@omnidev-ai/cli 0.17.0 → 0.18.1

package/dist/index.js

@@ -1287,85 +1287,6 @@ var init_dist = __esm(() => {
   dist_default = { parse, stringify, TomlDate, TomlError };
 });
 
-// ../core/src/providers.ts
-function normalizeProviderId(provider) {
-  if (provider in PROVIDER_ALIAS_MAP) {
-    return PROVIDER_ALIAS_MAP[provider];
-  }
-  throw new Error(`Unknown provider: ${provider}`);
-}
-function normalizeProviderApplicability(value, fieldName) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error(`${fieldName} must be a table of provider = boolean entries`);
-  }
-  const normalized = {};
-  for (const [rawProvider, rawEnabled] of Object.entries(value)) {
-    if (typeof rawEnabled !== "boolean") {
-      throw new Error(`${fieldName}.${rawProvider} must be a boolean`);
-    }
-    const canonicalProvider = normalizeProviderId(rawProvider);
-    const existing = normalized[canonicalProvider];
-    if (existing !== undefined && existing !== rawEnabled) {
-      throw new Error(`Conflicting provider entries in ${fieldName}: ${rawProvider} maps to ${canonicalProvider}`);
-    }
-    normalized[canonicalProvider] = rawEnabled;
-  }
-  return normalized;
-}
-var PROVIDER_ALIAS_MAP;
-var init_providers = __esm(() => {
-  PROVIDER_ALIAS_MAP = {
-    claude: "claude-code",
-    "claude-code": "claude-code",
-    codex: "codex",
-    cursor: "cursor",
-    opencode: "opencode"
-  };
-});
-
-// ../core/src/config/parser.ts
-function parseOmniConfig(tomlContent) {
-  try {
-    return parse(tomlContent);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Invalid TOML in config: ${message}`);
-  }
-}
-function validateCapabilityConfig(parsed) {
-  const cap = parsed["capability"];
-  if (typeof cap !== "object" || cap === null) {
-    throw new Error("capability.id is required in capability.toml");
-  }
-  const capability = cap;
-  if (typeof capability["id"] !== "string") {
-    throw new Error("capability.id is required in capability.toml");
-  }
-  if (typeof capability["name"] !== "string") {
-    throw new Error("capability.name is required in capability.toml");
-  }
-  if (typeof capability["version"] !== "string") {
-    throw new Error("capability.version is required in capability.toml");
-  }
-  if (capability["providers"] !== undefined) {
-    capability["providers"] = normalizeProviderApplicability(capability["providers"], "capability.providers");
-  }
-}
-function parseCapabilityConfig(tomlContent) {
-  try {
-    const parsed = parse(tomlContent);
-    validateCapabilityConfig(parsed);
-    return parsed;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Invalid capability.toml: ${message}`);
-  }
-}
-var init_parser = __esm(() => {
-  init_dist();
-  init_providers();
-});
-
 // ../core/src/hooks/constants.ts
 var HOOK_EVENTS, MATCHER_EVENTS, PROMPT_HOOK_EVENTS, HOOK_TYPES, COMMON_TOOL_MATCHERS, NOTIFICATION_MATCHERS, SESSION_START_MATCHERS, PRE_COMPACT_MATCHERS, DEFAULT_COMMAND_TIMEOUT = 60, DEFAULT_PROMPT_TIMEOUT = 30, VARIABLE_MAPPINGS, HOOKS_CONFIG_FILENAME = "hooks.toml", CLAUDE_HOOKS_CONFIG_FILENAME = "hooks.json", HOOKS_DIRECTORY = "hooks";
 var init_constants = __esm(() => {
@@ -2451,14 +2372,90 @@ var init_loader = __esm(() => {
   init_constants();
 });
 
-// ../core/src/capability/mcp-env.ts
+// ../core/src/providers.ts
+function normalizeProviderId(provider) {
+  if (provider in PROVIDER_ALIAS_MAP) {
+    return PROVIDER_ALIAS_MAP[provider];
+  }
+  throw new Error(`Unknown provider: ${provider}`);
+}
+function normalizeProviderApplicability(value, fieldName) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${fieldName} must be a table of provider = boolean entries`);
+  }
+  const normalized = {};
+  for (const [rawProvider, rawEnabled] of Object.entries(value)) {
+    if (typeof rawEnabled !== "boolean") {
+      throw new Error(`${fieldName}.${rawProvider} must be a boolean`);
+    }
+    const canonicalProvider = normalizeProviderId(rawProvider);
+    const existing = normalized[canonicalProvider];
+    if (existing !== undefined && existing !== rawEnabled) {
+      throw new Error(`Conflicting provider entries in ${fieldName}: ${rawProvider} maps to ${canonicalProvider}`);
+    }
+    normalized[canonicalProvider] = rawEnabled;
+  }
+  return normalized;
+}
+var PROVIDER_ALIAS_MAP;
+var init_providers = __esm(() => {
+  PROVIDER_ALIAS_MAP = {
+    claude: "claude-code",
+    "claude-code": "claude-code",
+    codex: "codex",
+    cursor: "cursor",
+    opencode: "opencode"
+  };
+});
+
+// ../core/src/config/parser.ts
+function parseOmniConfig(tomlContent) {
+  try {
+    return parse(tomlContent);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid TOML in config: ${message}`);
+  }
+}
+function validateCapabilityConfig(parsed) {
+  const cap = parsed["capability"];
+  if (typeof cap !== "object" || cap === null) {
+    throw new Error("capability.id is required in capability.toml");
+  }
+  const capability = cap;
+  if (typeof capability["id"] !== "string") {
+    throw new Error("capability.id is required in capability.toml");
+  }
+  if (typeof capability["name"] !== "string") {
+    throw new Error("capability.name is required in capability.toml");
+  }
+  if (typeof capability["version"] !== "string") {
+    throw new Error("capability.version is required in capability.toml");
+  }
+  if (capability["providers"] !== undefined) {
+    capability["providers"] = normalizeProviderApplicability(capability["providers"], "capability.providers");
+  }
+}
+function parseCapabilityConfig(tomlContent) {
+  try {
+    const parsed = parse(tomlContent);
+    validateCapabilityConfig(parsed);
+    return parsed;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid capability.toml: ${message}`);
+  }
+}
+var init_parser = __esm(() => {
+  init_dist();
+  init_providers();
+});
+
+// ../core/src/capability/env.ts
 import { existsSync as existsSync6 } from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 import { parseEnv } from "node:util";
-function hasEnvPlaceholder(value) {
-  return ENV_PLACEHOLDER_DETECTOR.test(value);
-}
 function mergeEnvSources(capabilityEnv) {
   const merged = { ...capabilityEnv };
   for (const [key, value] of Object.entries(process.env)) {
@@ -2468,13 +2465,21 @@ function mergeEnvSources(capabilityEnv) {
   }
   return merged;
 }
-async function loadCapabilityEnv(capabilityPath) {
+async function loadCapabilityEnvVariables(capabilityPath) {
   const envPath = join4(capabilityPath, CAPABILITY_ENV_FILE);
   if (!existsSync6(envPath)) {
-    return {};
+    return mergeEnvSources({});
   }
   const envContent = await readFile3(envPath, "utf-8");
-  return Object.fromEntries(Object.entries(parseEnv(envContent)).filter((entry) => typeof entry[1] === "string"));
+  const capabilityEnv = Object.fromEntries(Object.entries(parseEnv(envContent)).filter((entry) => typeof entry[1] === "string"));
+  return mergeEnvSources(capabilityEnv);
+}
+var CAPABILITY_ENV_FILE = ".env";
+var init_env = () => {};
+
+// ../core/src/capability/mcp-env.ts
+function hasEnvPlaceholder(value) {
+  return ENV_PLACEHOLDER_DETECTOR.test(value);
 }
 function resolveString(value, variables, capabilityId, fieldPath) {
   if (!hasEnvPlaceholder(value)) {
@@ -2510,35 +2515,35 @@ function mcpHasPlaceholders(mcp) {
   }
   return strings.some((value) => hasEnvPlaceholder(value));
 }
-async function resolveCapabilityMcpEnv(config, capabilityPath) {
+async function resolveCapabilityMcpEnv(config, capabilityPath, variables) {
   if (!config.mcp || !mcpHasPlaceholders(config.mcp)) {
     return config;
   }
-  const variables = mergeEnvSources(await loadCapabilityEnv(capabilityPath));
+  const resolvedVariables = variables ?? await loadCapabilityEnvVariables(capabilityPath);
   const resolvedMcp = { ...config.mcp };
   const capabilityId = config.capability.id;
   if (resolvedMcp.command) {
-    resolvedMcp.command = resolveString(resolvedMcp.command, variables, capabilityId, "mcp.command");
+    resolvedMcp.command = resolveString(resolvedMcp.command, resolvedVariables, capabilityId, "mcp.command");
   }
   if (resolvedMcp.cwd) {
-    resolvedMcp.cwd = resolveString(resolvedMcp.cwd, variables, capabilityId, "mcp.cwd");
+    resolvedMcp.cwd = resolveString(resolvedMcp.cwd, resolvedVariables, capabilityId, "mcp.cwd");
   }
   if (resolvedMcp.url) {
-    resolvedMcp.url = resolveString(resolvedMcp.url, variables, capabilityId, "mcp.url");
+    resolvedMcp.url = resolveString(resolvedMcp.url, resolvedVariables, capabilityId, "mcp.url");
   }
   if (resolvedMcp.args) {
-    resolvedMcp.args = resolvedMcp.args.map((arg, index) => resolveString(arg, variables, capabilityId, `mcp.args[${index}]`));
+    resolvedMcp.args = resolvedMcp.args.map((arg, index) => resolveString(arg, resolvedVariables, capabilityId, `mcp.args[${index}]`));
   }
   if (resolvedMcp.env) {
     resolvedMcp.env = Object.fromEntries(Object.entries(resolvedMcp.env).map(([key, value]) => [
       key,
-      resolveString(value, variables, capabilityId, `mcp.env.${key}`)
+      resolveString(value, resolvedVariables, capabilityId, `mcp.env.${key}`)
     ]));
   }
   if (resolvedMcp.headers) {
     resolvedMcp.headers = Object.fromEntries(Object.entries(resolvedMcp.headers).map(([key, value]) => [
       key,
-      resolveString(value, variables, capabilityId, `mcp.headers.${key}`)
+      resolveString(value, resolvedVariables, capabilityId, `mcp.headers.${key}`)
     ]));
   }
   return {
@@ -2546,8 +2551,9 @@ async function resolveCapabilityMcpEnv(config, capabilityPath) {
     mcp: resolvedMcp
   };
 }
-var CAPABILITY_ENV_FILE = ".env", ENV_PLACEHOLDER, ENV_PLACEHOLDER_DETECTOR;
+var ENV_PLACEHOLDER, ENV_PLACEHOLDER_DETECTOR;
 var init_mcp_env = __esm(() => {
+  init_env();
   ENV_PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
   ENV_PLACEHOLDER_DETECTOR = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/;
 });
@@ -2582,9 +2588,45 @@ var init_rules = () => {};
 import { existsSync as existsSync8, readdirSync as readdirSync4 } from "node:fs";
 import { readFile as readFile5 } from "node:fs/promises";
 import { join as join6 } from "node:path";
-async function loadSkills(capabilityPath, capabilityId) {
+function hasSkillPlaceholder(value) {
+  return SKILL_PLACEHOLDER_DETECTOR.test(value);
+}
+function resolveSkillPlaceholders(content, variables, capabilityId, sourceLabel) {
+  if (!hasSkillPlaceholder(content)) {
+    return content;
+  }
+  return content.replace(SKILL_PLACEHOLDER, (match, variableName) => {
+    const resolved = variables[variableName];
+    if (resolved === undefined) {
+      throw new Error(`Missing environment variable "${variableName}" required by capability "${capabilityId}" in ${sourceLabel} (placeholder "${match}")`);
+    }
+    return resolved;
+  });
+}
+function parseSkillMarkdown(content, capabilityId, options) {
+  const resolvedContent = options?.variables && options.sourceLabel ? resolveSkillPlaceholders(content, options.variables, capabilityId, options.sourceLabel) : content;
+  const parsed = parseFrontmatterWithMarkdown(resolvedContent);
+  if (!parsed) {
+    const sourceLabel = options?.sourceLabel ?? "skill content";
+    throw new Error(`Invalid SKILL.md format at ${sourceLabel}: missing YAML frontmatter`);
+  }
+  const frontmatter = parsed.frontmatter;
+  const instructions = parsed.markdown;
+  if (!frontmatter.name || !frontmatter.description) {
+    const sourceLabel = options?.sourceLabel ?? "skill content";
+    throw new Error(`Invalid SKILL.md at ${sourceLabel}: name and description required in frontmatter`);
+  }
+  return {
+    name: frontmatter.name,
+    description: frontmatter.description,
+    instructions: instructions.trim(),
+    capabilityId
+  };
+}
+async function loadSkills(capabilityPath, capabilityId, variables) {
   const skills = [];
   const possibleDirNames = ["skills", "skill"];
+  const resolvedVariables = variables ?? await loadCapabilityEnvVariables(capabilityPath);
   for (const dirName of possibleDirNames) {
     const dir = join6(capabilityPath, dirName);
     if (!existsSync8(dir)) {
@@ -2595,33 +2637,30 @@ async function loadSkills(capabilityPath, capabilityId) {
       if (entry.isDirectory()) {
         const skillPath = join6(dir, entry.name, "SKILL.md");
         if (existsSync8(skillPath)) {
-          const skill = await parseSkillFile(skillPath, capabilityId);
-          skills.push(skill);
+          const skill = await parseSkillFile(skillPath, capabilityId, resolvedVariables, `skill file ${skillPath}`);
+          skills.push({
+            ...skill,
+            sourcePath: join6(dir, entry.name)
+          });
         }
       }
     }
   }
   return skills;
 }
-async function parseSkillFile(filePath, capabilityId) {
+async function parseSkillFile(filePath, capabilityId, variables, sourceLabel) {
   const content = await readFile5(filePath, "utf-8");
-  const parsed = parseFrontmatterWithMarkdown(content);
-  if (!parsed) {
-    throw new Error(`Invalid SKILL.md format at ${filePath}: missing YAML frontmatter`);
-  }
-  const frontmatter = parsed.frontmatter;
-  const instructions = parsed.markdown;
-  if (!frontmatter.name || !frontmatter.description) {
-    throw new Error(`Invalid SKILL.md at ${filePath}: name and description required in frontmatter`);
-  }
-  return {
-    name: frontmatter.name,
-    description: frontmatter.description,
-    instructions: instructions.trim(),
-    capabilityId
-  };
+  return parseSkillMarkdown(content, capabilityId, {
+    variables,
+    sourceLabel
+  });
 }
-var init_skills = () => {};
+var SKILL_PLACEHOLDER, SKILL_PLACEHOLDER_DETECTOR;
+var init_skills = __esm(() => {
+  init_env();
+  SKILL_PLACEHOLDER = /\{OMNIDEV_([A-Za-z_][A-Za-z0-9_]*)\}/g;
+  SKILL_PLACEHOLDER_DETECTOR = /\{OMNIDEV_([A-Za-z_][A-Za-z0-9_]*)\}/;
+});
 
 // ../core/src/capability/subagents.ts
 import { existsSync as existsSync9, readdirSync as readdirSync5 } from "node:fs";
@@ -2767,40 +2806,13 @@ async function loadTypeDefinitions(capabilityPath) {
   }
   return readFile7(typesPath, "utf-8");
 }
-function convertSkillExports(skillExports, capabilityId) {
-  return skillExports.map((skillExport) => {
+function convertSkillExports(skillExports, capabilityId, variables) {
+  return skillExports.map((skillExport, index) => {
     const exportObj = skillExport;
-    const lines = exportObj.skillMd.split(`
-`);
-    let name = "unnamed";
-    let description = "";
-    let instructions = exportObj.skillMd;
-    if (lines[0]?.trim() === "---") {
-      const endIndex = lines.findIndex((line, i) => i > 0 && line.trim() === "---");
-      if (endIndex > 0) {
-        const frontmatter = lines.slice(1, endIndex);
-        instructions = lines.slice(endIndex + 1).join(`
-`).trim();
-        for (const line of frontmatter) {
-          const match = line.match(/^(\w+):\s*(.+)$/);
-          if (match?.[1] && match[2]) {
-            const key = match[1];
-            const value = match[2];
-            if (key === "name") {
-              name = value.replace(/^["']|["']$/g, "");
-            } else if (key === "description") {
-              description = value.replace(/^["']|["']$/g, "");
-            }
-          }
-        }
-      }
-    }
-    return {
-      name,
-      description,
-      instructions,
-      capabilityId
-    };
+    return parseSkillMarkdown(exportObj.skillMd, capabilityId, {
+      variables,
+      sourceLabel: `programmatic skill export[${index}]`
+    });
   });
 }
 function convertRuleExports(ruleExports, capabilityId) {
@@ -2953,8 +2965,9 @@ function mergeByName(fileBased, programmatic) {
   return Array.from(byName.values());
 }
 async function loadCapability(capabilityPath) {
+  const capabilityEnvVariables = await loadCapabilityEnvVariables(capabilityPath);
   const rawConfig = await loadCapabilityConfig(capabilityPath);
-  const config = await resolveCapabilityMcpEnv(rawConfig, capabilityPath);
+  const config = await resolveCapabilityMcpEnv(rawConfig, capabilityPath, capabilityEnvVariables);
   const id = config.capability.id;
   const exports = await importCapabilityExports(capabilityPath);
   const exportsAny = exports;
@@ -2969,8 +2982,8 @@ async function loadCapability(capabilityPath) {
     return;
   };
   const skillsExport = getExportValue("skills");
-  const programmaticSkills = Array.isArray(skillsExport) ? convertSkillExports(skillsExport, id) : [];
-  const fileSkills = await loadSkills(capabilityPath, id);
+  const programmaticSkills = Array.isArray(skillsExport) ? convertSkillExports(skillsExport, id, capabilityEnvVariables) : [];
+  const fileSkills = await loadSkills(capabilityPath, id, capabilityEnvVariables);
   const skills = mergeByName(fileSkills, programmaticSkills);
   const rulesExport = getExportValue("rules");
   const programmaticRules = Array.isArray(rulesExport) ? convertRuleExports(rulesExport, id) : [];
@@ -3018,11 +3031,12 @@ async function loadCapability(capabilityPath) {
 }
 var CAPABILITIES_DIR = ".omni/capabilities";
 var init_loader2 = __esm(() => {
-  init_parser();
   init_loader();
-  init_mcp_env();
+  init_parser();
   init_commands();
   init_docs();
+  init_env();
+  init_mcp_env();
   init_rules();
   init_skills();
   init_subagents();
@@ -3513,7 +3527,7 @@ import { existsSync as existsSync13 } from "node:fs";
 import { spawn } from "node:child_process";
 import { cp, mkdir, readdir, readFile as readFile10, rename, rm, stat, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join9 } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 async function spawnCapture(command, args, options) {
   const timeout = options?.timeout ?? 60000;
   return await new Promise((resolve2, reject) => {
@@ -3722,7 +3736,7 @@ function escapeTomlString(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
 }
 async function computeContentHash(dirPath, excludePatterns = CONTENT_HASH_EXCLUDES) {
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   const files = [];
   async function collectFiles(currentPath, relativeTo) {
     const entries = await readdir(currentPath, { withFileTypes: true });
@@ -5157,29 +5171,107 @@ var init_mcp_json = __esm(() => {
 });
 
 // ../core/src/state/manifest.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync2, rmSync } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync17, mkdirSync as mkdirSync2, readdirSync as readdirSync7, rmSync } from "node:fs";
+import { dirname, join as join10 } from "node:path";
 import { readFile as readFile14, writeFile as writeFile7 } from "node:fs/promises";
-async function loadManifest() {
-  if (!existsSync17(MANIFEST_PATH)) {
+function createEmptyManifest() {
+  return {
+    version: CURRENT_VERSION,
+    syncedAt: new Date().toISOString(),
+    capabilities: {},
+    providers: {}
+  };
+}
+function normalizeManifest(parsed) {
+  if (parsed.version === CURRENT_VERSION && "providers" in parsed) {
     return {
       version: CURRENT_VERSION,
-      syncedAt: new Date().toISOString(),
-      capabilities: {}
+      syncedAt: parsed.syncedAt,
+      capabilities: parsed.capabilities,
+      providers: parsed.providers ?? {}
     };
   }
+  return {
+    version: CURRENT_VERSION,
+    syncedAt: parsed.syncedAt,
+    capabilities: parsed.capabilities,
+    providers: {}
+  };
+}
+function hashContent2(content) {
+  return createHash3("sha256").update(content).digest("hex");
+}
+function normalizePath(path) {
+  return path.replace(/\\/g, "/");
+}
+function isDirectoryEmpty(path) {
+  return readdirSync7(path).length === 0;
+}
+async function cleanupManagedOutput(output) {
+  const outputPath = join10(process.cwd(), output.path);
+  if (!existsSync17(outputPath)) {
+    return { deleted: false };
+  }
+  if (output.cleanupStrategy === "remove-json-key") {
+    if (!output.jsonKey) {
+      return { deleted: false, reason: `missing jsonKey metadata for ${output.path}` };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(await readFile14(outputPath, "utf-8"));
+    } catch {
+      return { deleted: false, reason: `could not parse JSON at ${output.path}` };
+    }
+    const currentValue = parsed[output.jsonKey];
+    if (currentValue === undefined) {
+      return { deleted: false };
+    }
+    if (hashContent2(JSON.stringify(currentValue)) !== output.hash) {
+      return { deleted: false, reason: `managed section changed at ${output.path}` };
+    }
+    delete parsed[output.jsonKey];
+    if (Object.keys(parsed).length === 0) {
+      rmSync(outputPath);
+    } else {
+      await writeFile7(outputPath, `${JSON.stringify(parsed, null, 2)}
+`, "utf-8");
+    }
+    return { deleted: true };
+  }
+  const currentContent = await readFile14(outputPath, "utf-8");
+  if (hashContent2(currentContent) !== output.hash) {
+    return { deleted: false, reason: `managed file changed at ${output.path}` };
+  }
+  rmSync(outputPath);
+  if (output.cleanupStrategy === "delete-file-and-prune-empty-parents" && output.pruneRoot) {
+    const pruneRoot = join10(process.cwd(), output.pruneRoot);
+    let currentDir = dirname(outputPath);
+    while (normalizePath(currentDir).startsWith(normalizePath(pruneRoot)) && normalizePath(currentDir) !== normalizePath(pruneRoot) && existsSync17(currentDir) && isDirectoryEmpty(currentDir)) {
+      rmSync(currentDir, { recursive: true });
+      currentDir = dirname(currentDir);
+    }
+  }
+  return { deleted: true };
+}
+async function loadManifest() {
+  if (!existsSync17(MANIFEST_PATH)) {
+    return createEmptyManifest();
+  }
   const content = await readFile14(MANIFEST_PATH, "utf-8");
-  return JSON.parse(content);
+  return normalizeManifest(JSON.parse(content));
 }
 async function saveManifest(manifest) {
   mkdirSync2(".omni/state", { recursive: true });
   await writeFile7(MANIFEST_PATH, `${JSON.stringify(manifest, null, 2)}
 `, "utf-8");
 }
-function buildManifestFromCapabilities(capabilities2) {
+function buildManifestFromCapabilities(capabilities2, providerOutputs = new Map) {
   const manifest = {
     version: CURRENT_VERSION,
     syncedAt: new Date().toISOString(),
-    capabilities: {}
+    capabilities: {},
+    providers: {}
   };
   for (const cap of capabilities2) {
     const resources = {
@@ -5191,38 +5283,59 @@ function buildManifestFromCapabilities(capabilities2) {
     };
     manifest.capabilities[cap.id] = resources;
   }
+  for (const [providerId, outputs] of providerOutputs) {
+    manifest.providers[providerId] = {
+      outputs: Object.fromEntries(outputs.map((output) => [output.path, output]))
+    };
+  }
   return manifest;
 }
-async function cleanupStaleResources(previousManifest, currentCapabilityIds) {
-  const result = {
+async function cleanupStaleResources(_previousManifest, _currentCapabilityIds) {
+  return {
     deletedSkills: [],
     deletedRules: [],
     deletedCommands: [],
     deletedSubagents: [],
     deletedMcps: []
   };
-  for (const [capId, resources] of Object.entries(previousManifest.capabilities)) {
-    if (currentCapabilityIds.has(capId)) {
-      continue;
+}
+async function cleanupStaleManagedOutputs(previousManifest, nextProviders) {
+  const result = {
+    deletedPaths: [],
+    skippedPaths: []
+  };
+  const claimedPaths = new Set;
+  for (const outputs of nextProviders.values()) {
+    for (const output of outputs) {
+      claimedPaths.add(output.path);
     }
-    for (const skillName of resources.skills) {
-      const skillDir = `.claude/skills/${skillName}`;
-      if (existsSync17(skillDir)) {
-        rmSync(skillDir, { recursive: true });
-        result.deletedSkills.push(skillName);
+  }
+  for (const [providerId, providerState] of Object.entries(previousManifest.providers)) {
+    const nextPaths = new Set((nextProviders.get(providerId) ?? []).map((output) => output.path));
+    for (const output of Object.values(providerState.outputs)) {
+      if (nextPaths.has(output.path)) {
+        continue;
       }
-    }
-    for (const ruleName of resources.rules) {
-      const rulePath = `.cursor/rules/omnidev-${ruleName}.mdc`;
-      if (existsSync17(rulePath)) {
-        rmSync(rulePath);
-        result.deletedRules.push(ruleName);
+      if (claimedPaths.has(output.path)) {
+        continue;
+      }
+      const cleanup = await cleanupManagedOutput(output);
+      if (cleanup.deleted) {
+        result.deletedPaths.push(output.path);
+      } else if (cleanup.reason) {
+        result.skippedPaths.push({
+          path: output.path,
+          reason: cleanup.reason
+        });
       }
     }
   }
   return result;
 }
-var MANIFEST_PATH = ".omni/state/manifest.json", CURRENT_VERSION = 1;
+function getProviderManagedOutputs(manifest, providerId) {
+  return Object.values(manifest.providers[providerId]?.outputs ?? {});
+}
+var MANIFEST_PATH = ".omni/state/manifest.json", CURRENT_VERSION = 2;
 var init_manifest = () => {};
 
 // ../core/src/state/providers.ts
@@ -5370,16 +5483,42 @@ var init_state = __esm(() => {
 
 // ../core/src/sync.ts
 import { spawn as spawn2 } from "node:child_process";
-import { mkdirSync as mkdirSync5 } from "node:fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync5, readFileSync as readFileSync3 } from "node:fs";
+import { join as join11 } from "node:path";
+function getDeclaredPackageManager(packageManager) {
+  if (typeof packageManager !== "string" || packageManager.trim().length === 0) {
+    return;
+  }
+  const atIndex = packageManager.indexOf("@");
+  return atIndex === -1 ? packageManager : packageManager.slice(0, atIndex);
+}
+function resolveCapabilityInstallCommand(capabilityPath, options) {
+  const packageJsonPath = join11(capabilityPath, "package.json");
+  const packageLockPath = join11(capabilityPath, "package-lock.json");
+  let packageManager;
+  try {
+    const pkgJson = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
+    packageManager = getDeclaredPackageManager(pkgJson.packageManager);
+  } catch {}
+  if (!options.hasNpm) {
+    throw new Error("npm is not installed. Install npm to install capability dependencies.");
+  }
+  if (packageManager && packageManager !== "npm") {
+    throw new Error(`Capability at ${capabilityPath} declares packageManager=${packageManager}, but OmniDev only supports npm for capability dependencies.`);
+  }
+  return {
+    cmd: "npm",
+    args: [existsSync20(packageLockPath) ? "ci" : "install"]
+  };
+}
 async function installCapabilityDependencies(silent) {
-  const { existsSync: existsSync20, readdirSync: readdirSync7, readFileSync: readFileSync3 } = await import("node:fs");
-  const { join: join10 } = await import("node:path");
+  const { readdirSync: readdirSync8 } = await import("node:fs");
   const { parse: parse2 } = await Promise.resolve().then(() => (init_dist(), exports_dist));
   const capabilitiesDir = ".omni/capabilities";
   if (!existsSync20(capabilitiesDir)) {
     return;
   }
-  const entries = readdirSync7(capabilitiesDir, { withFileTypes: true });
+  const entries = readdirSync8(capabilitiesDir, { withFileTypes: true });
   async function commandExists(cmd) {
     return await new Promise((resolve2) => {
       const proc = spawn2(cmd, ["--version"], { stdio: "ignore" });
@@ -5387,18 +5526,17 @@ async function installCapabilityDependencies(silent) {
       proc.on("close", (code) => resolve2(code === 0));
     });
   }
-  const hasBun = await commandExists("bun");
-  const hasNpm = hasBun ? false : await commandExists("npm");
-  if (!hasBun && !hasNpm) {
-    throw new Error("Neither Bun nor npm is installed. Install one of them to install capability dependencies.");
+  const hasNpm = await commandExists("npm");
+  if (!hasNpm) {
+    throw new Error("npm is not installed. Install npm to install capability dependencies.");
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const capabilityPath = join10(capabilitiesDir, entry.name);
-    const packageJsonPath = join10(capabilityPath, "package.json");
-    const capabilityTomlPath = join10(capabilityPath, "capability.toml");
+    const capabilityPath = join11(capabilitiesDir, entry.name);
+    const packageJsonPath = join11(capabilityPath, "package.json");
+    const capabilityTomlPath = join11(capabilityPath, "capability.toml");
     if (!existsSync20(packageJsonPath)) {
       continue;
     }
@@ -5413,9 +5551,9 @@ async function installCapabilityDependencies(silent) {
     }
     try {
       await new Promise((resolve2, reject) => {
-        const useNpmCi = hasNpm && existsSync20(join10(capabilityPath, "package-lock.json"));
-        const cmd = hasBun ? "bun" : "npm";
-        const args = hasBun ? ["install"] : useNpmCi ? ["ci"] : ["install"];
+        const { cmd, args } = resolveCapabilityInstallCommand(capabilityPath, {
+          hasNpm
+        });
         const proc = spawn2(cmd, args, {
           cwd: capabilityPath,
           stdio: "pipe"
@@ -5436,7 +5574,7 @@ ${stderr}`));
           reject(error);
         });
       });
-      const hasIndexTs = existsSync20(join10(capabilityPath, "index.ts"));
+      const hasIndexTs = existsSync20(join11(capabilityPath, "index.ts"));
       let hasBuildScript = false;
       try {
         const pkgJson = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
@@ -5444,9 +5582,7 @@ ${stderr}`));
       } catch {}
       if (hasBuildScript) {
         await new Promise((resolve2, reject) => {
-          const cmd = hasBun ? "bun" : "npm";
-          const args = ["run", "build"];
-          const proc = spawn2(cmd, args, {
+          const proc = spawn2("npm", ["run", "build"], {
             cwd: capabilityPath,
             stdio: "pipe"
           });
@@ -5467,7 +5603,7 @@ ${stderr}`));
           });
         });
       } else if (hasIndexTs && !silent) {
-        const hasBuiltIndex = existsSync20(join10(capabilityPath, "dist", "index.js"));
+        const hasBuiltIndex = existsSync20(join11(capabilityPath, "dist", "index.js"));
         if (!hasBuiltIndex) {
           console.warn(`Warning: Capability at ${capabilityPath} has index.ts but no build script.
   Add a "build" script to package.json (e.g., "build": "tsc") to compile TypeScript.`);
@@ -5538,8 +5674,8 @@ async function syncAgentConfiguration(options) {
   }
   mkdirSync5(".omni", { recursive: true });
   await syncMcpJson(capabilities2, previousManifest);
-  const newManifest = buildManifestFromCapabilities(capabilities2);
-  await saveManifest(newManifest);
+  const enabledProviderIds = new Set(adapters.map((adapter) => String(adapter.id)));
+  const successfulProviderOutputs = new Map;
   if (adapters.length > 0) {
     const config2 = await loadConfig();
     const ctx = {
@@ -5548,12 +5684,33 @@ async function syncAgentConfiguration(options) {
     };
     for (const adapter of adapters) {
       try {
-        await adapter.sync(bundle, ctx);
+        const adapterResult = await adapter.sync(bundle, ctx);
+        successfulProviderOutputs.set(String(adapter.id), adapterResult.managedOutputs ?? []);
       } catch (error) {
         console.error(`Error running ${adapter.displayName} adapter:`, error);
       }
     }
   }
+  const nextProviderOutputs = new Map;
+  if (adapters.length === 0) {
+    for (const providerId of Object.keys(previousManifest.providers)) {
+      nextProviderOutputs.set(providerId, getProviderManagedOutputs(previousManifest, providerId));
+    }
+  } else {
+    for (const providerId of enabledProviderIds) {
+      if (successfulProviderOutputs.has(providerId)) {
+        nextProviderOutputs.set(providerId, successfulProviderOutputs.get(providerId) ?? []);
+        continue;
+      }
+      nextProviderOutputs.set(providerId, getProviderManagedOutputs(previousManifest, providerId));
+    }
+  }
+  const cleanupResult = await cleanupStaleManagedOutputs(previousManifest, nextProviderOutputs);
+  for (const skipped of cleanupResult.skippedPaths) {
+    console.warn(`Warning: skipped cleanup for ${skipped.path} (${skipped.reason})`);
+  }
+  const newManifest = buildManifestFromCapabilities(capabilities2, nextProviderOutputs);
+  await saveManifest(newManifest);
   const result = {
     capabilities: capabilities2.map((c) => c.id),
     skillCount: bundle.skills.length,
@@ -5598,21 +5755,23 @@ var init_types3 = __esm(() => {
       unicode: true,
       symlinks: true,
       scripts: true,
-      binaries: false
+      binaries: false,
+      hiddenCommands: true
     }
   };
   DEFAULT_SCAN_SETTINGS = {
     unicode: true,
     symlinks: true,
     scripts: true,
-    binaries: false
+    binaries: false,
+    hiddenCommands: true
   };
 });
 
 // ../core/src/security/scanner.ts
-import { existsSync as existsSync20 } from "node:fs";
+import { existsSync as existsSync21 } from "node:fs";
 import { lstat, readdir as readdir2, readFile as readFile17, readlink, realpath } from "node:fs/promises";
-import { join as join10, relative, resolve as resolve2 } from "node:path";
+import { join as join12, relative, resolve as resolve2 } from "node:path";
 async function scanFileForUnicode(filePath, relativePath) {
   const findings = [];
   try {
@@ -5693,10 +5852,113 @@ async function scanFileForScripts(filePath, relativePath) {
   } catch {}
   return findings;
 }
+function extractHiddenRegions(fileContent) {
+  const regions = [];
+  HTML_COMMENT_RE.lastIndex = 0;
+  for (let match = HTML_COMMENT_RE.exec(fileContent);match !== null; match = HTML_COMMENT_RE.exec(fileContent)) {
+    const captured = match[1];
+    if (captured === undefined)
+      continue;
+    const beforeMatch = fileContent.substring(0, match.index);
+    const startLine = beforeMatch.split(`
+`).length;
+    regions.push({ content: captured, startLine });
+  }
+  HIDDEN_REFERENCE_RE.lastIndex = 0;
+  for (let match = HIDDEN_REFERENCE_RE.exec(fileContent);match !== null; match = HIDDEN_REFERENCE_RE.exec(fileContent)) {
+    const captured = match[1];
+    if (captured === undefined)
+      continue;
+    const beforeMatch = fileContent.substring(0, match.index);
+    const startLine = beforeMatch.split(`
+`).length;
+    regions.push({ content: captured, startLine });
+  }
+  return regions;
+}
+async function scanFileForHiddenCommands(filePath, relativePath) {
+  const findings = [];
+  try {
+    const content = await readFile17(filePath, "utf-8");
+    const hiddenRegions = extractHiddenRegions(content);
+    for (const region of hiddenRegions) {
+      const regionLines = region.content.split(`
+`);
+      for (let i = 0;i < regionLines.length; i++) {
+        const line = regionLines[i] ?? "";
+        if (!line.trim())
+          continue;
+        for (const { pattern, message, severity } of HIDDEN_COMMAND_PATTERNS) {
+          if (pattern.test(line)) {
+            findings.push({
+              type: "hidden_command",
+              severity,
+              file: relativePath,
+              line: region.startLine + i,
+              message: `Hidden in comment: ${message}`,
+              details: line.trim().substring(0, 100)
+            });
+          }
+        }
+        for (const { pattern, message, severity } of NETWORK_REQUEST_PATTERNS) {
+          if (pattern.test(line)) {
+            findings.push({
+              type: "network_request",
+              severity: severity === "medium" ? "high" : severity,
+              file: relativePath,
+              line: region.startLine + i,
+              message: `Hidden in comment: ${message}`,
+              details: line.trim().substring(0, 100)
+            });
+          }
+        }
+        for (const { pattern, message, severity } of SUSPICIOUS_SCRIPT_PATTERNS) {
+          if (pattern.test(line)) {
+            findings.push({
+              type: "hidden_command",
+              severity: severity === "medium" ? "high" : severity,
+              file: relativePath,
+              line: region.startLine + i,
+              message: `Hidden in comment: ${message}`,
+              details: line.trim().substring(0, 100)
+            });
+          }
+        }
+      }
+    }
+  } catch {}
+  return findings;
+}
+async function scanFileForNetworkRequests(filePath, relativePath) {
+  const findings = [];
+  try {
+    const content = await readFile17(filePath, "utf-8");
+    const lines = content.split(`
+`);
+    for (let lineNum = 0;lineNum < lines.length; lineNum++) {
+      const line = lines[lineNum];
+      if (!line)
+        continue;
+      for (const { pattern, message, severity } of NETWORK_REQUEST_PATTERNS) {
+        if (pattern.test(line)) {
+          findings.push({
+            type: "network_request",
+            severity,
+            file: relativePath,
+            line: lineNum + 1,
+            message,
+            details: line.trim().substring(0, 100)
+          });
+        }
+      }
+    }
+  } catch {}
+  return findings;
+}
 async function checkSymlink(symlinkPath, relativePath, capabilityRoot) {
   try {
     const linkTarget = await readlink(symlinkPath);
-    const resolvedTarget = resolve2(join10(symlinkPath, "..", linkTarget));
+    const resolvedTarget = resolve2(join12(symlinkPath, "..", linkTarget));
     const normalizedRoot = await realpath(capabilityRoot);
     if (linkTarget.startsWith("/")) {
       return {
@@ -5731,7 +5993,7 @@ function isTextFile(filePath) {
 async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_SCAN_SETTINGS) {
   const startTime = Date.now();
   const findings = [];
-  if (!existsSync20(capabilityPath)) {
+  if (!existsSync21(capabilityPath)) {
     return {
       capabilityId,
       path: capabilityPath,
@@ -5743,7 +6005,7 @@ async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_S
   async function scanDirectory(dirPath) {
     const entries = await readdir2(dirPath, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = join10(dirPath, entry.name);
+      const fullPath = join12(dirPath, entry.name);
       const relativePath = relative(capabilityPath, fullPath);
       if (entry.name.startsWith(".") || entry.name === "node_modules" || entry.name === "__pycache__") {
         continue;
@@ -5770,17 +6032,27 @@ async function scanCapability(capabilityId, capabilityPath, settings = DEFAULT_S
           });
         }
         if (isTextFile(fullPath)) {
+          const ext = fullPath.toLowerCase().substring(fullPath.lastIndexOf("."));
           if (settings.unicode) {
             const unicodeFindings = await scanFileForUnicode(fullPath, relativePath);
             findings.push(...unicodeFindings);
           }
           if (settings.scripts) {
-            const ext = fullPath.toLowerCase().substring(fullPath.lastIndexOf("."));
             if ([".sh", ".bash", ".zsh", ".fish", ".py", ".rb", ".js", ".ts"].includes(ext)) {
               const scriptFindings = await scanFileForScripts(fullPath, relativePath);
               findings.push(...scriptFindings);
             }
           }
+          if (settings.hiddenCommands) {
+            if ([".md", ".txt", ".yaml", ".yml", ".toml"].includes(ext)) {
+              const hiddenFindings = await scanFileForHiddenCommands(fullPath, relativePath);
+              findings.push(...hiddenFindings);
+            }
+          }
+          if (settings.hiddenCommands) {
+            const networkFindings = await scanFileForNetworkRequests(fullPath, relativePath);
+            findings.push(...networkFindings);
+          }
         }
       }
     }
@@ -5812,7 +6084,9 @@ async function scanCapabilities(capabilities2, config2 = {}) {
     symlink_escape: 0,
     symlink_absolute: 0,
     suspicious_script: 0,
-    binary_file: 0
+    binary_file: 0,
+    hidden_command: 0,
+    network_request: 0
   };
   const findingsBySeverity = {
     low: 0,
@@ -5887,7 +6161,7 @@ function formatScanResults(summary, verbose = false) {
   return lines.join(`
 `);
 }
-var UNICODE_PATTERNS, SUSPICIOUS_SCRIPT_PATTERNS, BINARY_EXTENSIONS, TEXT_EXTENSIONS;
+var UNICODE_PATTERNS, SUSPICIOUS_SCRIPT_PATTERNS, NETWORK_REQUEST_PATTERNS, HIDDEN_COMMAND_PATTERNS, BINARY_EXTENSIONS, TEXT_EXTENSIONS, HTML_COMMENT_RE, HIDDEN_REFERENCE_RE;
 var init_scanner = __esm(() => {
   init_types3();
   UNICODE_PATTERNS = {
@@ -5979,6 +6253,75 @@ var init_scanner = __esm(() => {
       severity: "high"
     }
   ];
+  NETWORK_REQUEST_PATTERNS = [
+    {
+      pattern: /\bcurl\s+.*https?:\/\//i,
+      message: "Outbound curl request detected",
+      severity: "medium"
+    },
+    {
+      pattern: /\bwget\s+.*https?:\/\//i,
+      message: "Outbound wget request detected",
+      severity: "medium"
+    },
+    {
+      pattern: /\bfetch\s*\(\s*["'`]https?:\/\//i,
+      message: "Outbound fetch() request detected",
+      severity: "medium"
+    },
+    {
+      pattern: /\b(?:http|https)\.(?:get|request|post|put)\s*\(/i,
+      message: "Outbound HTTP request via Node.js http module",
+      severity: "medium"
+    },
+    {
+      pattern: /\brequests\.(?:get|post|put|delete|patch)\s*\(/i,
+      message: "Outbound HTTP request via Python requests",
+      severity: "medium"
+    },
+    {
+      pattern: /\bnc\b.*\s\d{2,5}\b/i,
+      message: "Netcat connection detected",
+      severity: "high"
+    },
+    {
+      pattern: /\b(?:Invoke-WebRequest|Invoke-RestMethod|iwr|irm)\b/i,
+      message: "Outbound PowerShell web request detected",
+      severity: "medium"
+    }
+  ];
+  HIDDEN_COMMAND_PATTERNS = [
+    {
+      pattern: /`[^`]*(?:curl|wget|bash|sh|python|ruby|node|exec|eval|system)\s[^`]*`/i,
+      message: "Executable command in backtick-wrapped code",
+      severity: "critical"
+    },
+    {
+      pattern: /\|\s*(?:ba)?sh\b/i,
+      message: "Pipe to shell execution",
+      severity: "critical"
+    },
+    {
+      pattern: /(?:^|\s)(?:bash|sh|zsh)\s+-c\s+/i,
+      message: "Shell invocation with -c flag",
+      severity: "high"
+    },
+    {
+      pattern: /\b(?:curl|wget)\s+.*https?:\/\//i,
+      message: "Network fetch command detected",
+      severity: "high"
+    },
+    {
+      pattern: /\b(?:python|ruby|node)\s+-e\s+/i,
+      message: "Inline script execution",
+      severity: "high"
+    },
+    {
+      pattern: /\beval\s*\(.*\)/i,
+      message: "eval() call detected",
+      severity: "high"
+    }
+  ];
   BINARY_EXTENSIONS = new Set([
     ".exe",
     ".dll",
@@ -6013,6 +6356,8 @@ var init_scanner = __esm(() => {
     ".py",
     ".rb"
   ]);
+  HTML_COMMENT_RE = /<!--([\s\S]*?)-->/g;
+  HIDDEN_REFERENCE_RE = /^\[.*?\]:\s*\S+\s+"(.+)"/gm;
 });
 
 // ../core/src/security/index.ts
@@ -6023,7 +6368,9 @@ var init_security = __esm(() => {
 
 // ../core/src/templates/agents.ts
 function generateAgentsTemplate() {
-  return `# Project Instructions
+  return `> IMPORTANT: Do not edit this file directly. Edit \`OMNI.md\` instead. This file is a generated copy of \`OMNI.md\` and is ephemeral. Any persistent change must be made in \`OMNI.md\`.
+
+# Project Instructions
 
 <!-- Add your project-specific instructions here -->
 
@@ -6150,7 +6497,9 @@ function formatDisplayName(kebabCase) {
 
 // ../core/src/templates/claude.ts
 function generateClaudeTemplate() {
-  return `# Project Instructions
+  return `> IMPORTANT: Do not edit this file directly. Edit \`OMNI.md\` instead. This file is a generated copy of \`OMNI.md\` and is ephemeral. Any persistent change must be made in \`OMNI.md\`.
+
+# Project Instructions
 
 <!-- Add your project-specific instructions here -->
 `;
@@ -6222,6 +6571,7 @@ __export(exports_src, {
   resolveEnabledCapabilities: () => resolveEnabledCapabilities,
   resolveCapabilityRootInConfig: () => resolveCapabilityRootInConfig,
   resolveCapabilityRoot: () => resolveCapabilityRoot,
+  resolveCapabilityInstallCommand: () => resolveCapabilityInstallCommand,
   removeSecurityAllow: () => removeSecurityAllow,
   readSecurityAllows: () => readSecurityAllows,
   readMcpJson: () => readMcpJson,
@@ -6273,6 +6623,7 @@ __export(exports_src, {
   hasAnyHooks: () => hasAnyHooks,
   getVersion: () => getVersion,
   getSourceCapabilityPath: () => getSourceCapabilityPath,
+  getProviderManagedOutputs: () => getProviderManagedOutputs,
   getLockFilePath: () => getLockFilePath,
   getHooksDirectory: () => getHooksDirectory,
   getHooksConfigPath: () => getHooksConfigPath,
@@ -6310,6 +6661,7 @@ __export(exports_src, {
   clearAllSecurityAllows: () => clearAllSecurityAllows,
   clearActiveProfileState: () => clearActiveProfileState,
   cleanupStaleResources: () => cleanupStaleResources,
+  cleanupStaleManagedOutputs: () => cleanupStaleManagedOutputs,
   checkVersionMismatch: () => checkVersionMismatch,
   checkForUpdates: () => checkForUpdates,
   buildSyncBundle: () => buildSyncBundle,
@@ -6353,15 +6705,33 @@ var init_src = __esm(() => {
 import { run } from "@stricli/core";
 
 // src/lib/dynamic-app.ts
-import { existsSync as existsSync30 } from "node:fs";
+import { existsSync as existsSync32 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
-import { join as join27 } from "node:path";
+import { join as join29 } from "node:path";
 import { buildApplication, buildRouteMap as buildRouteMap7 } from "@stricli/core";
 
 // src/commands/add.ts
-import { existsSync as existsSync23 } from "node:fs";
+import { existsSync as existsSync24 } from "node:fs";
 import { basename as basename5, resolve as resolve3 } from "node:path";
 
+// ../adapters/src/writers/generic/managed-outputs.ts
+import { createHash } from "node:crypto";
+function hashContent(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function trimTrailingSlash(path) {
+  return path.endsWith("/") ? path.slice(0, -1) : path;
+}
+function createManagedOutput(path, writerId, content, options) {
+  return {
+    path,
+    writerId,
+    hash: hashContent(content),
+    cleanupStrategy: options?.cleanupStrategy ?? "delete-file",
+    ...options?.pruneRoot ? { pruneRoot: trimTrailingSlash(options.pruneRoot) } : {},
+    ...options?.jsonKey ? { jsonKey: options.jsonKey } : {}
+  };
+}
 // ../adapters/src/writers/generic/executor.ts
 async function executeWriters(writerConfigs, bundle, projectRoot, providerId) {
   const seen = new Set;
@@ -6377,6 +6747,7 @@ async function executeWriters(writerConfigs, bundle, projectRoot, providerId) {
     uniqueConfigs.push(config);
   }
   const allFilesWritten = [];
+  const allManagedOutputs = [];
   for (const config of uniqueConfigs) {
     const result = await config.writer.write(bundle, {
       outputPath: config.outputPath,
@@ -6384,29 +6755,31 @@ async function executeWriters(writerConfigs, bundle, projectRoot, providerId) {
       ...providerId ? { providerId } : {}
     });
     allFilesWritten.push(...result.filesWritten);
+    allManagedOutputs.push(...result.managedOutputs ?? []);
   }
   return {
     filesWritten: allFilesWritten,
-    deduplicatedCount
+    deduplicatedCount,
+    managedOutputs: allManagedOutputs
   };
 }
 // ../adapters/src/writers/generic/hooks.ts
 init_src();
-import { existsSync as existsSync21 } from "node:fs";
+import { existsSync as existsSync22 } from "node:fs";
 import { mkdir as mkdir2, readFile as readFile18, writeFile as writeFile10 } from "node:fs/promises";
-import { dirname, join as join11 } from "node:path";
+import { dirname as dirname2, join as join13 } from "node:path";
 var HooksWriter = {
   id: "hooks",
   async write(bundle, ctx) {
     if (!bundle.hooks) {
       return { filesWritten: [] };
     }
-    const settingsPath = join11(ctx.projectRoot, ctx.outputPath);
-    const parentDir = dirname(settingsPath);
+    const settingsPath = join13(ctx.projectRoot, ctx.outputPath);
+    const parentDir = dirname2(settingsPath);
     await mkdir2(parentDir, { recursive: true });
     const claudeHooks = transformHooksConfig(bundle.hooks, "toClaude");
     let existingSettings = {};
-    if (existsSync21(settingsPath)) {
+    if (existsSync22(settingsPath)) {
       try {
         const content = await readFile18(settingsPath, "utf-8");
         existingSettings = JSON.parse(content);
@@ -6421,14 +6794,20 @@ var HooksWriter = {
     await writeFile10(settingsPath, `${JSON.stringify(newSettings, null, 2)}
 `, "utf-8");
     return {
-      filesWritten: [ctx.outputPath]
+      filesWritten: [ctx.outputPath],
+      managedOutputs: [
+        createManagedOutput(ctx.outputPath, this.id, JSON.stringify(claudeHooks), {
+          cleanupStrategy: "remove-json-key",
+          jsonKey: "hooks"
+        })
+      ]
     };
   }
 };
 // ../adapters/src/writers/generic/instructions-md.ts
-import { existsSync as existsSync22 } from "node:fs";
+import { existsSync as existsSync23 } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile19, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname2, join as join12 } from "node:path";
+import { dirname as dirname3, join as join14 } from "node:path";
 
 // ../adapters/src/writers/generic/omni-md.ts
 init_src();
@@ -6450,20 +6829,32 @@ function renderOmniMdForProvider(content, providerId) {
 }
 
 // ../adapters/src/writers/generic/instructions-md.ts
+function getGeneratedCopyNotice(outputPath) {
+  if (outputPath !== "AGENTS.md" && outputPath !== "CLAUDE.md") {
+    return "";
+  }
+  return "> IMPORTANT: Do not edit this file directly. Edit `OMNI.md` instead. This file is a generated copy of `OMNI.md` and is ephemeral. Any persistent change must be made in `OMNI.md`.";
+}
 var InstructionsMdWriter = {
   id: "instructions-md",
   async write(bundle, ctx) {
-    const outputFullPath = join12(ctx.projectRoot, ctx.outputPath);
-    const parentDir = dirname2(outputFullPath);
+    const outputFullPath = join14(ctx.projectRoot, ctx.outputPath);
+    const parentDir = dirname3(outputFullPath);
     if (parentDir !== ctx.projectRoot) {
       await mkdir3(parentDir, { recursive: true });
     }
-    const omniMdPath = join12(ctx.projectRoot, "OMNI.md");
+    const omniMdPath = join14(ctx.projectRoot, "OMNI.md");
     let omniMdContent = "";
-    if (existsSync22(omniMdPath)) {
+    if (existsSync23(omniMdPath)) {
       omniMdContent = renderOmniMdForProvider(await readFile19(omniMdPath, "utf-8"), ctx.providerId);
     }
     let content = omniMdContent;
+    const generatedCopyNotice = getGeneratedCopyNotice(ctx.outputPath);
+    if (generatedCopyNotice) {
+      content = content ? `${generatedCopyNotice}
+
+${content}` : generatedCopyNotice;
+    }
     if (bundle.instructionsContent) {
       content += `
 
@@ -6472,23 +6863,30 @@ ${bundle.instructionsContent}
     }
     await writeFile11(outputFullPath, content, "utf-8");
     return {
-      filesWritten: [ctx.outputPath]
+      filesWritten: [ctx.outputPath],
+      managedOutputs: [createManagedOutput(ctx.outputPath, this.id, content)]
     };
   }
 };
 // ../adapters/src/writers/generic/skills.ts
-import { mkdir as mkdir4, writeFile as writeFile12 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { cp as cp2, mkdir as mkdir4, readdir as readdir3, rm as rm2, writeFile as writeFile12 } from "node:fs/promises";
+import { join as join15, relative as relative2 } from "node:path";
 var SkillsWriter = {
   id: "skills",
   async write(bundle, ctx) {
-    const skillsDir = join13(ctx.projectRoot, ctx.outputPath);
+    const skillsDir = join15(ctx.projectRoot, ctx.outputPath);
     await mkdir4(skillsDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const skill of bundle.skills) {
-      const skillDir = join13(skillsDir, skill.name);
-      await mkdir4(skillDir, { recursive: true });
-      const skillPath = join13(skillDir, "SKILL.md");
+      const skillDir = join15(skillsDir, skill.name);
+      await rm2(skillDir, { recursive: true, force: true });
+      if (skill.sourcePath) {
+        await cp2(skill.sourcePath, skillDir, { recursive: true });
+      } else {
+        await mkdir4(skillDir, { recursive: true });
+      }
+      const skillPath = join15(skillDir, "SKILL.md");
       const content = `---
 name: ${skill.name}
 description: "${skill.description}"
@@ -6496,16 +6894,43 @@ description: "${skill.description}"
 
 ${skill.instructions}`;
       await writeFile12(skillPath, content, "utf-8");
-      filesWritten.push(join13(ctx.outputPath, skill.name, "SKILL.md"));
+      const relativePaths = skill.sourcePath ? await listRelativeFiles(skillDir) : ["SKILL.md"];
+      for (const relativeFile of relativePaths) {
+        filesWritten.push(join15(ctx.outputPath, skill.name, relativeFile));
+      }
+      const relativePath = join15(ctx.outputPath, skill.name, "SKILL.md");
+      managedOutputs.push(createManagedOutput(relativePath, this.id, content, {
+        cleanupStrategy: "delete-file-and-prune-empty-parents",
+        pruneRoot: ctx.outputPath
+      }));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
+async function listRelativeFiles(basePath) {
+  const files = [];
+  const entries = await readdir3(basePath, { withFileTypes: true });
+  for (const entry of entries) {
+    const entryPath = join15(basePath, entry.name);
+    if (entry.isDirectory()) {
+      const nestedFiles = await listRelativeFiles(entryPath);
+      for (const nestedFile of nestedFiles) {
+        files.push(relative2(basePath, join15(entryPath, nestedFile)));
+      }
+      continue;
+    }
+    if (entry.isFile()) {
+      files.push(entry.name);
+    }
+  }
+  return files.sort((a, b) => a.localeCompare(b));
+}
 // ../adapters/src/writers/generic/commands-as-skills.ts
 import { mkdir as mkdir5, writeFile as writeFile13 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 function generateSkillFrontmatter(command) {
   const lines = ["---"];
   lines.push(`name: ${command.name}`);
@@ -6520,22 +6945,29 @@ function generateSkillFrontmatter(command) {
 var CommandsAsSkillsWriter = {
   id: "commands-as-skills",
   async write(bundle, ctx) {
-    const skillsDir = join14(ctx.projectRoot, ctx.outputPath);
+    const skillsDir = join16(ctx.projectRoot, ctx.outputPath);
     await mkdir5(skillsDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const command of bundle.commands) {
-      const commandSkillDir = join14(skillsDir, command.name);
+      const commandSkillDir = join16(skillsDir, command.name);
       await mkdir5(commandSkillDir, { recursive: true });
       const frontmatter = generateSkillFrontmatter(command);
       const content = `${frontmatter}
 
 ${command.prompt}`;
-      const skillPath = join14(commandSkillDir, "SKILL.md");
+      const skillPath = join16(commandSkillDir, "SKILL.md");
       await writeFile13(skillPath, content, "utf-8");
-      filesWritten.push(join14(ctx.outputPath, command.name, "SKILL.md"));
+      const relativePath = join16(ctx.outputPath, command.name, "SKILL.md");
+      filesWritten.push(relativePath);
+      managedOutputs.push(createManagedOutput(relativePath, this.id, content, {
+        cleanupStrategy: "delete-file-and-prune-empty-parents",
+        pruneRoot: ctx.outputPath
+      }));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
@@ -6588,7 +7020,7 @@ function createProviderScopedBundle(bundle, providerId) {
 
 // ../adapters/src/writers/claude/agents.ts
 import { mkdir as mkdir6, writeFile as writeFile14 } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { join as join17 } from "node:path";
 function generateFrontmatter(agent) {
   const lines = ["---"];
   lines.push(`name: ${agent.name}`);
@@ -6615,20 +7047,24 @@ function generateFrontmatter(agent) {
 var ClaudeAgentsWriter = {
   id: "claude-agents",
   async write(bundle, ctx) {
-    const agentsDir = join15(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join17(ctx.projectRoot, ctx.outputPath);
     await mkdir6(agentsDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const agent of bundle.subagents) {
       const frontmatter = generateFrontmatter(agent);
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join15(agentsDir, `${agent.name}.md`);
+      const agentPath = join17(agentsDir, `${agent.name}.md`);
       await writeFile14(agentPath, content, "utf-8");
-      filesWritten.push(join15(ctx.outputPath, `${agent.name}.md`));
+      const relativePath = join17(ctx.outputPath, `${agent.name}.md`);
+      filesWritten.push(relativePath);
+      managedOutputs.push(createManagedOutput(relativePath, this.id, content));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
@@ -6655,18 +7091,19 @@ var claudeCodeAdapter = {
     const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
-      filesDeleted: []
+      filesDeleted: [],
+      managedOutputs: result.managedOutputs
     };
   }
 };
 // ../adapters/src/codex/index.ts
 import { mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 
 // ../adapters/src/writers/codex/toml.ts
 init_dist();
 import { mkdir as mkdir7, writeFile as writeFile15 } from "node:fs/promises";
-import { dirname as dirname3, join as join16 } from "node:path";
+import { dirname as dirname4, join as join18 } from "node:path";
 var FILE_HEADER = `# Generated by OmniDev - DO NOT EDIT
 # Run \`omnidev sync\` to regenerate
 
@@ -6717,8 +7154,8 @@ var CodexTomlWriter = {
     if (mcps.size === 0) {
       return { filesWritten: [] };
     }
-    const configPath = join16(ctx.projectRoot, ctx.outputPath);
-    const parentDir = dirname3(configPath);
+    const configPath = join18(ctx.projectRoot, ctx.outputPath);
+    const parentDir = dirname4(configPath);
     await mkdir7(parentDir, { recursive: true });
     const mcpServers = {};
     for (const [id, mcp] of mcps) {
@@ -6736,7 +7173,8 @@ var CodexTomlWriter = {
     const tomlContent = FILE_HEADER + stringify(codexConfig);
     await writeFile15(configPath, tomlContent, "utf-8");
     return {
-      filesWritten: [ctx.outputPath]
+      filesWritten: [ctx.outputPath],
+      managedOutputs: [createManagedOutput(ctx.outputPath, this.id, tomlContent)]
     };
   }
 };
@@ -6751,7 +7189,7 @@ var codexAdapter = {
     { writer: CodexTomlWriter, outputPath: ".codex/config.toml" }
   ],
   async init(ctx) {
-    const codexDir = join17(ctx.projectRoot, ".codex");
+    const codexDir = join19(ctx.projectRoot, ".codex");
     mkdirSync6(codexDir, { recursive: true });
     return {
       filesCreated: [".codex/"],
@@ -6764,17 +7202,18 @@ var codexAdapter = {
     const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
-      filesDeleted: []
+      filesDeleted: [],
+      managedOutputs: result.managedOutputs
     };
   }
 };
 // ../adapters/src/cursor/index.ts
 import { mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join24 } from "node:path";
 
 // ../adapters/src/writers/cursor/agents.ts
 import { mkdir as mkdir8, writeFile as writeFile16 } from "node:fs/promises";
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 function mapModelToCursor(model) {
   if (!model || model === "inherit")
     return "inherit";
@@ -6806,50 +7245,58 @@ function generateFrontmatter2(agent) {
 var CursorAgentsWriter = {
   id: "cursor-agents",
   async write(bundle, ctx) {
-    const agentsDir = join18(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join20(ctx.projectRoot, ctx.outputPath);
     await mkdir8(agentsDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const agent of bundle.subagents) {
       const frontmatter = generateFrontmatter2(agent);
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join18(agentsDir, `${agent.name}.md`);
+      const agentPath = join20(agentsDir, `${agent.name}.md`);
       await writeFile16(agentPath, content, "utf-8");
-      filesWritten.push(join18(ctx.outputPath, `${agent.name}.md`));
+      const relativePath = join20(ctx.outputPath, `${agent.name}.md`);
+      filesWritten.push(relativePath);
+      managedOutputs.push(createManagedOutput(relativePath, this.id, content));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
 // ../adapters/src/writers/cursor/commands.ts
 import { mkdir as mkdir9, writeFile as writeFile17 } from "node:fs/promises";
-import { join as join19 } from "node:path";
+import { join as join21 } from "node:path";
 var CursorCommandsWriter = {
   id: "cursor-commands",
   async write(bundle, ctx) {
-    const commandsDir = join19(ctx.projectRoot, ctx.outputPath);
+    const commandsDir = join21(ctx.projectRoot, ctx.outputPath);
     await mkdir9(commandsDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const command of bundle.commands) {
       const content = `# ${command.name}
 
 ${command.description}
 
 ${command.prompt}`;
-      const commandPath = join19(commandsDir, `${command.name}.md`);
+      const commandPath = join21(commandsDir, `${command.name}.md`);
       await writeFile17(commandPath, content, "utf-8");
-      filesWritten.push(join19(ctx.outputPath, `${command.name}.md`));
+      const relativePath = join21(ctx.outputPath, `${command.name}.md`);
+      filesWritten.push(relativePath);
+      managedOutputs.push(createManagedOutput(relativePath, this.id, content));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
 // ../adapters/src/writers/cursor/mcp-json.ts
 import { mkdir as mkdir10, writeFile as writeFile18 } from "node:fs/promises";
-import { dirname as dirname4, join as join20 } from "node:path";
+import { dirname as dirname5, join as join22 } from "node:path";
 function buildCursorMcpConfig(mcp) {
   const transport = mcp.transport ?? "stdio";
   if (transport === "http" || transport === "sse") {
@@ -6894,8 +7341,8 @@ var CursorMcpJsonWriter = {
     if (mcps.size === 0) {
       return { filesWritten: [] };
     }
-    const configPath = join20(ctx.projectRoot, ctx.outputPath);
-    const parentDir = dirname4(configPath);
+    const configPath = join22(ctx.projectRoot, ctx.outputPath);
+    const parentDir = dirname5(configPath);
     await mkdir10(parentDir, { recursive: true });
     const mcpServers = {};
     for (const [id, mcp] of mcps) {
@@ -6910,29 +7357,35 @@ var CursorMcpJsonWriter = {
     const cursorMcpJson = {
       mcpServers
     };
-    await writeFile18(configPath, `${JSON.stringify(cursorMcpJson, null, 2)}
-`, "utf-8");
+    const content = `${JSON.stringify(cursorMcpJson, null, 2)}
+`;
+    await writeFile18(configPath, content, "utf-8");
     return {
-      filesWritten: [ctx.outputPath]
+      filesWritten: [ctx.outputPath],
+      managedOutputs: [createManagedOutput(ctx.outputPath, this.id, content)]
     };
   }
 };
 // ../adapters/src/writers/cursor/rules.ts
 import { mkdir as mkdir11, writeFile as writeFile19 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 var CursorRulesWriter = {
   id: "cursor-rules",
   async write(bundle, ctx) {
-    const rulesDir = join21(ctx.projectRoot, ctx.outputPath);
+    const rulesDir = join23(ctx.projectRoot, ctx.outputPath);
     await mkdir11(rulesDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const rule of bundle.rules) {
-      const rulePath = join21(rulesDir, `omnidev-${rule.name}.mdc`);
+      const rulePath = join23(rulesDir, `omnidev-${rule.name}.mdc`);
       await writeFile19(rulePath, rule.content, "utf-8");
-      filesWritten.push(join21(ctx.outputPath, `omnidev-${rule.name}.mdc`));
+      const relativePath = join23(ctx.outputPath, `omnidev-${rule.name}.mdc`);
+      filesWritten.push(relativePath);
+      managedOutputs.push(createManagedOutput(relativePath, this.id, rule.content));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
@@ -6949,7 +7402,7 @@ var cursorAdapter = {
     { writer: CursorMcpJsonWriter, outputPath: ".cursor/mcp.json" }
   ],
   async init(ctx) {
-    const rulesDir = join22(ctx.projectRoot, ".cursor", "rules");
+    const rulesDir = join24(ctx.projectRoot, ".cursor", "rules");
     mkdirSync7(rulesDir, { recursive: true });
     return {
       filesCreated: [".cursor/rules/"],
@@ -6969,17 +7422,18 @@ var cursorAdapter = {
       filesWritten: [
         ...new Set([...instructionsResult.filesWritten, ...cursorResult.filesWritten])
       ],
-      filesDeleted: []
+      filesDeleted: [],
+      managedOutputs: [...instructionsResult.managedOutputs, ...cursorResult.managedOutputs]
     };
   }
 };
 // ../adapters/src/opencode/index.ts
 import { mkdirSync as mkdirSync8 } from "node:fs";
-import { join as join25 } from "node:path";
+import { join as join27 } from "node:path";
 
 // ../adapters/src/writers/opencode/agents.ts
 import { mkdir as mkdir12, writeFile as writeFile20 } from "node:fs/promises";
-import { join as join23 } from "node:path";
+import { join as join25 } from "node:path";
 function mapModelToOpenCode(model) {
   if (!model || model === "inherit")
     return;
@@ -7057,26 +7511,30 @@ function generateFrontmatter3(agent) {
 var OpenCodeAgentsWriter = {
   id: "opencode-agents",
   async write(bundle, ctx) {
-    const agentsDir = join23(ctx.projectRoot, ctx.outputPath);
+    const agentsDir = join25(ctx.projectRoot, ctx.outputPath);
     await mkdir12(agentsDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const agent of bundle.subagents) {
       const frontmatter = generateFrontmatter3(agent);
       const content = `${frontmatter}
 
 ${agent.systemPrompt}`;
-      const agentPath = join23(agentsDir, `${agent.name}.md`);
+      const agentPath = join25(agentsDir, `${agent.name}.md`);
       await writeFile20(agentPath, content, "utf-8");
-      filesWritten.push(join23(ctx.outputPath, `${agent.name}.md`));
+      const relativePath = join25(ctx.outputPath, `${agent.name}.md`);
+      filesWritten.push(relativePath);
+      managedOutputs.push(createManagedOutput(relativePath, this.id, content));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
 // ../adapters/src/writers/opencode/commands.ts
 import { mkdir as mkdir13, writeFile as writeFile21 } from "node:fs/promises";
-import { join as join24 } from "node:path";
+import { join as join26 } from "node:path";
 function generateFrontmatter4(command) {
   const lines = ["---"];
   lines.push(`description: "${command.description.replace(/"/g, "\\\"")}"`);
@@ -7093,20 +7551,24 @@ function generateFrontmatter4(command) {
 var OpenCodeCommandsWriter = {
   id: "opencode-commands",
   async write(bundle, ctx) {
-    const commandsDir = join24(ctx.projectRoot, ctx.outputPath);
+    const commandsDir = join26(ctx.projectRoot, ctx.outputPath);
     await mkdir13(commandsDir, { recursive: true });
     const filesWritten = [];
+    const managedOutputs = [];
     for (const command of bundle.commands) {
       const frontmatter = generateFrontmatter4(command);
       const content = `${frontmatter}
 
 ${command.prompt}`;
-      const commandPath = join24(commandsDir, `${command.name}.md`);
+      const commandPath = join26(commandsDir, `${command.name}.md`);
       await writeFile21(commandPath, content, "utf-8");
-      filesWritten.push(join24(ctx.outputPath, `${command.name}.md`));
+      const relativePath = join26(ctx.outputPath, `${command.name}.md`);
+      filesWritten.push(relativePath);
+      managedOutputs.push(createManagedOutput(relativePath, this.id, content));
     }
     return {
-      filesWritten
+      filesWritten,
+      managedOutputs
     };
   }
 };
@@ -7121,7 +7583,7 @@ var opencodeAdapter = {
     { writer: OpenCodeCommandsWriter, outputPath: ".opencode/commands/" }
   ],
   async init(ctx) {
-    const opencodeDir = join25(ctx.projectRoot, ".opencode");
+    const opencodeDir = join27(ctx.projectRoot, ".opencode");
     mkdirSync8(opencodeDir, { recursive: true });
     return {
       filesCreated: [".opencode/"],
@@ -7134,7 +7596,8 @@ var opencodeAdapter = {
     const result = await executeWriters(this.writers, providerBundle, ctx.projectRoot, providerId);
     return {
       filesWritten: result.filesWritten,
-      filesDeleted: []
+      filesDeleted: [],
+      managedOutputs: result.managedOutputs
     };
   }
 };
@@ -7175,7 +7638,7 @@ async function inferCapabilityId(source, sourceType) {
 }
 async function runAddCap(flags, name) {
   try {
-    if (!existsSync23("omni.toml")) {
+    if (!existsSync24("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -7198,7 +7661,7 @@ async function runAddCap(flags, name) {
       sourceType = "local";
       const localPath = flags.local.startsWith("file://") ? flags.local.slice(7) : flags.local;
       source = `file://${localPath}`;
-      if (!existsSync23(localPath)) {
+      if (!existsSync24(localPath)) {
         console.error(`✗ Local path not found: ${localPath}`);
         process.exit(1);
       }
@@ -7290,7 +7753,7 @@ async function runAddCap(flags, name) {
 }
 async function runAddMcp(flags, name) {
   try {
-    if (!existsSync23("omni.toml")) {
+    if (!existsSync24("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -7577,9 +8040,9 @@ var addRoutes = buildRouteMap({
 });
 
 // src/commands/capability.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync9 } from "node:fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync9 } from "node:fs";
 import { writeFile as writeFile22 } from "node:fs/promises";
-import { join as join26 } from "node:path";
+import { join as join28 } from "node:path";
 import { input } from "@inquirer/prompts";
 init_src();
 import { buildCommand as buildCommand2, buildRouteMap as buildRouteMap2 } from "@stricli/core";
@@ -7768,7 +8231,7 @@ function generateGitignore(programmatic) {
 }
 async function runCapabilityNew(flags, capabilityId) {
   try {
-    if (!existsSync24(".omni")) {
+    if (!existsSync25(".omni")) {
       console.error("✗ OmniDev is not initialized in this directory.");
       console.log("");
       console.log("  Run: omnidev init");
@@ -7792,28 +8255,28 @@ async function runCapabilityNew(flags, capabilityId) {
         default: defaultPath
       });
     }
-    if (existsSync24(capabilityDir)) {
+    if (existsSync25(capabilityDir)) {
       console.error(`✗ Directory already exists at ${capabilityDir}`);
       process.exit(1);
     }
     const name = toTitleCase(id);
     mkdirSync9(capabilityDir, { recursive: true });
     const capabilityToml = generateCapabilityToml2({ id, name });
-    await writeFile22(join26(capabilityDir, "capability.toml"), capabilityToml, "utf-8");
-    const skillDir = join26(capabilityDir, "skills", "getting-started");
+    await writeFile22(join28(capabilityDir, "capability.toml"), capabilityToml, "utf-8");
+    const skillDir = join28(capabilityDir, "skills", "getting-started");
     mkdirSync9(skillDir, { recursive: true });
-    await writeFile22(join26(skillDir, "SKILL.md"), generateSkillTemplate("getting-started"), "utf-8");
-    const rulesDir = join26(capabilityDir, "rules");
+    await writeFile22(join28(skillDir, "SKILL.md"), generateSkillTemplate("getting-started"), "utf-8");
+    const rulesDir = join28(capabilityDir, "rules");
     mkdirSync9(rulesDir, { recursive: true });
-    await writeFile22(join26(rulesDir, "coding-standards.md"), generateRuleTemplate("coding-standards"), "utf-8");
-    const hooksDir = join26(capabilityDir, "hooks");
+    await writeFile22(join28(rulesDir, "coding-standards.md"), generateRuleTemplate("coding-standards"), "utf-8");
+    const hooksDir = join28(capabilityDir, "hooks");
     mkdirSync9(hooksDir, { recursive: true });
-    await writeFile22(join26(hooksDir, "hooks.toml"), generateHooksTemplate(), "utf-8");
-    await writeFile22(join26(hooksDir, "example-hook.sh"), generateHookScript(), "utf-8");
-    await writeFile22(join26(capabilityDir, ".gitignore"), generateGitignore(Boolean(flags.programmatic)), "utf-8");
+    await writeFile22(join28(hooksDir, "hooks.toml"), generateHooksTemplate(), "utf-8");
+    await writeFile22(join28(hooksDir, "example-hook.sh"), generateHookScript(), "utf-8");
+    await writeFile22(join28(capabilityDir, ".gitignore"), generateGitignore(Boolean(flags.programmatic)), "utf-8");
     if (flags.programmatic) {
-      await writeFile22(join26(capabilityDir, "package.json"), generatePackageJson(id), "utf-8");
-      await writeFile22(join26(capabilityDir, "index.ts"), generateIndexTs(id, name), "utf-8");
+      await writeFile22(join28(capabilityDir, "package.json"), generatePackageJson(id), "utf-8");
+      await writeFile22(join28(capabilityDir, "index.ts"), generateIndexTs(id, name), "utf-8");
     }
     console.log(`✓ Created capability: ${name}`);
     console.log(`  Location: ${capabilityDir}`);
@@ -7969,7 +8432,7 @@ var capabilityRoutes = buildRouteMap2({
 });
 
 // src/commands/doctor.ts
-import { existsSync as existsSync25 } from "node:fs";
+import { existsSync as existsSync26 } from "node:fs";
 import { execFile } from "node:child_process";
 import { readFile as readFile20 } from "node:fs/promises";
 import { promisify } from "node:util";
@@ -8016,50 +8479,52 @@ async function runDoctor() {
 async function checkPackageManager() {
   const execFileAsync = promisify(execFile);
   try {
-    const { stdout } = await execFileAsync("bun", ["--version"]);
-    const version2 = stdout.trim();
-    const firstPart = version2.split(".")[0];
-    if (!firstPart) {
+    const { stdout: npmStdout } = await execFileAsync("npm", ["--version"]);
+    const npmVersion = npmStdout.trim();
+    try {
+      const { stdout: bunStdout } = await execFileAsync("bun", ["--version"]);
+      const bunVersion = bunStdout.trim();
+      const firstPart = bunVersion.split(".")[0];
+      if (!firstPart) {
+        return {
+          name: "Package Manager",
+          passed: false,
+          message: `Invalid Bun version format: ${bunVersion}`,
+          fix: "Reinstall Bun: curl -fsSL https://bun.sh/install | bash"
+        };
+      }
+      const major = Number.parseInt(firstPart, 10);
+      if (major < 1) {
+        return {
+          name: "Package Manager",
+          passed: false,
+          message: `npm v${npmVersion}; bun v${bunVersion}`,
+          fix: "Upgrade Bun: curl -fsSL https://bun.sh/install | bash"
+        };
+      }
       return {
         name: "Package Manager",
-        passed: false,
-        message: `Invalid Bun version format: ${version2}`,
-        fix: "Reinstall Bun: curl -fsSL https://bun.sh/install | bash"
+        passed: true,
+        message: `npm v${npmVersion}; bun v${bunVersion}`
       };
-    }
-    const major = Number.parseInt(firstPart, 10);
-    if (major < 1) {
+    } catch {
       return {
         name: "Package Manager",
-        passed: false,
-        message: `bun v${version2}`,
-        fix: "Upgrade Bun: curl -fsSL https://bun.sh/install | bash"
+        passed: true,
+        message: `npm v${npmVersion}`
       };
     }
-    return {
-      name: "Package Manager",
-      passed: true,
-      message: `bun v${version2}`
-    };
-  } catch {}
-  try {
-    const { stdout } = await execFileAsync("npm", ["--version"]);
-    return {
-      name: "Package Manager",
-      passed: true,
-      message: `npm v${stdout.trim()}`
-    };
   } catch {
     return {
       name: "Package Manager",
       passed: false,
-      message: "Neither Bun nor npm is installed",
-      fix: "Install Bun (recommended): curl -fsSL https://bun.sh/install | bash"
+      message: "npm is not installed",
+      fix: "Install Node.js and npm: https://nodejs.org/"
     };
   }
 }
 async function checkOmniLocalDir() {
-  const exists = existsSync25(".omni");
+  const exists = existsSync26(".omni");
   if (!exists) {
     return {
       name: ".omni/ directory",
@@ -8076,7 +8541,7 @@ async function checkOmniLocalDir() {
 }
 async function checkConfig() {
   const configPath = "omni.toml";
-  if (!existsSync25(configPath)) {
+  if (!existsSync26(configPath)) {
     return {
       name: "Configuration",
       passed: false,
@@ -8103,7 +8568,7 @@ async function checkConfig() {
 }
 async function checkRootGitignore() {
   const gitignorePath = ".gitignore";
-  if (!existsSync25(gitignorePath)) {
+  if (!existsSync26(gitignorePath)) {
     return {
       name: "Root .gitignore",
       passed: false,
@@ -8137,7 +8602,7 @@ async function checkRootGitignore() {
 }
 async function checkCapabilitiesDir() {
   const capabilitiesDirPath = ".omni/capabilities";
-  if (!existsSync25(capabilitiesDirPath)) {
+  if (!existsSync26(capabilitiesDirPath)) {
     return {
       name: "Capabilities Directory",
       passed: true,
@@ -8153,7 +8618,7 @@ async function checkCapabilitiesDir() {
 
 // src/commands/init.ts
 import { exec } from "node:child_process";
-import { existsSync as existsSync26, mkdirSync as mkdirSync10 } from "node:fs";
+import { existsSync as existsSync27, mkdirSync as mkdirSync10 } from "node:fs";
 import { readFile as readFile21, writeFile as writeFile23 } from "node:fs/promises";
 import { promisify as promisify2 } from "node:util";
 init_src();
@@ -8223,7 +8688,7 @@ async function runInit(_flags, providerArg) {
     }
   }
   await writeEnabledProviders(providerIds);
-  if (!existsSync26("omni.toml")) {
+  if (!existsSync27("omni.toml")) {
     await writeConfig({
       profiles: {
         default: {
@@ -8239,7 +8704,7 @@ async function runInit(_flags, providerArg) {
     });
     await setActiveProfile("default");
   }
-  if (!existsSync26("OMNI.md")) {
+  if (!existsSync27("OMNI.md")) {
     await writeFile23("OMNI.md", generateOmniMdTemplate(), "utf-8");
   }
   const config3 = await loadConfig();
@@ -8317,7 +8782,7 @@ async function addProviderFilesToGitignore(entries) {
 async function addToGitignore(entriesToAdd, sectionHeader) {
   const gitignorePath = ".gitignore";
   let content = "";
-  if (existsSync26(gitignorePath)) {
+  if (existsSync27(gitignorePath)) {
     content = await readFile21(gitignorePath, "utf-8");
   }
   const lines = content.split(`
@@ -8349,7 +8814,7 @@ async function getTrackedProviderFiles(files) {
 }
 
 // src/commands/profile.ts
-import { existsSync as existsSync27 } from "node:fs";
+import { existsSync as existsSync28 } from "node:fs";
 init_src();
 import { buildCommand as buildCommand5, buildRouteMap as buildRouteMap3 } from "@stricli/core";
 var listCommand2 = buildCommand5({
@@ -8393,7 +8858,7 @@ var profileRoutes = buildRouteMap3({
 });
 async function runProfileList() {
   try {
-    if (!existsSync27("omni.toml")) {
+    if (!existsSync28("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8433,7 +8898,7 @@ async function runProfileList() {
 }
 async function runProfileSet(profileName) {
   try {
-    if (!existsSync27("omni.toml")) {
+    if (!existsSync28("omni.toml")) {
       console.log("✗ No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8466,6 +8931,8 @@ async function runProfileSet(profileName) {
 }
 
 // src/commands/provider.ts
+import { existsSync as existsSync29 } from "node:fs";
+import { readFile as readFile22 } from "node:fs/promises";
 init_src();
 import { buildCommand as buildCommand6, buildRouteMap as buildRouteMap4 } from "@stricli/core";
 async function runProviderList() {
@@ -8499,6 +8966,7 @@ async function runProviderEnable(_flags, providerId) {
   }
   await enableProvider(providerId);
   console.log(`✓ Enabled provider: ${adapter.displayName}`);
+  await maybeRemindAboutProviderGitignore(providerId);
   const enabledAdapters = await getEnabledAdapters();
   await syncAgentConfiguration({ silent: false, adapters: enabledAdapters });
 }
@@ -8579,10 +9047,33 @@ var providerRoutes = buildRouteMap4({
     brief: "Manage AI provider adapters"
   }
 });
+async function maybeRemindAboutProviderGitignore(providerId) {
+  const missingEntries = await getMissingGitignoreEntries(getProviderGitignoreFiles([providerId]));
+  if (missingEntries.length === 0) {
+    return;
+  }
+  console.log("");
+  console.log("Also update your .gitignore to ignore provider files if you do not want to commit them:");
+  for (const entry of missingEntries) {
+    console.log(`  - ${entry}`);
+  }
+}
+async function getMissingGitignoreEntries(entries) {
+  if (entries.length === 0) {
+    return [];
+  }
+  let content = "";
+  if (existsSync29(".gitignore")) {
+    content = await readFile22(".gitignore", "utf-8");
+  }
+  const lines = new Set(content.split(`
+`).map((line) => line.trim()));
+  return [...new Set(entries)].filter((entry) => !lines.has(entry));
+}
 
 // src/commands/security.ts
 init_src();
-import { existsSync as existsSync28 } from "node:fs";
+import { existsSync as existsSync30 } from "node:fs";
 import { buildCommand as buildCommand7, buildRouteMap as buildRouteMap5 } from "@stricli/core";
 var VALID_FINDING_TYPES = [
   "unicode_bidi",
@@ -8621,7 +9112,9 @@ async function filterAllowedFindings(summary, options = {}) {
     symlink_escape: 0,
     symlink_absolute: 0,
     suspicious_script: 0,
-    binary_file: 0
+    binary_file: 0,
+    hidden_command: 0,
+    network_request: 0
   };
   const findingsBySeverity = {
     low: 0,
@@ -8699,7 +9192,7 @@ function formatFindingsWithHints(summary) {
 }
 async function runSecurityIssues(flags = {}) {
   try {
-    if (!existsSync28("omni.toml")) {
+    if (!existsSync30("omni.toml")) {
       console.log("No config file found");
       console.log("  Run: omnidev init");
       process.exit(1);
@@ -8954,7 +9447,7 @@ var securityRoutes = buildRouteMap5({
 });
 
 // src/commands/sync.ts
-import { existsSync as existsSync29 } from "node:fs";
+import { existsSync as existsSync31 } from "node:fs";
 init_src();
 import { buildCommand as buildCommand8 } from "@stricli/core";
 var PROVIDERS_STATE_PATH = ".omni/state/providers.json";
@@ -8972,7 +9465,7 @@ async function runSync() {
     const config3 = await loadConfig();
     const activeProfile = await getActiveProfile() ?? "default";
     let adapters = await getEnabledAdapters();
-    if (!existsSync29(PROVIDERS_STATE_PATH) || adapters.length === 0) {
+    if (!existsSync31(PROVIDERS_STATE_PATH) || adapters.length === 0) {
       console.log("No providers configured yet. Select your provider(s):");
       const providerIds = await promptForProviders();
       await writeEnabledProviders(providerIds);
@@ -9182,9 +9675,9 @@ async function buildDynamicApp() {
     security: securityRoutes
   };
   debug("Core routes registered", Object.keys(routes));
-  const configPath = join27(process.cwd(), "omni.toml");
-  debug("Checking for config", { configPath, exists: existsSync30(configPath), cwd: process.cwd() });
-  if (existsSync30(configPath)) {
+  const configPath = join29(process.cwd(), "omni.toml");
+  debug("Checking for config", { configPath, exists: existsSync32(configPath), cwd: process.cwd() });
+  if (existsSync32(configPath)) {
     try {
       debug("Loading capability commands...");
       const capabilityCommands = await loadCapabilityCommands();
@@ -9259,25 +9752,25 @@ async function loadCapabilityCommands() {
   return commands;
 }
 async function loadCapabilityExport(capability3) {
-  const capabilityPath = join27(process.cwd(), capability3.path);
-  const builtIndexPath = join27(capabilityPath, "dist", "index.js");
-  const jsIndexPath = join27(capabilityPath, "index.js");
-  const tsIndexPath = join27(capabilityPath, "index.ts");
+  const capabilityPath = join29(process.cwd(), capability3.path);
+  const builtIndexPath = join29(capabilityPath, "dist", "index.js");
+  const jsIndexPath = join29(capabilityPath, "index.js");
+  const tsIndexPath = join29(capabilityPath, "index.ts");
   debug(`Checking entry points for '${capability3.id}'`, {
     capabilityPath,
     builtIndexPath,
-    builtExists: existsSync30(builtIndexPath),
+    builtExists: existsSync32(builtIndexPath),
     jsIndexPath,
-    jsExists: existsSync30(jsIndexPath),
+    jsExists: existsSync32(jsIndexPath),
     tsIndexPath,
-    tsExists: existsSync30(tsIndexPath)
+    tsExists: existsSync32(tsIndexPath)
   });
   let indexPath = null;
-  if (existsSync30(builtIndexPath)) {
+  if (existsSync32(builtIndexPath)) {
     indexPath = builtIndexPath;
-  } else if (existsSync30(jsIndexPath)) {
+  } else if (existsSync32(jsIndexPath)) {
     indexPath = jsIndexPath;
-  } else if (existsSync30(tsIndexPath)) {
+  } else if (existsSync32(tsIndexPath)) {
     indexPath = tsIndexPath;
   }
   if (!indexPath) {