@omnidev-ai/cli 0.16.0 → 0.18.0

package/dist/index.js

@@ -1287,45 +1287,6 @@ var init_dist = __esm(() => {
   dist_default = { parse, stringify, TomlDate, TomlError };
 });
 
-// ../core/src/config/parser.ts
-function parseOmniConfig(tomlContent) {
-  try {
-    return parse(tomlContent);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Invalid TOML in config: ${message}`);
-  }
-}
-function validateCapabilityConfig(parsed) {
-  const cap = parsed["capability"];
-  if (typeof cap !== "object" || cap === null) {
-    throw new Error("capability.id is required in capability.toml");
-  }
-  const capability = cap;
-  if (typeof capability["id"] !== "string") {
-    throw new Error("capability.id is required in capability.toml");
-  }
-  if (typeof capability["name"] !== "string") {
-    throw new Error("capability.name is required in capability.toml");
-  }
-  if (typeof capability["version"] !== "string") {
-    throw new Error("capability.version is required in capability.toml");
-  }
-}
-function parseCapabilityConfig(tomlContent) {
-  try {
-    const parsed = parse(tomlContent);
-    validateCapabilityConfig(parsed);
-    return parsed;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Invalid capability.toml: ${message}`);
-  }
-}
-var init_parser = __esm(() => {
-  init_dist();
-});
-
 // ../core/src/hooks/constants.ts
 var HOOK_EVENTS, MATCHER_EVENTS, PROMPT_HOOK_EVENTS, HOOK_TYPES, COMMON_TOOL_MATCHERS, NOTIFICATION_MATCHERS, SESSION_START_MATCHERS, PRE_COMPACT_MATCHERS, DEFAULT_COMMAND_TIMEOUT = 60, DEFAULT_PROMPT_TIMEOUT = 30, VARIABLE_MAPPINGS, HOOKS_CONFIG_FILENAME = "hooks.toml", CLAUDE_HOOKS_CONFIG_FILENAME = "hooks.json", HOOKS_DIRECTORY = "hooks";
 var init_constants = __esm(() => {
@@ -2411,21 +2372,207 @@ var init_loader = __esm(() => {
   init_constants();
 });
 
-// ../core/src/capability/rules.ts
-import { existsSync as existsSync6, readdirSync as readdirSync3 } from "node:fs";
+// ../core/src/providers.ts
+function normalizeProviderId(provider) {
+  if (provider in PROVIDER_ALIAS_MAP) {
+    return PROVIDER_ALIAS_MAP[provider];
+  }
+  throw new Error(`Unknown provider: ${provider}`);
+}
+function normalizeProviderApplicability(value, fieldName) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${fieldName} must be a table of provider = boolean entries`);
+  }
+  const normalized = {};
+  for (const [rawProvider, rawEnabled] of Object.entries(value)) {
+    if (typeof rawEnabled !== "boolean") {
+      throw new Error(`${fieldName}.${rawProvider} must be a boolean`);
+    }
+    const canonicalProvider = normalizeProviderId(rawProvider);
+    const existing = normalized[canonicalProvider];
+    if (existing !== undefined && existing !== rawEnabled) {
+      throw new Error(`Conflicting provider entries in ${fieldName}: ${rawProvider} maps to ${canonicalProvider}`);
+    }
+    normalized[canonicalProvider] = rawEnabled;
+  }
+  return normalized;
+}
+var PROVIDER_ALIAS_MAP;
+var init_providers = __esm(() => {
+  PROVIDER_ALIAS_MAP = {
+    claude: "claude-code",
+    "claude-code": "claude-code",
+    codex: "codex",
+    cursor: "cursor",
+    opencode: "opencode"
+  };
+});
+
+// ../core/src/config/parser.ts
+function parseOmniConfig(tomlContent) {
+  try {
+    return parse(tomlContent);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid TOML in config: ${message}`);
+  }
+}
+function validateCapabilityConfig(parsed) {
+  const cap = parsed["capability"];
+  if (typeof cap !== "object" || cap === null) {
+    throw new Error("capability.id is required in capability.toml");
+  }
+  const capability = cap;
+  if (typeof capability["id"] !== "string") {
+    throw new Error("capability.id is required in capability.toml");
+  }
+  if (typeof capability["name"] !== "string") {
+    throw new Error("capability.name is required in capability.toml");
+  }
+  if (typeof capability["version"] !== "string") {
+    throw new Error("capability.version is required in capability.toml");
+  }
+  if (capability["providers"] !== undefined) {
+    capability["providers"] = normalizeProviderApplicability(capability["providers"], "capability.providers");
+  }
+}
+function parseCapabilityConfig(tomlContent) {
+  try {
+    const parsed = parse(tomlContent);
+    validateCapabilityConfig(parsed);
+    return parsed;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid capability.toml: ${message}`);
+  }
+}
+var init_parser = __esm(() => {
+  init_dist();
+  init_providers();
+});
+
+// ../core/src/capability/env.ts
+import { existsSync as existsSync6 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
-import { basename as basename3, join as join4 } from "node:path";
+import { join as join4 } from "node:path";
+import { parseEnv } from "node:util";
+function mergeEnvSources(capabilityEnv) {
+  const merged = { ...capabilityEnv };
+  for (const [key, value] of Object.entries(process.env)) {
+    if (typeof value === "string") {
+      merged[key] = value;
+    }
+  }
+  return merged;
+}
+async function loadCapabilityEnvVariables(capabilityPath) {
+  const envPath = join4(capabilityPath, CAPABILITY_ENV_FILE);
+  if (!existsSync6(envPath)) {
+    return mergeEnvSources({});
+  }
+  const envContent = await readFile3(envPath, "utf-8");
+  const capabilityEnv = Object.fromEntries(Object.entries(parseEnv(envContent)).filter((entry) => typeof entry[1] === "string"));
+  return mergeEnvSources(capabilityEnv);
+}
+var CAPABILITY_ENV_FILE = ".env";
+var init_env = () => {};
+
+// ../core/src/capability/mcp-env.ts
+function hasEnvPlaceholder(value) {
+  return ENV_PLACEHOLDER_DETECTOR.test(value);
+}
+function resolveString(value, variables, capabilityId, fieldPath) {
+  if (!hasEnvPlaceholder(value)) {
+    return value;
+  }
+  return value.replace(ENV_PLACEHOLDER, (_match, variableName) => {
+    const resolved = variables[variableName];
+    if (resolved === undefined) {
+      throw new Error(`Missing environment variable "${variableName}" required by capability "${capabilityId}" in ${fieldPath}`);
+    }
+    return resolved;
+  });
+}
+function mcpHasPlaceholders(mcp) {
+  const strings = [];
+  if (mcp.command) {
+    strings.push(mcp.command);
+  }
+  if (mcp.cwd) {
+    strings.push(mcp.cwd);
+  }
+  if (mcp.url) {
+    strings.push(mcp.url);
+  }
+  if (mcp.args) {
+    strings.push(...mcp.args);
+  }
+  if (mcp.env) {
+    strings.push(...Object.values(mcp.env));
+  }
+  if (mcp.headers) {
+    strings.push(...Object.values(mcp.headers));
+  }
+  return strings.some((value) => hasEnvPlaceholder(value));
+}
+async function resolveCapabilityMcpEnv(config, capabilityPath, variables) {
+  if (!config.mcp || !mcpHasPlaceholders(config.mcp)) {
+    return config;
+  }
+  const resolvedVariables = variables ?? await loadCapabilityEnvVariables(capabilityPath);
+  const resolvedMcp = { ...config.mcp };
+  const capabilityId = config.capability.id;
+  if (resolvedMcp.command) {
+    resolvedMcp.command = resolveString(resolvedMcp.command, resolvedVariables, capabilityId, "mcp.command");
+  }
+  if (resolvedMcp.cwd) {
+    resolvedMcp.cwd = resolveString(resolvedMcp.cwd, resolvedVariables, capabilityId, "mcp.cwd");
+  }
+  if (resolvedMcp.url) {
+    resolvedMcp.url = resolveString(resolvedMcp.url, resolvedVariables, capabilityId, "mcp.url");
+  }
+  if (resolvedMcp.args) {
+    resolvedMcp.args = resolvedMcp.args.map((arg, index) => resolveString(arg, resolvedVariables, capabilityId, `mcp.args[${index}]`));
+  }
+  if (resolvedMcp.env) {
+    resolvedMcp.env = Object.fromEntries(Object.entries(resolvedMcp.env).map(([key, value]) => [
+      key,
+      resolveString(value, resolvedVariables, capabilityId, `mcp.env.${key}`)
+    ]));
+  }
+  if (resolvedMcp.headers) {
+    resolvedMcp.headers = Object.fromEntries(Object.entries(resolvedMcp.headers).map(([key, value]) => [
+      key,
+      resolveString(value, resolvedVariables, capabilityId, `mcp.headers.${key}`)
+    ]));
+  }
+  return {
+    ...config,
+    mcp: resolvedMcp
+  };
+}
+var ENV_PLACEHOLDER, ENV_PLACEHOLDER_DETECTOR;
+var init_mcp_env = __esm(() => {
+  init_env();
+  ENV_PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+  ENV_PLACEHOLDER_DETECTOR = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/;
+});
+
+// ../core/src/capability/rules.ts
+import { existsSync as existsSync7, readdirSync as readdirSync3 } from "node:fs";
+import { readFile as readFile4 } from "node:fs/promises";
+import { basename as basename3, join as join5 } from "node:path";
 async function loadRules(capabilityPath, capabilityId) {
-  const rulesDir = join4(capabilityPath, "rules");
-  if (!existsSync6(rulesDir)) {
+  const rulesDir = join5(capabilityPath, "rules");
+  if (!existsSync7(rulesDir)) {
     return [];
   }
   const rules = [];
   const entries = readdirSync3(rulesDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".md")) {
-      const rulePath = join4(rulesDir, entry.name);
-      const content = await readFile3(rulePath, "utf-8");
+      const rulePath = join5(rulesDir, entry.name);
+      const content = await readFile4(rulePath, "utf-8");
       rules.push({
         name: basename3(entry.name, ".md"),
         content: content.trim(),
@@ -2438,23 +2585,59 @@ async function loadRules(capabilityPath, capabilityId) {
 var init_rules = () => {};
 
 // ../core/src/capability/skills.ts
-import { existsSync as existsSync7, readdirSync as readdirSync4 } from "node:fs";
-import { readFile as readFile4 } from "node:fs/promises";
-import { join as join5 } from "node:path";
-async function loadSkills(capabilityPath, capabilityId) {
+import { existsSync as existsSync8, readdirSync as readdirSync4 } from "node:fs";
+import { readFile as readFile5 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+function hasSkillPlaceholder(value) {
+  return SKILL_PLACEHOLDER_DETECTOR.test(value);
+}
+function resolveSkillPlaceholders(content, variables, capabilityId, sourceLabel) {
+  if (!hasSkillPlaceholder(content)) {
+    return content;
+  }
+  return content.replace(SKILL_PLACEHOLDER, (match, variableName) => {
+    const resolved = variables[variableName];
+    if (resolved === undefined) {
+      throw new Error(`Missing environment variable "${variableName}" required by capability "${capabilityId}" in ${sourceLabel} (placeholder "${match}")`);
+    }
+    return resolved;
+  });
+}
+function parseSkillMarkdown(content, capabilityId, options) {
+  const resolvedContent = options?.variables && options.sourceLabel ? resolveSkillPlaceholders(content, options.variables, capabilityId, options.sourceLabel) : content;
+  const parsed = parseFrontmatterWithMarkdown(resolvedContent);
+  if (!parsed) {
+    const sourceLabel = options?.sourceLabel ?? "skill content";
+    throw new Error(`Invalid SKILL.md format at ${sourceLabel}: missing YAML frontmatter`);
+  }
+  const frontmatter = parsed.frontmatter;
+  const instructions = parsed.markdown;
+  if (!frontmatter.name || !frontmatter.description) {
+    const sourceLabel = options?.sourceLabel ?? "skill content";
+    throw new Error(`Invalid SKILL.md at ${sourceLabel}: name and description required in frontmatter`);
+  }
+  return {
+    name: frontmatter.name,
+    description: frontmatter.description,
+    instructions: instructions.trim(),
+    capabilityId
+  };
+}
+async function loadSkills(capabilityPath, capabilityId, variables) {
   const skills = [];
   const possibleDirNames = ["skills", "skill"];
+  const resolvedVariables = variables ?? await loadCapabilityEnvVariables(capabilityPath);
   for (const dirName of possibleDirNames) {
-    const dir = join5(capabilityPath, dirName);
-    if (!existsSync7(dir)) {
+    const dir = join6(capabilityPath, dirName);
+    if (!existsSync8(dir)) {
       continue;
     }
     const entries = readdirSync4(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        const skillPath = join5(dir, entry.name, "SKILL.md");
-        if (existsSync7(skillPath)) {
-          const skill = await parseSkillFile(skillPath, capabilityId);
+        const skillPath = join6(dir, entry.name, "SKILL.md");
+        if (existsSync8(skillPath)) {
+          const skill = await parseSkillFile(skillPath, capabilityId, resolvedVariables, `skill file ${skillPath}`);
           skills.push(skill);
         }
       }
@@ -2462,51 +2645,45 @@ async function loadSkills(capabilityPath, capabilityId) {
   }
   return skills;
 }
-async function parseSkillFile(filePath, capabilityId) {
-  const content = await readFile4(filePath, "utf-8");
-  const parsed = parseFrontmatterWithMarkdown(content);
-  if (!parsed) {
-    throw new Error(`Invalid SKILL.md format at ${filePath}: missing YAML frontmatter`);
-  }
-  const frontmatter = parsed.frontmatter;
-  const instructions = parsed.markdown;
-  if (!frontmatter.name || !frontmatter.description) {
-    throw new Error(`Invalid SKILL.md at ${filePath}: name and description required in frontmatter`);
-  }
-  return {
-    name: frontmatter.name,
-    description: frontmatter.description,
-    instructions: instructions.trim(),
-    capabilityId
-  };
+async function parseSkillFile(filePath, capabilityId, variables, sourceLabel) {
+  const content = await readFile5(filePath, "utf-8");
+  return parseSkillMarkdown(content, capabilityId, {
+    variables,
+    sourceLabel
+  });
 }
-var init_skills = () => {};
+var SKILL_PLACEHOLDER, SKILL_PLACEHOLDER_DETECTOR;
+var init_skills = __esm(() => {
+  init_env();
+  SKILL_PLACEHOLDER = /\{OMNIDEV_([A-Za-z_][A-Za-z0-9_]*)\}/g;
+  SKILL_PLACEHOLDER_DETECTOR = /\{OMNIDEV_([A-Za-z_][A-Za-z0-9_]*)\}/;
+});
 
 // ../core/src/capability/subagents.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5 } from "node:fs";
-import { readFile as readFile5 } from "node:fs/promises";
-import { basename as basename4, join as join6 } from "node:path";
+import { existsSync as existsSync9, readdirSync as readdirSync5 } from "node:fs";
+import { readFile as readFile6 } from "node:fs/promises";
+import { basename as basename4, join as join7 } from "node:path";
 async function loadSubagents(capabilityPath, capabilityId) {
   const subagents = [];
   const possibleDirNames = ["subagents", "agents", "agent", "subagent"];
   for (const dirName of possibleDirNames) {
-    const dir = join6(capabilityPath, dirName);
-    if (!existsSync8(dir)) {
+    const dir = join7(capabilityPath, dirName);
+    if (!existsSync9(dir)) {
       continue;
     }
     const entries = readdirSync5(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        let subagentPath = join6(dir, entry.name, "SUBAGENT.md");
-        if (!existsSync8(subagentPath)) {
-          subagentPath = join6(dir, entry.name, "AGENT.md");
+        let subagentPath = join7(dir, entry.name, "SUBAGENT.md");
+        if (!existsSync9(subagentPath)) {
+          subagentPath = join7(dir, entry.name, "AGENT.md");
         }
-        if (existsSync8(subagentPath)) {
+        if (existsSync9(subagentPath)) {
           const subagent = await parseSubagentFile(subagentPath, capabilityId);
           subagents.push(subagent);
         }
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
-        const subagentPath = join6(dir, entry.name);
+        const subagentPath = join7(dir, entry.name);
         const subagent = await parseSubagentFile(subagentPath, capabilityId);
         subagents.push(subagent);
       }
@@ -2515,7 +2692,7 @@ async function loadSubagents(capabilityPath, capabilityId) {
   return subagents;
 }
 async function parseSubagentFile(filePath, capabilityId) {
-  const content = await readFile5(filePath, "utf-8");
+  const content = await readFile6(filePath, "utf-8");
   const parsed = parseFrontmatterWithMarkdown(content);
   if (!parsed) {
     throw new Error(`Invalid SUBAGENT.md format at ${filePath}: missing YAML frontmatter`);
@@ -2559,18 +2736,18 @@ function parseCommaSeparatedList(value) {
 var init_subagents = () => {};
 
 // ../core/src/capability/loader.ts
-import { existsSync as existsSync9, readdirSync as readdirSync6 } from "node:fs";
-import { readFile as readFile6 } from "node:fs/promises";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync6 } from "node:fs";
+import { readFile as readFile7 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 async function discoverCapabilities() {
   const capabilities = [];
-  if (existsSync9(CAPABILITIES_DIR)) {
+  if (existsSync10(CAPABILITIES_DIR)) {
     const entries = readdirSync6(CAPABILITIES_DIR, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        const entryPath = join7(CAPABILITIES_DIR, entry.name);
-        const configPath = join7(entryPath, "capability.toml");
-        if (existsSync9(configPath)) {
+        const entryPath = join8(CAPABILITIES_DIR, entry.name);
+        const configPath = join8(entryPath, "capability.toml");
+        if (existsSync10(configPath)) {
           capabilities.push(entryPath);
         }
       }
@@ -2579,28 +2756,28 @@ async function discoverCapabilities() {
   return capabilities;
 }
 async function loadCapabilityConfig(capabilityPath) {
-  const configPath = join7(capabilityPath, "capability.toml");
-  const content = await readFile6(configPath, "utf-8");
+  const configPath = join8(capabilityPath, "capability.toml");
+  const content = await readFile7(configPath, "utf-8");
   const config = parseCapabilityConfig(content);
   return config;
 }
 async function importCapabilityExports(capabilityPath) {
-  const builtIndexPath = join7(capabilityPath, "dist", "index.js");
-  const jsIndexPath = join7(capabilityPath, "index.js");
-  const tsIndexPath = join7(capabilityPath, "index.ts");
+  const builtIndexPath = join8(capabilityPath, "dist", "index.js");
+  const jsIndexPath = join8(capabilityPath, "index.js");
+  const tsIndexPath = join8(capabilityPath, "index.ts");
   let indexPath = null;
-  if (existsSync9(builtIndexPath)) {
+  if (existsSync10(builtIndexPath)) {
     indexPath = builtIndexPath;
-  } else if (existsSync9(jsIndexPath)) {
+  } else if (existsSync10(jsIndexPath)) {
     indexPath = jsIndexPath;
-  } else if (existsSync9(tsIndexPath)) {
+  } else if (existsSync10(tsIndexPath)) {
     indexPath = tsIndexPath;
   }
   if (!indexPath) {
     return {};
   }
   try {
-    const absolutePath = join7(process.cwd(), indexPath);
+    const absolutePath = join8(process.cwd(), indexPath);
     const module = await import(absolutePath);
     return module;
   } catch (error) {
@@ -2620,46 +2797,19 @@ If this is a project-specific capability, install dependencies or remove it from
   }
 }
 async function loadTypeDefinitions(capabilityPath) {
-  const typesPath = join7(capabilityPath, "types.d.ts");
-  if (!existsSync9(typesPath)) {
+  const typesPath = join8(capabilityPath, "types.d.ts");
+  if (!existsSync10(typesPath)) {
     return;
   }
-  return readFile6(typesPath, "utf-8");
+  return readFile7(typesPath, "utf-8");
 }
-function convertSkillExports(skillExports, capabilityId) {
-  return skillExports.map((skillExport) => {
+function convertSkillExports(skillExports, capabilityId, variables) {
+  return skillExports.map((skillExport, index) => {
     const exportObj = skillExport;
-    const lines = exportObj.skillMd.split(`
-`);
-    let name = "unnamed";
-    let description = "";
-    let instructions = exportObj.skillMd;
-    if (lines[0]?.trim() === "---") {
-      const endIndex = lines.findIndex((line, i) => i > 0 && line.trim() === "---");
-      if (endIndex > 0) {
-        const frontmatter = lines.slice(1, endIndex);
-        instructions = lines.slice(endIndex + 1).join(`
-`).trim();
-        for (const line of frontmatter) {
-          const match = line.match(/^(\w+):\s*(.+)$/);
-          if (match?.[1] && match[2]) {
-            const key = match[1];
-            const value = match[2];
-            if (key === "name") {
-              name = value.replace(/^["']|["']$/g, "");
-            } else if (key === "description") {
-              description = value.replace(/^["']|["']$/g, "");
-            }
-          }
-        }
-      }
-    }
-    return {
-      name,
-      description,
-      instructions,
-      capabilityId
-    };
+    return parseSkillMarkdown(exportObj.skillMd, capabilityId, {
+      variables,
+      sourceLabel: `programmatic skill export[${index}]`
+    });
   });
 }
 function convertRuleExports(ruleExports, capabilityId) {
@@ -2812,7 +2962,9 @@ function mergeByName(fileBased, programmatic) {
   return Array.from(byName.values());
 }
 async function loadCapability(capabilityPath) {
-  const config = await loadCapabilityConfig(capabilityPath);
+  const capabilityEnvVariables = await loadCapabilityEnvVariables(capabilityPath);
+  const rawConfig = await loadCapabilityConfig(capabilityPath);
+  const config = await resolveCapabilityMcpEnv(rawConfig, capabilityPath, capabilityEnvVariables);
   const id = config.capability.id;
   const exports = await importCapabilityExports(capabilityPath);
   const exportsAny = exports;
@@ -2827,8 +2979,8 @@ async function loadCapability(capabilityPath) {
     return;
   };
   const skillsExport = getExportValue("skills");
-  const programmaticSkills = Array.isArray(skillsExport) ? convertSkillExports(skillsExport, id) : [];
-  const fileSkills = await loadSkills(capabilityPath, id);
+  const programmaticSkills = Array.isArray(skillsExport) ? convertSkillExports(skillsExport, id, capabilityEnvVariables) : [];
+  const fileSkills = await loadSkills(capabilityPath, id, capabilityEnvVariables);
   const skills = mergeByName(fileSkills, programmaticSkills);
   const rulesExport = getExportValue("rules");
   const programmaticRules = Array.isArray(rulesExport) ? convertRuleExports(rulesExport, id) : [];
@@ -2876,18 +3028,20 @@ async function loadCapability(capabilityPath) {
 }
 var CAPABILITIES_DIR = ".omni/capabilities";
 var init_loader2 = __esm(() => {
-  init_parser();
   init_loader();
+  init_parser();
   init_commands();
   init_docs();
+  init_env();
+  init_mcp_env();
   init_rules();
   init_skills();
   init_subagents();
 });
 
 // ../core/src/config/config.ts
-import { existsSync as existsSync10 } from "node:fs";
-import { readFile as readFile7, writeFile } from "node:fs/promises";
+import { existsSync as existsSync11 } from "node:fs";
+import { readFile as readFile8, writeFile } from "node:fs/promises";
 function mergeConfigs(base, override) {
   const merged = { ...base, ...override };
   merged.profiles = { ...base.profiles };
@@ -2929,8 +3083,8 @@ function mergeConfigs(base, override) {
   return merged;
 }
 async function loadBaseConfig() {
-  if (existsSync10(CONFIG_PATH)) {
-    const content = await readFile7(CONFIG_PATH, "utf-8");
+  if (existsSync11(CONFIG_PATH)) {
+    const content = await readFile8(CONFIG_PATH, "utf-8");
     return parseOmniConfig(content);
   }
   return {};
@@ -2938,8 +3092,8 @@ async function loadBaseConfig() {
 async function loadConfig() {
   const baseConfig = await loadBaseConfig();
   let localConfig = {};
-  if (existsSync10(LOCAL_CONFIG)) {
-    const content = await readFile7(LOCAL_CONFIG, "utf-8");
+  if (existsSync11(LOCAL_CONFIG)) {
+    const content = await readFile8(LOCAL_CONFIG, "utf-8");
     localConfig = parseOmniConfig(content);
   }
   return mergeConfigs(baseConfig, localConfig);
@@ -3103,14 +3257,14 @@ var init_config = __esm(() => {
 });
 
 // ../core/src/state/active-profile.ts
-import { existsSync as existsSync11, mkdirSync } from "node:fs";
-import { readFile as readFile8, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { existsSync as existsSync12, mkdirSync } from "node:fs";
+import { readFile as readFile9, unlink, writeFile as writeFile2 } from "node:fs/promises";
 async function readActiveProfileState() {
-  if (!existsSync11(ACTIVE_PROFILE_PATH)) {
+  if (!existsSync12(ACTIVE_PROFILE_PATH)) {
     return null;
   }
   try {
-    const content = await readFile8(ACTIVE_PROFILE_PATH, "utf-8");
+    const content = await readFile9(ACTIVE_PROFILE_PATH, "utf-8");
     const trimmed = content.trim();
     return trimmed || null;
   } catch {
@@ -3122,7 +3276,7 @@ async function writeActiveProfileState(profileName) {
   await writeFile2(ACTIVE_PROFILE_PATH, profileName, "utf-8");
 }
 async function clearActiveProfileState() {
-  if (existsSync11(ACTIVE_PROFILE_PATH)) {
+  if (existsSync12(ACTIVE_PROFILE_PATH)) {
     await unlink(ACTIVE_PROFILE_PATH);
   }
 }
@@ -3366,10 +3520,10 @@ function getActiveProviders(config) {
 var init_types2 = () => {};
 
 // ../core/src/capability/sources.ts
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import { spawn } from "node:child_process";
-import { cp, mkdir, readdir, readFile as readFile9, rename, rm, stat, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join8 } from "node:path";
+import { cp, mkdir, readdir, readFile as readFile10, rename, rm, stat, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join9 } from "node:path";
 import { createHash } from "node:crypto";
 async function spawnCapture(command, args, options) {
   const timeout = options?.timeout ?? 60000;
@@ -3426,10 +3580,10 @@ function parseFileSourcePath(source) {
   return source.slice(7);
 }
 async function readCapabilityIdFromPath(capabilityPath) {
-  const tomlPath = join8(capabilityPath, "capability.toml");
-  if (existsSync12(tomlPath)) {
+  const tomlPath = join9(capabilityPath, "capability.toml");
+  if (existsSync13(tomlPath)) {
     try {
-      const content = await readFile9(tomlPath, "utf-8");
+      const content = await readFile10(tomlPath, "utf-8");
       const parsed = parse(content);
       const capability = parsed["capability"];
       if (capability?.["id"] && typeof capability["id"] === "string") {
@@ -3482,18 +3636,18 @@ function sourceToGitUrl(source) {
   return source;
 }
 function getSourceCapabilityPath(id) {
-  return join8(OMNI_LOCAL, "capabilities", id);
+  return join9(OMNI_LOCAL, "capabilities", id);
 }
 function getLockFilePath() {
   return "omni.lock.toml";
 }
 async function loadLockFile() {
   const lockPath = getLockFilePath();
-  if (!existsSync12(lockPath)) {
+  if (!existsSync13(lockPath)) {
     return { capabilities: {} };
   }
   try {
-    const content = await readFile9(lockPath, "utf-8");
+    const content = await readFile10(lockPath, "utf-8");
     const parsed = parse(content);
     const rawCapabilities = parsed["capabilities"];
     if (!rawCapabilities) {
@@ -3551,7 +3705,7 @@ function stringifyLockFile(lockFile) {
 }
 async function saveLockFile(lockFile) {
   const lockPath = getLockFilePath();
-  await mkdir(join8(OMNI_LOCAL, "capabilities"), { recursive: true });
+  await mkdir(join9(OMNI_LOCAL, "capabilities"), { recursive: true });
   const header = `# Auto-generated by OmniDev - DO NOT EDIT
 # Records installed capability versions for reproducibility
 # Last updated: ${new Date().toISOString()}
@@ -3585,7 +3739,7 @@ async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUD
     const entries = await readdir(currentPath, { withFileTypes: true });
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
-      const fullPath = join8(currentPath, entry.name);
+      const fullPath = join9(currentPath, entry.name);
       const relativePath = fullPath.slice(relativeTo.length + 1);
       if (excludePatterns.some((pattern) => entry.name === pattern || relativePath.startsWith(`${pattern}/`))) {
         continue;
@@ -3593,7 +3747,7 @@ async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUD
       if (entry.isDirectory()) {
         await collectFiles(fullPath, relativeTo);
       } else if (entry.isFile()) {
-        const content = await readFile9(fullPath);
+        const content = await readFile10(fullPath);
         files.push({ relativePath, content });
       }
     }
@@ -3607,10 +3761,10 @@ async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUD
   return hash.digest("hex");
 }
 async function detectDisplayVersion(dirPath, fallback, fallbackSource) {
-  const capTomlPath = join8(dirPath, "capability.toml");
-  if (existsSync12(capTomlPath)) {
+  const capTomlPath = join9(dirPath, "capability.toml");
+  if (existsSync13(capTomlPath)) {
     try {
-      const content = await readFile9(capTomlPath, "utf-8");
+      const content = await readFile10(capTomlPath, "utf-8");
       const parsed = parse(content);
       const capability = parsed["capability"];
       if (capability?.["version"] && typeof capability["version"] === "string") {
@@ -3618,20 +3772,20 @@ async function detectDisplayVersion(dirPath, fallback, fallbackSource) {
       }
     } catch {}
   }
-  const pluginJsonPath = join8(dirPath, ".claude-plugin", "plugin.json");
-  if (existsSync12(pluginJsonPath)) {
+  const pluginJsonPath = join9(dirPath, ".claude-plugin", "plugin.json");
+  if (existsSync13(pluginJsonPath)) {
     try {
-      const content = await readFile9(pluginJsonPath, "utf-8");
+      const content = await readFile10(pluginJsonPath, "utf-8");
       const parsed = JSON.parse(content);
       if (parsed.version && typeof parsed.version === "string") {
         return { version: parsed.version, source: "plugin.json" };
       }
     } catch {}
   }
-  const pkgJsonPath = join8(dirPath, "package.json");
-  if (existsSync12(pkgJsonPath)) {
+  const pkgJsonPath = join9(dirPath, "package.json");
+  if (existsSync13(pkgJsonPath)) {
     try {
-      const content = await readFile9(pkgJsonPath, "utf-8");
+      const content = await readFile10(pkgJsonPath, "utf-8");
       const parsed = JSON.parse(content);
       if (parsed.version && typeof parsed.version === "string") {
         return { version: parsed.version, source: "package.json" };
@@ -3642,9 +3796,9 @@ async function detectDisplayVersion(dirPath, fallback, fallbackSource) {
 }
 async function validateGitCapability(sourceUrl, subPath) {
   const gitUrl = sourceToGitUrl(sourceUrl);
-  const tempPath = join8(OMNI_LOCAL, "_temp", `_validate-${Date.now()}`);
+  const tempPath = join9(OMNI_LOCAL, "_temp", `_validate-${Date.now()}`);
   try {
-    await mkdir(join8(tempPath, ".."), { recursive: true });
+    await mkdir(join9(tempPath, ".."), { recursive: true });
     const args = ["clone", "--depth", "1", gitUrl, tempPath];
     const { exitCode, stderr } = await spawnCapture("git", args, { timeout: 30000 });
     if (exitCode !== 0) {
@@ -3680,8 +3834,8 @@ async function validateGitCapability(sourceUrl, subPath) {
         error: `Failed to clone repository: ${stderr.trim()}`
       };
     }
-    const checkPath = subPath ? join8(tempPath, subPath) : tempPath;
-    if (subPath && !existsSync12(checkPath)) {
+    const checkPath = subPath ? join9(tempPath, subPath) : tempPath;
+    if (subPath && !existsSync13(checkPath)) {
       return {
         valid: false,
         hasCapabilityToml: false,
@@ -3692,9 +3846,9 @@ async function validateGitCapability(sourceUrl, subPath) {
     const hasCapToml = hasCapabilityToml(checkPath);
     let capabilityId;
     if (hasCapToml) {
-      const tomlPath = join8(checkPath, "capability.toml");
+      const tomlPath = join9(checkPath, "capability.toml");
       try {
-        const content = await readFile9(tomlPath, "utf-8");
+        const content = await readFile10(tomlPath, "utf-8");
         const parsed = parse(content);
         const capability = parsed["capability"];
         if (capability?.["id"] && typeof capability["id"] === "string") {
@@ -3726,27 +3880,27 @@ async function validateGitCapability(sourceUrl, subPath) {
       canBeWrapped: true
     };
   } finally {
-    if (existsSync12(tempPath)) {
+    if (existsSync13(tempPath)) {
       await rm(tempPath, { recursive: true });
     }
   }
 }
 async function detectPinVersion(sourceUrl, subPath) {
   const gitUrl = sourceToGitUrl(sourceUrl);
-  const tempPath = join8(OMNI_LOCAL, "_temp", `_pin-detect-${Date.now()}`);
+  const tempPath = join9(OMNI_LOCAL, "_temp", `_pin-detect-${Date.now()}`);
   try {
-    await mkdir(join8(tempPath, ".."), { recursive: true });
+    await mkdir(join9(tempPath, ".."), { recursive: true });
     const args = ["clone", "--depth", "1", gitUrl, tempPath];
     const { exitCode, stderr } = await spawnCapture("git", args);
     if (exitCode !== 0) {
       throw new Error(`Failed to clone ${gitUrl}: ${stderr.trim()}`);
     }
     const commit = await getRepoCommit(tempPath);
-    const checkPath = subPath ? join8(tempPath, subPath) : tempPath;
-    const capTomlPath = join8(checkPath, "capability.toml");
-    if (existsSync12(capTomlPath)) {
+    const checkPath = subPath ? join9(tempPath, subPath) : tempPath;
+    const capTomlPath = join9(checkPath, "capability.toml");
+    if (existsSync13(capTomlPath)) {
       try {
-        const content = await readFile9(capTomlPath, "utf-8");
+        const content = await readFile10(capTomlPath, "utf-8");
         const parsed = parse(content);
         const capability = parsed["capability"];
         if (capability?.["version"] && typeof capability["version"] === "string") {
@@ -3754,10 +3908,10 @@ async function detectPinVersion(sourceUrl, subPath) {
         }
       } catch {}
     }
-    const pluginJsonPath = join8(checkPath, ".claude-plugin", "plugin.json");
-    if (existsSync12(pluginJsonPath)) {
+    const pluginJsonPath = join9(checkPath, ".claude-plugin", "plugin.json");
+    if (existsSync13(pluginJsonPath)) {
       try {
-        const content = await readFile9(pluginJsonPath, "utf-8");
+        const content = await readFile10(pluginJsonPath, "utf-8");
         const parsed = JSON.parse(content);
         if (parsed.version && typeof parsed.version === "string") {
           return parsed.version;
@@ -3766,13 +3920,13 @@ async function detectPinVersion(sourceUrl, subPath) {
     }
     return commit;
   } finally {
-    if (existsSync12(tempPath)) {
+    if (existsSync13(tempPath)) {
       await rm(tempPath, { recursive: true });
     }
   }
 }
 async function cloneRepo(gitUrl, targetPath, ref) {
-  await mkdir(join8(targetPath, ".."), { recursive: true });
+  await mkdir(join9(targetPath, ".."), { recursive: true });
   const args = ["clone", "--depth", "1"];
   if (ref) {
     args.push("--branch", ref);
@@ -3830,16 +3984,16 @@ async function fetchRepo(repoPath, ref) {
   return true;
 }
 function hasCapabilityToml(dirPath) {
-  return existsSync12(join8(dirPath, "capability.toml"));
+  return existsSync13(join9(dirPath, "capability.toml"));
 }
 async function shouldWrapDirectory(dirPath) {
-  if (existsSync12(join8(dirPath, ".claude-plugin", "plugin.json"))) {
+  if (existsSync13(join9(dirPath, ".claude-plugin", "plugin.json"))) {
     return true;
   }
   const allDirs = [...SKILL_DIRS, ...AGENT_DIRS, ...COMMAND_DIRS, ...RULE_DIRS, ...DOC_DIRS];
   for (const dirName of allDirs) {
-    const checkPath = join8(dirPath, dirName);
-    if (existsSync12(checkPath)) {
+    const checkPath = join9(dirPath, dirName);
+    if (existsSync13(checkPath)) {
       const stats = await stat(checkPath);
       if (stats.isDirectory()) {
         return true;
@@ -3848,10 +4002,64 @@ async function shouldWrapDirectory(dirPath) {
   }
   return false;
 }
+function isRecognizedWrappedDirectory(dirName, keepGitDir = false) {
+  if (keepGitDir && dirName === ".git") {
+    return true;
+  }
+  return WRAPPED_CONTENT_DIRS.has(dirName);
+}
+function isMandatoryWrappedRootFile(fileName) {
+  if (WRAPPED_ROOT_FILES_EXACT.has(fileName)) {
+    return true;
+  }
+  return WRAPPED_ROOT_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
+}
+async function copyWrappedContentOnly(sourcePath, targetPath) {
+  await mkdir(targetPath, { recursive: true });
+  const entries = await readdir(sourcePath, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory() && !isRecognizedWrappedDirectory(entry.name)) {
+      continue;
+    }
+    if (entry.isFile() && !isMandatoryWrappedRootFile(entry.name)) {
+      continue;
+    }
+    if (!entry.isDirectory() && !entry.isFile()) {
+      continue;
+    }
+    const sourceEntryPath = join9(sourcePath, entry.name);
+    const targetEntryPath = join9(targetPath, entry.name);
+    if (entry.isDirectory()) {
+      await cp(sourceEntryPath, targetEntryPath, { recursive: true });
+    } else {
+      await cp(sourceEntryPath, targetEntryPath);
+    }
+  }
+}
+async function pruneUnknownWrappedEntries(repoPath, keepGitDir = false) {
+  const entries = await readdir(repoPath, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (isRecognizedWrappedDirectory(entry.name, keepGitDir)) {
+        continue;
+      }
+      await rm(join9(repoPath, entry.name), { recursive: true, force: true });
+      continue;
+    }
+    if (entry.isFile()) {
+      if (isMandatoryWrappedRootFile(entry.name)) {
+        continue;
+      }
+      await rm(join9(repoPath, entry.name), { force: true });
+      continue;
+    }
+    await rm(join9(repoPath, entry.name), { recursive: true, force: true });
+  }
+}
 async function findMatchingDirs(basePath, names) {
   for (const name of names) {
-    const dirPath = join8(basePath, name);
-    if (existsSync12(dirPath)) {
+    const dirPath = join9(basePath, name);
+    if (existsSync13(dirPath)) {
       const stats = await stat(dirPath);
       if (stats.isDirectory()) {
         return dirPath;
@@ -3862,15 +4070,15 @@ async function findMatchingDirs(basePath, names) {
 }
 async function findContentItems(dirPath, filePatterns) {
   const items = [];
-  if (!existsSync12(dirPath)) {
+  if (!existsSync13(dirPath)) {
     return items;
   }
   const entries = (await readdir(dirPath, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
-    const entryPath = join8(dirPath, entry.name);
+    const entryPath = join9(dirPath, entry.name);
     if (entry.isDirectory()) {
       for (const pattern of filePatterns) {
-        if (existsSync12(join8(entryPath, pattern))) {
+        if (existsSync13(join9(entryPath, pattern))) {
           items.push({
             name: entry.name,
             path: entryPath,
@@ -3891,12 +4099,12 @@ async function findContentItems(dirPath, filePatterns) {
   return items;
 }
 async function parsePluginJson(dirPath) {
-  const pluginJsonPath = join8(dirPath, ".claude-plugin", "plugin.json");
-  if (!existsSync12(pluginJsonPath)) {
+  const pluginJsonPath = join9(dirPath, ".claude-plugin", "plugin.json");
+  if (!existsSync13(pluginJsonPath)) {
     return null;
   }
   try {
-    const content = await readFile9(pluginJsonPath, "utf-8");
+    const content = await readFile10(pluginJsonPath, "utf-8");
     const data = JSON.parse(content);
     const result = {
       name: data.name,
@@ -3916,12 +4124,12 @@ async function parsePluginJson(dirPath) {
   }
 }
 async function readReadmeDescription(dirPath) {
-  const readmePath = join8(dirPath, "README.md");
-  if (!existsSync12(readmePath)) {
+  const readmePath = join9(dirPath, "README.md");
+  if (!existsSync13(readmePath)) {
     return null;
   }
   try {
-    const content = await readFile9(readmePath, "utf-8");
+    const content = await readFile10(readmePath, "utf-8");
     const lines = content.split(`
 `);
     let description = "";
@@ -3956,9 +4164,9 @@ async function normalizeFolderNames(repoPath) {
     { from: "rule", to: "rules" }
   ];
   for (const { from, to } of renameMappings) {
-    const fromPath = join8(repoPath, from);
-    const toPath = join8(repoPath, to);
-    if (existsSync12(fromPath) && !existsSync12(toPath)) {
+    const fromPath = join9(repoPath, from);
+    const toPath = join9(repoPath, to);
+    if (existsSync13(fromPath) && !existsSync13(toPath)) {
       try {
         const stats = await stat(fromPath);
         if (stats.isDirectory()) {
@@ -4047,7 +4255,7 @@ repository = "${escapeTomlString(repoUrl)}"
 wrapped = true
 commit = "${commit}"
 `;
-  await writeFile3(join8(repoPath, "capability.toml"), tomlContent, "utf-8");
+  await writeFile3(join9(repoPath, "capability.toml"), tomlContent, "utf-8");
 }
 async function fetchGitCapabilitySource(id, config, options) {
   const gitUrl = sourceToGitUrl(config.source);
@@ -4055,31 +4263,40 @@ async function fetchGitCapabilitySource(id, config, options) {
   let updated = false;
   let commit;
   let repoPath;
+  let needsWrap = false;
   const gitRef = config.version && config.version !== "latest" ? config.version : undefined;
   if (config.path) {
-    const tempPath = join8(OMNI_LOCAL, "_temp", `${id}-repo`);
-    if (existsSync12(join8(tempPath, ".git"))) {
+    const tempPath = join9(OMNI_LOCAL, "_temp", `${id}-repo`);
+    if (existsSync13(join9(tempPath, ".git"))) {
       updated = await fetchRepo(tempPath, gitRef);
       commit = await getRepoCommit(tempPath);
     } else {
-      await mkdir(join8(tempPath, ".."), { recursive: true });
+      await mkdir(join9(tempPath, ".."), { recursive: true });
       await cloneRepo(gitUrl, tempPath, gitRef);
       commit = await getRepoCommit(tempPath);
       updated = true;
     }
-    const sourcePath = join8(tempPath, config.path);
-    if (!existsSync12(sourcePath)) {
+    const sourcePath = join9(tempPath, config.path);
+    if (!existsSync13(sourcePath)) {
       throw new Error(`Path not found in repository: ${config.path}`);
     }
-    if (existsSync12(targetPath)) {
+    const sourceHasCapabilityToml = hasCapabilityToml(sourcePath);
+    if (!sourceHasCapabilityToml) {
+      needsWrap = await shouldWrapDirectory(sourcePath);
+    }
+    if (existsSync13(targetPath)) {
       await rm(targetPath, { recursive: true });
     }
-    await mkdir(join8(targetPath, ".."), { recursive: true });
-    await cp(sourcePath, targetPath, { recursive: true });
+    await mkdir(join9(targetPath, ".."), { recursive: true });
+    if (needsWrap) {
+      await copyWrappedContentOnly(sourcePath, targetPath);
+    } else {
+      await cp(sourcePath, targetPath, { recursive: true });
+    }
     await rm(tempPath, { recursive: true });
     repoPath = targetPath;
   } else {
-    if (existsSync12(join8(targetPath, ".git"))) {
+    if (existsSync13(join9(targetPath, ".git"))) {
       if (!options?.silent) {
         console.log(`  Checking ${id}...`);
       }
@@ -4095,11 +4312,11 @@ async function fetchGitCapabilitySource(id, config, options) {
     }
     repoPath = targetPath;
   }
-  let needsWrap = false;
-  if (!hasCapabilityToml(repoPath)) {
+  if (!config.path && !hasCapabilityToml(repoPath)) {
     needsWrap = await shouldWrapDirectory(repoPath);
   }
   if (needsWrap) {
+    await pruneUnknownWrappedEntries(repoPath, true);
     await normalizeFolderNames(repoPath);
     const content = await discoverContent(repoPath);
     await generateCapabilityToml(id, repoPath, config.source, commit, content);
@@ -4130,7 +4347,7 @@ async function fetchGitCapabilitySource(id, config, options) {
 async function fetchFileCapabilitySource(id, config, options) {
   const sourcePath = parseFileSourcePath(config.source);
   const targetPath = getSourceCapabilityPath(id);
-  if (!existsSync12(sourcePath)) {
+  if (!existsSync13(sourcePath)) {
     throw new Error(`File source not found: ${sourcePath}`);
   }
   const sourceStats = await stat(sourcePath);
@@ -4138,7 +4355,7 @@ async function fetchFileCapabilitySource(id, config, options) {
     throw new Error(`File source must be a directory: ${sourcePath}`);
   }
   const contentHash = await computeContentHash(sourcePath);
-  const hasCapToml = existsSync12(join8(sourcePath, "capability.toml"));
+  const hasCapToml = existsSync13(join9(sourcePath, "capability.toml"));
   let needsWrap = false;
   if (!hasCapToml) {
     needsWrap = await shouldWrapDirectory(sourcePath);
@@ -4149,11 +4366,15 @@ async function fetchFileCapabilitySource(id, config, options) {
   if (!options?.silent) {
     console.log(`  Copying ${id} from ${sourcePath}...`);
   }
-  if (existsSync12(targetPath)) {
+  if (existsSync13(targetPath)) {
     await rm(targetPath, { recursive: true });
   }
-  await mkdir(join8(targetPath, ".."), { recursive: true });
-  await cp(sourcePath, targetPath, { recursive: true });
+  await mkdir(join9(targetPath, ".."), { recursive: true });
+  if (needsWrap) {
+    await copyWrappedContentOnly(sourcePath, targetPath);
+  } else {
+    await cp(sourcePath, targetPath, { recursive: true });
+  }
   if (needsWrap) {
     await normalizeFolderNames(targetPath);
     const content = await discoverContent(targetPath);
@@ -4232,7 +4453,7 @@ description = "${escapeTomlString(description)}"
 wrapped = true
 source = "${escapeTomlString(source)}"
 `;
-  await writeFile3(join8(targetPath, "capability.toml"), tomlContent, "utf-8");
+  await writeFile3(join9(targetPath, "capability.toml"), tomlContent, "utf-8");
 }
 async function fetchCapabilitySource(id, sourceConfig, options) {
   const config = parseSourceConfig(sourceConfig);
@@ -4305,16 +4526,16 @@ generated_from_omni_toml = true
 }
 async function generateMcpCapabilityToml(id, mcpConfig, targetPath) {
   const tomlContent = generateMcpCapabilityTomlContent(id, mcpConfig);
-  await writeFile3(join8(targetPath, "capability.toml"), tomlContent, "utf-8");
+  await writeFile3(join9(targetPath, "capability.toml"), tomlContent, "utf-8");
 }
 async function isGeneratedMcpCapability(capabilityDir) {
-  const tomlPath = join8(capabilityDir, "capability.toml");
-  if (!existsSync12(tomlPath)) {
+  const tomlPath = join9(capabilityDir, "capability.toml");
+  if (!existsSync13(tomlPath)) {
     console.warn("no capability.toml found in", capabilityDir);
     return false;
   }
   try {
-    const content = await readFile9(tomlPath, "utf-8");
+    const content = await readFile10(tomlPath, "utf-8");
     const parsed = parse(content);
     const capability = parsed["capability"];
     const metadata = capability?.["metadata"];
@@ -4324,14 +4545,14 @@ async function isGeneratedMcpCapability(capabilityDir) {
   }
 }
 async function cleanupStaleMcpCapabilities(currentMcpIds) {
-  const capabilitiesDir = join8(OMNI_LOCAL, "capabilities");
-  if (!existsSync12(capabilitiesDir)) {
+  const capabilitiesDir = join9(OMNI_LOCAL, "capabilities");
+  if (!existsSync13(capabilitiesDir)) {
     return;
   }
   const entries = await readdir(capabilitiesDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      const capDir = join8(capabilitiesDir, entry.name);
+      const capDir = join9(capabilitiesDir, entry.name);
       const isGenerated = await isGeneratedMcpCapability(capDir);
       if (isGenerated && !currentMcpIds.has(entry.name)) {
         await rm(capDir, { recursive: true });
@@ -4344,10 +4565,10 @@ async function generateMcpCapabilities(config) {
     await cleanupStaleMcpCapabilities(new Set);
     return;
   }
-  const mcpCapabilitiesDir = join8(OMNI_LOCAL, "capabilities");
+  const mcpCapabilitiesDir = join9(OMNI_LOCAL, "capabilities");
   const currentMcpIds = new Set;
   for (const [id, mcpConfig] of Object.entries(config.mcps)) {
-    const targetPath = join8(mcpCapabilitiesDir, id);
+    const targetPath = join9(mcpCapabilitiesDir, id);
     currentMcpIds.add(id);
     await mkdir(targetPath, { recursive: true });
     await generateMcpCapabilityToml(id, mcpConfig, targetPath);
@@ -4356,8 +4577,8 @@ async function generateMcpCapabilities(config) {
 }
 async function fetchAllCapabilitySources(config, options) {
   await generateMcpCapabilities(config);
-  const tempDir = join8(OMNI_LOCAL, "_temp");
-  if (existsSync12(tempDir)) {
+  const tempDir = join9(OMNI_LOCAL, "_temp");
+  if (existsSync13(tempDir)) {
     await rm(tempDir, { recursive: true });
   }
   const sources = config.capabilities?.sources;
@@ -4443,7 +4664,7 @@ async function checkForUpdates(config) {
       continue;
     }
     const gitConfig = sourceConfig;
-    if (!existsSync12(join8(targetPath, ".git"))) {
+    if (!existsSync13(join9(targetPath, ".git"))) {
       updates.push({
         id,
         source: gitConfig.source,
@@ -4486,12 +4707,12 @@ function checkVersionMismatch(lockEntry, currentCommit, currentVersion) {
 }
 async function verifyIntegrity(id, lockEntry) {
   const capabilityPath = getSourceCapabilityPath(id);
-  if (!existsSync12(capabilityPath)) {
+  if (!existsSync13(capabilityPath)) {
     return "capability directory missing";
   }
   if (lockEntry.commit) {
-    const gitDir = join8(capabilityPath, ".git");
-    if (existsSync12(gitDir)) {
+    const gitDir = join9(capabilityPath, ".git");
+    if (existsSync13(gitDir)) {
       try {
         const currentCommit = await getRepoCommit(capabilityPath);
         if (currentCommit !== lockEntry.commit) {
@@ -4510,7 +4731,7 @@ async function verifyIntegrity(id, lockEntry) {
   }
   return null;
 }
-var OMNI_LOCAL = ".omni", SKILL_DIRS, AGENT_DIRS, COMMAND_DIRS, RULE_DIRS, DOC_DIRS, SKILL_FILES, AGENT_FILES, COMMAND_FILES, CONTENT_HASH_EXCLUDES;
+var OMNI_LOCAL = ".omni", SKILL_DIRS, AGENT_DIRS, COMMAND_DIRS, RULE_DIRS, DOC_DIRS, WRAPPED_CONTENT_DIRS, WRAPPED_ROOT_FILES_EXACT, WRAPPED_ROOT_FILE_PATTERNS, SKILL_FILES, AGENT_FILES, COMMAND_FILES, CONTENT_HASH_EXCLUDES;
 var init_sources = __esm(() => {
   init_dist();
   init_types2();
@@ -4519,6 +4740,23 @@ var init_sources = __esm(() => {
   COMMAND_DIRS = ["commands", "command"];
   RULE_DIRS = ["rules", "rule"];
   DOC_DIRS = ["docs", "doc", "documentation"];
+  WRAPPED_CONTENT_DIRS = new Set([
+    ...SKILL_DIRS,
+    ...AGENT_DIRS,
+    ...COMMAND_DIRS,
+    ...RULE_DIRS,
+    ...DOC_DIRS,
+    "hooks",
+    ".claude-plugin"
+  ]);
+  WRAPPED_ROOT_FILES_EXACT = new Set([".gitignore", "hooks.json"]);
+  WRAPPED_ROOT_FILE_PATTERNS = [
+    /^readme(?:\..+)?$/i,
+    /^license(?:\..+)?$/i,
+    /^licence(?:\..+)?$/i,
+    /^notice(?:\..+)?$/i,
+    /^copying(?:\..+)?$/i
+  ];
   SKILL_FILES = ["SKILL.md", "skill.md", "Skill.md"];
   AGENT_FILES = ["AGENT.md", "agent.md", "Agent.md", "SUBAGENT.md", "subagent.md"];
   COMMAND_FILES = ["COMMAND.md", "command.md", "Command.md"];
@@ -4560,13 +4798,13 @@ var init_hooks = __esm(() => {
 });
 
 // ../core/src/config/provider.ts
-import { existsSync as existsSync13 } from "node:fs";
-import { readFile as readFile10, writeFile as writeFile4 } from "node:fs/promises";
+import { existsSync as existsSync14 } from "node:fs";
+import { readFile as readFile11, writeFile as writeFile4 } from "node:fs/promises";
 async function loadProviderConfig() {
-  if (!existsSync13(PROVIDER_CONFIG_PATH)) {
+  if (!existsSync14(PROVIDER_CONFIG_PATH)) {
     return { provider: "claude" };
   }
-  const content = await readFile10(PROVIDER_CONFIG_PATH, "utf-8");
+  const content = await readFile11(PROVIDER_CONFIG_PATH, "utf-8");
   const parsed = parse(content);
   return parsed;
 }
@@ -4613,13 +4851,13 @@ var init_provider = __esm(() => {
 });
 
 // ../core/src/config/toml-patcher.ts
-import { existsSync as existsSync14 } from "node:fs";
-import { readFile as readFile11, writeFile as writeFile5 } from "node:fs/promises";
+import { existsSync as existsSync15 } from "node:fs";
+import { readFile as readFile12, writeFile as writeFile5 } from "node:fs/promises";
 async function readConfigFile() {
-  if (!existsSync14(CONFIG_PATH2)) {
+  if (!existsSync15(CONFIG_PATH2)) {
     return "";
   }
-  return readFile11(CONFIG_PATH2, "utf-8");
+  return readFile12(CONFIG_PATH2, "utf-8");
 }
 async function writeConfigFile(content) {
   await writeFile5(CONFIG_PATH2, content, "utf-8");
@@ -4841,14 +5079,14 @@ var init_config2 = __esm(() => {
 });
 
 // ../core/src/mcp-json/manager.ts
-import { existsSync as existsSync15 } from "node:fs";
-import { readFile as readFile12, writeFile as writeFile6 } from "node:fs/promises";
+import { existsSync as existsSync16 } from "node:fs";
+import { readFile as readFile13, writeFile as writeFile6 } from "node:fs/promises";
 async function readMcpJson() {
-  if (!existsSync15(MCP_JSON_PATH)) {
+  if (!existsSync16(MCP_JSON_PATH)) {
     return { mcpServers: {} };
   }
   try {
-    const content = await readFile12(MCP_JSON_PATH, "utf-8");
+    const content = await readFile13(MCP_JSON_PATH, "utf-8");
     const parsed = JSON.parse(content);
     return {
       mcpServers: parsed.mcpServers || {}
@@ -4930,17 +5168,17 @@ var init_mcp_json = __esm(() => {
 });
 
 // ../core/src/state/manifest.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync2, rmSync } from "node:fs";
-import { readFile as readFile13, writeFile as writeFile7 } from "node:fs/promises";
+import { existsSync as existsSync17, mkdirSync as mkdirSync2, rmSync } from "node:fs";
+import { readFile as readFile14, writeFile as writeFile7 } from "node:fs/promises";
 async function loadManifest() {
-  if (!existsSync16(MANIFEST_PATH)) {
+  if (!existsSync17(MANIFEST_PATH)) {
     return {
       version: CURRENT_VERSION,
       syncedAt: new Date().toISOString(),
       capabilities: {}
     };
   }
-  const content = await readFile13(MANIFEST_PATH, "utf-8");
+  const content = await readFile14(MANIFEST_PATH, "utf-8");
   return JSON.parse(content);
 }
 async function saveManifest(manifest) {
@@ -4980,14 +5218,14 @@ async function cleanupStaleResources(previousManifest, currentCapabilityIds) {
     }
     for (const skillName of resources.skills) {
       const skillDir = `.claude/skills/${skillName}`;
-      if (existsSync16(skillDir)) {
+      if (existsSync17(skillDir)) {
         rmSync(skillDir, { recursive: true });
         result.deletedSkills.push(skillName);
       }
     }
     for (const ruleName of resources.rules) {
       const rulePath = `.cursor/rules/omnidev-${ruleName}.mdc`;
-      if (existsSync16(rulePath)) {
+      if (existsSync17(rulePath)) {
         rmSync(rulePath);
         result.deletedRules.push(ruleName);
       }
@@ -4999,14 +5237,14 @@ var MANIFEST_PATH = ".omni/state/manifest.json", CURRENT_VERSION = 1;
 var init_manifest = () => {};
 
 // ../core/src/state/providers.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync3 } from "node:fs";
-import { readFile as readFile14, writeFile as writeFile8 } from "node:fs/promises";
+import { existsSync as existsSync18, mkdirSync as mkdirSync3 } from "node:fs";
+import { readFile as readFile15, writeFile as writeFile8 } from "node:fs/promises";
 async function readEnabledProviders() {
-  if (!existsSync17(PROVIDERS_PATH)) {
+  if (!existsSync18(PROVIDERS_PATH)) {
     return DEFAULT_PROVIDERS;
   }
   try {
-    const content = await readFile14(PROVIDERS_PATH, "utf-8");
+    const content = await readFile15(PROVIDERS_PATH, "utf-8");
     const state = JSON.parse(content);
     return state.enabled.length > 0 ? state.enabled : DEFAULT_PROVIDERS;
   } catch {
@@ -5035,20 +5273,20 @@ async function isProviderEnabled(providerId) {
   return current.includes(providerId);
 }
 var STATE_DIR2 = ".omni/state", PROVIDERS_PATH, DEFAULT_PROVIDERS;
-var init_providers = __esm(() => {
+var init_providers2 = __esm(() => {
   PROVIDERS_PATH = `${STATE_DIR2}/providers.json`;
   DEFAULT_PROVIDERS = ["claude-code"];
 });
 
 // ../core/src/state/security-allows.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync4 } from "node:fs";
-import { readFile as readFile15, writeFile as writeFile9 } from "node:fs/promises";
+import { existsSync as existsSync19, mkdirSync as mkdirSync4 } from "node:fs";
+import { readFile as readFile16, writeFile as writeFile9 } from "node:fs/promises";
 async function readSecurityAllows() {
-  if (!existsSync18(SECURITY_PATH)) {
+  if (!existsSync19(SECURITY_PATH)) {
     return { ...DEFAULT_STATE };
   }
   try {
-    const content = await readFile15(SECURITY_PATH, "utf-8");
+    const content = await readFile16(SECURITY_PATH, "utf-8");
     const state = JSON.parse(content);
     return state;
   } catch {
@@ -5137,19 +5375,45 @@ var init_security_allows = __esm(() => {
 var init_state = __esm(() => {
   init_active_profile();
   init_manifest();
-  init_providers();
+  init_providers2();
   init_security_allows();
 });
 
 // ../core/src/sync.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdirSync as mkdirSync5 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync5, readFileSync as readFileSync3 } from "node:fs";
+import { join as join10 } from "node:path";
+function getDeclaredPackageManager(packageManager) {
+  if (typeof packageManager !== "string" || packageManager.trim().length === 0) {
+    return;
+  }
+  const atIndex = packageManager.indexOf("@");
+  return atIndex === -1 ? packageManager : packageManager.slice(0, atIndex);
+}
+function resolveCapabilityInstallCommand(capabilityPath, options) {
+  const packageJsonPath = join10(capabilityPath, "package.json");
+  const packageLockPath = join10(capabilityPath, "package-lock.json");
+  let packageManager;
+  try {
+    const pkgJson = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
+    packageManager = getDeclaredPackageManager(pkgJson.packageManager);
+  } catch {}
+  if (!options.hasNpm) {
+    throw new Error("npm is not installed. Install npm to install capability dependencies.");
+  }
+  if (packageManager && packageManager !== "npm") {
+    throw new Error(`Capability at ${capabilityPath} declares packageManager=${packageManager}, but OmniDev only supports npm for capability dependencies.`);
+  }
+  return {
+    cmd: "npm",
+    args: [existsSync20(packageLockPath) ? "ci" : "install"]
+  };
+}
 async function installCapabilityDependencies(silent) {
-  const { existsSync: existsSync19, readdirSync: readdirSync7, readFileSync: readFileSync3 } = await import("node:fs");
-  const { join: join9 } = await import("node:path");
+  const { readdirSync: readdirSync7 } = await import("node:fs");
   const { parse: parse2 } = await Promise.resolve().then(() => (init_dist(), exports_dist));
   const capabilitiesDir = ".omni/capabilities";
-  if (!existsSync19(capabilitiesDir)) {
+  if (!existsSync20(capabilitiesDir)) {
     return;
   }
   const entries = readdirSync7(capabilitiesDir, { withFileTypes: true });
@@ -5160,22 +5424,21 @@ async function installCapabilityDependencies(silent) {
       proc.on("close", (code) => resolve2(code === 0));
     });
   }
-  const hasBun = await commandExists("bun");
-  const hasNpm = hasBun ? false : await commandExists("npm");
-  if (!hasBun && !hasNpm) {
-    throw new Error("Neither Bun nor npm is installed. Install one of them to install capability dependencies.");
+  const hasNpm = await commandExists("npm");
+  if (!hasNpm) {
+    throw new Error("npm is not installed. Install npm to install capability dependencies.");
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const capabilityPath = join9(capabilitiesDir, entry.name);
-    const packageJsonPath = join9(capabilityPath, "package.json");
-    const capabilityTomlPath = join9(capabilityPath, "capability.toml");
-    if (!existsSync19(packageJsonPath)) {
+    const capabilityPath = join10(capabilitiesDir, entry.name);
+    const packageJsonPath = join10(capabilityPath, "package.json");
+    const capabilityTomlPath = join10(capabilityPath, "capability.toml");
+    if (!existsSync20(packageJsonPath)) {
       continue;
     }
-    if (existsSync19(capabilityTomlPath)) {
+    if (existsSync20(capabilityTomlPath)) {
       try {
         const tomlContent = readFileSync3(capabilityTomlPath, "utf-8");
         const parsed = parse2(tomlContent);
@@ -5186,9 +5449,9 @@ async function installCapabilityDependencies(silent) {
     }
     try {
       await new Promise((resolve2, reject) => {
-        const useNpmCi = hasNpm && existsSync19(join9(capabilityPath, "package-lock.json"));
-        const cmd = hasBun ? "bun" : "npm";
-        const args = hasBun ? ["install"] : useNpmCi ? ["ci"] : ["install"];
+        const { cmd, args } = resolveCapabilityInstallCommand(capabilityPath, {
+          hasNpm
+        });
         const proc = spawn2(cmd, args, {
           cwd: capabilityPath,
           stdio: "pipe"
@@ -5209,7 +5472,7 @@ ${stderr}`));
           reject(error);
         });
       });
-      const hasIndexTs = existsSync19(join9(capabilityPath, "index.ts"));
+      const hasIndexTs = existsSync20(join10(capabilityPath, "index.ts"));
       let hasBuildScript = false;
       try {
         const pkgJson = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
@@ -5217,9 +5480,7 @@ ${stderr}`));
       } catch {}
       if (hasBuildScript) {
         await new Promise((resolve2, reject) => {
-          const cmd = hasBun ? "bun" : "npm";
-          const args = ["run", "build"];
-          const proc = spawn2(cmd, args, {
+          const proc = spawn2("npm", ["run", "build"], {
             cwd: capabilityPath,
             stdio: "pipe"
           });
@@ -5240,7 +5501,7 @@ ${stderr}`));
           });
         });
       } else if (hasIndexTs && !silent) {
-        const hasBuiltIndex = existsSync19(join9(capabilityPath, "dist", "index.js"));
+        const hasBuiltIndex = existsSync20(join10(capabilityPath, "dist", "index.js"));
         if (!hasBuiltIndex) {
           console.warn(`Warning: Capability at ${capabilityPath} has index.ts but no build script.
   Add a "build" script to package.json (e.g., "build": "tsc") to compile TypeScript.`);
@@ -5371,25 +5632,27 @@ var init_types3 = __esm(() => {
       unicode: true,
       symlinks: true,
       scripts: true,
-      binaries: false
+      binaries: false,
+      hiddenCommands: true
     }
   };
   DEFAULT_SCAN_SETTINGS = {
     unicode: true,
     symlinks: true,
     scripts: true,
-    binaries: false
+    binaries: false,
+    hiddenCommands: true
   };
 });
 
 // ../core/src/security/scanner.ts
-import { existsSync as existsSync19 } from "node:fs";
-import { lstat, readdir as readdir2, readFile as readFile16, readlink, realpath } from "node:fs/promises";
-import { join as join9, relative, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync21 } from "node:fs";
+import { lstat, readdir as readdir2, readFile as readFile17, readlink, realpath } from "node:fs/promises";
+import { join as join11, relative, resolve as resolve2 } from "node:path";
 async function scanFileForUnicode(filePath, relativePath) {
   const findings = [];
   try {
-    const content = await readFile16(filePath, "utf-8");
+    const content = await readFile17(filePath, "utf-8");
     const lines = content.split(`
 `);
     for (let lineNum = 0;lineNum < lines.length; lineNum++) {
@@ -5443,7 +5706,7 @@ async function scanFileForUnicode(filePath, relativePath) {
 async function scanFileForScripts(filePath, relativePath) {
   const findings = [];
   try {
-    const content = await readFile16(filePath, "utf-8");
+    const content = await readFile17(filePath, "utf-8");
     const lines = content.split(`
 `);
     for (let lineNum = 0;lineNum < lines.length; lineNum++) {
@@ -5466,10 +5729,113 @@ async function scanFileForScripts(filePath, relativePath) {
   } catch {}
   return findings;
 }
+function extractHiddenRegions(fileContent) {
+  const regions = [];
+  HTML_COMMENT_RE.lastIndex = 0;
+  for (let match = HTML_COMMENT_RE.exec(fileContent);match !== null; match = HTML_COMMENT_RE.exec(fileContent)) {
+    const captured = match[1];
+    if (captured === undefined)
+      continue;
+    const beforeMatch = fileContent.substring(0, match.index);
+    const startLine = beforeMatch.split(`
+`).length;
+    regions.push({ content: captured, startLine });
+  }
+  HIDDEN_REFERENCE_RE.lastIndex = 0;
+  for (let match = HIDDEN_REFERENCE_RE.exec(fileContent);match !== null; match = HIDDEN_REFERENCE_RE.exec(fileContent)) {
+    const captured = match[1];
+    if (captured === undefined)
+      continue;
+    const beforeMatch = fileContent.substring(0, match.index);
+    const startLine = beforeMatch.split(`
+`).length;
+    regions.push({ content: captured, startLine });
+  }
+  return regions;
+}
+async function scanFileForHiddenCommands(filePath, relativePath) {
+  const findings = [];
+  try {
+    const content = await readFile17(filePath, "utf-8");
+    const hiddenRegions = extractHiddenRegions(content);
+    for (const region of hiddenRegions) {
+      const regionLines = region.content.split(`
+`);
+      for (let i = 0;i < regionLines.length; i++) {
+        const line = regionLines[i] ?? "";
+        if (!line.trim())
+          continue;
+        for (const { pattern, message, severity } of HIDDEN_COMMAND_PATTERNS) {
+          if (pattern.test(line)) {
+            findings.push({
+              type: "hidden_command",
+              severity,
+              file: relativePath,
+              line: region.startLine + i,
+              message: `Hidden in comment: ${message}`,
+              details: line.trim().substring(0, 100)
+            });
+          }
+        }
+        for (const { pattern, message, severity } of NETWORK_REQUEST_PATTERNS) {
+          if (pattern.test(line)) {
+            findings.push({
+              type: "network_request",
+              severity: severity === "medium" ? "high" : severity,
+              file: relativePath,
+              line: region.startLine + i,
+              message: `Hidden in comment: ${message}`,
+              details: line.trim().substring(0, 100)
+            });
+          }
+        }
+        for (const { pattern, message, severity } of SUSPICIOUS_SCRIPT_PATTERNS) {
+          if (pattern.test(line)) {
+            findings.push({
+              type: "hidden_command",
+              severity: severity === "medium" ? "high" : severity,
+              file: relativePath,
+              line: region.startLine + i,
+              message: `Hidden in comment: ${message}`,
+              details: line.trim().substring(0, 100)
+            });
+          }
+        }
+      }
+    }
+  } catch {}
+  return findings;
+}
+async function scanFileForNetworkRequests(filePath, relativePath) {
+  const findings = [];
+  try {
+    const content = await readFile17(filePath, "utf-8");
+    const lines = content.split(`
+`);
+    for (let lineNum = 0;lineNum < lines.length; lineNum++) {
+      const line = lines[lineNum];
+      if (!line)
+        continue;
+      for (const { pattern, message, severity } of NETWORK_REQUEST_PATTERNS) {
+        if (pattern.test(line)) {
+          findings.push({
+            type: "network_request",
+            severity,
+            file: relativePath,
+            line: lineNum + 1,
+            message,
+            details: line.trim().substring(0, 100)
+          });
+        }
+      }
+    }
+  } catch {}
+  return findings;
+}
 async function checkSymlink(symlinkPath, relativePath, capabilityRoot) {
   try {
     const linkTarget = await readlink(symlinkPath);
-    const resolvedTarget = resolve2(join9(symlinkPath, "..", linkTarget));
+    const resolvedTarget = resolve2(join11(symlinkPath, "..", linkTarget));
     const normalizedRoot = await realpath(capabilityRoot);
     if (linkTarget.startsWith("/")) {
       return {
@@ -5504,7 +5870,7 @@ function isTextFile(filePath) {
 async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_SCAN_SETTINGS) {
   const startTime = Date.now();
   const findings = [];
-  if (!existsSync19(capabilityPath)) {
+  if (!existsSync21(capabilityPath)) {
     return {
       capabilityId,
       path: capabilityPath,
@@ -5516,7 +5882,7 @@ async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_S
   async function scanDirectory(dirPath) {
     const entries = await readdir2(dirPath, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join9(dirPath, entry.name);
+      const fullPath = join11(dirPath, entry.name);
       const relativePath = relative(capabilityPath, fullPath);
       if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "__pycache__") {
         continue;
@@ -5543,17 +5909,27 @@ async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_S
           });
         }
         if (isTextFile(fullPath)) {
+          const ext = fullPath.toLowerCase().substring(fullPath.lastIndexOf("."));
           if (settings.unicode) {
             const unicodeFindings = await scanFileForUnicode(fullPath, relativePath);
             findings.push(...unicodeFindings);
           }
           if (settings.scripts) {
-            const ext = fullPath.toLowerCase().substring(fullPath.lastIndexOf("."));
             if ([".sh", ".bash", ".zsh", ".fish", ".py", ".rb", ".js", ".ts"].includes(ext)) {
               const scriptFindings = await scanFileForScripts(fullPath, relativePath);
               findings.push(...scriptFindings);
             }
           }
+          if (settings.hiddenCommands) {
+            if ([".md", ".txt", ".yaml", ".yml", ".toml"].includes(ext)) {
+              const hiddenFindings = await scanFileForHiddenCommands(fullPath, relativePath);
+              findings.push(...hiddenFindings);
+            }
+          }
+          if (settings.hiddenCommands) {
+            const networkFindings = await scanFileForNetworkRequests(fullPath, relativePath);
+            findings.push(...networkFindings);
+          }
         }
       }
     }
@@ -5585,7 +5961,9 @@ async function scanCapabilities(capabilities2, config2 = {}) {
     symlink_escape: 0,
     symlink_absolute: 0,
     suspicious_script: 0,
-    binary_file: 0
+    binary_file: 0,
+    hidden_command: 0,
+    network_request: 0
   };
   const findingsBySeverity = {
     low: 0,
@@ -5660,7 +6038,7 @@ function formatScanResults(summary, verbose = false) {
   return lines.join(`
 `);
 }
-var UNICODE_PATTERNS, SUSPICIOUS_SCRIPT_PATTERNS, BINARY_EXTENSIONS, TEXT_EXTENSIONS;
+var UNICODE_PATTERNS, SUSPICIOUS_SCRIPT_PATTERNS, NETWORK_REQUEST_PATTERNS, HIDDEN_COMMAND_PATTERNS, BINARY_EXTENSIONS, TEXT_EXTENSIONS, HTML_COMMENT_RE, HIDDEN_REFERENCE_RE;
 var init_scanner = __esm(() => {
   init_types3();
   UNICODE_PATTERNS = {
@@ -5752,6 +6130,75 @@ var init_scanner = __esm(() => {
       severity: "high"
     }
   ];
+  NETWORK_REQUEST_PATTERNS = [
+    {
+      pattern: /\bcurl\s+.*https?:\/\//i,
+      message: "Outbound curl request detected",
+      severity: "medium"
+    },
+    {
+      pattern: /\bwget\s+.*https?:\/\//i,
+      message: "Outbound wget request detected",
+      severity: "medium"
+    },
+    {
+      pattern: /\bfetch\s*\(\s*["'`]https?:\/\//i,
+      message: "Outbound fetch() request detected",
+      severity: "medium"
+    },
+    {
+      pattern: /\b(?:http|https)\.(?:get|request|post|put)\s*\(/i,
+      message: "Outbound HTTP request via Node.js http module",
+      severity: "medium"
+    },
+    {
+      pattern: /\brequests\.(?:get|post|put|delete|patch)\s*\(/i,
+      message: "Outbound HTTP request via Python requests",
+      severity: "medium"
+    },
+    {
+      pattern: /\bnc\b.*\s\d{2,5}\b/i,
+      message: "Netcat connection detected",
+      severity: "high"
+    },
+    {
+      pattern: /\b(?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i,
+      message: "Outbound PowerShell web request detected",
+      severity: "medium"
+    }
+  ];
+  HIDDEN_COMMAND_PATTERNS = [
+    {
+      pattern: /`[^`]*(?:curl|wget|bash|sh|python|ruby|node|exec|eval|system)\s[^`]*`/i,
+      message: "Executable command in backtick-wrapped code",
+      severity: "critical"
+    },
+    {
+      pattern: /\|\s*(?:ba)?sh\b/i,
+      message: "Pipe to shell execution",
+      severity: "critical"
+    },
+    {
+      pattern: /(?:^|\s)(?:bash|sh|zsh)\s+-c\s+/i,
+      message: "Shell invocation with -c flag",
+      severity: "high"
+    },
+    {
+      pattern: /\b(?:curl|wget)\s+.*https?:\/\//i,
+      message: "Network fetch command detected",
+      severity: "high"
+    },
+    {
+      pattern: /\b(?:python|ruby|node)\s+-e\s+/i,
+      message: "Inline script execution",
+      severity: "high"
+    },
+    {
+      pattern: /\beval\s*\(.*\)/i,
+      message: "eval() call detected",
+      severity: "high"
+    }
+  ];
   BINARY_EXTENSIONS = new Set([
     ".exe",
     ".dll",
@@ -5786,6 +6233,8 @@ var init_scanner = __esm(() => {
     ".py",
     ".rb"
   ]);
+  HTML_COMMENT_RE = /<!--([\s\S]*?)-->/g;
+  HIDDEN_REFERENCE_RE = /^\[.*?\]:\s*\S+\s+"(.+)"/gm;
 });
 
 // ../core/src/security/index.ts
@@ -5995,6 +6444,7 @@ __export(exports_src, {
   resolveEnabledCapabilities: () => resolveEnabledCapabilities,
   resolveCapabilityRootInConfig: () => resolveCapabilityRootInConfig,
   resolveCapabilityRoot: () => resolveCapabilityRoot,
+  resolveCapabilityInstallCommand: () => resolveCapabilityInstallCommand,
   removeSecurityAllow: () => removeSecurityAllow,
   readSecurityAllows: () => readSecurityAllows,
   readMcpJson: () => readMcpJson,
@@ -6009,6 +6459,8 @@ __export(exports_src, {
   parseOmniConfig: () => parseOmniConfig,
   parseFileSourcePath: () => parseFileSourcePath,
   parseCapabilityConfig: () => parseCapabilityConfig,
+  normalizeProviderId: () => normalizeProviderId,
+  normalizeProviderApplicability: () => normalizeProviderApplicability,
   mergeHooksConfigs: () => mergeHooksConfigs,
   mergeAndDeduplicateHooks: () => mergeAndDeduplicateHooks,
   loadSubagents: () => loadSubagents,
@@ -6116,6 +6568,7 @@ var init_src = __esm(() => {
   init_state();
   init_sync();
   init_security();
+  init_providers();
   init_types2();
 });
 
@@ -6123,17 +6576,17 @@ var init_src = __esm(() => {
 import { run } from "@stricli/core";
 
 // src/lib/dynamic-app.ts
-import { existsSync as existsSync29 } from "node:fs";
+import { existsSync as existsSync31 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { join as join26 } from "node:path";
+import { join as join28 } from "node:path";
 import { buildApplication, buildRouteMap as buildRouteMap7 } from "@stricli/core";
 
 // src/commands/add.ts
-import { existsSync as existsSync22 } from "node:fs";
+import { existsSync as existsSync24 } from "node:fs";
 import { basename as basename5, resolve as resolve3 } from "node:path";
 
 // ../adapters/src/writers/generic/executor.ts
-async function executeWriters(writerConfigs, bundle, projectRoot) {
+async function executeWriters(writerConfigs, bundle, projectRoot, providerId) {
   const seen = new Set;
   const uniqueConfigs = [];
   let deduplicatedCount = 0;
@@ -6150,7 +6603,8 @@ async function executeWriters(writerConfigs, bundle, projectRoot) {
   for (const config of uniqueConfigs) {
     const result = await config.writer.write(bundle, {
       outputPath: config.outputPath,
-      projectRoot
+      projectRoot,
+      ...providerId ? { providerId } : {}
     });
     allFilesWritten.push(...result.filesWritten);
   }
@@ -6161,23 +6615,23 @@ async function executeWriters(writerConfigs, bundle, projectRoot) {
 }
 // ../adapters/src/writers/generic/hooks.ts
 init_src();
-import { existsSync as existsSync20 } from "node:fs";
-import { mkdir as mkdir2, readFile as readFile17, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname, join as join10 } from "node:path";
+import { existsSync as existsSync22 } from "node:fs";
+import { mkdir as mkdir2, readFile as readFile18, writeFile as writeFile10 } from "node:fs/promises";
+import { dirname, join as join12 } from "node:path";
 var HooksWriter = {
   id: "hooks",
   async write(bundle, ctx) {
     if (!bundle.hooks) {
       return { filesWritten: [] };
     }
-    const settingsPath = join10(ctx.projectRoot, ctx.outputPath);
+    const settingsPath = join12(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname(settingsPath);
     await mkdir2(parentDir, { recursive: true });
     const claudeHooks = transformHooksConfig(bundle.hooks, "toClaude");
     let existingSettings = {};
-    if (existsSync20(settingsPath)) {
+    if (existsSync22(settingsPath)) {
       try {
-        const content = await readFile17(settingsPath, "utf-8");
+        const content = await readFile18(settingsPath, "utf-8");
         existingSettings = JSON.parse(content);
       } catch {
         existingSettings = {};
@@ -6195,21 +6649,42 @@ var HooksWriter = {
   }
 };
 // ../adapters/src/writers/generic/instructions-md.ts
-import { existsSync as existsSync21 } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile18, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname2, join as join11 } from "node:path";
+import { existsSync as existsSync23 } from "node:fs";
+import { mkdir as mkdir3, readFile as readFile19, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname2, join as join13 } from "node:path";
+
+// ../adapters/src/writers/generic/omni-md.ts
+init_src();
+var PROVIDER_BLOCK_REGEX = /<provider\.([a-z-]+)>([\s\S]*?)<\/provider\.\1>/g;
+var PROVIDER_TAG_REGEX = /<\/?provider\.[a-z-]+>/;
+function renderOmniMdForProvider(content, providerId) {
+  if (!providerId) {
+    return content;
+  }
+  const rendered = content.replace(PROVIDER_BLOCK_REGEX, (_match, rawProvider, providerContent) => {
+    const canonicalProvider = normalizeProviderId(rawProvider);
+    return canonicalProvider === providerId ? providerContent : "";
+  });
+  const strayTag = rendered.match(PROVIDER_TAG_REGEX);
+  if (strayTag) {
+    throw new Error(`Invalid provider block syntax in OMNI.md near ${strayTag[0]}`);
+  }
+  return rendered;
+}
+
+// ../adapters/src/writers/generic/instructions-md.ts
 var InstructionsMdWriter = {
   id: "instructions-md",
   async write(bundle, ctx) {
-    const outputFullPath = join11(ctx.projectRoot, ctx.outputPath);
+    const outputFullPath = join13(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname2(outputFullPath);
     if (parentDir !== ctx.projectRoot) {
       await mkdir3(parentDir, { recursive: true });
     }
-    const omniMdPath = join11(ctx.projectRoot, "OMNI.md");
+    const omniMdPath = join13(ctx.projectRoot, "OMNI.md");
     let omniMdContent = "";
-    if (existsSync21(omniMdPath)) {
-      omniMdContent = await readFile18(omniMdPath, "utf-8");
+    if (existsSync23(omniMdPath)) {
+      omniMdContent = renderOmniMdForProvider(await readFile19(omniMdPath, "utf-8"), ctx.providerId);
     }
     let content = omniMdContent;
     if (bundle.instructionsContent) {
@@ -6226,17 +6701,17 @@ ${bundle.instructionsContent}
 };
 // ../adapters/src/writers/generic/skills.ts
 import { mkdir as mkdir4, writeFile as writeFile12 } from "node:fs/promises";
-import { join as join12 } from "node:path";
+import { join as join14 } from "node:path";
 var SkillsWriter = {
   id: "skills",
   async write(bundle, ctx) {
-    const skillsDir = join12(ctx.projectRoot, ctx.outputPath);
+    const skillsDir = join14(ctx.projectRoot, ctx.outputPath);
     await mkdir4(skillsDir, { recursive: true });
     const filesWritten = [];
     for (const skill of bundle.skills) {
-      const skillDir = join12(skillsDir, skill.name);
+      const skillDir = join14(skillsDir, skill.name);
       await mkdir4(skillDir, { recursive: true });
-      const skillPath = join12(skillDir, "SKILL.md");
+      const skillPath = join14(skillDir, "SKILL.md");
       const content = `---
 name: ${skill.name}
 description: "${skill.description}"
@@ -6244,7 +6719,7 @@ description: "${skill.description}"
 
 ${skill.instructions}`;
       await writeFile12(skillPath, content, "utf-8");
-      filesWritten.push(join12(ctx.outputPath, skill.name, "SKILL.md"));
+      filesWritten.push(join14(ctx.outputPath, skill.name, "SKILL.md"));
     }
     return {
       filesWritten
@@ -6253,7 +6728,7 @@ ${skill.instructions}`;
 };
 // ../adapters/src/writers/generic/commands-as-skills.ts
 import { mkdir as mkdir5, writeFile as writeFile13 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join15 } from "node:path";
 function generateSkillFrontmatter(command) {
   const lines = ["---"];
   lines.push(`name: ${command.name}`);
@@ -6268,28 +6743,75 @@ function generateSkillFrontmatter(command) {
 var CommandsAsSkillsWriter = {
   id: "commands-as-skills",
   async write(bundle, ctx) {
-    const skillsDir = join13(ctx.projectRoot, ctx.outputPath);
+    const skillsDir = join15(ctx.projectRoot, ctx.outputPath);
     await mkdir5(skillsDir, { recursive: true });
     const filesWritten = [];
     for (const command of bundle.commands) {
-      const commandSkillDir = join13(skillsDir, command.name);
+      const commandSkillDir = join15(skillsDir, command.name);
       await mkdir5(commandSkillDir, { recursive: true });
       const frontmatter = generateSkillFrontmatter(command);
       const content = `${frontmatter}
 
 ${command.prompt}`;
-      const skillPath = join13(commandSkillDir, "SKILL.md");
+      const skillPath = join15(commandSkillDir, "SKILL.md");
       await writeFile13(skillPath, content, "utf-8");
-      filesWritten.push(join13(ctx.outputPath, command.name, "SKILL.md"));
+      filesWritten.push(join15(ctx.outputPath, command.name, "SKILL.md"));
     }
     return {
       filesWritten
     };
   }
 };
+// ../adapters/src/provider-bundle.ts
+init_src();
+function capabilityAppliesToProvider(capability3, providerId) {
+  const providers3 = capability3.config.capability.providers;
+  if (!providers3) {
+    return true;
+  }
+  return providers3[providerId] === true;
+}
+function generateInstructionsContent2(rules, _docs) {
+  if (rules.length === 0) {
+    return "";
+  }
+  let content = `## Rules
+
+`;
+  for (const rule of rules) {
+    content += `${rule.content}
+
+`;
+  }
+  return content.trimEnd();
+}
+function createProviderScopedBundle(bundle, providerId) {
+  const capabilities2 = bundle.capabilities.filter((capability3) => capabilityAppliesToProvider(capability3, providerId));
+  const capabilityIds = new Set(capabilities2.map((capability3) => capability3.id));
+  const skills = bundle.skills.filter((skill) => capabilityIds.has(skill.capabilityId));
+  const rules = bundle.rules.filter((rule) => capabilityIds.has(rule.capabilityId));
+  const docs = bundle.docs.filter((doc) => capabilityIds.has(doc.capabilityId));
+  const commands = bundle.commands.filter((command) => capabilityIds.has(command.capabilityId));
+  const subagents = bundle.subagents.filter((subagent) => capabilityIds.has(subagent.capabilityId));
+  const scopedBundle = {
+    capabilities: capabilities2,
+    skills,
+    rules,
+    docs,
+    commands,
+    subagents,
+    instructionsContent: generateInstructionsContent2(rules, docs)
+  };
+  const mergedHooks = mergeHooksConfigs(capabilities2.flatMap((capability3) => capability3.hooks ? [capability3.hooks] : []));
+  if (hasAnyHooks(mergedHooks)) {
+    scopedBundle.hooks = mergedHooks;
+  }
+  return scopedBundle;
+}
+
 // ../adapters/src/writers/claude/agents.ts
 import { mkdir as mkdir6, writeFile as writeFile14 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 function generateFrontmatter(agent) {
   const lines = ["---"];
   lines.push(`name: ${agent.name}`);
@@ -6316,7 +6838,7 @@ function generateFrontmatter(agent) {
 var ClaudeAgentsWriter = {
   id: "claude-agents",
   async write(bundle, ctx) {
-    const agentsDir = join14(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join16(ctx.projectRoot, ctx.outputPath);
     await mkdir6(agentsDir, { recursive: true });
     const filesWritten = [];
     for (const agent of bundle.subagents) {
@@ -6324,9 +6846,9 @@ var ClaudeAgentsWriter = {
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join14(agentsDir, `${agent.name}.md`);
+      const agentPath = join16(agentsDir, `${agent.name}.md`);
       await writeFile14(agentPath, content, "utf-8");
-      filesWritten.push(join14(ctx.outputPath, `${agent.name}.md`));
+      filesWritten.push(join16(ctx.outputPath, `${agent.name}.md`));
     }
     return {
       filesWritten
@@ -6351,7 +6873,9 @@ var claudeCodeAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const providerId = "claude-code";
+    const providerBundle = createProviderScopedBundle(bundle, providerId);
+    const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
       filesDeleted: []
@@ -6360,12 +6884,12 @@ var claudeCodeAdapter = {
 };
 // ../adapters/src/codex/index.ts
 import { mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 
 // ../adapters/src/writers/codex/toml.ts
 init_dist();
 import { mkdir as mkdir7, writeFile as writeFile15 } from "node:fs/promises";
-import { dirname as dirname3, join as join15 } from "node:path";
+import { dirname as dirname3, join as join17 } from "node:path";
 var FILE_HEADER = `# Generated by OmniDev - DO NOT EDIT
 # Run \`omnidev sync\` to regenerate
 
@@ -6416,7 +6940,7 @@ var CodexTomlWriter = {
     if (mcps.size === 0) {
       return { filesWritten: [] };
     }
-    const configPath = join15(ctx.projectRoot, ctx.outputPath);
+    const configPath = join17(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname3(configPath);
     await mkdir7(parentDir, { recursive: true });
     const mcpServers = {};
@@ -6450,7 +6974,7 @@ var codexAdapter = {
     { writer: CodexTomlWriter, outputPath: ".codex/config.toml" }
   ],
   async init(ctx) {
-    const codexDir = join16(ctx.projectRoot, ".codex");
+    const codexDir = join18(ctx.projectRoot, ".codex");
     mkdirSync6(codexDir, { recursive: true });
     return {
       filesCreated: [".codex/"],
@@ -6458,7 +6982,9 @@ var codexAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const providerId = "codex";
+    const providerBundle = createProviderScopedBundle(bundle, providerId);
+    const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
       filesDeleted: []
@@ -6467,11 +6993,11 @@ var codexAdapter = {
 };
 // ../adapters/src/cursor/index.ts
 import { mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 
 // ../adapters/src/writers/cursor/agents.ts
 import { mkdir as mkdir8, writeFile as writeFile16 } from "node:fs/promises";
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 function mapModelToCursor(model) {
   if (!model || model === "inherit")
     return "inherit";
@@ -6503,7 +7029,7 @@ function generateFrontmatter2(agent) {
 var CursorAgentsWriter = {
   id: "cursor-agents",
   async write(bundle, ctx) {
-    const agentsDir = join17(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join19(ctx.projectRoot, ctx.outputPath);
     await mkdir8(agentsDir, { recursive: true });
     const filesWritten = [];
     for (const agent of bundle.subagents) {
@@ -6511,9 +7037,9 @@ var CursorAgentsWriter = {
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join17(agentsDir, `${agent.name}.md`);
+      const agentPath = join19(agentsDir, `${agent.name}.md`);
       await writeFile16(agentPath, content, "utf-8");
-      filesWritten.push(join17(ctx.outputPath, `${agent.name}.md`));
+      filesWritten.push(join19(ctx.outputPath, `${agent.name}.md`));
     }
     return {
       filesWritten
@@ -6522,11 +7048,11 @@ ${agent.systemPrompt}`;
 };
 // ../adapters/src/writers/cursor/commands.ts
 import { mkdir as mkdir9, writeFile as writeFile17 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 var CursorCommandsWriter = {
   id: "cursor-commands",
   async write(bundle, ctx) {
-    const commandsDir = join18(ctx.projectRoot, ctx.outputPath);
+    const commandsDir = join20(ctx.projectRoot, ctx.outputPath);
     await mkdir9(commandsDir, { recursive: true });
     const filesWritten = [];
     for (const command of bundle.commands) {
@@ -6535,9 +7061,9 @@ var CursorCommandsWriter = {
 ${command.description}
 
 ${command.prompt}`;
-      const commandPath = join18(commandsDir, `${command.name}.md`);
+      const commandPath = join20(commandsDir, `${command.name}.md`);
       await writeFile17(commandPath, content, "utf-8");
-      filesWritten.push(join18(ctx.outputPath, `${command.name}.md`));
+      filesWritten.push(join20(ctx.outputPath, `${command.name}.md`));
     }
     return {
       filesWritten
@@ -6546,7 +7072,7 @@ ${command.prompt}`;
 };
 // ../adapters/src/writers/cursor/mcp-json.ts
 import { mkdir as mkdir10, writeFile as writeFile18 } from "node:fs/promises";
-import { dirname as dirname4, join as join19 } from "node:path";
+import { dirname as dirname4, join as join21 } from "node:path";
 function buildCursorMcpConfig(mcp) {
   const transport = mcp.transport ?? "stdio";
   if (transport === "http" || transport === "sse") {
@@ -6591,7 +7117,7 @@ var CursorMcpJsonWriter = {
     if (mcps.size === 0) {
       return { filesWritten: [] };
     }
-    const configPath = join19(ctx.projectRoot, ctx.outputPath);
+    const configPath = join21(ctx.projectRoot, ctx.outputPath);
     const parentDir = dirname4(configPath);
     await mkdir10(parentDir, { recursive: true });
     const mcpServers = {};
@@ -6616,17 +7142,17 @@ var CursorMcpJsonWriter = {
 };
 // ../adapters/src/writers/cursor/rules.ts
 import { mkdir as mkdir11, writeFile as writeFile19 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join22 } from "node:path";
 var CursorRulesWriter = {
   id: "cursor-rules",
   async write(bundle, ctx) {
-    const rulesDir = join20(ctx.projectRoot, ctx.outputPath);
+    const rulesDir = join22(ctx.projectRoot, ctx.outputPath);
     await mkdir11(rulesDir, { recursive: true });
     const filesWritten = [];
     for (const rule of bundle.rules) {
-      const rulePath = join20(rulesDir, `omnidev-${rule.name}.mdc`);
+      const rulePath = join22(rulesDir, `omnidev-${rule.name}.mdc`);
       await writeFile19(rulePath, rule.content, "utf-8");
-      filesWritten.push(join20(ctx.outputPath, `omnidev-${rule.name}.mdc`));
+      filesWritten.push(join22(ctx.outputPath, `omnidev-${rule.name}.mdc`));
     }
     return {
       filesWritten
@@ -6646,7 +7172,7 @@ var cursorAdapter = {
     { writer: CursorMcpJsonWriter, outputPath: ".cursor/mcp.json" }
   ],
   async init(ctx) {
-    const rulesDir = join21(ctx.projectRoot, ".cursor", "rules");
+    const rulesDir = join23(ctx.projectRoot, ".cursor", "rules");
     mkdirSync7(rulesDir, { recursive: true });
     return {
       filesCreated: [".cursor/rules/"],
@@ -6654,20 +7180,29 @@ var cursorAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const cursorProviderId = "cursor";
+    const instructionsProviderId = "claude-code";
+    const instructionsWriters = this.writers.filter((config3) => config3.writer.id === "instructions-md");
+    const cursorWriters = this.writers.filter((config3) => config3.writer.id !== "instructions-md");
+    const instructionsBundle = createProviderScopedBundle(bundle, instructionsProviderId);
+    const cursorBundle = createProviderScopedBundle(bundle, cursorProviderId);
+    const instructionsResult = await executeWriters(instructionsWriters, instructionsBundle, ctx.projectRoot, instructionsProviderId);
+    const cursorResult = await executeWriters(cursorWriters, cursorBundle, ctx.projectRoot, cursorProviderId);
     return {
-      filesWritten: result.filesWritten,
+      filesWritten: [
+        ...new Set([...instructionsResult.filesWritten, ...cursorResult.filesWritten])
+      ],
       filesDeleted: []
     };
   }
 };
 // ../adapters/src/opencode/index.ts
 import { mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join26 } from "node:path";
 
 // ../adapters/src/writers/opencode/agents.ts
 import { mkdir as mkdir12, writeFile as writeFile20 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { join as join24 } from "node:path";
 function mapModelToOpenCode(model) {
   if (!model || model === "inherit")
     return;
@@ -6745,7 +7280,7 @@ function generateFrontmatter3(agent) {
 var OpenCodeAgentsWriter = {
   id: "opencode-agents",
   async write(bundle, ctx) {
-    const agentsDir = join22(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join24(ctx.projectRoot, ctx.outputPath);
     await mkdir12(agentsDir, { recursive: true });
     const filesWritten = [];
     for (const agent of bundle.subagents) {
@@ -6753,9 +7288,9 @@ var OpenCodeAgentsWriter = {
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join22(agentsDir, `${agent.name}.md`);
+      const agentPath = join24(agentsDir, `${agent.name}.md`);
       await writeFile20(agentPath, content, "utf-8");
-      filesWritten.push(join22(ctx.outputPath, `${agent.name}.md`));
+      filesWritten.push(join24(ctx.outputPath, `${agent.name}.md`));
     }
     return {
       filesWritten
@@ -6764,7 +7299,7 @@ ${agent.systemPrompt}`;
 };
 // ../adapters/src/writers/opencode/commands.ts
 import { mkdir as mkdir13, writeFile as writeFile21 } from "node:fs/promises";
-import { join as join23 } from "node:path";
+import { join as join25 } from "node:path";
 function generateFrontmatter4(command) {
   const lines = ["---"];
   lines.push(`description: "${command.description.replace(/"/g, "\\\"")}"`);
@@ -6781,7 +7316,7 @@ function generateFrontmatter4(command) {
 var OpenCodeCommandsWriter = {
   id: "opencode-commands",
   async write(bundle, ctx) {
-    const commandsDir = join23(ctx.projectRoot, ctx.outputPath);
+    const commandsDir = join25(ctx.projectRoot, ctx.outputPath);
     await mkdir13(commandsDir, { recursive: true });
     const filesWritten = [];
     for (const command of bundle.commands) {
@@ -6789,9 +7324,9 @@ var OpenCodeCommandsWriter = {
       const content = `${frontmatter}
 
 ${command.prompt}`;
-      const commandPath = join23(commandsDir, `${command.name}.md`);
+      const commandPath = join25(commandsDir, `${command.name}.md`);
       await writeFile21(commandPath, content, "utf-8");
-      filesWritten.push(join23(ctx.outputPath, `${command.name}.md`));
+      filesWritten.push(join25(ctx.outputPath, `${command.name}.md`));
     }
     return {
       filesWritten
@@ -6809,7 +7344,7 @@ var opencodeAdapter = {
     { writer: OpenCodeCommandsWriter, outputPath: ".opencode/commands/" }
   ],
   async init(ctx) {
-    const opencodeDir = join24(ctx.projectRoot, ".opencode");
+    const opencodeDir = join26(ctx.projectRoot, ".opencode");
     mkdirSync8(opencodeDir, { recursive: true });
     return {
       filesCreated: [".opencode/"],
@@ -6817,7 +7352,9 @@ var opencodeAdapter = {
     };
   },
   async sync(bundle, ctx) {
-    const result = await executeWriters(this.writers, bundle, ctx.projectRoot);
+    const providerId = "opencode";
+    const providerBundle = createProviderScopedBundle(bundle, providerId);
+    const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
       filesDeleted: []
@@ -6861,7 +7398,7 @@ async function inferCapabilityId(source, sourceType) {
 }
 async function runAddCap(flags, name) {
   try {
-    if (!existsSync22("omni.toml")) {
+    if (!existsSync24("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -6884,7 +7421,7 @@ async function runAddCap(flags, name) {
       sourceType = "local";
       const localPath = flags.local.startsWith("file://") ? flags.local.slice(7) : flags.local;
       source = `file://${localPath}`;
-      if (!existsSync22(localPath)) {
+      if (!existsSync24(localPath)) {
         console.error(`✗ Local path not found: ${localPath}`);
         process.exit(1);
       }
@@ -6976,7 +7513,7 @@ async function runAddCap(flags, name) {
 }
 async function runAddMcp(flags, name) {
   try {
-    if (!existsSync22("omni.toml")) {
+    if (!existsSync24("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -7263,9 +7800,9 @@ var addRoutes = buildRouteMap({
 });
 
 // src/commands/capability.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync9 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync9 } from "node:fs";
 import { writeFile as writeFile22 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { join as join27 } from "node:path";
 import { input } from "@inquirer/prompts";
 init_src();
 import { buildCommand as buildCommand2, buildRouteMap as buildRouteMap2 } from "@stricli/core";
@@ -7443,14 +7980,18 @@ export default {
 } satisfies CapabilityExport;
 `;
 }
-function generateGitignore() {
-  return `dist/
-node_modules/
+function generateGitignore(programmatic) {
+  const lines = [".env"];
+  if (programmatic) {
+    lines.push("dist/", "node_modules/");
+  }
+  return `${lines.join(`
+`)}
 `;
 }
 async function runCapabilityNew(flags, capabilityId) {
   try {
-    if (!existsSync23(".omni")) {
+    if (!existsSync25(".omni")) {
       console.error("✗ OmniDev is not initialized in this directory.");
       console.log("");
       console.log("  Run: omnidev init");
@@ -7474,28 +8015,28 @@ async function runCapabilityNew(flags, capabilityId) {
         default: defaultPath
       });
     }
-    if (existsSync23(capabilityDir)) {
+    if (existsSync25(capabilityDir)) {
       console.error(`✗ Directory already exists at ${capabilityDir}`);
       process.exit(1);
     }
     const name = toTitleCase(id);
     mkdirSync9(capabilityDir, { recursive: true });
     const capabilityToml = generateCapabilityToml2({ id, name });
-    await writeFile22(join25(capabilityDir, "capability.toml"), capabilityToml, "utf-8");
-    const skillDir = join25(capabilityDir, "skills", "getting-started");
+    await writeFile22(join27(capabilityDir, "capability.toml"), capabilityToml, "utf-8");
+    const skillDir = join27(capabilityDir, "skills", "getting-started");
     mkdirSync9(skillDir, { recursive: true });
-    await writeFile22(join25(skillDir, "SKILL.md"), generateSkillTemplate("getting-started"), "utf-8");
-    const rulesDir = join25(capabilityDir, "rules");
+    await writeFile22(join27(skillDir, "SKILL.md"), generateSkillTemplate("getting-started"), "utf-8");
+    const rulesDir = join27(capabilityDir, "rules");
     mkdirSync9(rulesDir, { recursive: true });
-    await writeFile22(join25(rulesDir, "coding-standards.md"), generateRuleTemplate("coding-standards"), "utf-8");
-    const hooksDir = join25(capabilityDir, "hooks");
+    await writeFile22(join27(rulesDir, "coding-standards.md"), generateRuleTemplate("coding-standards"), "utf-8");
+    const hooksDir = join27(capabilityDir, "hooks");
     mkdirSync9(hooksDir, { recursive: true });
-    await writeFile22(join25(hooksDir, "hooks.toml"), generateHooksTemplate(), "utf-8");
-    await writeFile22(join25(hooksDir, "example-hook.sh"), generateHookScript(), "utf-8");
+    await writeFile22(join27(hooksDir, "hooks.toml"), generateHooksTemplate(), "utf-8");
+    await writeFile22(join27(hooksDir, "example-hook.sh"), generateHookScript(), "utf-8");
+    await writeFile22(join27(capabilityDir, ".gitignore"), generateGitignore(Boolean(flags.programmatic)), "utf-8");
     if (flags.programmatic) {
-      await writeFile22(join25(capabilityDir, "package.json"), generatePackageJson(id), "utf-8");
-      await writeFile22(join25(capabilityDir, "index.ts"), generateIndexTs(id, name), "utf-8");
-      await writeFile22(join25(capabilityDir, ".gitignore"), generateGitignore(), "utf-8");
+      await writeFile22(join27(capabilityDir, "package.json"), generatePackageJson(id), "utf-8");
+      await writeFile22(join27(capabilityDir, "index.ts"), generateIndexTs(id, name), "utf-8");
     }
     console.log(`✓ Created capability: ${name}`);
     console.log(`  Location: ${capabilityDir}`);
@@ -7506,10 +8047,10 @@ async function runCapabilityNew(flags, capabilityId) {
     console.log("    - rules/coding-standards.md");
     console.log("    - hooks/hooks.toml");
     console.log("    - hooks/example-hook.sh");
+    console.log("    - .gitignore");
     if (flags.programmatic) {
       console.log("    - package.json");
       console.log("    - index.ts");
-      console.log("    - .gitignore");
     }
     console.log("");
     if (flags.programmatic) {
@@ -7651,9 +8192,9 @@ var capabilityRoutes = buildRouteMap2({
 });
 
 // src/commands/doctor.ts
-import { existsSync as existsSync24 } from "node:fs";
+import { existsSync as existsSync26 } from "node:fs";
 import { execFile } from "node:child_process";
-import { readFile as readFile19 } from "node:fs/promises";
+import { readFile as readFile20 } from "node:fs/promises";
 import { promisify } from "node:util";
 import { buildCommand as buildCommand3 } from "@stricli/core";
 var doctorCommand = buildCommand3({
@@ -7698,50 +8239,52 @@ async function runDoctor() {
 async function checkPackageManager() {
   const execFileAsync = promisify(execFile);
   try {
-    const { stdout } = await execFileAsync("bun", ["--version"]);
-    const version2 = stdout.trim();
-    const firstPart = version2.split(".")[0];
-    if (!firstPart) {
+    const { stdout: npmStdout } = await execFileAsync("npm", ["--version"]);
+    const npmVersion = npmStdout.trim();
+    try {
+      const { stdout: bunStdout } = await execFileAsync("bun", ["--version"]);
+      const bunVersion = bunStdout.trim();
+      const firstPart = bunVersion.split(".")[0];
+      if (!firstPart) {
+        return {
+          name: "Package Manager",
+          passed: false,
+          message: `Invalid Bun version format: ${bunVersion}`,
+          fix: "Reinstall Bun: curl -fsSL https://bun.sh/install | bash"
+        };
+      }
+      const major = Number.parseInt(firstPart, 10);
+      if (major < 1) {
+        return {
+          name: "Package Manager",
+          passed: false,
+          message: `npm v${npmVersion}; bun v${bunVersion}`,
+          fix: "Upgrade Bun: curl -fsSL https://bun.sh/install | bash"
+        };
+      }
       return {
         name: "Package Manager",
-        passed: false,
-        message: `Invalid Bun version format: ${version2}`,
-        fix: "Reinstall Bun: curl -fsSL https://bun.sh/install | bash"
+        passed: true,
+        message: `npm v${npmVersion}; bun v${bunVersion}`
       };
-    }
-    const major = Number.parseInt(firstPart, 10);
-    if (major < 1) {
+    } catch {
       return {
         name: "Package Manager",
-        passed: false,
-        message: `bun v${version2}`,
-        fix: "Upgrade Bun: curl -fsSL https://bun.sh/install | bash"
+        passed: true,
+        message: `npm v${npmVersion}`
       };
     }
-    return {
-      name: "Package Manager",
-      passed: true,
-      message: `bun v${version2}`
-    };
-  } catch {}
-  try {
-    const { stdout } = await execFileAsync("npm", ["--version"]);
-    return {
-      name: "Package Manager",
-      passed: true,
-      message: `npm v${stdout.trim()}`
-    };
   } catch {
     return {
       name: "Package Manager",
       passed: false,
-      message: "Neither Bun nor npm is installed",
-      fix: "Install Bun (recommended): curl -fsSL https://bun.sh/install | bash"
+      message: "npm is not installed",
+      fix: "Install Node.js and npm: https://nodejs.org/"
     };
   }
 }
 async function checkOmniLocalDir() {
-  const exists = existsSync24(".omni");
+  const exists = existsSync26(".omni");
   if (!exists) {
     return {
       name: ".omni/ directory",
@@ -7758,7 +8301,7 @@ async function checkOmniLocalDir() {
 }
 async function checkConfig() {
   const configPath = "omni.toml";
-  if (!existsSync24(configPath)) {
+  if (!existsSync26(configPath)) {
     return {
       name: "Configuration",
       passed: false,
@@ -7785,7 +8328,7 @@ async function checkConfig() {
 }
 async function checkRootGitignore() {
   const gitignorePath = ".gitignore";
-  if (!existsSync24(gitignorePath)) {
+  if (!existsSync26(gitignorePath)) {
     return {
       name: "Root .gitignore",
       passed: false,
@@ -7793,7 +8336,7 @@ async function checkRootGitignore() {
       fix: "Run: omnidev init"
     };
   }
-  const content = await readFile19(gitignorePath, "utf-8");
+  const content = await readFile20(gitignorePath, "utf-8");
   const lines = content.split(`
 `).map((line) => line.trim());
   const hasOmniDir = lines.includes(".omni/");
@@ -7819,7 +8362,7 @@ async function checkRootGitignore() {
 }
 async function checkCapabilitiesDir() {
   const capabilitiesDirPath = ".omni/capabilities";
-  if (!existsSync24(capabilitiesDirPath)) {
+  if (!existsSync26(capabilitiesDirPath)) {
     return {
       name: "Capabilities Directory",
       passed: true,
@@ -7835,8 +8378,8 @@ async function checkCapabilitiesDir() {
 
 // src/commands/init.ts
 import { exec } from "node:child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync10 } from "node:fs";
-import { readFile as readFile20, writeFile as writeFile23 } from "node:fs/promises";
+import { existsSync as existsSync27, mkdirSync as mkdirSync10 } from "node:fs";
+import { readFile as readFile21, writeFile as writeFile23 } from "node:fs/promises";
 import { promisify as promisify2 } from "node:util";
 init_src();
 import { buildCommand as buildCommand4 } from "@stricli/core";
@@ -7849,8 +8392,8 @@ var PROVIDER_GITIGNORE_FILES = {
   codex: ["AGENTS.md", ".codex/"],
   opencode: [".opencode/"]
 };
-function getProviderGitignoreFiles(providers2) {
-  return providers2.flatMap((p) => PROVIDER_GITIGNORE_FILES[p] ?? []);
+function getProviderGitignoreFiles(providers3) {
+  return providers3.flatMap((p) => PROVIDER_GITIGNORE_FILES[p] ?? []);
 }
 async function promptForProviders() {
   const answers = await checkbox({
@@ -7905,7 +8448,7 @@ async function runInit(_flags, providerArg) {
     }
   }
   await writeEnabledProviders(providerIds);
-  if (!existsSync25("omni.toml")) {
+  if (!existsSync27("omni.toml")) {
     await writeConfig({
       profiles: {
         default: {
@@ -7921,7 +8464,7 @@ async function runInit(_flags, providerArg) {
     });
     await setActiveProfile("default");
   }
-  if (!existsSync25("OMNI.md")) {
+  if (!existsSync27("OMNI.md")) {
     await writeFile23("OMNI.md", generateOmniMdTemplate(), "utf-8");
   }
   const config3 = await loadConfig();
@@ -7999,8 +8542,8 @@ async function addProviderFilesToGitignore(entries) {
 async function addToGitignore(entriesToAdd, sectionHeader) {
   const gitignorePath = ".gitignore";
   let content = "";
-  if (existsSync25(gitignorePath)) {
-    content = await readFile20(gitignorePath, "utf-8");
+  if (existsSync27(gitignorePath)) {
+    content = await readFile21(gitignorePath, "utf-8");
   }
   const lines = content.split(`
 `);
@@ -8031,7 +8574,7 @@ async function getTrackedProviderFiles(files) {
 }
 
 // src/commands/profile.ts
-import { existsSync as existsSync26 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 init_src();
 import { buildCommand as buildCommand5, buildRouteMap as buildRouteMap3 } from "@stricli/core";
 var listCommand2 = buildCommand5({
@@ -8075,7 +8618,7 @@ var profileRoutes = buildRouteMap3({
 });
 async function runProfileList() {
   try {
-    if (!existsSync26("omni.toml")) {
+    if (!existsSync28("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8115,7 +8658,7 @@ async function runProfileList() {
 }
 async function runProfileSet(profileName) {
   try {
-    if (!existsSync26("omni.toml")) {
+    if (!existsSync28("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8264,7 +8807,7 @@ var providerRoutes = buildRouteMap4({
 
 // src/commands/security.ts
 init_src();
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync29 } from "node:fs";
 import { buildCommand as buildCommand7, buildRouteMap as buildRouteMap5 } from "@stricli/core";
 var VALID_FINDING_TYPES = [
   "unicode_bidi",
@@ -8303,7 +8846,9 @@ async function filterAllowedFindings(summary, options = {}) {
     symlink_escape: 0,
     symlink_absolute: 0,
     suspicious_script: 0,
-    binary_file: 0
+    binary_file: 0,
+    hidden_command: 0,
+    network_request: 0
   };
   const findingsBySeverity = {
     low: 0,
@@ -8381,7 +8926,7 @@ function formatFindingsWithHints(summary) {
 }
 async function runSecurityIssues(flags = {}) {
   try {
-    if (!existsSync27("omni.toml")) {
+    if (!existsSync29("omni.toml")) {
       console.log("No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8636,7 +9181,7 @@ var securityRoutes = buildRouteMap5({
 });
 
 // src/commands/sync.ts
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 init_src();
 import { buildCommand as buildCommand8 } from "@stricli/core";
 var PROVIDERS_STATE_PATH = ".omni/state/providers.json";
@@ -8654,7 +9199,7 @@ async function runSync() {
     const config3 = await loadConfig();
     const activeProfile = await getActiveProfile() ?? "default";
     let adapters = await getEnabledAdapters();
-    if (!existsSync28(PROVIDERS_STATE_PATH) || adapters.length === 0) {
+    if (!existsSync30(PROVIDERS_STATE_PATH) || adapters.length === 0) {
       console.log("No providers configured yet. Select your provider(s):");
       const providerIds = await promptForProviders();
       await writeEnabledProviders(providerIds);
@@ -8864,9 +9409,9 @@ async function buildDynamicApp() {
     security: securityRoutes
   };
   debug("Core routes registered", Object.keys(routes));
-  const configPath = join26(process.cwd(), "omni.toml");
-  debug("Checking for config", { configPath, exists: existsSync29(configPath), cwd: process.cwd() });
-  if (existsSync29(configPath)) {
+  const configPath = join28(process.cwd(), "omni.toml");
+  debug("Checking for config", { configPath, exists: existsSync31(configPath), cwd: process.cwd() });
+  if (existsSync31(configPath)) {
     try {
       debug("Loading capability commands...");
       const capabilityCommands = await loadCapabilityCommands();
@@ -8941,25 +9486,25 @@ async function loadCapabilityCommands() {
   return commands;
 }
 async function loadCapabilityExport(capability3) {
-  const capabilityPath = join26(process.cwd(), capability3.path);
-  const builtIndexPath = join26(capabilityPath, "dist", "index.js");
-  const jsIndexPath = join26(capabilityPath, "index.js");
-  const tsIndexPath = join26(capabilityPath, "index.ts");
+  const capabilityPath = join28(process.cwd(), capability3.path);
+  const builtIndexPath = join28(capabilityPath, "dist", "index.js");
+  const jsIndexPath = join28(capabilityPath, "index.js");
+  const tsIndexPath = join28(capabilityPath, "index.ts");
   debug(`Checking entry points for '${capability3.id}'`, {
     capabilityPath,
     builtIndexPath,
-    builtExists: existsSync29(builtIndexPath),
+    builtExists: existsSync31(builtIndexPath),
     jsIndexPath,
-    jsExists: existsSync29(jsIndexPath),
+    jsExists: existsSync31(jsIndexPath),
     tsIndexPath,
-    tsExists: existsSync29(tsIndexPath)
+    tsExists: existsSync31(tsIndexPath)
   });
   let indexPath = null;
-  if (existsSync29(builtIndexPath)) {
+  if (existsSync31(builtIndexPath)) {
     indexPath = builtIndexPath;
-  } else if (existsSync29(jsIndexPath)) {
+  } else if (existsSync31(jsIndexPath)) {
     indexPath = jsIndexPath;
-  } else if (existsSync29(tsIndexPath)) {
+  } else if (existsSync31(tsIndexPath)) {
     indexPath = tsIndexPath;
   }
   if (!indexPath) {