@pieai/pro-gov 0.3.5 → 0.3.7

package/dist/cli.js

@@ -48,8 +48,8 @@ function isPlatformMetadata(name) {
 }
 
 // src/commands/assets.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname5, join as join11 } from "node:path";
 
 // src/asset-bundles/bundles.ts
 import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync } from "node:fs";
@@ -202,7 +202,6 @@ import { existsSync as existsSync4, lstatSync } from "node:fs";
 import { isAbsolute, join as join4, posix } from "node:path";
 var supportedFamilies = /* @__PURE__ */ new Set([
   "pie-skills",
-  "dokobot",
   "npx-skills",
   "pie-rules",
   "pie-commands"
@@ -214,6 +213,8 @@ var supportedVisibilities = /* @__PURE__ */ new Set([
   "third-party"
 ]);
 var supportedSourceKinds = /* @__PURE__ */ new Set(["local", "local-pack", "npx"]);
+var supportedSkillPlacements = /* @__PURE__ */ new Set(["auto", "manual"]);
+var supportedSkillScopes = /* @__PURE__ */ new Set(["project", "user"]);
 var supportedHosts = /* @__PURE__ */ new Set([
   "codex",
   "claude-code",
@@ -269,6 +270,20 @@ function validateAssetRegistry(registry, options = {}) {
         });
       }
     }
+    if (asset.kind === "skill" && !supportedSkillPlacements.has(asset.defaultPlacement)) {
+      issues.push({
+        type: "unsupported-skill-placement",
+        id: asset.id,
+        message: `Skill asset must declare defaultPlacement auto or manual: ${asset.id}`
+      });
+    }
+    if (asset.defaultScope && asset.kind !== "skill" || asset.kind === "skill" && asset.defaultScope && !supportedSkillScopes.has(asset.defaultScope)) {
+      issues.push({
+        type: "unsupported-skill-scope",
+        id: asset.id,
+        message: `Skill asset defaultScope must be project or user: ${asset.id}`
+      });
+    }
     if (!isSafeRegistrySourcePath(asset.sourcePath)) {
       issues.push({
         type: "unsafe-source-path",
@@ -363,7 +378,9 @@ function createAgentAssetLockEntries(registry, agentAssetsDir, assetIds) {
   })).sort((a, b) => a.id.localeCompare(b.id));
 }
 function hashAgentAssetContent(asset, agentAssetsDir) {
-  const sourceAbsolutePath = join5(agentAssetsDir, asset.sourcePath);
+  return hashAssetPathContent(join5(agentAssetsDir, asset.sourcePath));
+}
+function hashAssetPathContent(sourceAbsolutePath) {
   const hash = createHash2("sha256");
   for (const filePath of listFiles3(sourceAbsolutePath)) {
     const relativePath = toUnixPath3(relative3(sourceAbsolutePath, filePath));
@@ -377,7 +394,12 @@ function hashAgentAssetContent(asset, agentAssetsDir) {
 function findDefaultAgentAssetsDir() {
   const packageRoot2 = findPackageRoot(dirname2(fileURLToPath2(import.meta.url)));
   const repoRoot = join5(packageRoot2, "..", "..");
-  const candidates = [join5(packageRoot2, "assets/agent-assets"), join5(repoRoot, "agent-assets")];
+  const candidates = [
+    join5(packageRoot2, "assets/agent-assets"),
+    join5(repoRoot, "agent-assets"),
+    join5(packageRoot2, "assets/public-agent-assets"),
+    join5(repoRoot, "public-agent-assets")
+  ];
   return candidates.find((candidate) => existsSync5(join5(candidate, "registry.json"))) ?? candidates[0];
 }
 function findPackageRoot(startDir) {
@@ -400,6 +422,7 @@ function listFiles3(absolutePath) {
   if (stats.isFile()) return [absolutePath];
   const files = [];
   for (const entry of readdirSync4(absolutePath, { withFileTypes: true })) {
+    if (shouldIgnoreAssetHashEntry(entry.name)) continue;
     const entryPath = join5(absolutePath, entry.name);
     if (entry.isDirectory()) {
       files.push(...listFiles3(entryPath));
@@ -409,13 +432,112 @@ function listFiles3(absolutePath) {
   }
   return files.sort();
 }
+function shouldIgnoreAssetHashEntry(name) {
+  return name === "__pycache__" || name === ".DS_Store" || name === "Thumbs.db" || name === "node_modules" || name.endsWith(".pyc") || name.endsWith(".pyo");
+}
 function toUnixPath3(path) {
   return path.replaceAll("\\", "/");
 }
 
+// src/asset-registry/public-promotion.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join6, posix as posix2 } from "node:path";
+function checkPublicAssetPromotions(options) {
+  const issues = [];
+  let checked = 0;
+  for (const asset of options.registry.assets) {
+    if (!needsPromotionCheck(asset)) continue;
+    checked += 1;
+    if (!asset.promotion) {
+      issues.push({
+        type: "missing-promotion",
+        id: asset.id,
+        message: `Public asset is missing promotion metadata: ${asset.id}`
+      });
+      continue;
+    }
+    const publicPathResult = resolveSafePath(options.publicAgentAssetsDir, asset.sourcePath);
+    if (!publicPathResult.ok) {
+      issues.push({
+        type: "unsafe-public-source-path",
+        id: asset.id,
+        path: asset.sourcePath,
+        message: `Public asset source path is unsafe: ${asset.sourcePath}`
+      });
+      continue;
+    }
+    const privatePathResult = resolveSafePath(
+      options.privateAgentAssetsDir,
+      asset.promotion.privateSourcePath
+    );
+    if (!privatePathResult.ok) {
+      issues.push({
+        type: "unsafe-private-source-path",
+        id: asset.id,
+        path: asset.promotion.privateSourcePath,
+        message: `Private promotion source path is unsafe: ${asset.promotion.privateSourcePath}`
+      });
+      continue;
+    }
+    if (!existsSync6(privatePathResult.path)) {
+      issues.push({
+        type: "missing-private-source",
+        id: asset.id,
+        path: asset.promotion.privateSourcePath,
+        message: `Private promotion source does not exist: ${asset.promotion.privateSourcePath}`
+      });
+    } else {
+      const actualPrivateHash = hashAssetPathContent(privatePathResult.path);
+      if (actualPrivateHash !== asset.promotion.privateSourceHash) {
+        issues.push({
+          type: "source-drift",
+          id: asset.id,
+          path: asset.promotion.privateSourcePath,
+          expected: asset.promotion.privateSourceHash,
+          actual: actualPrivateHash,
+          message: `Private source changed after public promotion: ${asset.id}`
+        });
+      }
+    }
+    if (!existsSync6(publicPathResult.path)) {
+      issues.push({
+        type: "missing-public-source",
+        id: asset.id,
+        path: asset.sourcePath,
+        message: `Public promoted asset does not exist: ${asset.sourcePath}`
+      });
+    } else {
+      const actualPublicHash = hashAssetPathContent(publicPathResult.path);
+      if (actualPublicHash !== asset.promotion.publicHash) {
+        issues.push({
+          type: "public-drift",
+          id: asset.id,
+          path: asset.sourcePath,
+          expected: asset.promotion.publicHash,
+          actual: actualPublicHash,
+          message: `Public promoted asset changed after review: ${asset.id}`
+        });
+      }
+    }
+  }
+  return { checked, issues };
+}
+function needsPromotionCheck(asset) {
+  return asset.visibility === "public" && asset.publishable;
+}
+function resolveSafePath(root, sourcePath) {
+  if (!sourcePath || isAbsolute2(sourcePath) || sourcePath.startsWith("/")) return { ok: false };
+  const normalized = posix2.normalize(sourcePath.replaceAll("\\", "/"));
+  if (normalized === "." || normalized === ".." || normalized.startsWith("../")) {
+    return { ok: false };
+  }
+  if (normalized.split("/").includes("..")) return { ok: false };
+  return { ok: true, path: join6(root, normalized) };
+}
+
 // src/asset-targets/apply.ts
-import { existsSync as existsSync6, lstatSync as lstatSync2, mkdirSync as mkdirSync2, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname as dirname3, join as join6, resolve } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync2, mkdirSync as mkdirSync2, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname as dirname3, join as join7, relative as relative4, resolve } from "node:path";
 function applyAssetInstallPlan(plan) {
   const appliedActions = [];
   for (const action of plan.actions) {
@@ -425,7 +547,7 @@ function applyAssetInstallPlan(plan) {
   return { appliedActions };
 }
 function applyAction(targetDir, action) {
-  const targetAbsolutePath = join6(targetDir, action.targetPath);
+  const targetAbsolutePath = join7(targetDir, action.targetPath);
   if (action.type === "create-dir") {
     mkdirSync2(targetAbsolutePath, { recursive: true });
     return;
@@ -437,15 +559,16 @@ function applyAction(targetDir, action) {
   }
   mkdirSync2(dirname3(targetAbsolutePath), { recursive: true });
   const sourceAbsolutePath = resolve(action.sourcePath);
+  const symlinkTarget = relative4(realpathSync(dirname3(targetAbsolutePath)), realpathSync(sourceAbsolutePath)) || ".";
   if (action.type === "symlink") {
     if (pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
       throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
     }
-    symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+    symlinkSync(symlinkTarget, targetAbsolutePath);
     return;
   }
   if (!pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) {
-    symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+    symlinkSync(symlinkTarget, targetAbsolutePath);
     return;
   }
   const stats = lstatSync2(targetAbsolutePath);
@@ -453,23 +576,23 @@ function applyAction(targetDir, action) {
     throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
   }
   unlinkSync(targetAbsolutePath);
-  symlinkSync(sourceAbsolutePath, targetAbsolutePath);
+  symlinkSync(symlinkTarget, targetAbsolutePath);
 }
 function pathExistsEvenIfDanglingSymlink2(path) {
   try {
     lstatSync2(path);
     return true;
   } catch {
-    return existsSync6(path);
+    return existsSync7(path);
   }
 }
 
 // src/asset-targets/check.ts
-import { existsSync as existsSync7, lstatSync as lstatSync3, readFileSync as readFileSync4 } from "node:fs";
-import { join as join7 } from "node:path";
+import { existsSync as existsSync8, lstatSync as lstatSync3, readFileSync as readFileSync4 } from "node:fs";
+import { basename, join as join8 } from "node:path";
 function checkInstalledAssets(options) {
-  const lockfilePath = join7(options.targetDir, ".pro-gov/assets.lock.json");
-  if (!existsSync7(lockfilePath)) {
+  const lockfilePath = join8(options.targetDir, ".pro-gov/assets.lock.json");
+  if (!existsSync8(lockfilePath)) {
     return {
       targetDir: options.targetDir,
       issues: [
@@ -483,22 +606,35 @@ function checkInstalledAssets(options) {
   const registryById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
   const lockfile = JSON.parse(readFileSync4(lockfilePath, "utf8"));
   const issues = [];
+  const strictRegistry = options.strictRegistry ?? false;
   for (const entry of lockfile.assets ?? []) {
     const asset = registryById.get(entry.id);
-    const targetAbsolutePath = join7(options.targetDir, entry.targetPath);
-    const sourceAbsolutePath = join7(options.agentAssetsDir, entry.sourcePath);
-    if (!asset) {
+    const targetAbsolutePath = join8(options.targetDir, entry.targetPath);
+    if (!asset && strictRegistry) {
       issues.push({
         type: "unknown-asset",
         id: entry.id,
         targetPath: entry.targetPath,
         message: `Lockfile references unknown asset: ${entry.id}`
       });
-      continue;
     }
-    const hostFolderIssue = checkHostFolder(lockfile.host, asset.kind, entry.targetPath, entry.id);
-    if (hostFolderIssue) {
-      issues.push(hostFolderIssue);
+    if (asset?.kind === "skill" && asset.defaultScope === "user") {
+      issues.push({
+        type: "user-scoped-asset-in-project-lock",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `User-scoped skill is still locked into this project; move it to the user skill roots: ${entry.id}`
+      });
+    }
+    if (asset) {
+      const hostFolderIssue = checkHostFolder(lockfile.host, asset.kind, entry.targetPath, entry.id);
+      if (hostFolderIssue) {
+        issues.push(hostFolderIssue);
+      }
+      const placementDriftIssue = checkRegistryPlacement(lockfile, asset, entry.targetPath);
+      if (placementDriftIssue) {
+        issues.push(placementDriftIssue);
+      }
     }
     if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       issues.push({
@@ -519,7 +655,7 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    if (!existsSync7(targetAbsolutePath)) {
+    if (!existsSync8(targetAbsolutePath)) {
       issues.push({
         type: "dangling-symlink",
         id: entry.id,
@@ -528,7 +664,19 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    if (!existsSync7(sourceAbsolutePath)) {
+    const currentTargetHash = hashAssetPathContent(targetAbsolutePath);
+    const targetHashMatchesLock = currentTargetHash === entry.contentHash;
+    if (!targetHashMatchesLock) {
+      issues.push({
+        type: "hash-drift",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `Managed asset hash drifted: ${entry.id}`
+      });
+    }
+    if (!asset || !strictRegistry) continue;
+    const sourceAbsolutePath = join8(options.agentAssetsDir, asset.sourcePath);
+    if (!existsSync8(sourceAbsolutePath)) {
       issues.push({
         type: "missing-source",
         id: entry.id,
@@ -537,8 +685,8 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    const currentHash = hashAgentAssetContent(asset, options.agentAssetsDir);
-    if (currentHash !== entry.contentHash) {
+    const currentSourceHash = hashAgentAssetContent(asset, options.agentAssetsDir);
+    if (targetHashMatchesLock && currentSourceHash !== entry.contentHash) {
       issues.push({
         type: "hash-drift",
         id: entry.id,
@@ -547,12 +695,43 @@ function checkInstalledAssets(options) {
       });
     }
   }
+  issues.push(...checkDuplicateSkillPlacements(options.targetDir, options.registry));
   return { targetDir: options.targetDir, issues };
 }
+function checkRegistryPlacement(lockfile, asset, targetPath) {
+  if (lockfile.placement !== "registry") return void 0;
+  if (asset.kind !== "skill") return void 0;
+  const expectedPath = expectedRegistrySkillTargetPath(lockfile.host, asset.sourcePath, asset.defaultPlacement);
+  if (!expectedPath || targetPath === expectedPath) return void 0;
+  return {
+    type: "skill-placement-drift",
+    id: asset.id,
+    targetPath,
+    message: `Managed skill target ${targetPath} does not match registry placement; expected ${expectedPath}`
+  };
+}
+function checkDuplicateSkillPlacements(targetDir, registry) {
+  const issues = [];
+  for (const asset of registry.assets) {
+    if (asset.kind !== "skill") continue;
+    const skillName = basename(asset.sourcePath);
+    const autoPath = `.agents/skills/${skillName}`;
+    const manualPath = `.agents/manual-skills/${skillName}`;
+    if (pathExistsEvenIfDanglingSymlink3(join8(targetDir, autoPath)) && pathExistsEvenIfDanglingSymlink3(join8(targetDir, manualPath))) {
+      issues.push({
+        type: "duplicate-skill-placement",
+        id: asset.id,
+        targetPath: `${autoPath} + ${manualPath}`,
+        message: `Skill is linked in both auto and manual locations: ${skillName}`
+      });
+    }
+  }
+  return issues;
+}
 function checkHostFolder(host, kind, targetPath, id) {
   if (kind !== "skill") return void 0;
-  const expectedPrefix = expectedSkillTargetPrefix(host);
-  if (!expectedPrefix) {
+  const expectedPrefixes = expectedSkillTargetPrefixes(host);
+  if (!expectedPrefixes) {
     return {
       type: "unsupported-host-folder",
       id,
@@ -560,20 +739,30 @@ function checkHostFolder(host, kind, targetPath, id) {
       message: `Lockfile host is unsupported for managed skill target: ${host ?? "missing"}`
     };
   }
-  if (!targetPath.startsWith(expectedPrefix)) {
+  if (!expectedPrefixes.some((prefix) => targetPath.startsWith(prefix))) {
     return {
       type: "unsupported-host-folder",
       id,
       targetPath,
-      message: `Managed skill target ${targetPath} does not match host ${host}; expected ${expectedPrefix}`
+      message: `Managed skill target ${targetPath} does not match host ${host}; expected ${expectedPrefixes.join(" or ")}`
     };
   }
   return void 0;
 }
-function expectedSkillTargetPrefix(host) {
-  if (host === "claude-code") return ".claude/skills/";
+function expectedSkillTargetPrefixes(host) {
+  if (host === "claude-code") return [".claude/skills/"];
   if (host === "codex" || host === "gemini-cli" || host === "antigravity") {
-    return ".agents/skills/";
+    return [".agents/skills/", ".agents/manual-skills/"];
+  }
+  return void 0;
+}
+function expectedRegistrySkillTargetPath(host, sourcePath, placement) {
+  const skillName = basename(sourcePath);
+  if (host === "claude-code") {
+    return placement === "manual" ? void 0 : `.claude/skills/${skillName}`;
+  }
+  if (host === "codex" || host === "gemini-cli" || host === "antigravity") {
+    return placement === "manual" ? `.agents/manual-skills/${skillName}` : `.agents/skills/${skillName}`;
   }
   return void 0;
 }
@@ -587,9 +776,10 @@ function pathExistsEvenIfDanglingSymlink3(path) {
 }
 
 // src/asset-targets/install-plan.ts
-import { existsSync as existsSync8, lstatSync as lstatSync4, readFileSync as readFileSync5 } from "node:fs";
-import { basename, dirname as dirname4, join as join8 } from "node:path";
+import { existsSync as existsSync9, lstatSync as lstatSync4, readFileSync as readFileSync5 } from "node:fs";
+import { basename as basename2, dirname as dirname4, join as join9 } from "node:path";
 function createAssetInstallPlan(options) {
+  const placement = options.placement ?? "registry";
   const assetsById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
   const bundlesById = new Map(options.bundles.map((bundle) => [bundle.id, bundle]));
   const assetIds = resolveBundleAssetIds(options.bundleIds, bundlesById);
@@ -604,17 +794,19 @@ function createAssetInstallPlan(options) {
   const lockEntries = createAgentAssetLockEntries(options.registry, options.agentAssetsDir, assetIds);
   const managedTargets = readManagedTargets(options.targetDir);
   const assetActions = assets.map(
-    (asset) => createAssetAction(asset, options.agentAssetsDir, options.targetDir, options.host, managedTargets)
+    (asset) => createAssetAction(asset, options.agentAssetsDir, options.targetDir, options.host, placement, managedTargets)
   );
   const manifest = {
     schemaVersion: 1,
     host: options.host,
+    placement,
     bundleIds: [...options.bundleIds],
     assetIds
   };
   const lockfile = {
     schemaVersion: 1,
     host: options.host,
+    placement,
     bundleIds: [...options.bundleIds],
     assets: lockEntries.map((entry) => {
       const action = assetActions.find((candidate) => "assetId" in candidate && candidate.assetId === entry.id);
@@ -643,6 +835,7 @@ function createAssetInstallPlan(options) {
     dryRun: true,
     targetDir: options.targetDir,
     host: options.host,
+    placement,
     bundleIds: [...options.bundleIds],
     assetIds,
     actions: [...createDirectoryActions([...assetActions, ...writeActions]), ...assetActions, ...writeActions]
@@ -659,10 +852,15 @@ function resolveBundleAssetIds(bundleIds, bundlesById) {
   }
   return [...ids].sort();
 }
-function createAssetAction(asset, agentAssetsDir, targetDir, host, managedTargets) {
-  const sourcePath = join8(agentAssetsDir, asset.sourcePath);
-  const targetPath = resolveHostTargetPath(asset, host);
-  const targetAbsolutePath = join8(targetDir, targetPath);
+function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, managedTargets) {
+  if (asset.kind === "skill" && asset.defaultScope === "user") {
+    throw new Error(
+      `User-scoped asset ${asset.id} must be linked at the user level, not installed into a project target.`
+    );
+  }
+  const sourcePath = join9(agentAssetsDir, asset.sourcePath);
+  const targetPath = resolveHostTargetPath(asset, host, placement);
+  const targetAbsolutePath = join9(targetDir, targetPath);
   const targetExists = pathExistsEvenIfDanglingSymlink4(targetAbsolutePath);
   if (targetExists) {
     const stats = lstatSync4(targetAbsolutePath);
@@ -683,17 +881,28 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, managedTarget
     targetPath
   };
 }
-function resolveHostTargetPath(asset, host) {
+function resolveHostTargetPath(asset, host, placement) {
   if (asset.kind === "skill") {
+    const effectivePlacement = resolveSkillPlacement(asset, placement);
     if (host === "claude-code") {
-      return `.claude/skills/${basename(asset.sourcePath)}`;
+      if (placement === "manual") {
+        throw new Error("Manual skill placement is only supported for .agents hosts");
+      }
+      return `.claude/skills/${basename2(asset.sourcePath)}`;
+    }
+    if (effectivePlacement === "manual") {
+      return `.agents/manual-skills/${basename2(asset.sourcePath)}`;
     }
-    return `.agents/skills/${basename(asset.sourcePath)}`;
+    return `.agents/skills/${basename2(asset.sourcePath)}`;
   }
   if (asset.kind === "rule") {
-    return `.pro-gov/agent-assets/rules/${basename(asset.sourcePath)}`;
+    return `.pro-gov/agent-assets/rules/${basename2(asset.sourcePath)}`;
   }
-  return `.pro-gov/agent-assets/commands/${basename(asset.sourcePath)}`;
+  return `.pro-gov/agent-assets/commands/${basename2(asset.sourcePath)}`;
+}
+function resolveSkillPlacement(asset, placement) {
+  if (placement !== "registry") return placement;
+  return asset.defaultPlacement ?? "auto";
 }
 function createDirectoryActions(actions) {
   const directories = /* @__PURE__ */ new Set();
@@ -705,8 +914,8 @@ function createDirectoryActions(actions) {
   return [...directories].sort().map((targetPath) => ({ type: "create-dir", targetPath }));
 }
 function readManagedTargets(targetDir) {
-  const lockfilePath = join8(targetDir, ".pro-gov/assets.lock.json");
-  if (!existsSync8(lockfilePath)) return /* @__PURE__ */ new Set();
+  const lockfilePath = join9(targetDir, ".pro-gov/assets.lock.json");
+  if (!existsSync9(lockfilePath)) return /* @__PURE__ */ new Set();
   try {
     const lockfile = JSON.parse(readFileSync5(lockfilePath, "utf8"));
     return new Set((lockfile.assets ?? []).map((asset) => asset.targetPath).filter(Boolean));
@@ -724,8 +933,8 @@ function pathExistsEvenIfDanglingSymlink4(path) {
 }
 
 // src/asset-targets/recommend.ts
-import { existsSync as existsSync9, readdirSync as readdirSync5, readFileSync as readFileSync6 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync6 } from "node:fs";
+import { join as join10 } from "node:path";
 var frontendPackages = /* @__PURE__ */ new Set([
   "@vitejs/plugin-react",
   "astro",
@@ -737,23 +946,23 @@ var frontendPackages = /* @__PURE__ */ new Set([
   "vite",
   "vue"
 ]);
-var agentEntryCandidates = ["AGENTS.md", "CLAUDE.md", ".gemini/settings.json", "GEMINI.md"];
+var agentEntryCandidates = ["AGENTS.md", "CLAUDE.md"];
 function discoverTargetSignals(targetDir) {
-  const packageJson = readJson(join9(targetDir, "package.json"));
+  const packageJson = readJson(join10(targetDir, "package.json"));
   const dependencyNames = packageJson ? Object.keys({ ...packageJson.dependencies, ...packageJson.devDependencies }) : [];
   const frontendSignals = dependencyNames.filter((name) => frontendPackages.has(name)).sort();
-  const hasAgentEntry = agentEntryCandidates.some((file) => existsSync9(join9(targetDir, file)));
+  const hasAgentEntry = agentEntryCandidates.some((file) => existsSync10(join10(targetDir, file)));
   const researchSignals = [
-    existsSync9(join9(targetDir, "docs/research")) ? "docs/research" : "",
-    existsSync9(join9(targetDir, "research")) ? "research" : "",
+    existsSync10(join10(targetDir, "docs/research")) ? "docs/research" : "",
+    existsSync10(join10(targetDir, "research")) ? "research" : "",
     hasBookChildDirectory(targetDir, "research") ? "books/*/research" : "",
-    textFileIncludes(join9(targetDir, "README.md"), ["research", "\u8C03\u7814"]) ? "README research" : ""
+    textFileIncludes(join10(targetDir, "README.md"), ["research", "\u8C03\u7814"]) ? "README research" : ""
   ].filter(Boolean);
   const writingSignals = [
-    existsSync9(join9(targetDir, "chapters")) ? "chapters" : "",
-    existsSync9(join9(targetDir, "src/chapters")) ? "src/chapters" : "",
+    existsSync10(join10(targetDir, "chapters")) ? "chapters" : "",
+    existsSync10(join10(targetDir, "src/chapters")) ? "src/chapters" : "",
     hasBookChildDirectory(targetDir, "chapters") ? "books/*/chapters" : "",
-    textFileIncludes(join9(targetDir, "AGENTS.md"), ["writing mode", "novel chapter", "book content"]) ? "AGENTS writing" : ""
+    textFileIncludes(join10(targetDir, "AGENTS.md"), ["writing mode", "novel chapter", "book content"]) ? "AGENTS writing" : ""
   ].filter(Boolean);
   return {
     targetDir,
@@ -801,7 +1010,7 @@ function recommendBundlesForTarget(targetDir) {
   return recommendations;
 }
 function readJson(path) {
-  if (!existsSync9(path)) return void 0;
+  if (!existsSync10(path)) return void 0;
   try {
     return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
@@ -809,16 +1018,16 @@ function readJson(path) {
   }
 }
 function textFileIncludes(path, needles) {
-  if (!existsSync9(path)) return false;
+  if (!existsSync10(path)) return false;
   const contents = readFileSync6(path, "utf8").toLowerCase();
   return needles.some((needle) => contents.includes(needle.toLowerCase()));
 }
 function hasBookChildDirectory(targetDir, childName) {
-  const booksDir = join9(targetDir, "books");
-  if (!existsSync9(booksDir)) return false;
+  const booksDir = join10(targetDir, "books");
+  if (!existsSync10(booksDir)) return false;
   try {
     return readdirSync5(booksDir, { withFileTypes: true }).some(
-      (entry) => entry.isDirectory() && existsSync9(join9(booksDir, entry.name, childName))
+      (entry) => entry.isDirectory() && existsSync10(join10(booksDir, entry.name, childName))
     );
   } catch {
     return false;
@@ -846,12 +1055,55 @@ function runAssets(args) {
   if (subcommand2 === "check") {
     return runAssetsCheck(rest);
   }
+  if (subcommand2 === "public-check") {
+    return runAssetsPublicCheck(rest);
+  }
   if (subcommand2 === "npx") {
     return runAssetsNpx(rest);
   }
   printUsage();
   return 1;
 }
+function runAssetsPublicCheck(args) {
+  const options = parsePublicCheckOptions(args);
+  if (!options.ok) {
+    console.error(options.error);
+    printUsage();
+    return 1;
+  }
+  const registryLoad = loadAgentAssetRegistry({ agentAssetsDir: options.value.publicRoot });
+  if (registryLoad.issues.length > 0) {
+    for (const issue of registryLoad.issues) {
+      console.error(`${issue.type}: ${issue.message}`);
+    }
+    return 1;
+  }
+  const result = checkPublicAssetPromotions({
+    publicAgentAssetsDir: options.value.publicRoot,
+    privateAgentAssetsDir: options.value.privateRoot,
+    registry: registryLoad.registry
+  });
+  if (options.value.json) {
+    console.log(
+      JSON.stringify(
+        {
+          publicRoot: options.value.publicRoot,
+          privateRoot: options.value.privateRoot,
+          ...result
+        },
+        null,
+        2
+      )
+    );
+  } else if (result.issues.length === 0) {
+    console.log(`public assets check passed (${result.checked} checked)`);
+  } else {
+    for (const issue of result.issues) {
+      console.log(`${issue.type}: ${issue.message}`);
+    }
+  }
+  return result.issues.length === 0 ? 0 : 1;
+}
 function runAssetsNpx(args) {
   const [operation, ...rest] = args;
   if (!operation || operation === "--help" || operation === "-h" || rest.includes("--help")) {
@@ -911,7 +1163,8 @@ function runAssetsCheck(args) {
   const result = checkInstalledAssets({
     targetDir: options.value.targetDir,
     agentAssetsDir: loaded.agentAssetsDir,
-    registry: loaded.registry
+    registry: loaded.registry,
+    strictRegistry: options.value.strictRegistry
   });
   if (options.value.json) {
     console.log(JSON.stringify(result, null, 2));
@@ -999,13 +1252,15 @@ function runAssetsPlan(args) {
       registry: loaded.registry,
       bundles: loadAgentAssetBundles(loaded.agentAssetsDir),
       bundleIds: options.value.bundleIds,
-      host: options.value.host
+      host: options.value.host,
+      placement: options.value.placement
     });
     if (options.value.json) {
       console.log(JSON.stringify(plan, null, 2));
     } else {
       console.log(`target: ${plan.targetDir}`);
       console.log(`host: ${plan.host}`);
+      console.log(`placement: ${plan.placement}`);
       console.log(`bundles: ${plan.bundleIds.join(", ")}`);
       console.log(`assets: ${plan.assetIds.length}`);
       console.log(`actions: ${plan.actions.length}`);
@@ -1064,6 +1319,8 @@ function parseTargetJsonOptions(args) {
       if (!targetDir) return { ok: false, error: "Expected --target <path>" };
       options.targetDir = targetDir;
       index += 1;
+    } else if (arg === "--strict-registry") {
+      options.strictRegistry = true;
     } else if (arg === "--json") {
       options.json = true;
     } else {
@@ -1101,6 +1358,16 @@ function parsePlanOptions(args) {
       }
       options.host = host;
       index += 1;
+    } else if (arg === "--placement") {
+      const placement = args[index + 1];
+      if (!isSkillPlacement(placement)) {
+        return {
+          ok: false,
+          error: "Expected --placement auto|manual"
+        };
+      }
+      options.placement = placement;
+      index += 1;
     } else if (arg === "--out") {
       const outPath = args[index + 1];
       if (!outPath) return { ok: false, error: "Expected --out <path>" };
@@ -1167,6 +1434,52 @@ function parseNpxOptions(operation, args) {
   }
   return { ok: true, value: options };
 }
+function parsePublicCheckOptions(args) {
+  const defaults = getDefaultPublicCheckRoots();
+  const options = {
+    publicRoot: defaults.publicRoot,
+    privateRoot: defaults.privateRoot,
+    json: false
+  };
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--public-root") {
+      const publicRoot = args[index + 1];
+      if (!publicRoot) return { ok: false, error: "Expected --public-root <path>" };
+      options.publicRoot = publicRoot;
+      index += 1;
+    } else if (arg === "--private-root") {
+      const privateRoot = args[index + 1];
+      if (!privateRoot) return { ok: false, error: "Expected --private-root <path>" };
+      options.privateRoot = privateRoot;
+      index += 1;
+    } else if (arg === "--json") {
+      options.json = true;
+    } else {
+      return { ok: false, error: `Unknown assets public-check option: ${arg}` };
+    }
+  }
+  if (!existsSync11(options.publicRoot)) {
+    return { ok: false, error: `Public agent assets root does not exist: ${options.publicRoot}` };
+  }
+  if (!existsSync11(options.privateRoot)) {
+    return { ok: false, error: `Private agent assets root does not exist: ${options.privateRoot}` };
+  }
+  return { ok: true, value: options };
+}
+function getDefaultPublicCheckRoots() {
+  const defaultRegistryRoot = loadAgentAssetRegistry().agentAssetsDir;
+  if (defaultRegistryRoot.endsWith("public-agent-assets")) {
+    return {
+      privateRoot: join11(dirname5(defaultRegistryRoot), "agent-assets"),
+      publicRoot: defaultRegistryRoot
+    };
+  }
+  return {
+    privateRoot: defaultRegistryRoot,
+    publicRoot: join11(dirname5(defaultRegistryRoot), "public-agent-assets")
+  };
+}
 function listRegistryAssets(options) {
   const loaded = loadAgentAssetRegistry();
   if (loaded.issues.length > 0) {
@@ -1205,14 +1518,18 @@ function isVisibilityFilter(value) {
 function isHost(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
+function isSkillPlacement(value) {
+  return value === "auto" || value === "manual";
+}
 function printUsage() {
   console.error("Usage:");
   console.error("  pro-gov assets list [--registry] [--json] [--visibility public|private|third-party|all]");
   console.error("  pro-gov assets discover [--target <path>] [--json]");
   console.error("  pro-gov assets recommend [--target <path>] [--json]");
-  console.error("  pro-gov assets plan --bundle <bundle-id> [--bundle <bundle-id>] [--target <path>] [--host codex|claude-code|gemini-cli|antigravity] [--out <path>] [--json]");
+  console.error("  pro-gov assets plan --bundle <bundle-id> [--bundle <bundle-id>] [--target <path>] [--host codex|claude-code|gemini-cli|antigravity] [--placement auto|manual] [--out <path>] [--json]");
   console.error("  pro-gov assets apply --plan <path>");
   console.error("  pro-gov assets check [--target <path>] [--json]");
+  console.error("  pro-gov assets public-check [--public-root <path>] [--private-root <path>] [--json]");
   console.error("  pro-gov assets npx add <source> [--skill <name>] --plan [--root <path>]");
   console.error("  pro-gov assets npx update [--skill <name>] --plan [--root <path>]");
 }
@@ -1225,12 +1542,11 @@ function printNpxUsage() {
 
 // src/commands/doctor.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync12 } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname as dirname6, join as join10 } from "node:path";
+import { dirname as dirname6, join as join12 } from "node:path";
 var REQUIRED_ASSETS = [
   "starter/AGENTS.template.md",
-  "starter/.gemini/settings.json",
   "starter/docs/governance/ssot-v0.9.md",
   "starter/docs/governance/agents-routing/engineering-runtime-v0.9.md",
   "starter/docs/governance/agents-routing/doc-only-v0.9.md",
@@ -1278,8 +1594,8 @@ function resolveDocGovDependencyCli() {
   try {
     const require2 = createRequire(import.meta.url);
     const packageJsonPath = require2.resolve("@pieai/doc-gov/package.json");
-    const cliPath = join10(dirname6(packageJsonPath), "dist/cli.js");
-    return existsSync10(cliPath) ? cliPath : null;
+    const cliPath = join12(dirname6(packageJsonPath), "dist/cli.js");
+    return existsSync12(cliPath) ? cliPath : null;
   } catch {
     return null;
   }
@@ -1421,8 +1737,8 @@ function bulletList(values) {
 
 // src/lens/scan.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
-import { join as join11, relative as relative4 } from "node:path";
+import { existsSync as existsSync13, readdirSync as readdirSync6, readFileSync as readFileSync8, statSync as statSync3 } from "node:fs";
+import { join as join13, relative as relative5 } from "node:path";
 var ignoredDirectories = /* @__PURE__ */ new Set([
   ".git",
   ".next",
@@ -1438,23 +1754,23 @@ function scanProjectLensTarget(targetDir, options = {}) {
   const packageJson = readPackageJson(targetDir);
   return {
     targetDir,
-    aiEntryFiles: ["AGENTS.md", "CLAUDE.md", "GEMINI.md"].filter(
-      (file) => existsSync11(join11(targetDir, file))
+    aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter(
+      (file) => existsSync13(join13(targetDir, file))
     ),
-    aiConfigFiles: [".gemini/settings.json"].filter((file) => existsSync11(join11(targetDir, file))),
+    aiConfigFiles: [],
     packageJson,
     docs: {
-      hasDocsDirectory: existsSync11(join11(targetDir, "docs")),
+      hasDocsDirectory: existsSync13(join13(targetDir, "docs")),
       markdownFileCount: markdownFiles.length,
       governanceFiles: markdownFiles.filter((file) => file.startsWith("docs/governance/") || file.startsWith("docs/policy/")).sort()
     },
     git: readGitState(targetDir),
-    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join11(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
+    largeFiles: files.map((file) => ({ path: file, bytes: statSync3(join13(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
   };
 }
 function readPackageJson(targetDir) {
-  const packageJsonPath = join11(targetDir, "package.json");
-  if (!existsSync11(packageJsonPath)) return void 0;
+  const packageJsonPath = join13(targetDir, "package.json");
+  if (!existsSync13(packageJsonPath)) return void 0;
   try {
     const packageJson = JSON.parse(readFileSync8(packageJsonPath, "utf8"));
     return {
@@ -1491,13 +1807,13 @@ function listProjectFiles(targetDir) {
   return files.sort();
 }
 function collectFiles2(rootDir, currentDir, files) {
-  if (!existsSync11(currentDir)) return;
+  if (!existsSync13(currentDir)) return;
   for (const entry of readdirSync6(currentDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (ignoredDirectories.has(entry.name)) continue;
-      collectFiles2(rootDir, join11(currentDir, entry.name), files);
+      collectFiles2(rootDir, join13(currentDir, entry.name), files);
     } else if (entry.isFile()) {
-      files.push(toUnixPath4(relative4(rootDir, join11(currentDir, entry.name))));
+      files.push(toUnixPath4(relative5(rootDir, join13(currentDir, entry.name))));
     }
   }
 }
@@ -1591,9 +1907,441 @@ function printUsage2() {
   console.error("Usage: pro-gov lens report --target <path> --out <path>");
 }
 
+// src/commands/portfolio.ts
+import { existsSync as existsSync15 } from "node:fs";
+import { join as join14 } from "node:path";
+
+// src/portfolio/manifest.ts
+import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
+function loadPortfolioManifest(configPath) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync9(configPath, "utf8"));
+  } catch (error) {
+    return {
+      configPath,
+      issues: [
+        {
+          type: "invalid-json",
+          message: error instanceof Error ? error.message : String(error)
+        }
+      ]
+    };
+  }
+  const issues = validatePortfolioManifest(parsed);
+  return {
+    configPath,
+    manifest: issues.length === 0 ? parsed : void 0,
+    issues
+  };
+}
+function validatePortfolioManifest(value) {
+  const issues = [];
+  if (!isRecord(value)) {
+    return [
+      {
+        type: "invalid-field",
+        field: "root",
+        message: "Portfolio manifest must be a JSON object."
+      }
+    ];
+  }
+  if (value.schemaVersion !== 1) {
+    issues.push({
+      type: "invalid-field",
+      field: "schemaVersion",
+      message: "Portfolio manifest schemaVersion must be 1."
+    });
+  }
+  if (typeof value.portfolioId !== "string" || value.portfolioId.length === 0) {
+    issues.push({
+      type: "invalid-field",
+      field: "portfolioId",
+      message: "Portfolio manifest portfolioId must be a non-empty string."
+    });
+  }
+  validateAllowedFields(value, "root", ["schemaVersion", "portfolioId", "controlPlane", "executionEngine", "targets"], issues);
+  validateEndpoint(value.controlPlane, "controlPlane", issues);
+  validateEndpoint(value.executionEngine, "executionEngine", issues);
+  if (!Array.isArray(value.targets)) {
+    issues.push({
+      type: "invalid-field",
+      field: "targets",
+      message: "Portfolio manifest targets must be an array."
+    });
+    return issues;
+  }
+  const seenTargetIds = /* @__PURE__ */ new Set();
+  for (const target of value.targets) {
+    if (!isRecord(target)) {
+      issues.push({
+        type: "invalid-field",
+        field: "targets",
+        message: "Portfolio target must be an object."
+      });
+      continue;
+    }
+    validateEndpoint(target, "targets", issues);
+    validateAllowedFields(target, "target", ["id", "path", "profile", "assetBundles"], issues);
+    if (typeof target.id === "string") {
+      if (seenTargetIds.has(target.id)) {
+        issues.push({
+          type: "duplicate-target-id",
+          id: target.id,
+          message: `Duplicate portfolio target id: ${target.id}`
+        });
+      }
+      seenTargetIds.add(target.id);
+    }
+    if (target.profile !== void 0 && (typeof target.profile !== "string" || !isValidProfile(target.profile))) {
+      issues.push({
+        type: "invalid-field",
+        id: typeof target.id === "string" ? target.id : void 0,
+        field: "profile",
+        message: "Portfolio target profile must be engineering-runtime or doc-only."
+      });
+    }
+    validateOptionalStringArray(target.assetBundles, target.id, "assetBundles", issues);
+    if ("sharedRules" in target) {
+      issues.push({
+        type: "invalid-field",
+        id: typeof target.id === "string" ? target.id : void 0,
+        field: "sharedRules",
+        message: "Portfolio target sharedRules is not managed yet; remove it until plan/check supports it."
+      });
+    }
+  }
+  return issues;
+}
+function getDefaultPortfolioTargets(manifest) {
+  return manifest?.targets ?? [];
+}
+function validateAllowedFields(value, location, allowedFields, issues) {
+  const allowed = new Set(allowedFields);
+  for (const field of Object.keys(value)) {
+    if (allowed.has(field)) continue;
+    issues.push({
+      type: "invalid-field",
+      id: typeof value.id === "string" ? value.id : void 0,
+      field,
+      message: `Unknown portfolio ${location} field: ${field}`
+    });
+  }
+}
+function validateEndpoint(value, field, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({
+      type: "invalid-field",
+      field,
+      message: `Portfolio ${field} must be an object.`
+    });
+    return;
+  }
+  if (typeof value.id !== "string" || value.id.length === 0) {
+    issues.push({
+      type: "invalid-field",
+      field: `${field}.id`,
+      message: `Portfolio ${field} id must be a non-empty string.`
+    });
+  }
+  if (typeof value.path !== "string" || value.path.length === 0) {
+    issues.push({
+      type: "invalid-field",
+      id: typeof value.id === "string" ? value.id : void 0,
+      field: `${field}.path`,
+      message: `Portfolio ${field} path must be a non-empty string.`
+    });
+    return;
+  }
+  if (!existsSync14(value.path)) {
+    issues.push({
+      type: "missing-path",
+      id: typeof value.id === "string" ? value.id : void 0,
+      field: `${field}.path`,
+      message: `Portfolio ${field} path does not exist: ${value.path}`
+    });
+  }
+}
+function validateOptionalStringArray(value, id, field, issues) {
+  if (value === void 0) return;
+  if (!Array.isArray(value) || !value.every((entry) => typeof entry === "string")) {
+    issues.push({
+      type: "invalid-field",
+      id: typeof id === "string" ? id : void 0,
+      field,
+      message: `Portfolio target ${field} must be an array of strings.`
+    });
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/commands/portfolio.ts
+function runPortfolio(args) {
+  const [subcommand2, ...rest] = args;
+  if (subcommand2 === "check") return runPortfolioCheck(rest);
+  if (subcommand2 === "plan") return runPortfolioPlan(rest);
+  if (subcommand2 === "assets-check") return runPortfolioAssetsCheck(rest);
+  printUsage3();
+  return 1;
+}
+function runPortfolioCheck(args) {
+  const options = parsePortfolioOptions(args);
+  if (!options.ok) {
+    console.error(options.error);
+    printUsage3();
+    return 1;
+  }
+  const loaded = loadPortfolioManifest(options.value.configPath);
+  const targetIds = getDefaultPortfolioTargets(loaded.manifest).map((target) => target.id);
+  if (options.value.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok: loaded.issues.length === 0,
+          configPath: loaded.configPath,
+          portfolioId: loaded.manifest?.portfolioId,
+          targetIds,
+          issues: loaded.issues
+        },
+        null,
+        2
+      )
+    );
+  } else if (loaded.issues.length === 0) {
+    console.log(`portfolio check passed (${targetIds.length} targets)`);
+  } else {
+    for (const issue of loaded.issues) {
+      console.log(`${issue.type}: ${issue.message}`);
+    }
+  }
+  return loaded.issues.length === 0 ? 0 : 1;
+}
+function runPortfolioPlan(args) {
+  const options = parsePortfolioOptions(args);
+  if (!options.ok) {
+    console.error(options.error);
+    printUsage3();
+    return 1;
+  }
+  const loaded = loadPortfolioManifest(options.value.configPath);
+  if (loaded.issues.length > 0 || !loaded.manifest) {
+    for (const issue of loaded.issues) {
+      console.error(`${issue.type}: ${issue.message}`);
+    }
+    return 1;
+  }
+  const targets = getDefaultPortfolioTargets(loaded.manifest).filter(
+    (target) => !options.value.targetId || options.value.targetId === "all" || target.id === options.value.targetId
+  );
+  if (targets.length === 0) {
+    console.error(`Unknown portfolio target: ${options.value.targetId}`);
+    return 1;
+  }
+  const loadedAssets = loadAgentAssetRegistry({
+    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+  });
+  if (loadedAssets.issues.length > 0) {
+    for (const issue of loadedAssets.issues) {
+      console.error(`${issue.type}: ${issue.message}`);
+    }
+    return 1;
+  }
+  const bundles = loadAgentAssetBundles(loadedAssets.agentAssetsDir);
+  try {
+    const plans = targets.map((target) => {
+      const bundleIds = target.assetBundles ?? [];
+      if (bundleIds.length === 0) {
+        throw new Error(`Portfolio target ${target.id} has no assetBundles`);
+      }
+      return {
+        id: target.id,
+        path: target.path,
+        plan: createAssetInstallPlan({
+          targetDir: target.path,
+          agentAssetsDir: loadedAssets.agentAssetsDir,
+          registry: loadedAssets.registry,
+          bundles,
+          bundleIds,
+          host: options.value.host
+        })
+      };
+    });
+    if (options.value.json) {
+      console.log(
+        JSON.stringify(
+          {
+            configPath: loaded.configPath,
+            portfolioId: loaded.manifest.portfolioId,
+            targets: plans
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      console.log(`portfolio plan targets: ${plans.length}`);
+      for (const target of plans) {
+        console.log(`${target.id}	${target.plan.actions.length} actions	dry-run`);
+      }
+    }
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
+function runPortfolioAssetsCheck(args) {
+  const options = parsePortfolioOptions(args);
+  if (!options.ok) {
+    console.error(options.error);
+    printUsage3();
+    return 1;
+  }
+  const loaded = loadPortfolioManifest(options.value.configPath);
+  if (loaded.issues.length > 0 || !loaded.manifest) {
+    if (options.value.json) {
+      console.log(
+        JSON.stringify(
+          {
+            ok: false,
+            configPath: loaded.configPath,
+            issues: loaded.issues,
+            targets: []
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      for (const issue of loaded.issues) {
+        console.error(`${issue.type}: ${issue.message}`);
+      }
+    }
+    return 1;
+  }
+  const targets = getDefaultPortfolioTargets(loaded.manifest).filter(
+    (target) => !options.value.targetId || options.value.targetId === "all" || target.id === options.value.targetId
+  );
+  if (targets.length === 0) {
+    console.error(`Unknown portfolio target: ${options.value.targetId}`);
+    return 1;
+  }
+  const loadedAssets = loadAgentAssetRegistry({
+    agentAssetsDir: findPortfolioAgentAssetsDir(loaded.manifest)
+  });
+  if (loadedAssets.issues.length > 0) {
+    if (options.value.json) {
+      console.log(
+        JSON.stringify(
+          {
+            ok: false,
+            configPath: loaded.configPath,
+            portfolioId: loaded.manifest.portfolioId,
+            registryIssues: loadedAssets.issues,
+            targets: []
+          },
+          null,
+          2
+        )
+      );
+    } else {
+      for (const issue of loadedAssets.issues) {
+        console.error(`${issue.type}: ${issue.message}`);
+      }
+    }
+    return 1;
+  }
+  const targetResults = targets.map((target) => {
+    const result = checkInstalledAssets({
+      targetDir: target.path,
+      agentAssetsDir: loadedAssets.agentAssetsDir,
+      registry: loadedAssets.registry,
+      strictRegistry: true
+    });
+    return {
+      id: target.id,
+      path: target.path,
+      issues: result.issues
+    };
+  });
+  const ok = targetResults.every((target) => target.issues.length === 0);
+  if (options.value.json) {
+    console.log(
+      JSON.stringify(
+        {
+          ok,
+          configPath: loaded.configPath,
+          portfolioId: loaded.manifest.portfolioId,
+          agentAssetsDir: loadedAssets.agentAssetsDir,
+          targets: targetResults
+        },
+        null,
+        2
+      )
+    );
+  } else if (ok) {
+    console.log(`portfolio assets check passed (${targetResults.length} targets)`);
+  } else {
+    for (const target of targetResults) {
+      for (const issue of target.issues) {
+        console.log(`${target.id}	${issue.type}: ${issue.message}`);
+      }
+    }
+  }
+  return ok ? 0 : 1;
+}
+function parsePortfolioOptions(args) {
+  const options = {
+    configPath: "",
+    host: "codex",
+    json: false
+  };
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--config") {
+      const configPath = args[index + 1];
+      if (!configPath) return { ok: false, error: "Expected --config <path>" };
+      options.configPath = configPath;
+      index += 1;
+    } else if (arg === "--target") {
+      const targetId = args[index + 1];
+      if (!targetId) return { ok: false, error: "Expected --target <id|all>" };
+      options.targetId = targetId;
+      index += 1;
+    } else if (arg === "--host") {
+      const host = args[index + 1];
+      if (!isHost2(host)) return { ok: false, error: "Expected --host codex|claude-code" };
+      options.host = host;
+      index += 1;
+    } else if (arg === "--json") {
+      options.json = true;
+    } else {
+      return { ok: false, error: `Unknown portfolio option: ${arg}` };
+    }
+  }
+  if (!options.configPath) return { ok: false, error: "Expected --config <path>" };
+  return { ok: true, value: options };
+}
+function isHost2(value) {
+  return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
+}
+function findPortfolioAgentAssetsDir(manifest) {
+  const agentAssetsDir = manifest?.executionEngine?.path ? join14(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync15(join14(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+}
+function printUsage3() {
+  console.error("Usage:");
+  console.error("  pro-gov portfolio check --config <path> [--json]");
+  console.error("  pro-gov portfolio plan --config <path> [--target <id|all>] [--host codex|claude-code|gemini-cli|antigravity] [--json]");
+  console.error("  pro-gov portfolio assets-check --config <path> [--target <id|all>] [--json]");
+}
+
 // src/commands/sync.ts
-import { existsSync as existsSync12, readFileSync as readFileSync9 } from "node:fs";
-import { join as join12 } from "node:path";
+import { existsSync as existsSync16, readFileSync as readFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
 function runSync(args) {
   if (!args.includes("--check")) {
     console.error("pro-gov sync requires --check in this first read-only release.");
@@ -1602,14 +2350,14 @@ function runSync(args) {
   let differences = 0;
   console.log("pro-gov sync check");
   for (const file of planStarterFiles()) {
-    const targetPath = join12(process.cwd(), file.targetPath);
-    if (!existsSync12(targetPath)) {
+    const targetPath = join15(process.cwd(), file.targetPath);
+    if (!existsSync16(targetPath)) {
       console.log(`missing: ${file.targetPath}`);
       differences += 1;
       continue;
     }
-    const source = readFileSync9(file.absoluteSourcePath, "utf8");
-    const target = readFileSync9(targetPath, "utf8");
+    const source = readFileSync10(file.absoluteSourcePath, "utf8");
+    const target = readFileSync10(targetPath, "utf8");
     if (source !== target) {
       console.log(`different: ${file.targetPath}`);
       differences += 1;
@@ -1630,8 +2378,12 @@ var COMMANDS = [
   "assets recommend [--target <path>] [--json]",
   "assets plan --bundle <bundle-id> [--target <path>] [--json]",
   "assets apply --plan <path>",
-  "assets check [--target <path>] [--json]",
+  "assets check [--target <path>] [--strict-registry] [--json]",
+  "assets public-check [--public-root <path>] [--private-root <path>] [--json]",
   "assets npx add|update ... --plan",
+  "portfolio check --config <path> [--json]",
+  "portfolio plan --config <path> [--target <id|all>] [--json]",
+  "portfolio assets-check --config <path> [--target <id|all>] [--json]",
   "lens scan [--target <path>] [--json]",
   "lens inspect [--target <path>] [--format text|json]",
   "lens report --target <path> --out <path>",
@@ -1647,6 +2399,8 @@ if (!command || command === "--help" || command === "-h") {
   process.exitCode = runAssets(process.argv.slice(3));
 } else if (command === "lens") {
   process.exitCode = runLens(process.argv.slice(3));
+} else if (command === "portfolio") {
+  process.exitCode = runPortfolio(process.argv.slice(3));
 } else if (command === "init") {
   process.exitCode = runInit(process.argv.slice(3));
 } else if (command === "sync") {