, value] of Object.entries(process.env)) {
+    if (typeof value === "string") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+async function loadCapabilityEnv(capabilityPath) {
+  const envPath = join4(capabilityPath, CAPABILITY_ENV_FILE);
+  if (!existsSync6(envPath)) {
+    return {};
+  }
+  const envContent = await readFile3(envPath, "utf-8");
+  return Object.fromEntries(Object.entries(parseEnv(envContent)).filter((entry) => typeof entry[1] === "string"));
+}
+function resolveString(value, variables, capabilityId, fieldPath) {
+  if (!hasEnvPlaceholder(value)) {
+    return value;
+  }
+  return value.replace(ENV_PLACEHOLDER, (_match, variableName) => {
+    const resolved = variables[variableName];
+    if (resolved === undefined) {
+      throw new Error(`Missing environment variable "${variableName}" required by capability "${capabilityId}" in ${fieldPath}`);
+    }
+    return resolved;
+  });
+}
+function mcpHasPlaceholders(mcp) {
+  const strings = [];
+  if (mcp.command) {
+    strings.push(mcp.command);
+  }
+  if (mcp.cwd) {
+    strings.push(mcp.cwd);
+  }
+  if (mcp.url) {
+    strings.push(mcp.url);
+  }
+  if (mcp.args) {
+    strings.push(...mcp.args);
+  }
+  if (mcp.env) {
+    strings.push(...Object.values(mcp.env));
+  }
+  if (mcp.headers) {
+    strings.push(...Object.values(mcp.headers));
+  }
+  return strings.some((value) => hasEnvPlaceholder(value));
+}
+async function resolveCapabilityMcpEnv(config, capabilityPath) {
+  if (!config.mcp || !mcpHasPlaceholders(config.mcp)) {
+    return config;
+  }
+  const variables = mergeEnvSources(await loadCapabilityEnv(capabilityPath));
+  const resolvedMcp = { ...config.mcp };
+  const capabilityId = config.capability.id;
+  if (resolvedMcp.command) {
+    resolvedMcp.command = resolveString(resolvedMcp.command, variables, capabilityId, "mcp.command");
+  }
+  if (resolvedMcp.cwd) {
+    resolvedMcp.cwd = resolveString(resolvedMcp.cwd, variables, capabilityId, "mcp.cwd");
+  }
+  if (resolvedMcp.url) {
+    resolvedMcp.url = resolveString(resolvedMcp.url, variables, capabilityId, "mcp.url");
+  }
+  if (resolvedMcp.args) {
+    resolvedMcp.args = resolvedMcp.args.map((arg, index) => resolveString(arg, variables, capabilityId, `mcp.args[${index}]`));
+  }
+  if (resolvedMcp.env) {
+    resolvedMcp.env = Object.fromEntries(Object.entries(resolvedMcp.env).map(([key, value]) => [
+      key,
+      resolveString(value, variables, capabilityId, `mcp.env.${key}`)
+    ]));
+  }
+  if (resolvedMcp.headers) {
+    resolvedMcp.headers = Object.fromEntries(Object.entries(resolvedMcp.headers).map(([key, value]) => [
+      key,
+      resolveString(value, variables, capabilityId, `mcp.headers.${key}`)
+    ]));
+  }
+  return {
+    ...config,
+    mcp: resolvedMcp
+  };
+}
+var CAPABILITY_ENV_FILE = ".env", ENV_PLACEHOLDER, ENV_PLACEHOLDER_DETECTOR;
+var init_mcp_env = __esm(() => {
+  ENV_PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+  ENV_PLACEHOLDER_DETECTOR = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/;
+});
+
+// ../core/src/capability/rules.ts
+import { existsSync as existsSync7, readdirSync as readdirSync3 } from "node:fs";
+import { readFile as readFile4 } from "node:fs/promises";
+import { basename as basename3, join as join5 } from "node:path";
 async function loadRules(capabilityPath, capabilityId) {
-  const rulesDir = join4(capabilityPath, "rules");
-  if (!existsSync6(rulesDir)) {
+  const rulesDir = join5(capabilityPath, "rules");
+  if (!existsSync7(rulesDir)) {
     return [];
   }
   const rules = [];
   const entries = readdirSync3(rulesDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".md")) {
-      const rulePath = join4(rulesDir, entry.name);
-      const content = await readFile3(rulePath, "utf-8");
+      const rulePath = join5(rulesDir, entry.name);
+      const content = await readFile4(rulePath, "utf-8");
       rules.push({
         name: basename3(entry.name, ".md"),
         content: content.trim(),
@@ -2428,22 +2579,22 @@ async function loadRules(capabilityPath, capabilityId) {
 var init_rules = () => {};
 
 // ../core/src/capability/skills.ts
-import { existsSync as existsSync7, readdirSync as readdirSync4 } from "node:fs";
-import { readFile as readFile4 } from "node:fs/promises";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync8, readdirSync as readdirSync4 } from "node:fs";
+import { readFile as readFile5 } from "node:fs/promises";
+import { join as join6 } from "node:path";
 async function loadSkills(capabilityPath, capabilityId) {
   const skills = [];
   const possibleDirNames = ["skills", "skill"];
   for (const dirName of possibleDirNames) {
-    const dir = join5(capabilityPath, dirName);
-    if (!existsSync7(dir)) {
+    const dir = join6(capabilityPath, dirName);
+    if (!existsSync8(dir)) {
       continue;
     }
     const entries = readdirSync4(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        const skillPath = join5(dir, entry.name, "SKILL.md");
-        if (existsSync7(skillPath)) {
+        const skillPath = join6(dir, entry.name, "SKILL.md");
+        if (existsSync8(skillPath)) {
           const skill = await parseSkillFile(skillPath, capabilityId);
           skills.push(skill);
         }
@@ -2453,7 +2604,7 @@ async function loadSkills(capabilityPath, capabilityId) {
   return skills;
 }
 async function parseSkillFile(filePath, capabilityId) {
-  const content = await readFile4(filePath, "utf-8");
+  const content = await readFile5(filePath, "utf-8");
   const parsed = parseFrontmatterWithMarkdown(content);
   if (!parsed) {
     throw new Error(`Invalid SKILL.md format at ${filePath}: missing YAML frontmatter`);
@@ -2473,30 +2624,30 @@ async function parseSkillFile(filePath, capabilityId) {
 var init_skills = () => {};
 
 // ../core/src/capability/subagents.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5 } from "node:fs";
-import { readFile as readFile5 } from "node:fs/promises";
-import { basename as basename4, join as join6 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync5 } from "node:fs";
+import { readFile as readFile6 } from "node:fs/promises";
+import { basename as basename4, join as join7 } from "node:path";
 async function loadSubagents(capabilityPath, capabilityId) {
   const subagents = [];
   const possibleDirNames = ["subagents", "agents", "agent", "subagent"];
   for (const dirName of possibleDirNames) {
-    const dir = join6(capabilityPath, dirName);
-    if (!existsSync8(dir)) {
+    const dir = join7(capabilityPath, dirName);
+    if (!existsSync9(dir)) {
       continue;
     }
     const entries = readdirSync5(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        let subagentPath = join6(dir, entry.name, "SUBAGENT.md");
-        if (!existsSync8(subagentPath)) {
-          subagentPath = join6(dir, entry.name, "AGENT.md");
+        let subagentPath = join7(dir, entry.name, "SUBAGENT.md");
+        if (!existsSync9(subagentPath)) {
+          subagentPath = join7(dir, entry.name, "AGENT.md");
         }
-        if (existsSync8(subagentPath)) {
+        if (existsSync9(subagentPath)) {
           const subagent = await parseSubagentFile(subagentPath, capabilityId);
           subagents.push(subagent);
         }
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        const subagentPath = join6(dir, entry.name);
+        const subagentPath = join7(dir, entry.name);
         const subagent = await parseSubagentFile(subagentPath, capabilityId);
         subagents.push(subagent);
       }
@@ -2505,7 +2656,7 @@ async function loadSubagents(capabilityPath, capabilityId) {
   return subagents;
 }
 async function parseSubagentFile(filePath, capabilityId) {
-  const content = await readFile5(filePath, "utf-8");
+  const content = await readFile6(filePath, "utf-8");
   const parsed = parseFrontmatterWithMarkdown(content);
   if (!parsed) {
     throw new Error(`Invalid SUBAGENT.md format at ${filePath}: missing YAML frontmatter`);
@@ -2549,18 +2700,18 @@ function parseCommaSeparatedList(value) {
 var init_subagents = () => {};
 
 // ../core/src/capability/loader.ts
-import { existsSync as existsSync9, readdirSync as readdirSync6 } from "node:fs";
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync6 } from "node:fs";
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 async function discoverCapabilities() {
   const capabilities = [];
-  if (existsSync9(CAPABILITIES_DIR)) {
+  if (existsSync10(CAPABILITIES_DIR)) {
     const entries = readdirSync6(CAPABILITIES_DIR, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        const entryPath = join7(CAPABILITIES_DIR, entry.name);
-        const configPath = join7(entryPath, "capability.toml");
-        if (existsSync9(configPath)) {
+        const entryPath = join8(CAPABILITIES_DIR, entry.name);
+        const configPath = join8(entryPath, "capability.toml");
+        if (existsSync10(configPath)) {
           capabilities.push(entryPath);
         }
       }
@@ -2569,28 +2720,28 @@ async function discoverCapabilities() {
   return capabilities;
 }
 async function loadCapabilityConfig(capabilityPath) {
-  const configPath = join7(capabilityPath, "capability.toml");
-  const content = await readFile6(configPath, "utf-8");
+  const configPath = join8(capabilityPath, "capability.toml");
+  const content = await readFile7(configPath, "utf-8");
   const config = parseCapabilityConfig(content);
   return config;
 }
 async function importCapabilityExports(capabilityPath) {
-  const builtIndexPath = join7(capabilityPath, "dist", "index.js");
-  const jsIndexPath = join7(capabilityPath, "index.js");
-  const tsIndexPath = join7(capabilityPath, "index.ts");
+  const builtIndexPath = join8(capabilityPath, "dist", "index.js");
+  const jsIndexPath = join8(capabilityPath, "index.js");
+  const tsIndexPath = join8(capabilityPath, "index.ts");
   let indexPath = null;
-  if (existsSync9(builtIndexPath)) {
+  if (existsSync10(builtIndexPath)) {
     indexPath = builtIndexPath;
-  } else if (existsSync9(jsIndexPath)) {
+  } else if (existsSync10(jsIndexPath)) {
     indexPath = jsIndexPath;
-  } else if (existsSync9(tsIndexPath)) {
+  } else if (existsSync10(tsIndexPath)) {
     indexPath = tsIndexPath;
   }
   if (!indexPath) {
     return {};
   }
   try {
-    const absolutePath = join7(process.cwd(), indexPath);
+    const absolutePath = join8(process.cwd(), indexPath);
     const module = await import(absolutePath);
     return module;
   } catch (error) {
@@ -2610,11 +2761,11 @@ If this is a project-specific capability, install dependencies or remove it from
   }
 }
 async function loadTypeDefinitions(capabilityPath) {
-  const typesPath = join7(capabilityPath, "types.d.ts");
-  if (!existsSync9(typesPath)) {
+  const typesPath = join8(capabilityPath, "types.d.ts");
+  if (!existsSync10(typesPath)) {
     return;
   }
-  return readFile6(typesPath, "utf-8");
+  return readFile7(typesPath, "utf-8");
 }
 function convertSkillExports(skillExports, capabilityId) {
   return skillExports.map((skillExport) => {
@@ -2791,19 +2942,57 @@ function convertCommandExports(commandExports, capabilityId) {
     return result;
   });
 }
+function mergeByName(fileBased, programmatic) {
+  const byName = new Map;
+  for (const item of fileBased) {
+    byName.set(item.name, item);
+  }
+  for (const item of programmatic) {
+    byName.set(item.name, item);
+  }
+  return Array.from(byName.values());
+}
 async function loadCapability(capabilityPath) {
-  const config = await loadCapabilityConfig(capabilityPath);
+  const rawConfig = await loadCapabilityConfig(capabilityPath);
+  const config = await resolveCapabilityMcpEnv(rawConfig, capabilityPath);
   const id = config.capability.id;
   const exports = await importCapabilityExports(capabilityPath);
   const exportsAny = exports;
-  const skills = "skills" in exports && Array.isArray(exportsAny.skills) ? convertSkillExports(exportsAny.skills, id) : await loadSkills(capabilityPath, id);
-  const rules = "rules" in exports && Array.isArray(exportsAny.rules) ? convertRuleExports(exportsAny.rules, id) : await loadRules(capabilityPath, id);
-  const docs = "docs" in exports && Array.isArray(exportsAny.docs) ? convertDocExports(exportsAny.docs, id) : await loadDocs(capabilityPath, id);
-  const subagents = "subagents" in exports && Array.isArray(exportsAny.subagents) ? convertSubagentExports(exportsAny.subagents, id) : await loadSubagents(capabilityPath, id);
-  const commands = "commands" in exports && Array.isArray(exportsAny.commands) ? convertCommandExports(exportsAny.commands, id) : await loadCommands(capabilityPath, id);
-  const typeDefinitionsFromExports = "typeDefinitions" in exports && typeof exportsAny.typeDefinitions === "string" ? exportsAny.typeDefinitions : undefined;
+  const defaultExport = exportsAny.default ?? {};
+  const getExportValue = (key) => {
+    if (key in exports && exports[key] !== undefined) {
+      return exportsAny[key];
+    }
+    if (key in defaultExport && defaultExport[key] !== undefined) {
+      return defaultExport[key];
+    }
+    return;
+  };
+  const skillsExport = getExportValue("skills");
+  const programmaticSkills = Array.isArray(skillsExport) ? convertSkillExports(skillsExport, id) : [];
+  const fileSkills = await loadSkills(capabilityPath, id);
+  const skills = mergeByName(fileSkills, programmaticSkills);
+  const rulesExport = getExportValue("rules");
+  const programmaticRules = Array.isArray(rulesExport) ? convertRuleExports(rulesExport, id) : [];
+  const fileRules = await loadRules(capabilityPath, id);
+  const rules = mergeByName(fileRules, programmaticRules);
+  const docsExport = getExportValue("docs");
+  const programmaticDocs = Array.isArray(docsExport) ? convertDocExports(docsExport, id) : [];
+  const fileDocs = await loadDocs(capabilityPath, id);
+  const docs = mergeByName(fileDocs, programmaticDocs);
+  const subagentsExport = getExportValue("subagents");
+  const programmaticSubagents = Array.isArray(subagentsExport) ? convertSubagentExports(subagentsExport, id) : [];
+  const fileSubagents = await loadSubagents(capabilityPath, id);
+  const subagents = mergeByName(fileSubagents, programmaticSubagents);
+  const commandsExport = getExportValue("commands");
+  const programmaticCommands = Array.isArray(commandsExport) ? convertCommandExports(commandsExport, id) : [];
+  const fileCommands = await loadCommands(capabilityPath, id);
+  const commands = mergeByName(fileCommands, programmaticCommands);
+  const typeDefinitionsExport = getExportValue("typeDefinitions");
+  const typeDefinitionsFromExports = typeof typeDefinitionsExport === "string" ? typeDefinitionsExport : undefined;
   const typeDefinitions = typeDefinitionsFromExports !== undefined ? typeDefinitionsFromExports : await loadTypeDefinitions(capabilityPath);
-  const gitignore = "gitignore" in exports && Array.isArray(exportsAny.gitignore) ? exportsAny.gitignore : undefined;
+  const gitignoreExport = getExportValue("gitignore");
+  const gitignore = Array.isArray(gitignoreExport) ? gitignoreExport : undefined;
   const hooks = loadCapabilityHooks(id, capabilityPath, { resolveCapabilityRoot: true });
   const result = {
     id,
@@ -2831,6 +3020,7 @@ var CAPABILITIES_DIR = ".omni/capabilities";
 var init_loader2 = __esm(() => {
   init_parser();
   init_loader();
+  init_mcp_env();
   init_commands();
   init_docs();
   init_rules();
@@ -2839,8 +3029,8 @@ var init_loader2 = __esm(() => {
 });
 
 // ../core/src/config/config.ts
-import { existsSync as existsSync10 } from "node:fs";
-import { readFile as readFile7, writeFile } from "node:fs/promises";
+import { existsSync as existsSync11 } from "node:fs";
+import { readFile as readFile8, writeFile } from "node:fs/promises";
 function mergeConfigs(base, override) {
   const merged = { ...base, ...override };
   merged.profiles = { ...base.profiles };
@@ -2882,8 +3072,8 @@ function mergeConfigs(base, override) {
   return merged;
 }
 async function loadBaseConfig() {
-  if (existsSync10(CONFIG_PATH)) {
-    const content = await readFile7(CONFIG_PATH, "utf-8");
+  if (existsSync11(CONFIG_PATH)) {
+    const content = await readFile8(CONFIG_PATH, "utf-8");
     return parseOmniConfig(content);
   }
   return {};
@@ -2891,8 +3081,8 @@ async function loadBaseConfig() {
 async function loadConfig() {
   const baseConfig = await loadBaseConfig();
   let localConfig = {};
-  if (existsSync10(LOCAL_CONFIG)) {
-    const content = await readFile7(LOCAL_CONFIG, "utf-8");
+  if (existsSync11(LOCAL_CONFIG)) {
+    const content = await readFile8(LOCAL_CONFIG, "utf-8");
     localConfig = parseOmniConfig(content);
   }
   return mergeConfigs(baseConfig, localConfig);
@@ -3056,14 +3246,14 @@ var init_config = __esm(() => {
 });
 
 // ../core/src/state/active-profile.ts
-import { existsSync as existsSync11, mkdirSync } from "node:fs";
-import { readFile as readFile8, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { existsSync as existsSync12, mkdirSync } from "node:fs";
+import { readFile as readFile9, unlink, writeFile as writeFile2 } from "node:fs/promises";
 async function readActiveProfileState() {
-  if (!existsSync11(ACTIVE_PROFILE_PATH)) {
+  if (!existsSync12(ACTIVE_PROFILE_PATH)) {
     return null;
   }
   try {
-    const content = await readFile8(ACTIVE_PROFILE_PATH, "utf-8");
+    const content = await readFile9(ACTIVE_PROFILE_PATH, "utf-8");
     const trimmed = content.trim();
     return trimmed || null;
   } catch {
@@ -3075,7 +3265,7 @@ async function writeActiveProfileState(profileName) {
   await writeFile2(ACTIVE_PROFILE_PATH, profileName, "utf-8");
 }
 async function clearActiveProfileState() {
-  if (existsSync11(ACTIVE_PROFILE_PATH)) {
+  if (existsSync12(ACTIVE_PROFILE_PATH)) {
     await unlink(ACTIVE_PROFILE_PATH);
   }
 }
@@ -3319,10 +3509,10 @@ function getActiveProviders(config) {
 var init_types2 = () => {};
 
 // ../core/src/capability/sources.ts
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import { spawn } from "node:child_process";
-import { cp, mkdir, readdir, readFile as readFile9, rename, rm, stat, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { cp, mkdir, readdir, readFile as readFile10, rename, rm, stat, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 import { createHash } from "node:crypto";
 async function spawnCapture(command, args, options) {
   const timeout = options?.timeout ?? 60000;
@@ -3379,10 +3569,10 @@ function parseFileSourcePath(source) {
   return source.slice(7);
 }
 async function readCapabilityIdFromPath(capabilityPath) {
-  const tomlPath = join8(capabilityPath, "capability.toml");
-  if (existsSync12(tomlPath)) {
+  const tomlPath = join9(capabilityPath, "capability.toml");
+  if (existsSync13(tomlPath)) {
     try {
-      const content = await readFile9(tomlPath, "utf-8");
+      const content = await readFile10(tomlPath, "utf-8");
       const parsed = parse(content);
       const capability = parsed["capability"];
       if (capability?.["id"] && typeof capability["id"] === "string") {
@@ -3435,18 +3625,18 @@ function sourceToGitUrl(source) {
   return source;
 }
 function getSourceCapabilityPath(id) {
-  return join8(OMNI_LOCAL, "capabilities", id);
+  return join9(OMNI_LOCAL, "capabilities", id);
 }
 function getLockFilePath() {
   return "omni.lock.toml";
 }
 async function loadLockFile() {
   const lockPath = getLockFilePath();
-  if (!existsSync12(lockPath)) {
+  if (!existsSync13(lockPath)) {
     return { capabilities: {} };
   }
   try {
-    const content = await readFile9(lockPath, "utf-8");
+    const content = await readFile10(lockPath, "utf-8");
     const parsed = parse(content);
     const rawCapabilities = parsed["capabilities"];
     if (!rawCapabilities) {
@@ -3504,7 +3694,7 @@ function stringifyLockFile(lockFile) {
 }
 async function saveLockFile(lockFile) {
   const lockPath = getLockFilePath();
-  await mkdir(join8(OMNI_LOCAL, "capabilities"), { recursive: true });
+  await mkdir(join9(OMNI_LOCAL, "capabilities"), { recursive: true });
   const header = `# Auto-generated by OmniDev - DO NOT EDIT
 # Records installed capability versions for reproducibility
 # Last updated: ${new Date().toISOString()}
@@ -3528,6 +3718,9 @@ function shortCommit(commit) {
 function shortContentHash(hash) {
   return hash.substring(0, 12);
 }
+function escapeTomlString(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
 async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUDES) {
   const hash = createHash("sha256");
   const files = [];
@@ -3535,7 +3728,7 @@ async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUD
     const entries = await readdir(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const fullPath = join8(currentPath, entry.name);
+      const fullPath = join9(currentPath, entry.name);
       const relativePath = fullPath.slice(relativeTo.length + 1);
       if (excludePatterns.some((pattern) => entry.name === pattern || relativePath.startsWith(`${pattern}/`))) {
         continue;
@@ -3543,7 +3736,7 @@ async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUD
       if (entry.isDirectory()) {
         await collectFiles(fullPath, relativeTo);
       } else if (entry.isFile()) {
-        const content = await readFile9(fullPath);
+        const content = await readFile10(fullPath);
         files.push({ relativePath, content });
       }
     }
@@ -3557,10 +3750,10 @@ async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUD
   return hash.digest("hex");
 }
 async function detectDisplayVersion(dirPath, fallback, fallbackSource) {
-  const capTomlPath = join8(dirPath, "capability.toml");
-  if (existsSync12(capTomlPath)) {
+  const capTomlPath = join9(dirPath, "capability.toml");
+  if (existsSync13(capTomlPath)) {
     try {
-      const content = await readFile9(capTomlPath, "utf-8");
+      const content = await readFile10(capTomlPath, "utf-8");
       const parsed = parse(content);
       const capability = parsed["capability"];
       if (capability?.["version"] && typeof capability["version"] === "string") {
@@ -3568,20 +3761,20 @@ async function detectDisplayVersion(dirPath, fallback, fallbackSource) {
       }
     } catch {}
   }
-  const pluginJsonPath = join8(dirPath, ".claude-plugin", "plugin.json");
-  if (existsSync12(pluginJsonPath)) {
+  const pluginJsonPath = join9(dirPath, ".claude-plugin", "plugin.json");
+  if (existsSync13(pluginJsonPath)) {
     try {
-      const content = await readFile9(pluginJsonPath, "utf-8");
+      const content = await readFile10(pluginJsonPath, "utf-8");
       const parsed = JSON.parse(content);
       if (parsed.version && typeof parsed.version === "string") {
         return { version: parsed.version, source: "plugin.json" };
       }
     } catch {}
   }
-  const pkgJsonPath = join8(dirPath, "package.json");
-  if (existsSync12(pkgJsonPath)) {
+  const pkgJsonPath = join9(dirPath, "package.json");
+  if (existsSync13(pkgJsonPath)) {
     try {
-      const content = await readFile9(pkgJsonPath, "utf-8");
+      const content = await readFile10(pkgJsonPath, "utf-8");
       const parsed = JSON.parse(content);
       if (parsed.version && typeof parsed.version === "string") {
         return { version: parsed.version, source: "package.json" };
@@ -3592,9 +3785,9 @@ async function detectDisplayVersion(dirPath, fallback, fallbackSource) {
 }
 async function validateGitCapability(sourceUrl, subPath) {
   const gitUrl = sourceToGitUrl(sourceUrl);
-  const tempPath = join8(OMNI_LOCAL, "_temp", `_validate-${Date.now()}`);
+  const tempPath = join9(OMNI_LOCAL, "_temp", `_validate-${Date.now()}`);
   try {
-    await mkdir(join8(tempPath, ".."), { recursive: true });
+    await mkdir(join9(tempPath, ".."), { recursive: true });
     const args = ["clone", "--depth", "1", gitUrl, tempPath];
     const { exitCode, stderr } = await spawnCapture("git", args, { timeout: 30000 });
     if (exitCode !== 0) {
@@ -3630,8 +3823,8 @@ async function validateGitCapability(sourceUrl, subPath) {
         error: `Failed to clone repository: ${stderr.trim()}`
       };
     }
-    const checkPath = subPath ? join8(tempPath, subPath) : tempPath;
-    if (subPath && !existsSync12(checkPath)) {
+    const checkPath = subPath ? join9(tempPath, subPath) : tempPath;
+    if (subPath && !existsSync13(checkPath)) {
       return {
         valid: false,
         hasCapabilityToml: false,
@@ -3642,9 +3835,9 @@ async function validateGitCapability(sourceUrl, subPath) {
     const hasCapToml = hasCapabilityToml(checkPath);
     let capabilityId;
     if (hasCapToml) {
-      const tomlPath = join8(checkPath, "capability.toml");
+      const tomlPath = join9(checkPath, "capability.toml");
       try {
-        const content = await readFile9(tomlPath, "utf-8");
+        const content = await readFile10(tomlPath, "utf-8");
         const parsed = parse(content);
         const capability = parsed["capability"];
         if (capability?.["id"] && typeof capability["id"] === "string") {
@@ -3676,27 +3869,27 @@ async function validateGitCapability(sourceUrl, subPath) {
       canBeWrapped: true
     };
   } finally {
-    if (existsSync12(tempPath)) {
+    if (existsSync13(tempPath)) {
       await rm(tempPath, { recursive: true });
     }
   }
 }
 async function detectPinVersion(sourceUrl, subPath) {
   const gitUrl = sourceToGitUrl(sourceUrl);
-  const tempPath = join8(OMNI_LOCAL, "_temp", `_pin-detect-${Date.now()}`);
+  const tempPath = join9(OMNI_LOCAL, "_temp", `_pin-detect-${Date.now()}`);
   try {
-    await mkdir(join8(tempPath, ".."), { recursive: true });
+    await mkdir(join9(tempPath, ".."), { recursive: true });
     const args = ["clone", "--depth", "1", gitUrl, tempPath];
     const { exitCode, stderr } = await spawnCapture("git", args);
     if (exitCode !== 0) {
       throw new Error(`Failed to clone ${gitUrl}: ${stderr.trim()}`);
     }
     const commit = await getRepoCommit(tempPath);
-    const checkPath = subPath ? join8(tempPath, subPath) : tempPath;
-    const capTomlPath = join8(checkPath, "capability.toml");
-    if (existsSync12(capTomlPath)) {
+    const checkPath = subPath ? join9(tempPath, subPath) : tempPath;
+    const capTomlPath = join9(checkPath, "capability.toml");
+    if (existsSync13(capTomlPath)) {
       try {
-        const content = await readFile9(capTomlPath, "utf-8");
+        const content = await readFile10(capTomlPath, "utf-8");
         const parsed = parse(content);
         const capability = parsed["capability"];
         if (capability?.["version"] && typeof capability["version"] === "string") {
@@ -3704,10 +3897,10 @@ async function detectPinVersion(sourceUrl, subPath) {
         }
       } catch {}
     }
-    const pluginJsonPath = join8(checkPath, ".claude-plugin", "plugin.json");
-    if (existsSync12(pluginJsonPath)) {
+    const pluginJsonPath = join9(checkPath, ".claude-plugin", "plugin.json");
+    if (existsSync13(pluginJsonPath)) {
       try {
-        const content = await readFile9(pluginJsonPath, "utf-8");
+        const content = await readFile10(pluginJsonPath, "utf-8");
         const parsed = JSON.parse(content);
         if (parsed.version && typeof parsed.version === "string") {
           return parsed.version;
@@ -3716,13 +3909,13 @@ async function detectPinVersion(sourceUrl, subPath) {
     }
     return commit;
   } finally {
-    if (existsSync12(tempPath)) {
+    if (existsSync13(tempPath)) {
       await rm(tempPath, { recursive: true });
     }
   }
 }
 async function cloneRepo(gitUrl, targetPath, ref) {
-  await mkdir(join8(targetPath, ".."), { recursive: true });
+  await mkdir(join9(targetPath, ".."), { recursive: true });
   const args = ["clone", "--depth", "1"];
   if (ref) {
     args.push("--branch", ref);
@@ -3734,41 +3927,62 @@ async function cloneRepo(gitUrl, targetPath, ref) {
   }
 }
 async function fetchRepo(repoPath, ref) {
-  const fetchResult = await spawnCapture("git", ["fetch", "--depth", "1", "origin"], {
+  const fetchArgs = ["fetch", "--depth", "1", "origin"];
+  if (ref) {
+    fetchArgs.push(ref);
+  }
+  const fetchResult = await spawnCapture("git", fetchArgs, {
     cwd: repoPath
   });
   if (fetchResult.exitCode !== 0) {
     throw new Error(`Failed to fetch in ${repoPath}: ${fetchResult.stderr.trim()}`);
   }
   const currentCommit = await getRepoCommit(repoPath);
-  const targetRef = ref || "HEAD";
-  const lsResult = await spawnCapture("git", ["ls-remote", "origin", targetRef], {
+  let resetTarget;
+  if (ref) {
+    resetTarget = "FETCH_HEAD";
+  } else {
+    const remoteShowResult = await spawnCapture("git", ["remote", "show", "origin"], {
+      cwd: repoPath
+    });
+    let defaultBranch = "main";
+    if (remoteShowResult.exitCode === 0) {
+      const match = remoteShowResult.stdout.match(/HEAD branch:\s*(\S+)/);
+      if (match?.[1]) {
+        defaultBranch = match[1];
+      }
+    }
+    resetTarget = `origin/${defaultBranch}`;
+  }
+  const revParseResult = await spawnCapture("git", ["rev-parse", resetTarget], {
     cwd: repoPath
   });
-  if (lsResult.exitCode !== 0) {
-    throw new Error(`Failed to ls-remote in ${repoPath}: ${lsResult.stderr.trim()}`);
+  if (revParseResult.exitCode !== 0) {
+    throw new Error(`Failed to resolve ${resetTarget} in ${repoPath}: ${revParseResult.stderr.trim()}`);
   }
-  const remoteCommit = lsResult.stdout.split("\t")[0];
-  if (currentCommit === remoteCommit) {
+  const targetCommit = revParseResult.stdout.trim();
+  if (currentCommit === targetCommit) {
     return false;
   }
-  const pullResult = await spawnCapture("git", ["pull", "--ff-only"], { cwd: repoPath });
-  if (pullResult.exitCode !== 0) {
-    throw new Error(`Failed to pull in ${repoPath}: ${pullResult.stderr.trim()}`);
+  const resetResult = await spawnCapture("git", ["reset", "--hard", resetTarget], {
+    cwd: repoPath
+  });
+  if (resetResult.exitCode !== 0) {
+    throw new Error(`Failed to reset in ${repoPath}: ${resetResult.stderr.trim()}`);
   }
   return true;
 }
 function hasCapabilityToml(dirPath) {
-  return existsSync12(join8(dirPath, "capability.toml"));
+  return existsSync13(join9(dirPath, "capability.toml"));
 }
 async function shouldWrapDirectory(dirPath) {
-  if (existsSync12(join8(dirPath, ".claude-plugin", "plugin.json"))) {
+  if (existsSync13(join9(dirPath, ".claude-plugin", "plugin.json"))) {
     return true;
   }
   const allDirs = [...SKILL_DIRS, ...AGENT_DIRS, ...COMMAND_DIRS, ...RULE_DIRS, ...DOC_DIRS];
   for (const dirName of allDirs) {
-    const checkPath = join8(dirPath, dirName);
-    if (existsSync12(checkPath)) {
+    const checkPath = join9(dirPath, dirName);
+    if (existsSync13(checkPath)) {
       const stats = await stat(checkPath);
       if (stats.isDirectory()) {
         return true;
@@ -3777,10 +3991,64 @@ async function shouldWrapDirectory(dirPath) {
   }
   return false;
 }
+function isRecognizedWrappedDirectory(dirName, keepGitDir = false) {
+  if (keepGitDir && dirName === ".git") {
+    return true;
+  }
+  return WRAPPED_CONTENT_DIRS.has(dirName);
+}
+function isMandatoryWrappedRootFile(fileName) {
+  if (WRAPPED_ROOT_FILES_EXACT.has(fileName)) {
+    return true;
+  }
+  return WRAPPED_ROOT_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
+}
+async function copyWrappedContentOnly(sourcePath, targetPath) {
+  await mkdir(targetPath, { recursive: true });
+  const entries = await readdir(sourcePath, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory() && !isRecognizedWrappedDirectory(entry.name)) {
+      continue;
+    }
+    if (entry.isFile() && !isMandatoryWrappedRootFile(entry.name)) {
+      continue;
+    }
+    if (!entry.isDirectory() && !entry.isFile()) {
+      continue;
+    }
+    const sourceEntryPath = join9(sourcePath, entry.name);
+    const targetEntryPath = join9(targetPath, entry.name);
+    if (entry.isDirectory()) {
+      await cp(sourceEntryPath, targetEntryPath, { recursive: true });
+    } else {
+      await cp(sourceEntryPath, targetEntryPath);
+    }
+  }
+}
+async function pruneUnknownWrappedEntries(repoPath, keepGitDir = false) {
+  const entries = await readdir(repoPath, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (isRecognizedWrappedDirectory(entry.name, keepGitDir)) {
+        continue;
+      }
+      await rm(join9(repoPath, entry.name), { recursive: true, force: true });
+      continue;
+    }
+    if (entry.isFile()) {
+      if (isMandatoryWrappedRootFile(entry.name)) {
+        continue;
+      }
+      await rm(join9(repoPath, entry.name), { force: true });
+      continue;
+    }
+    await rm(join9(repoPath, entry.name), { recursive: true, force: true });
+  }
+}
 async function findMatchingDirs(basePath, names) {
   for (const name of names) {
-    const dirPath = join8(basePath, name);
-    if (existsSync12(dirPath)) {
+    const dirPath = join9(basePath, name);
+    if (existsSync13(dirPath)) {
       const stats = await stat(dirPath);
       if (stats.isDirectory()) {
         return dirPath;
@@ -3791,15 +4059,15 @@ async function findMatchingDirs(basePath, names) {
 }
 async function findContentItems(dirPath, filePatterns) {
   const items = [];
-  if (!existsSync12(dirPath)) {
+  if (!existsSync13(dirPath)) {
     return items;
   }
   const entries = (await readdir(dirPath, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
-    const entryPath = join8(dirPath, entry.name);
+    const entryPath = join9(dirPath, entry.name);
     if (entry.isDirectory()) {
       for (const pattern of filePatterns) {
-        if (existsSync12(join8(entryPath, pattern))) {
+        if (existsSync13(join9(entryPath, pattern))) {
           items.push({
             name: entry.name,
             path: entryPath,
@@ -3820,12 +4088,12 @@ async function findContentItems(dirPath, filePatterns) {
   return items;
 }
 async function parsePluginJson(dirPath) {
-  const pluginJsonPath = join8(dirPath, ".claude-plugin", "plugin.json");
-  if (!existsSync12(pluginJsonPath)) {
+  const pluginJsonPath = join9(dirPath, ".claude-plugin", "plugin.json");
+  if (!existsSync13(pluginJsonPath)) {
     return null;
   }
   try {
-    const content = await readFile9(pluginJsonPath, "utf-8");
+    const content = await readFile10(pluginJsonPath, "utf-8");
     const data = JSON.parse(content);
     const result = {
       name: data.name,
@@ -3845,12 +4113,12 @@ async function parsePluginJson(dirPath) {
   }
 }
 async function readReadmeDescription(dirPath) {
-  const readmePath = join8(dirPath, "README.md");
-  if (!existsSync12(readmePath)) {
+  const readmePath = join9(dirPath, "README.md");
+  if (!existsSync13(readmePath)) {
     return null;
   }
   try {
-    const content = await readFile9(readmePath, "utf-8");
+    const content = await readFile10(readmePath, "utf-8");
     const lines = content.split(`
 `);
     let description = "";
@@ -3885,9 +4153,9 @@ async function normalizeFolderNames(repoPath) {
     { from: "rule", to: "rules" }
   ];
   for (const { from, to } of renameMappings) {
-    const fromPath = join8(repoPath, from);
-    const toPath = join8(repoPath, to);
-    if (existsSync12(fromPath) && !existsSync12(toPath)) {
+    const fromPath = join9(repoPath, from);
+    const toPath = join9(repoPath, to);
+    if (existsSync13(fromPath) && !existsSync13(toPath)) {
       try {
         const stats = await stat(fromPath);
         if (stats.isDirectory()) {
@@ -3952,31 +4220,31 @@ async function generateCapabilityToml(id, repoPath, source, commit, content) {
 # This capability was wrapped from an external repository
 
 [capability]
-id = "${id}"
-name = "${name}"
-version = "${version}"
-description = "${description}"
+id = "${escapeTomlString(id)}"
+name = "${escapeTomlString(name)}"
+version = "${escapeTomlString(version)}"
+description = "${escapeTomlString(description)}"
 `;
   if (pluginMeta?.author?.name || pluginMeta?.author?.email) {
     tomlContent += `
 [capability.author]
 `;
     if (pluginMeta.author.name) {
-      tomlContent += `name = "${pluginMeta.author.name}"
+      tomlContent += `name = "${escapeTomlString(pluginMeta.author.name)}"
 `;
     }
     if (pluginMeta.author.email) {
-      tomlContent += `email = "${pluginMeta.author.email}"
+      tomlContent += `email = "${escapeTomlString(pluginMeta.author.email)}"
 `;
     }
   }
   tomlContent += `
 [capability.metadata]
-repository = "${repoUrl}"
+repository = "${escapeTomlString(repoUrl)}"
 wrapped = true
 commit = "${commit}"
 `;
-  await writeFile3(join8(repoPath, "capability.toml"), tomlContent, "utf-8");
+  await writeFile3(join9(repoPath, "capability.toml"), tomlContent, "utf-8");
 }
 async function fetchGitCapabilitySource(id, config, options) {
   const gitUrl = sourceToGitUrl(config.source);
@@ -3984,31 +4252,40 @@ async function fetchGitCapabilitySource(id, config, options) {
   let updated = false;
   let commit;
   let repoPath;
+  let needsWrap = false;
   const gitRef = config.version && config.version !== "latest" ? config.version : undefined;
   if (config.path) {
-    const tempPath = join8(OMNI_LOCAL, "_temp", `${id}-repo`);
-    if (existsSync12(join8(tempPath, ".git"))) {
+    const tempPath = join9(OMNI_LOCAL, "_temp", `${id}-repo`);
+    if (existsSync13(join9(tempPath, ".git"))) {
       updated = await fetchRepo(tempPath, gitRef);
       commit = await getRepoCommit(tempPath);
     } else {
-      await mkdir(join8(tempPath, ".."), { recursive: true });
+      await mkdir(join9(tempPath, ".."), { recursive: true });
       await cloneRepo(gitUrl, tempPath, gitRef);
       commit = await getRepoCommit(tempPath);
       updated = true;
     }
-    const sourcePath = join8(tempPath, config.path);
-    if (!existsSync12(sourcePath)) {
+    const sourcePath = join9(tempPath, config.path);
+    if (!existsSync13(sourcePath)) {
       throw new Error(`Path not found in repository: ${config.path}`);
     }
-    if (existsSync12(targetPath)) {
+    const sourceHasCapabilityToml = hasCapabilityToml(sourcePath);
+    if (!sourceHasCapabilityToml) {
+      needsWrap = await shouldWrapDirectory(sourcePath);
+    }
+    if (existsSync13(targetPath)) {
       await rm(targetPath, { recursive: true });
     }
-    await mkdir(join8(targetPath, ".."), { recursive: true });
-    await cp(sourcePath, targetPath, { recursive: true });
+    await mkdir(join9(targetPath, ".."), { recursive: true });
+    if (needsWrap) {
+      await copyWrappedContentOnly(sourcePath, targetPath);
+    } else {
+      await cp(sourcePath, targetPath, { recursive: true });
+    }
     await rm(tempPath, { recursive: true });
     repoPath = targetPath;
   } else {
-    if (existsSync12(join8(targetPath, ".git"))) {
+    if (existsSync13(join9(targetPath, ".git"))) {
       if (!options?.silent) {
         console.log(`  Checking ${id}...`);
       }
@@ -4024,11 +4301,11 @@ async function fetchGitCapabilitySource(id, config, options) {
     }
     repoPath = targetPath;
   }
-  let needsWrap = false;
-  if (!hasCapabilityToml(repoPath)) {
+  if (!config.path && !hasCapabilityToml(repoPath)) {
     needsWrap = await shouldWrapDirectory(repoPath);
   }
   if (needsWrap) {
+    await pruneUnknownWrappedEntries(repoPath, true);
     await normalizeFolderNames(repoPath);
     const content = await discoverContent(repoPath);
     await generateCapabilityToml(id, repoPath, config.source, commit, content);
@@ -4059,7 +4336,7 @@ async function fetchGitCapabilitySource(id, config, options) {
 async function fetchFileCapabilitySource(id, config, options) {
   const sourcePath = parseFileSourcePath(config.source);
   const targetPath = getSourceCapabilityPath(id);
-  if (!existsSync12(sourcePath)) {
+  if (!existsSync13(sourcePath)) {
     throw new Error(`File source not found: ${sourcePath}`);
   }
   const sourceStats = await stat(sourcePath);
@@ -4067,7 +4344,7 @@ async function fetchFileCapabilitySource(id, config, options) {
     throw new Error(`File source must be a directory: ${sourcePath}`);
   }
   const contentHash = await computeContentHash(sourcePath);
-  const hasCapToml = existsSync12(join8(sourcePath, "capability.toml"));
+  const hasCapToml = existsSync13(join9(sourcePath, "capability.toml"));
   let needsWrap = false;
   if (!hasCapToml) {
     needsWrap = await shouldWrapDirectory(sourcePath);
@@ -4078,11 +4355,15 @@ async function fetchFileCapabilitySource(id, config, options) {
   if (!options?.silent) {
     console.log(`  Copying ${id} from ${sourcePath}...`);
   }
-  if (existsSync12(targetPath)) {
+  if (existsSync13(targetPath)) {
     await rm(targetPath, { recursive: true });
   }
-  await mkdir(join8(targetPath, ".."), { recursive: true });
-  await cp(sourcePath, targetPath, { recursive: true });
+  await mkdir(join9(targetPath, ".."), { recursive: true });
+  if (needsWrap) {
+    await copyWrappedContentOnly(sourcePath, targetPath);
+  } else {
+    await cp(sourcePath, targetPath, { recursive: true });
+  }
   if (needsWrap) {
     await normalizeFolderNames(targetPath);
     const content = await discoverContent(targetPath);
@@ -4138,30 +4419,30 @@ async function generateFileSourceCapabilityToml(id, source, hashVersion, content
 # This capability was wrapped from a local directory
 
 [capability]
-id = "${id}"
-name = "${name}"
-version = "${version}"
-description = "${description}"
+id = "${escapeTomlString(id)}"
+name = "${escapeTomlString(name)}"
+version = "${escapeTomlString(version)}"
+description = "${escapeTomlString(description)}"
 `;
   if (pluginMeta?.author?.name || pluginMeta?.author?.email) {
     tomlContent += `
 [capability.author]
 `;
     if (pluginMeta.author.name) {
-      tomlContent += `name = "${pluginMeta.author.name}"
+      tomlContent += `name = "${escapeTomlString(pluginMeta.author.name)}"
 `;
     }
     if (pluginMeta.author.email) {
-      tomlContent += `email = "${pluginMeta.author.email}"
+      tomlContent += `email = "${escapeTomlString(pluginMeta.author.email)}"
 `;
     }
   }
   tomlContent += `
 [capability.metadata]
 wrapped = true
-source = "${source}"
+source = "${escapeTomlString(source)}"
 `;
-  await writeFile3(join8(targetPath, "capability.toml"), tomlContent, "utf-8");
+  await writeFile3(join9(targetPath, "capability.toml"), tomlContent, "utf-8");
 }
 async function fetchCapabilitySource(id, sourceConfig, options) {
   const config = parseSourceConfig(sourceConfig);
@@ -4234,16 +4515,16 @@ generated_from_omni_toml = true
 }
 async function generateMcpCapabilityToml(id, mcpConfig, targetPath) {
   const tomlContent = generateMcpCapabilityTomlContent(id, mcpConfig);
-  await writeFile3(join8(targetPath, "capability.toml"), tomlContent, "utf-8");
+  await writeFile3(join9(targetPath, "capability.toml"), tomlContent, "utf-8");
 }
 async function isGeneratedMcpCapability(capabilityDir) {
-  const tomlPath = join8(capabilityDir, "capability.toml");
-  if (!existsSync12(tomlPath)) {
+  const tomlPath = join9(capabilityDir, "capability.toml");
+  if (!existsSync13(tomlPath)) {
     console.warn("no capability.toml found in", capabilityDir);
     return false;
   }
   try {
-    const content = await readFile9(tomlPath, "utf-8");
+    const content = await readFile10(tomlPath, "utf-8");
     const parsed = parse(content);
     const capability = parsed["capability"];
     const metadata = capability?.["metadata"];
@@ -4253,14 +4534,14 @@ async function isGeneratedMcpCapability(capabilityDir) {
   }
 }
 async function cleanupStaleMcpCapabilities(currentMcpIds) {
-  const capabilitiesDir = join8(OMNI_LOCAL, "capabilities");
-  if (!existsSync12(capabilitiesDir)) {
+  const capabilitiesDir = join9(OMNI_LOCAL, "capabilities");
+  if (!existsSync13(capabilitiesDir)) {
     return;
   }
   const entries = await readdir(capabilitiesDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      const capDir = join8(capabilitiesDir, entry.name);
+      const capDir = join9(capabilitiesDir, entry.name);
       const isGenerated = await isGeneratedMcpCapability(capDir);
       if (isGenerated && !currentMcpIds.has(entry.name)) {
         await rm(capDir, { recursive: true });
@@ -4273,10 +4554,10 @@ async function generateMcpCapabilities(config) {
     await cleanupStaleMcpCapabilities(new Set);
     return;
   }
-  const mcpCapabilitiesDir = join8(OMNI_LOCAL, "capabilities");
+  const mcpCapabilitiesDir = join9(OMNI_LOCAL, "capabilities");
   const currentMcpIds = new Set;
   for (const [id, mcpConfig] of Object.entries(config.mcps)) {
-    const targetPath = join8(mcpCapabilitiesDir, id);
+    const targetPath = join9(mcpCapabilitiesDir, id);
     currentMcpIds.add(id);
     await mkdir(targetPath, { recursive: true });
     await generateMcpCapabilityToml(id, mcpConfig, targetPath);
@@ -4285,8 +4566,8 @@ async function generateMcpCapabilities(config) {
 }
 async function fetchAllCapabilitySources(config, options) {
   await generateMcpCapabilities(config);
-  const tempDir = join8(OMNI_LOCAL, "_temp");
-  if (existsSync12(tempDir)) {
+  const tempDir = join9(OMNI_LOCAL, "_temp");
+  if (existsSync13(tempDir)) {
     await rm(tempDir, { recursive: true });
   }
   const sources = config.capabilities?.sources;
@@ -4372,7 +4653,7 @@ async function checkForUpdates(config) {
       continue;
     }
     const gitConfig = sourceConfig;
-    if (!existsSync12(join8(targetPath, ".git"))) {
+    if (!existsSync13(join9(targetPath, ".git"))) {
       updates.push({
         id,
         source: gitConfig.source,
@@ -4415,12 +4696,12 @@ function checkVersionMismatch(lockEntry, currentCommit, currentVersion) {
 }
 async function verifyIntegrity(id, lockEntry) {
   const capabilityPath = getSourceCapabilityPath(id);
-  if (!existsSync12(capabilityPath)) {
+  if (!existsSync13(capabilityPath)) {
     return "capability directory missing";
   }
   if (lockEntry.commit) {
-    const gitDir = join8(capabilityPath, ".git");
-    if (existsSync12(gitDir)) {
+    const gitDir = join9(capabilityPath, ".git");
+    if (existsSync13(gitDir)) {
       try {
         const currentCommit = await getRepoCommit(capabilityPath);
         if (currentCommit !== lockEntry.commit) {
@@ -4439,7 +4720,7 @@ async function verifyIntegrity(id, lockEntry) {
   }
   return null;
 }
-var OMNI_LOCAL = ".omni", SKILL_DIRS, AGENT_DIRS, COMMAND_DIRS, RULE_DIRS, DOC_DIRS, SKILL_FILES, AGENT_FILES, COMMAND_FILES, CONTENT_HASH_EXCLUDES;
+var OMNI_LOCAL = ".omni", SKILL_DIRS, AGENT_DIRS, COMMAND_DIRS, RULE_DIRS, DOC_DIRS, WRAPPED_CONTENT_DIRS, WRAPPED_ROOT_FILES_EXACT, WRAPPED_ROOT_FILE_PATTERNS, SKILL_FILES, AGENT_FILES, COMMAND_FILES, CONTENT_HASH_EXCLUDES;
 var init_sources = __esm(() => {
   init_dist();
   init_types2();
@@ -4448,6 +4729,23 @@ var init_sources = __esm(() => {
   COMMAND_DIRS = ["commands", "command"];
   RULE_DIRS = ["rules", "rule"];
   DOC_DIRS = ["docs", "doc", "documentation"];
+  WRAPPED_CONTENT_DIRS = new Set([
+    ...SKILL_DIRS,
+    ...AGENT_DIRS,
+    ...COMMAND_DIRS,
+    ...RULE_DIRS,
+    ...DOC_DIRS,
+    "hooks",
+    ".claude-plugin"
+  ]);
+  WRAPPED_ROOT_FILES_EXACT = new Set([".gitignore", "hooks.json"]);
+  WRAPPED_ROOT_FILE_PATTERNS = [
+    /^readme(?:\..+)?$/i,
+    /^license(?:\..+)?$/i,
+    /^licence(?:\..+)?$/i,
+    /^notice(?:\..+)?$/i,
+    /^copying(?:\..+)?$/i
+  ];
   SKILL_FILES = ["SKILL.md", "skill.md", "Skill.md"];
   AGENT_FILES = ["AGENT.md", "agent.md", "Agent.md", "SUBAGENT.md", "subagent.md"];
   COMMAND_FILES = ["COMMAND.md", "command.md", "Command.md"];
@@ -4489,13 +4787,13 @@ var init_hooks = __esm(() => {
 });
 
 // ../core/src/config/provider.ts
-import { existsSync as existsSync13 } from "node:fs";
-import { readFile as readFile10, writeFile as writeFile4 } from "node:fs/promises";
+import { existsSync as existsSync14 } from "node:fs";
+import { readFile as readFile11, writeFile as writeFile4 } from "node:fs/promises";
 async function loadProviderConfig() {
-  if (!existsSync13(PROVIDER_CONFIG_PATH)) {
+  if (!existsSync14(PROVIDER_CONFIG_PATH)) {
     return { provider: "claude" };
   }
-  const content = await readFile10(PROVIDER_CONFIG_PATH, "utf-8");
+  const content = await readFile11(PROVIDER_CONFIG_PATH, "utf-8");
   const parsed = parse(content);
   return parsed;
 }
@@ -4542,13 +4840,13 @@ var init_provider = __esm(() => {
 });
 
 // ../core/src/config/toml-patcher.ts
-import { existsSync as existsSync14 } from "node:fs";
-import { readFile as readFile11, writeFile as writeFile5 } from "node:fs/promises";
+import { existsSync as existsSync15 } from "node:fs";
+import { readFile as readFile12, writeFile as writeFile5 } from "node:fs/promises";
 async function readConfigFile() {
-  if (!existsSync14(CONFIG_PATH2)) {
+  if (!existsSync15(CONFIG_PATH2)) {
     return "";
   }
-  return readFile11(CONFIG_PATH2, "utf-8");
+  return readFile12(CONFIG_PATH2, "utf-8");
 }
 async function writeConfigFile(content) {
   await writeFile5(CONFIG_PATH2, content, "utf-8");
@@ -4770,14 +5068,14 @@ var init_config2 = __esm(() => {
 });
 
 // ../core/src/mcp-json/manager.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { readFile as readFile12, writeFile as writeFile6 } from "node:fs/promises";
+import { existsSync as existsSync16 } from "node:fs";
+import { readFile as readFile13, writeFile as writeFile6 } from "node:fs/promises";
 async function readMcpJson() {
-  if (!existsSync15(MCP_JSON_PATH)) {
+  if (!existsSync16(MCP_JSON_PATH)) {
     return { mcpServers: {} };
   }
   try {
-    const content = await readFile12(MCP_JSON_PATH, "utf-8");
+    const content = await readFile13(MCP_JSON_PATH, "utf-8");
     const parsed = JSON.parse(content);
     return {
       mcpServers: parsed.mcpServers || {}
@@ -4859,17 +5157,17 @@ var init_mcp_json = __esm(() => {
 });
 
 // ../core/src/state/manifest.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync2, rmSync } from "node:fs";
-import { readFile as readFile13, writeFile as writeFile7 } from "node:fs/promises";
+import { existsSync as existsSync17, mkdirSync as mkdirSync2, rmSync } from "node:fs";
+import { readFile as readFile14, writeFile as writeFile7 } from "node:fs/promises";
 async function loadManifest() {
-  if (!existsSync16(MANIFEST_PATH)) {
+  if (!existsSync17(MANIFEST_PATH)) {
     return {
       version: CURRENT_VERSION,
       syncedAt: new Date().toISOString(),
       capabilities: {}
     };
   }
-  const content = await readFile13(MANIFEST_PATH, "utf-8");
+  const content = await readFile14(MANIFEST_PATH, "utf-8");
   return JSON.parse(content);
 }
 async function saveManifest(manifest) {
@@ -4909,14 +5207,14 @@ async function cleanupStaleResources(previousManifest, currentCapabilityIds) {
     }
     for (const skillName of resources.skills) {
       const skillDir = `.claude/skills/${skillName}`;
-      if (existsSync16(skillDir)) {
+      if (existsSync17(skillDir)) {
         rmSync(skillDir, { recursive: true });
         result.deletedSkills.push(skillName);
       }
     }
     for (const ruleName of resources.rules) {
       const rulePath = `.cursor/rules/omnidev-${ruleName}.mdc`;
-      if (existsSync16(rulePath)) {
+      if (existsSync17(rulePath)) {
         rmSync(rulePath);
         result.deletedRules.push(ruleName);
       }
@@ -4928,14 +5226,14 @@ var MANIFEST_PATH = ".omni/state/manifest.json", CURRENT_VERSION = 1;
 var init_manifest = () => {};
 
 // ../core/src/state/providers.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync3 } from "node:fs";
-import { readFile as readFile14, writeFile as writeFile8 } from "node:fs/promises";
+import { existsSync as existsSync18, mkdirSync as mkdirSync3 } from "node:fs";
+import { readFile as readFile15, writeFile as writeFile8 } from "node:fs/promises";
 async function readEnabledProviders() {
-  if (!existsSync17(PROVIDERS_PATH)) {
+  if (!existsSync18(PROVIDERS_PATH)) {
     return DEFAULT_PROVIDERS;
   }
   try {
-    const content = await readFile14(PROVIDERS_PATH, "utf-8");
+    const content = await readFile15(PROVIDERS_PATH, "utf-8");
     const state = JSON.parse(content);
     return state.enabled.length > 0 ? state.enabled : DEFAULT_PROVIDERS;
   } catch {
@@ -4964,20 +5262,20 @@ async function isProviderEnabled(providerId) {
   return current.includes(providerId);
 }
 var STATE_DIR2 = ".omni/state", PROVIDERS_PATH, DEFAULT_PROVIDERS;
-var init_providers = __esm(() => {
+var init_providers2 = __esm(() => {
   PROVIDERS_PATH = `${STATE_DIR2}/providers.json`;
   DEFAULT_PROVIDERS = ["claude-code"];
 });
 
 // ../core/src/state/security-allows.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync4 } from "node:fs";
-import { readFile as readFile15, writeFile as writeFile9 } from "node:fs/promises";
+import { existsSync as existsSync19, mkdirSync as mkdirSync4 } from "node:fs";
+import { readFile as readFile16, writeFile as writeFile9 } from "node:fs/promises";
 async function readSecurityAllows() {
-  if (!existsSync18(SECURITY_PATH)) {
+  if (!existsSync19(SECURITY_PATH)) {
     return { ...DEFAULT_STATE };
   }
   try {
-    const content = await readFile15(SECURITY_PATH, "utf-8");
+    const content = await readFile16(SECURITY_PATH, "utf-8");
     const state = JSON.parse(content);
     return state;
   } catch {
@@ -5066,7 +5364,7 @@ var init_security_allows = __esm(() => {
 var init_state = __esm(() => {
   init_active_profile();
   init_manifest();
-  init_providers();
+  init_providers2();
   init_security_allows();
 });
 
@@ -5074,10 +5372,11 @@ var init_state = __esm(() => {
 import { spawn as spawn2 } from "node:child_process";
 import { mkdirSync as mkdirSync5 } from "node:fs";
 async function installCapabilityDependencies(silent) {
-  const { existsSync: existsSync19, readdirSync: readdirSync7, readFileSync: readFileSync3 } = await import("node:fs");
-  const { join: join9 } = await import("node:path");
+  const { existsSync: existsSync20, readdirSync: readdirSync7, readFileSync: readFileSync3 } = await import("node:fs");
+  const { join: join10 } = await import("node:path");
+  const { parse: parse2 } = await Promise.resolve().then(() => (init_dist(), exports_dist));
   const capabilitiesDir = ".omni/capabilities";
-  if (!existsSync19(capabilitiesDir)) {
+  if (!existsSync20(capabilitiesDir)) {
     return;
   }
   const entries = readdirSync7(capabilitiesDir, { withFileTypes: true });
@@ -5097,45 +5396,26 @@ async function installCapabilityDependencies(silent) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const capabilityPath = join9(capabilitiesDir, entry.name);
-    const packageJsonPath = join9(capabilityPath, "package.json");
-    if (!existsSync19(packageJsonPath)) {
+    const capabilityPath = join10(capabilitiesDir, entry.name);
+    const packageJsonPath = join10(capabilityPath, "package.json");
+    const capabilityTomlPath = join10(capabilityPath, "capability.toml");
+    if (!existsSync20(packageJsonPath)) {
       continue;
     }
-    await new Promise((resolve2, reject) => {
-      const useNpmCi = hasNpm && existsSync19(join9(capabilityPath, "package-lock.json"));
-      const cmd = hasBun ? "bun" : "npm";
-      const args = hasBun ? ["install"] : useNpmCi ? ["ci"] : ["install"];
-      const proc = spawn2(cmd, args, {
-        cwd: capabilityPath,
-        stdio: "pipe"
-      });
-      let stderr = "";
-      proc.stderr?.on("data", (data) => {
-        stderr += data.toString();
-      });
-      proc.on("close", (code) => {
-        if (code === 0) {
-          resolve2();
-        } else {
-          reject(new Error(`Failed to install dependencies for ${capabilityPath}:
-${stderr}`));
+    if (existsSync20(capabilityTomlPath)) {
+      try {
+        const tomlContent = readFileSync3(capabilityTomlPath, "utf-8");
+        const parsed = parse2(tomlContent);
+        if (parsed.capability?.metadata?.wrapped === true) {
+          continue;
         }
-      });
-      proc.on("error", (error) => {
-        reject(error);
-      });
-    });
-    const hasIndexTs = existsSync19(join9(capabilityPath, "index.ts"));
-    let hasBuildScript = false;
+      } catch {}
+    }
     try {
-      const pkgJson = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
-      hasBuildScript = Boolean(pkgJson.scripts?.build);
-    } catch {}
-    if (hasBuildScript) {
       await new Promise((resolve2, reject) => {
+        const useNpmCi = hasNpm && existsSync20(join10(capabilityPath, "package-lock.json"));
         const cmd = hasBun ? "bun" : "npm";
-        const args = ["run", "build"];
+        const args = hasBun ? ["install"] : useNpmCi ? ["ci"] : ["install"];
         const proc = spawn2(cmd, args, {
           cwd: capabilityPath,
           stdio: "pipe"
@@ -5148,7 +5428,7 @@ ${stderr}`));
           if (code === 0) {
             resolve2();
           } else {
-            reject(new Error(`Failed to build capability ${capabilityPath}:
+            reject(new Error(`Failed to install dependencies for ${capabilityPath}:
 ${stderr}`));
           }
         });
@@ -5156,12 +5436,46 @@ ${stderr}`));
           reject(error);
         });
       });
-    } else if (hasIndexTs && !silent) {
-      const hasBuiltIndex = existsSync19(join9(capabilityPath, "dist", "index.js"));
-      if (!hasBuiltIndex) {
-        console.warn(`Warning: Capability at ${capabilityPath} has index.ts but no build script.
+      const hasIndexTs = existsSync20(join10(capabilityPath, "index.ts"));
+      let hasBuildScript = false;
+      try {
+        const pkgJson = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
+        hasBuildScript = Boolean(pkgJson.scripts?.build);
+      } catch {}
+      if (hasBuildScript) {
+        await new Promise((resolve2, reject) => {
+          const cmd = hasBun ? "bun" : "npm";
+          const args = ["run", "build"];
+          const proc = spawn2(cmd, args, {
+            cwd: capabilityPath,
+            stdio: "pipe"
+          });
+          let stderr = "";
+          proc.stderr?.on("data", (data) => {
+            stderr += data.toString();
+          });
+          proc.on("close", (code) => {
+            if (code === 0) {
+              resolve2();
+            } else {
+              reject(new Error(`Failed to build capability ${capabilityPath}:
+${stderr}`));
+            }
+          });
+          proc.on("error", (error) => {
+            reject(error);
+          });
+        });
+      } else if (hasIndexTs && !silent) {
+        const hasBuiltIndex = existsSync20(join10(capabilityPath, "dist", "index.js"));
+        if (!hasBuiltIndex) {
+          console.warn(`Warning: Capability at ${capabilityPath} has index.ts but no build script.
   Add a "build" script to package.json (e.g., "build": "tsc") to compile TypeScript.`);
+        }
       }
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      console.warn(`Warning: ${errorMessage}`);
     }
   }
 }
@@ -5296,13 +5610,13 @@ var init_types3 = __esm(() => {
 });
 
 // ../core/src/security/scanner.ts
-import { existsSync as existsSync19 } from "node:fs";
-import { lstat, readdir as readdir2, readFile as readFile16, readlink, realpath } from "node:fs/promises";
-import { join as join9, relative, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync20 } from "node:fs";
+import { lstat, readdir as readdir2, readFile as readFile17, readlink, realpath } from "node:fs/promises";
+import { join as join10, relative, resolve as resolve2 } from "node:path";
 async function scanFileForUnicode(filePath, relativePath) {
   const findings = [];
   try {
-    const content = await readFile16(filePath, "utf-8");
+    const content = await readFile17(filePath, "utf-8");
     const lines = content.split(`
 `);
     for (let lineNum = 0;lineNum < lines.length; lineNum++) {
@@ -5356,7 +5670,7 @@ async function scanFileForUnicode(filePath, relativePath) {
 async function scanFileForScripts(filePath, relativePath) {
   const findings = [];
   try {
-    const content = await readFile16(filePath, "utf-8");
+    const content = await readFile17(filePath, "utf-8");
     const lines = content.split(`
 `);
     for (let lineNum = 0;lineNum < lines.length; lineNum++) {
@@ -5382,7 +5696,7 @@ async function scanFileForScripts(filePath, relativePath) {
 async function checkSymlink(symlinkPath, relativePath, capabilityRoot) {
   try {
     const linkTarget = await readlink(symlinkPath);
-    const resolvedTarget = resolve2(join9(symlinkPath, "..", linkTarget));
+    const resolvedTarget = resolve2(join10(symlinkPath, "..", linkTarget));
     const normalizedRoot = await realpath(capabilityRoot);
     if (linkTarget.startsWith("/")) {
       return {
@@ -5417,7 +5731,7 @@ function isTextFile(filePath) {
 async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_SCAN_SETTINGS) {
   const startTime = Date.now();
   const findings = [];
-  if (!existsSync19(capabilityPath)) {
+  if (!existsSync20(capabilityPath)) {
     return {
       capabilityId,
       path: capabilityPath,
@@ -5429,7 +5743,7 @@ async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_S
   async function scanDirectory(dirPath) {
     const entries = await readdir2(dirPath, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join9(dirPath, entry.name);
+      const fullPath = join10(dirPath, entry.name);
       const relativePath = relative(capabilityPath, fullPath);
       if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "__pycache__") {
         continue;
@@ -5720,13 +6034,16 @@ function generateAgentsTemplate() {
 }
 
 // ../core/src/templates/capability.ts
+function escapeTomlString2(value) {
+  return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
 function generateCapabilityToml2(options) {
   const description = options.description || "TODO: Add a description for your capability";
   return `[capability]
-id = "${options.id}"
-name = "${options.name}"
+id = "${escapeTomlString2(options.id)}"
+name = "${escapeTomlString2(options.name)}"
 version = "0.1.0"
-description = "${description}"
+description = "${escapeTomlString2(description)}"
 
 # Optional author information
 # [capability.author]
@@ -5919,6 +6236,8 @@ __export(exports_src, {
   parseOmniConfig: () => parseOmniConfig,
   parseFileSourcePath: () => parseFileSourcePath,
   parseCapabilityConfig: () => parseCapabilityConfig,
+  normalizeProviderId: () => normalizeProviderId,
+  normalizeProviderApplicability: () => normalizeProviderApplicability,
   mergeHooksConfigs: () => mergeHooksConfigs,
   mergeAndDeduplicateHooks: () => mergeAndDeduplicateHooks,
   loadSubagents: () => loadSubagents,
@@ -6026,6 +6345,7 @@ var init_src = __esm(() => {
   init_state();
   init_sync();
   init_security();
+  init_providers();
   init_types2();
 });
 
@@ -6033,17 +6353,17 @@ var init_src = __esm(() => {
 import { run } from "@stricli/core";
 
 // src/lib/dynamic-app.ts
-import { existsSync as existsSync29 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 import { buildApplication, buildRouteMap as buildRouteMap7 } from "@stricli/core";
 
 // src/commands/add.ts
-import { existsSync as existsSync22 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 import { basename as basename5, resolve as resolve3 } from "node:path";
 
 // ../adapters/src/writers/generic/executor.ts
-async function executeWriters(writerConfigs, bundle, projectRoot) {
+async function executeWriters(writerConfigs, bundle, projectRoot, providerId) {
   const seen = new Set;
   const uniqueConfigs = [];
   let deduplicatedCount = 0;
@@ -6060,7 +6380,8 @@ async function executeWriters(writerConfigs, bundle, projectRoot) {
   for (const config of uniqueConfigs) {
     const result = await config.writer.write(bundle, {
       outputPath: config.outputPath,
-      projectRoot
+      projectRoot,
+      ...providerId ? { providerId } : {}
     });
     allFilesWritten.push(...result.filesWritten);
   }
@@ -6071,23 +6392,23 @@ async function executeWriters(writerConfigs, bundle, projectRoot) {
 }
 // ../adapters/src/writers/generic/hooks.ts
 init_src();
-import { existsSync as existsSync20 } from "node:fs";
-import { mkdir as mkdir2, readFile as readFile17, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname, join as join10 } from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import { mkdir as mkdir2, readFile as readFile18, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname, join as join11 } from "node:path";
 var HooksWriter = {
   id: "hooks",
   async write(bundle, ctx) {
     if (!bundle.hooks) {
       return { filesWritten: [] };
     }
-    const settingsPath = join10(ctx.projectRoot, ctx.outputPath);
+    const settingsPath = join11(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname(settingsPath);
     await mkdir2(parentDir, { recursive: true });
     const claudeHooks = transformHooksConfig(bundle.hooks, "toClaude");
     let existingSettings = {};
-    if (existsSync20(settingsPath)) {
+    if (existsSync21(settingsPath)) {
       try {
-        const content = await readFile17(settingsPath, "utf-8");
+        const content = await readFile18(settingsPath, "utf-8");
         existingSettings = JSON.parse(content);
       } catch {
         existingSettings = {};
@@ -6105,21 +6426,42 @@ var HooksWriter = {
   }
 };
 // ../adapters/src/writers/generic/instructions-md.ts
-import { existsSync as existsSync21 } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile18, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname2, join as join11 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { mkdir as mkdir3, readFile as readFile19, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname2, join as join12 } from "node:path";
+
+// ../adapters/src/writers/generic/omni-md.ts
+init_src();
+var PROVIDER_BLOCK_REGEX = /<provider\.([a-z-]+)>([\s\S]*?)<\/provider\.\1>/g;
+var PROVIDER_TAG_REGEX = /<\/?provider\.[a-z-]+>/;
+function renderOmniMdForProvider(content, providerId) {
+  if (!providerId) {
+    return content;
+  }
+  const rendered = content.replace(PROVIDER_BLOCK_REGEX, (_match, rawProvider, providerContent) => {
+    const canonicalProvider = normalizeProviderId(rawProvider);
+    return canonicalProvider === providerId ? providerContent : "";
+  });
+  const strayTag = rendered.match(PROVIDER_TAG_REGEX);
+  if (strayTag) {
+    throw new Error(`Invalid provider block syntax in OMNI.md near ${strayTag[0]}`);
+  }
+  return rendered;
+}
+
+// ../adapters/src/writers/generic/instructions-md.ts
 var InstructionsMdWriter = {
   id: "instructions-md",
   async write(bundle, ctx) {
-    const outputFullPath = join11(ctx.projectRoot, ctx.outputPath);
+    const outputFullPath = join12(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname2(outputFullPath);
     if (parentDir !== ctx.projectRoot) {
       await mkdir3(parentDir, { recursive: true });
     }
-    const omniMdPath = join11(ctx.projectRoot, "OMNI.md");
+    const omniMdPath = join12(ctx.projectRoot, "OMNI.md");
     let omniMdContent = "";
-    if (existsSync21(omniMdPath)) {
-      omniMdContent = await readFile18(omniMdPath, "utf-8");
+    if (existsSync22(omniMdPath)) {
+      omniMdContent = renderOmniMdForProvider(await readFile19(omniMdPath, "utf-8"), ctx.providerId);
     }
     let content = omniMdContent;
     if (bundle.instructionsContent) {
@@ -6136,17 +6478,17 @@ ${bundle.instructionsContent}
 };
 // ../adapters/src/writers/generic/skills.ts
 import { mkdir as mkdir4, writeFile as writeFile12 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 var SkillsWriter = {
   id: "skills",
   async write(bundle, ctx) {
-    const skillsDir = join12(ctx.projectRoot, ctx.outputPath);
+    const skillsDir = join13(ctx.projectRoot, ctx.outputPath);
     await mkdir4(skillsDir, { recursive: true });
     const filesWritten = [];
     for (const skill of bundle.skills) {
-      const skillDir = join12(skillsDir, skill.name);
+      const skillDir = join13(skillsDir, skill.name);
       await mkdir4(skillDir, { recursive: true });
-      const skillPath = join12(skillDir, "SKILL.md");
+      const skillPath = join13(skillDir, "SKILL.md");
       const content = `---
 name: ${skill.name}
 description: "${skill.description}"
@@ -6154,7 +6496,7 @@ description: "${skill.description}"
 
 ${skill.instructions}`;
       await writeFile12(skillPath, content, "utf-8");
-      filesWritten.push(join12(ctx.outputPath, skill.name, "SKILL.md"));
+      filesWritten.push(join13(ctx.outputPath, skill.name, "SKILL.md"));
     }
     return {
       filesWritten
@@ -6163,7 +6505,7 @@ ${skill.instructions}`;
 };
 // ../adapters/src/writers/generic/commands-as-skills.ts
 import { mkdir as mkdir5, writeFile as writeFile13 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function generateSkillFrontmatter(command) {
   const lines = ["---"];
   lines.push(`name: ${command.name}`);
@@ -6178,28 +6520,75 @@ function generateSkillFrontmatter(command) {
 var CommandsAsSkillsWriter = {
   id: "commands-as-skills",
   async write(bundle, ctx) {
-    const skillsDir = join13(ctx.projectRoot, ctx.outputPath);
+    const skillsDir = join14(ctx.projectRoot, ctx.outputPath);
     await mkdir5(skillsDir, { recursive: true });
     const filesWritten = [];
     for (const command of bundle.commands) {
-      const commandSkillDir = join13(skillsDir, command.name);
+      const commandSkillDir = join14(skillsDir, command.name);
       await mkdir5(commandSkillDir, { recursive: true });
       const frontmatter = generateSkillFrontmatter(command);
       const content = `${frontmatter}
 
 ${command.prompt}`;
-      const skillPath = join13(commandSkillDir, "SKILL.md");
+      const skillPath = join14(commandSkillDir, "SKILL.md");
       await writeFile13(skillPath, content, "utf-8");
-      filesWritten.push(join13(ctx.outputPath, command.name, "SKILL.md"));
+      filesWritten.push(join14(ctx.outputPath, command.name, "SKILL.md"));
     }
     return {
       filesWritten
     };
   }
 };
+// ../adapters/src/provider-bundle.ts
+init_src();
+function capabilityAppliesToProvider(capability3, providerId) {
+  const providers3 = capability3.config.capability.providers;
+  if (!providers3) {
+    return true;
+  }
+  return providers3[providerId] === true;
+}
+function generateInstructionsContent2(rules, _docs) {
+  if (rules.length === 0) {
+    return "";
+  }
+  let content = `## Rules
+
+`;
+  for (const rule of rules) {
+    content += `${rule.content}
+
+`;
+  }
+  return content.trimEnd();
+}
+function createProviderScopedBundle(bundle, providerId) {
+  const capabilities2 = bundle.capabilities.filter((capability3) => capabilityAppliesToProvider(capability3, providerId));
+  const capabilityIds = new Set(capabilities2.map((capability3) => capability3.id));
+  const skills = bundle.skills.filter((skill) => capabilityIds.has(skill.capabilityId));
+  const rules = bundle.rules.filter((rule) => capabilityIds.has(rule.capabilityId));
+  const docs = bundle.docs.filter((doc) => capabilityIds.has(doc.capabilityId));
+  const commands = bundle.commands.filter((command) => capabilityIds.has(command.capabilityId));
+  const subagents = bundle.subagents.filter((subagent) => capabilityIds.has(subagent.capabilityId));
+  const scopedBundle = {
+    capabilities: capabilities2,
+    skills,
+    rules,
+    docs,
+    commands,
+    subagents,
+    instructionsContent: generateInstructionsContent2(rules, docs)
+  };
+  const mergedHooks = mergeHooksConfigs(capabilities2.flatMap((capability3) => capability3.hooks ? [capability3.hooks] : []));
+  if (hasAnyHooks(mergedHooks)) {
+    scopedBundle.hooks = mergedHooks;
+  }
+  return scopedBundle;
+}
+
 // ../adapters/src/writers/claude/agents.ts
 import { mkdir as mkdir6, writeFile as writeFile14 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 function generateFrontmatter(agent) {
   const lines = ["---"];
   lines.push(`name: ${agent.name}`);
@@ -6226,7 +6615,7 @@ function generateFrontmatter(agent) {
 var ClaudeAgentsWriter = {
   id: "claude-agents",
   async write(bundle, ctx) {
-    const agentsDir = join14(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join15(ctx.projectRoot, ctx.outputPath);
     await mkdir6(agentsDir, { recursive: true });
     const filesWritten = [];
     for (const agent of bundle.subagents) {
@@ -6234,9 +6623,9 @@ var ClaudeAgentsWriter = {
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join14(agentsDir, `${agent.name}.md`);
+      const agentPath = join15(agentsDir, `${agent.name}.md`);
       await writeFile14(agentPath, content, "utf-8");
-      filesWritten.push(join14(ctx.outputPath, `${agent.name}.md`));
+      filesWritten.push(join15(ctx.outputPath, `${agent.name}.md`));
     }
     return {
       filesWritten
@@ -6261,7 +6650,9 @@ var claudeCodeAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const providerId = "claude-code";
+    const providerBundle = createProviderScopedBundle(bundle, providerId);
+    const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
       filesDeleted: []
@@ -6270,12 +6661,12 @@ var claudeCodeAdapter = {
 };
 // ../adapters/src/codex/index.ts
 import { mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 
 // ../adapters/src/writers/codex/toml.ts
 init_dist();
 import { mkdir as mkdir7, writeFile as writeFile15 } from "node:fs/promises";
-import { dirname as dirname3, join as join15 } from "node:path";
+import { dirname as dirname3, join as join16 } from "node:path";
 var FILE_HEADER = `# Generated by OmniDev - DO NOT EDIT
 # Run \`omnidev sync\` to regenerate
 
@@ -6326,7 +6717,7 @@ var CodexTomlWriter = {
     if (mcps.size === 0) {
       return { filesWritten: [] };
     }
-    const configPath = join15(ctx.projectRoot, ctx.outputPath);
+    const configPath = join16(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname3(configPath);
     await mkdir7(parentDir, { recursive: true });
     const mcpServers = {};
@@ -6360,7 +6751,7 @@ var codexAdapter = {
     { writer: CodexTomlWriter, outputPath: ".codex/config.toml" }
   ],
   async init(ctx) {
-    const codexDir = join16(ctx.projectRoot, ".codex");
+    const codexDir = join17(ctx.projectRoot, ".codex");
     mkdirSync6(codexDir, { recursive: true });
     return {
       filesCreated: [".codex/"],
@@ -6368,7 +6759,9 @@ var codexAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const providerId = "codex";
+    const providerBundle = createProviderScopedBundle(bundle, providerId);
+    const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
       filesDeleted: []
@@ -6377,11 +6770,11 @@ var codexAdapter = {
 };
 // ../adapters/src/cursor/index.ts
 import { mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 
 // ../adapters/src/writers/cursor/agents.ts
 import { mkdir as mkdir8, writeFile as writeFile16 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 function mapModelToCursor(model) {
   if (!model || model === "inherit")
     return "inherit";
@@ -6413,7 +6806,7 @@ function generateFrontmatter2(agent) {
 var CursorAgentsWriter = {
   id: "cursor-agents",
   async write(bundle, ctx) {
-    const agentsDir = join17(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join18(ctx.projectRoot, ctx.outputPath);
     await mkdir8(agentsDir, { recursive: true });
     const filesWritten = [];
     for (const agent of bundle.subagents) {
@@ -6421,9 +6814,9 @@ var CursorAgentsWriter = {
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join17(agentsDir, `${agent.name}.md`);
+      const agentPath = join18(agentsDir, `${agent.name}.md`);
       await writeFile16(agentPath, content, "utf-8");
-      filesWritten.push(join17(ctx.outputPath, `${agent.name}.md`));
+      filesWritten.push(join18(ctx.outputPath, `${agent.name}.md`));
     }
     return {
       filesWritten
@@ -6432,11 +6825,11 @@ ${agent.systemPrompt}`;
 };
 // ../adapters/src/writers/cursor/commands.ts
 import { mkdir as mkdir9, writeFile as writeFile17 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 var CursorCommandsWriter = {
   id: "cursor-commands",
   async write(bundle, ctx) {
-    const commandsDir = join18(ctx.projectRoot, ctx.outputPath);
+    const commandsDir = join19(ctx.projectRoot, ctx.outputPath);
     await mkdir9(commandsDir, { recursive: true });
     const filesWritten = [];
     for (const command of bundle.commands) {
@@ -6445,9 +6838,9 @@ var CursorCommandsWriter = {
 ${command.description}
 
 ${command.prompt}`;
-      const commandPath = join18(commandsDir, `${command.name}.md`);
+      const commandPath = join19(commandsDir, `${command.name}.md`);
       await writeFile17(commandPath, content, "utf-8");
-      filesWritten.push(join18(ctx.outputPath, `${command.name}.md`));
+      filesWritten.push(join19(ctx.outputPath, `${command.name}.md`));
     }
     return {
       filesWritten
@@ -6456,7 +6849,7 @@ ${command.prompt}`;
 };
 // ../adapters/src/writers/cursor/mcp-json.ts
 import { mkdir as mkdir10, writeFile as writeFile18 } from "node:fs/promises";
-import { dirname as dirname4, join as join19 } from "node:path";
+import { dirname as dirname4, join as join20 } from "node:path";
 function buildCursorMcpConfig(mcp) {
   const transport = mcp.transport ?? "stdio";
   if (transport === "http" || transport === "sse") {
@@ -6501,7 +6894,7 @@ var CursorMcpJsonWriter = {
     if (mcps.size === 0) {
       return { filesWritten: [] };
     }
-    const configPath = join19(ctx.projectRoot, ctx.outputPath);
+    const configPath = join20(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname4(configPath);
     await mkdir10(parentDir, { recursive: true });
     const mcpServers = {};
@@ -6526,17 +6919,17 @@ var CursorMcpJsonWriter = {
 };
 // ../adapters/src/writers/cursor/rules.ts
 import { mkdir as mkdir11, writeFile as writeFile19 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var CursorRulesWriter = {
   id: "cursor-rules",
   async write(bundle, ctx) {
-    const rulesDir = join20(ctx.projectRoot, ctx.outputPath);
+    const rulesDir = join21(ctx.projectRoot, ctx.outputPath);
     await mkdir11(rulesDir, { recursive: true });
     const filesWritten = [];
     for (const rule of bundle.rules) {
-      const rulePath = join20(rulesDir, `omnidev-${rule.name}.mdc`);
+      const rulePath = join21(rulesDir, `omnidev-${rule.name}.mdc`);
       await writeFile19(rulePath, rule.content, "utf-8");
-      filesWritten.push(join20(ctx.outputPath, `omnidev-${rule.name}.mdc`));
+      filesWritten.push(join21(ctx.outputPath, `omnidev-${rule.name}.mdc`));
     }
     return {
       filesWritten
@@ -6556,7 +6949,7 @@ var cursorAdapter = {
     { writer: CursorMcpJsonWriter, outputPath: ".cursor/mcp.json" }
   ],
   async init(ctx) {
-    const rulesDir = join21(ctx.projectRoot, ".cursor", "rules");
+    const rulesDir = join22(ctx.projectRoot, ".cursor", "rules");
     mkdirSync7(rulesDir, { recursive: true });
     return {
       filesCreated: [".cursor/rules/"],
@@ -6564,20 +6957,29 @@ var cursorAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const cursorProviderId = "cursor";
+    const instructionsProviderId = "claude-code";
+    const instructionsWriters = this.writers.filter((config3) => config3.writer.id === "instructions-md");
+    const cursorWriters = this.writers.filter((config3) => config3.writer.id !== "instructions-md");
+    const instructionsBundle = createProviderScopedBundle(bundle, instructionsProviderId);
+    const cursorBundle = createProviderScopedBundle(bundle, cursorProviderId);
+    const instructionsResult = await executeWriters(instructionsWriters, instructionsBundle, ctx.projectRoot, instructionsProviderId);
+    const cursorResult = await executeWriters(cursorWriters, cursorBundle, ctx.projectRoot, cursorProviderId);
     return {
-      filesWritten: result.filesWritten,
+      filesWritten: [
+        ...new Set([...instructionsResult.filesWritten, ...cursorResult.filesWritten])
+      ],
       filesDeleted: []
     };
   }
 };
 // ../adapters/src/opencode/index.ts
 import { mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 
 // ../adapters/src/writers/opencode/agents.ts
 import { mkdir as mkdir12, writeFile as writeFile20 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 function mapModelToOpenCode(model) {
   if (!model || model === "inherit")
     return;
@@ -6655,7 +7057,7 @@ function generateFrontmatter3(agent) {
 var OpenCodeAgentsWriter = {
   id: "opencode-agents",
   async write(bundle, ctx) {
-    const agentsDir = join22(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join23(ctx.projectRoot, ctx.outputPath);
     await mkdir12(agentsDir, { recursive: true });
     const filesWritten = [];
     for (const agent of bundle.subagents) {
@@ -6663,9 +7065,9 @@ var OpenCodeAgentsWriter = {
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join22(agentsDir, `${agent.name}.md`);
+      const agentPath = join23(agentsDir, `${agent.name}.md`);
       await writeFile20(agentPath, content, "utf-8");
-      filesWritten.push(join22(ctx.outputPath, `${agent.name}.md`));
+      filesWritten.push(join23(ctx.outputPath, `${agent.name}.md`));
     }
     return {
       filesWritten
@@ -6674,7 +7076,7 @@ ${agent.systemPrompt}`;
 };
 // ../adapters/src/writers/opencode/commands.ts
 import { mkdir as mkdir13, writeFile as writeFile21 } from "node:fs/promises";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function generateFrontmatter4(command) {
   const lines = ["---"];
   lines.push(`description: "${command.description.replace(/"/g, "\\\"")}"`);
@@ -6691,7 +7093,7 @@ function generateFrontmatter4(command) {
 var OpenCodeCommandsWriter = {
   id: "opencode-commands",
   async write(bundle, ctx) {
-    const commandsDir = join23(ctx.projectRoot, ctx.outputPath);
+    const commandsDir = join24(ctx.projectRoot, ctx.outputPath);
     await mkdir13(commandsDir, { recursive: true });
     const filesWritten = [];
     for (const command of bundle.commands) {
@@ -6699,9 +7101,9 @@ var OpenCodeCommandsWriter = {
       const content = `${frontmatter}
 
 ${command.prompt}`;
-      const commandPath = join23(commandsDir, `${command.name}.md`);
+      const commandPath = join24(commandsDir, `${command.name}.md`);
       await writeFile21(commandPath, content, "utf-8");
-      filesWritten.push(join23(ctx.outputPath, `${command.name}.md`));
+      filesWritten.push(join24(ctx.outputPath, `${command.name}.md`));
     }
     return {
       filesWritten
@@ -6719,7 +7121,7 @@ var opencodeAdapter = {
     { writer: OpenCodeCommandsWriter, outputPath: ".opencode/commands/" }
   ],
   async init(ctx) {
-    const opencodeDir = join24(ctx.projectRoot, ".opencode");
+    const opencodeDir = join25(ctx.projectRoot, ".opencode");
     mkdirSync8(opencodeDir, { recursive: true });
     return {
       filesCreated: [".opencode/"],
@@ -6727,7 +7129,9 @@ var opencodeAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const providerId = "opencode";
+    const providerBundle = createProviderScopedBundle(bundle, providerId);
+    const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
       filesDeleted: []
@@ -6771,7 +7175,7 @@ async function inferCapabilityId(source, sourceType) {
 }
 async function runAddCap(flags, name) {
   try {
-    if (!existsSync22("omni.toml")) {
+    if (!existsSync23("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -6794,7 +7198,7 @@ async function runAddCap(flags, name) {
       sourceType = "local";
       const localPath = flags.local.startsWith("file://") ? flags.local.slice(7) : flags.local;
       source = `file://${localPath}`;
-      if (!existsSync22(localPath)) {
+      if (!existsSync23(localPath)) {
         console.error(`✗ Local path not found: ${localPath}`);
         process.exit(1);
       }
@@ -6886,7 +7290,7 @@ async function runAddCap(flags, name) {
 }
 async function runAddMcp(flags, name) {
   try {
-    if (!existsSync22("omni.toml")) {
+    if (!existsSync23("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -7173,9 +7577,9 @@ var addRoutes = buildRouteMap({
 });
 
 // src/commands/capability.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync9 } from "node:fs";
+import { existsSync as existsSync24, mkdirSync as mkdirSync9 } from "node:fs";
 import { writeFile as writeFile22 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { input } from "@inquirer/prompts";
 init_src();
 import { buildCommand as buildCommand2, buildRouteMap as buildRouteMap2 } from "@stricli/core";
@@ -7353,14 +7757,18 @@ export default {
 } satisfies CapabilityExport;
 `;
 }
-function generateGitignore() {
-  return `dist/
-node_modules/
+function generateGitignore(programmatic) {
+  const lines = [".env"];
+  if (programmatic) {
+    lines.push("dist/", "node_modules/");
+  }
+  return `${lines.join(`
+`)}
 `;
 }
 async function runCapabilityNew(flags, capabilityId) {
   try {
-    if (!existsSync23(".omni")) {
+    if (!existsSync24(".omni")) {
       console.error("✗ OmniDev is not initialized in this directory.");
       console.log("");
       console.log("  Run: omnidev init");
@@ -7384,28 +7792,28 @@ async function runCapabilityNew(flags, capabilityId) {
         default: defaultPath
       });
     }
-    if (existsSync23(capabilityDir)) {
+    if (existsSync24(capabilityDir)) {
       console.error(`✗ Directory already exists at ${capabilityDir}`);
       process.exit(1);
     }
     const name = toTitleCase(id);
     mkdirSync9(capabilityDir, { recursive: true });
     const capabilityToml = generateCapabilityToml2({ id, name });
-    await writeFile22(join25(capabilityDir, "capability.toml"), capabilityToml, "utf-8");
-    const skillDir = join25(capabilityDir, "skills", "getting-started");
+    await writeFile22(join26(capabilityDir, "capability.toml"), capabilityToml, "utf-8");
+    const skillDir = join26(capabilityDir, "skills", "getting-started");
     mkdirSync9(skillDir, { recursive: true });
-    await writeFile22(join25(skillDir, "SKILL.md"), generateSkillTemplate("getting-started"), "utf-8");
-    const rulesDir = join25(capabilityDir, "rules");
+    await writeFile22(join26(skillDir, "SKILL.md"), generateSkillTemplate("getting-started"), "utf-8");
+    const rulesDir = join26(capabilityDir, "rules");
     mkdirSync9(rulesDir, { recursive: true });
-    await writeFile22(join25(rulesDir, "coding-standards.md"), generateRuleTemplate("coding-standards"), "utf-8");
-    const hooksDir = join25(capabilityDir, "hooks");
+    await writeFile22(join26(rulesDir, "coding-standards.md"), generateRuleTemplate("coding-standards"), "utf-8");
+    const hooksDir = join26(capabilityDir, "hooks");
     mkdirSync9(hooksDir, { recursive: true });
-    await writeFile22(join25(hooksDir, "hooks.toml"), generateHooksTemplate(), "utf-8");
-    await writeFile22(join25(hooksDir, "example-hook.sh"), generateHookScript(), "utf-8");
+    await writeFile22(join26(hooksDir, "hooks.toml"), generateHooksTemplate(), "utf-8");
+    await writeFile22(join26(hooksDir, "example-hook.sh"), generateHookScript(), "utf-8");
+    await writeFile22(join26(capabilityDir, ".gitignore"), generateGitignore(Boolean(flags.programmatic)), "utf-8");
     if (flags.programmatic) {
-      await writeFile22(join25(capabilityDir, "package.json"), generatePackageJson(id), "utf-8");
-      await writeFile22(join25(capabilityDir, "index.ts"), generateIndexTs(id, name), "utf-8");
-      await writeFile22(join25(capabilityDir, ".gitignore"), generateGitignore(), "utf-8");
+      await writeFile22(join26(capabilityDir, "package.json"), generatePackageJson(id), "utf-8");
+      await writeFile22(join26(capabilityDir, "index.ts"), generateIndexTs(id, name), "utf-8");
     }
     console.log(`✓ Created capability: ${name}`);
     console.log(`  Location: ${capabilityDir}`);
@@ -7416,10 +7824,10 @@ async function runCapabilityNew(flags, capabilityId) {
     console.log("    - rules/coding-standards.md");
     console.log("    - hooks/hooks.toml");
     console.log("    - hooks/example-hook.sh");
+    console.log("    - .gitignore");
     if (flags.programmatic) {
       console.log("    - package.json");
       console.log("    - index.ts");
-      console.log("    - .gitignore");
     }
     console.log("");
     if (flags.programmatic) {
@@ -7561,9 +7969,9 @@ var capabilityRoutes = buildRouteMap2({
 });
 
 // src/commands/doctor.ts
-import { existsSync as existsSync24 } from "node:fs";
+import { existsSync as existsSync25 } from "node:fs";
 import { execFile } from "node:child_process";
-import { readFile as readFile19 } from "node:fs/promises";
+import { readFile as readFile20 } from "node:fs/promises";
 import { promisify } from "node:util";
 import { buildCommand as buildCommand3 } from "@stricli/core";
 var doctorCommand = buildCommand3({
@@ -7651,7 +8059,7 @@ async function checkPackageManager() {
   }
 }
 async function checkOmniLocalDir() {
-  const exists = existsSync24(".omni");
+  const exists = existsSync25(".omni");
   if (!exists) {
     return {
       name: ".omni/ directory",
@@ -7668,7 +8076,7 @@ async function checkOmniLocalDir() {
 }
 async function checkConfig() {
   const configPath = "omni.toml";
-  if (!existsSync24(configPath)) {
+  if (!existsSync25(configPath)) {
     return {
       name: "Configuration",
       passed: false,
@@ -7695,7 +8103,7 @@ async function checkConfig() {
 }
 async function checkRootGitignore() {
   const gitignorePath = ".gitignore";
-  if (!existsSync24(gitignorePath)) {
+  if (!existsSync25(gitignorePath)) {
     return {
       name: "Root .gitignore",
       passed: false,
@@ -7703,7 +8111,7 @@ async function checkRootGitignore() {
       fix: "Run: omnidev init"
     };
   }
-  const content = await readFile19(gitignorePath, "utf-8");
+  const content = await readFile20(gitignorePath, "utf-8");
   const lines = content.split(`
 `).map((line) => line.trim());
   const hasOmniDir = lines.includes(".omni/");
@@ -7729,7 +8137,7 @@ async function checkRootGitignore() {
 }
 async function checkCapabilitiesDir() {
   const capabilitiesDirPath = ".omni/capabilities";
-  if (!existsSync24(capabilitiesDirPath)) {
+  if (!existsSync25(capabilitiesDirPath)) {
     return {
       name: "Capabilities Directory",
       passed: true,
@@ -7745,8 +8153,8 @@ async function checkCapabilitiesDir() {
 
 // src/commands/init.ts
 import { exec } from "node:child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync10 } from "node:fs";
-import { readFile as readFile20, writeFile as writeFile23 } from "node:fs/promises";
+import { existsSync as existsSync26, mkdirSync as mkdirSync10 } from "node:fs";
+import { readFile as readFile21, writeFile as writeFile23 } from "node:fs/promises";
 import { promisify as promisify2 } from "node:util";
 init_src();
 import { buildCommand as buildCommand4 } from "@stricli/core";
@@ -7759,8 +8167,8 @@ var PROVIDER_GITIGNORE_FILES = {
   codex: ["AGENTS.md", ".codex/"],
   opencode: [".opencode/"]
 };
-function getProviderGitignoreFiles(providers2) {
-  return providers2.flatMap((p) => PROVIDER_GITIGNORE_FILES[p] ?? []);
+function getProviderGitignoreFiles(providers3) {
+  return providers3.flatMap((p) => PROVIDER_GITIGNORE_FILES[p] ?? []);
 }
 async function promptForProviders() {
   const answers = await checkbox({
@@ -7815,7 +8223,7 @@ async function runInit(_flags, providerArg) {
     }
   }
   await writeEnabledProviders(providerIds);
-  if (!existsSync25("omni.toml")) {
+  if (!existsSync26("omni.toml")) {
     await writeConfig({
       profiles: {
         default: {
@@ -7831,7 +8239,7 @@ async function runInit(_flags, providerArg) {
     });
     await setActiveProfile("default");
   }
-  if (!existsSync25("OMNI.md")) {
+  if (!existsSync26("OMNI.md")) {
     await writeFile23("OMNI.md", generateOmniMdTemplate(), "utf-8");
   }
   const config3 = await loadConfig();
@@ -7909,8 +8317,8 @@ async function addProviderFilesToGitignore(entries) {
 async function addToGitignore(entriesToAdd, sectionHeader) {
   const gitignorePath = ".gitignore";
   let content = "";
-  if (existsSync25(gitignorePath)) {
-    content = await readFile20(gitignorePath, "utf-8");
+  if (existsSync26(gitignorePath)) {
+    content = await readFile21(gitignorePath, "utf-8");
   }
   const lines = content.split(`
 `);
@@ -7941,7 +8349,7 @@ async function getTrackedProviderFiles(files) {
 }
 
 // src/commands/profile.ts
-import { existsSync as existsSync26 } from "node:fs";
+import { existsSync as existsSync27 } from "node:fs";
 init_src();
 import { buildCommand as buildCommand5, buildRouteMap as buildRouteMap3 } from "@stricli/core";
 var listCommand2 = buildCommand5({
@@ -7985,7 +8393,7 @@ var profileRoutes = buildRouteMap3({
 });
 async function runProfileList() {
   try {
-    if (!existsSync26("omni.toml")) {
+    if (!existsSync27("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8025,7 +8433,7 @@ async function runProfileList() {
 }
 async function runProfileSet(profileName) {
   try {
-    if (!existsSync26("omni.toml")) {
+    if (!existsSync27("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8174,7 +8582,7 @@ var providerRoutes = buildRouteMap4({
 
 // src/commands/security.ts
 init_src();
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 import { buildCommand as buildCommand7, buildRouteMap as buildRouteMap5 } from "@stricli/core";
 var VALID_FINDING_TYPES = [
   "unicode_bidi",
@@ -8291,7 +8699,7 @@ function formatFindingsWithHints(summary) {
 }
 async function runSecurityIssues(flags = {}) {
   try {
-    if (!existsSync27("omni.toml")) {
+    if (!existsSync28("omni.toml")) {
       console.log("No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8546,7 +8954,7 @@ var securityRoutes = buildRouteMap5({
 });
 
 // src/commands/sync.ts
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync29 } from "node:fs";
 init_src();
 import { buildCommand as buildCommand8 } from "@stricli/core";
 var PROVIDERS_STATE_PATH = ".omni/state/providers.json";
@@ -8564,7 +8972,7 @@ async function runSync() {
     const config3 = await loadConfig();
     const activeProfile = await getActiveProfile() ?? "default";
     let adapters = await getEnabledAdapters();
-    if (!existsSync28(PROVIDERS_STATE_PATH) || adapters.length === 0) {
+    if (!existsSync29(PROVIDERS_STATE_PATH) || adapters.length === 0) {
       console.log("No providers configured yet. Select your provider(s):");
       const providerIds = await promptForProviders();
       await writeEnabledProviders(providerIds);
@@ -8774,9 +9182,9 @@ async function buildDynamicApp() {
     security: securityRoutes
   };
   debug("Core routes registered", Object.keys(routes));
-  const configPath = join26(process.cwd(), "omni.toml");
-  debug("Checking for config", { configPath, exists: existsSync29(configPath), cwd: process.cwd() });
-  if (existsSync29(configPath)) {
+  const configPath = join27(process.cwd(), "omni.toml");
+  debug("Checking for config", { configPath, exists: existsSync30(configPath), cwd: process.cwd() });
+  if (existsSync30(configPath)) {
     try {
       debug("Loading capability commands...");
       const capabilityCommands = await loadCapabilityCommands();
@@ -8851,25 +9259,25 @@ async function loadCapabilityCommands() {
   return commands;
 }
 async function loadCapabilityExport(capability3) {
-  const capabilityPath = join26(process.cwd(), capability3.path);
-  const builtIndexPath = join26(capabilityPath, "dist", "index.js");
-  const jsIndexPath = join26(capabilityPath, "index.js");
-  const tsIndexPath = join26(capabilityPath, "index.ts");
+  const capabilityPath = join27(process.cwd(), capability3.path);
+  const builtIndexPath = join27(capabilityPath, "dist", "index.js");
+  const jsIndexPath = join27(capabilityPath, "index.js");
+  const tsIndexPath = join27(capabilityPath, "index.ts");
   debug(`Checking entry points for '${capability3.id}'`, {
     capabilityPath,
     builtIndexPath,
-    builtExists: existsSync29(builtIndexPath),
+    builtExists: existsSync30(builtIndexPath),
     jsIndexPath,
-    jsExists: existsSync29(jsIndexPath),
+    jsExists: existsSync30(jsIndexPath),
     tsIndexPath,
-    tsExists: existsSync29(tsIndexPath)
+    tsExists: existsSync30(tsIndexPath)
   });
   let indexPath = null;
-  if (existsSync29(builtIndexPath)) {
+  if (existsSync30(builtIndexPath)) {
     indexPath = builtIndexPath;
-  } else if (existsSync29(jsIndexPath)) {
+  } else if (existsSync30(jsIndexPath)) {
     indexPath = jsIndexPath;
-  } else if (existsSync29(tsIndexPath)) {
+  } else if (existsSync30(tsIndexPath)) {
     indexPath = tsIndexPath;
   }
   if (!indexPath) {